Data security management system and method in smart power grid

Abstract

The invention relates to the technical field of information security, and discloses a data security management system and method in an intelligent power grid, and the system comprises a dynamic encryption and key management module which is used for carrying out the encryption and key management of the data of the intelligent power grid, determining an encryption algorithm according to the sensitivity of the data, and generating a corresponding key, the dynamic encryption and key management module transmits encrypted data and key information to the adaptive access control module so as to ensure the security of data access; and the self-adaptive access control module is used for managing access permissions of the user and the equipment and performing dynamic authorization according to the attribute label and the context information. Through dynamic encryption and adaptive key management, an encryption algorithm and a key length are adjusted in real time according to data sensitivity and a network environment, a quantum key distribution technology is combined, high security and quantum attack resistance of a key are ensured, and then security and real-time performance of data transmission are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data security management system and method in a smart grid. Background Art

[0002] With the rapid development of smart grid technology, the power system is gradually moving towards informatization and intelligence. Smart grids collect, transmit, analyze and manage power data through sensors, communication equipment and control systems. However, the amount of data in smart grids is huge, and the data transmission and sharing process involves multi-party collaboration and high-frequency interaction, which faces severe challenges in data security and privacy protection. Traditional data security methods cannot fully adapt to the complexity and dynamics of smart grids, and there are the following problems: Smart grids have high real-time requirements and data needs to be transmitted frequently. However, traditional static encryption technology has limitations in dealing with differences in the sensitivity of transmitted data and cannot meet the security requirements of different scenarios. In addition, the ability of traditional encryption technology to resist quantum attacks is threatened and cannot guarantee the security of transmission keys, which puts higher requirements on the data transmission security of smart grids. Smart grids involve many types of users and devices with different permission requirements. Traditional role-based access control methods have limited flexibility in smart grid environments. They cannot dynamically adjust permissions based on multiple dimensions such as user identity, device location, data sensitivity, and environmental context. They also lack a complete traceability mechanism for permission operations. Once permission abuse or data leakage occurs, it is impossible to quickly trace the source and track access. The data analysis and sharing process of smart grids involves sensitive information, and traditional data sharing methods usually require the original data to be transmitted to a central server, which poses a risk of privacy leakage; The data management system of the smart grid lacks an efficient security audit mechanism and complete access log records. The traditional log recording method is easy to tamper with and the authenticity cannot be verified, resulting in the system being unable to achieve effective traceability and auditing after a security incident occurs, which is not conducive to the rapid location and handling of security incidents.

[0003] Therefore, those skilled in the art provide a data security management system and method in a smart grid to solve the above-mentioned problems. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a data security management system and method in a smart grid to solve the problems raised in the above background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: A data security management system in a smart grid, comprising: Dynamic encryption and key management module, used to encrypt and manage smart grid data. According to the sensitivity of the data, the encryption algorithm is determined and the corresponding key is generated. The dynamic encryption and key management module ensures the security of data access by passing the encrypted data and key information to the adaptive access control module. The adaptive access control module is used to manage the access rights of users and devices and perform dynamic authorization based on attribute tags and context information. The adaptive access control module performs fine-grained permission control based on the encrypted data provided by the dynamic encryption and key management module to prevent unauthorized access. Multi-level intelligent intrusion detection module, used to detect abnormal behaviors during data transmission and access, and identify single-point and multi-node attacks based on deep learning and graph neural network models. The multi-level intelligent intrusion detection module analyzes access behaviors and marks suspicious activities by obtaining logs and context information from the adaptive access control module; The privacy-preserving data sharing and collaborative computing module is used to protect user privacy during data sharing and collaborative computing. Based on federated learning and homomorphic encryption technology, the privacy-preserving data sharing and collaborative computing module obtains data encrypted by the dynamic encryption and key management module to maintain data privacy protection during data sharing, and provides encrypted data storage requirements to the distributed storage and intelligent backup and recovery module; The distributed storage and intelligent backup and recovery module is responsible for distributed storage and data backup and recovery. It realizes distributed data storage through blockchain and IPFS technology, and improves the fault tolerance of the system through multi-copy backup. The distributed storage and intelligent backup and recovery module receives data encrypted by the privacy-protected data sharing and collaborative computing module, and performs distributed storage management according to the backup requirements of smart grid data.

[0006] Preferably, the dynamic encryption and key management module includes: Dynamic encryption submodule, used to determine different encryption algorithms according to the sensitivity level of the data, to meet the balance between real-time performance and security; The dynamic encryption meets the following conditions: , in, Indicates data The encryption method is is the data unit to be encrypted, Indicates highly sensitive data. For Advanced Encryption Standard, It is an asymmetric encryption algorithm. Indicates medium-sensitivity data. For Advanced Encryption Standard, Indicates low sensitivity data, It is a fast stream encryption algorithm; The quantum key distribution submodule uses the BB84 protocol to generate highly secure keys for encrypted transmission of highly sensitive data.

[0007] Preferably, the quantum key distribution in the dynamic encryption and key management module meets the following conditions: The sender generates a bit string , and determine the polarization basis ; The receiver compares the polarization basis with the sender's basis and obtains the final key string through screening. , in, represents a bit string, represents the polarization basis, Indicates the generated shared key; The sender generates a bit string and randomly determines the polarization basis to encode the bits, and each bit is sent to the receiver on a specific polarization basis; Without knowing the polarization basis of the sender, the receiver randomly determines the polarization basis to measure the received bit string, and the measurement result of the receiver will match the polarization basis of the sender with a certain probability.

[0008] Preferably, the adaptive access control module includes: The attribute label and policy generation submodule is used to generate dynamic policies based on multi-dimensional attribute labels. The multi-dimensional attribute labels include user identity, user role, device location, access time, data sensitivity and environmental context. The attribute label and policy generation submodule passes the generated policies to the context awareness and real-time authorization submodule for real-time permission evaluation. The policy is defined as: , in, Indicates the user identity. Indicates the user role, Indicates the location of the device. Indicates the access time. Indicates the sensitivity of the data. Represents environmental context; The context-aware and real-time authorization submodule is used to make real-time authorization adjustments based on the current context. Its permission probability is defined as: , in, is the access request, S is the policy set, is the context-based authorization probability distribution; The blockchain record and permission management submodule generates log records for each permission allocation, change and revocation operation, and implements tamper-proof permission management through blockchain records.

[0009] Preferably, the multi-level intelligent intrusion detection module includes: The single-point anomaly detection submodule is used to detect the abnormal behavior of a single device or node in the smart grid. It receives the flow data and behavior data from the adaptive access control module and the distributed storage module, and performs feature extraction and anomaly detection on the input data through the convolutional neural network. Suppose the input data is , the feature extraction formula is: , in, Represents input data, represents the convolution kernel, represents the convolution operation, represents the activation function, represents the bias term, represents the extracted features; The multi-node association detection submodule detects multi-node attacks based on the graph neural network model. The node features are set as , the update formula is: , in, is the feature vector of node v at the k+1th layer, is the activation function, is the weight matrix of the kth layer, is the neighbor set of node v, is the feature vector of node u in the kth layer, is the bias term.

[0010] Preferably, the privacy-preserving data sharing and collaborative computing module includes: The federated learning submodule is used for each node to train the model on local data, and protects privacy through parameters rather than data transmission. The parameter update formula is: , in, is the global model parameter, Indicates the total number of nodes, is the gradient of the kth node; The homomorphic encryption submodule is used for direct calculation in the encrypted state to satisfy the homomorphic encryption additivity. The formula is: , in, and is plain text data, is the homomorphic encryption function, is the ciphertext of data x, is the ciphertext of data y, is the multiplication operation between ciphertexts; Differential privacy protection submodule, assuming the analysis result is , add noise to meet privacy protection requirements: , in, It means the mean is 0 and the variance is Normally distributed noise.

[0011] Preferably, the distributed storage and intelligent backup and recovery module includes: The blockchain and IPFS distributed storage submodule is used to generate the data file hash address H(F) through IPFS and record it in the blockchain; The multi-copy redundant storage submodule performs redundant storage of data files based on Reed-Solomon encoding, satisfying the following data recovery formula: , in, To reconstruct the original data or file, represents the decoding algorithm, Represents an encoded data segment.

[0012] Preferably, the dynamic encryption submodule includes a real-time key management function, which can adjust the key length adaptively. The adaptive adjustment satisfies the following relationship: , in, is the key length, is the sensitivity level of the data, is the sensitivity coefficient, The base key length.

[0013] Preferably, the distributed storage and intelligent backup and recovery module further includes an automated backup and recovery management submodule, which is used to periodically perform data integrity checks in the system and automatically trigger a backup and recovery process when data damage or loss is detected. The recovery process includes the following steps: Periodic backup operations: perform data backup and verify data consistency at specified intervals; Fault detection and automatic recovery, based on the node status monitoring system in the smart grid, automatically activates the backup recovery process when a node fails or data is abnormal, and uses multiple copies and redundant coding to rebuild and recover data.

[0014] A data security management method in a smart grid, comprising: Step 1: Determine the encryption algorithm according to the sensitivity of the smart grid data, generate the corresponding encryption key, encrypt the data, and pass the encrypted data and key information to the next step to ensure that subsequent access operations comply with the security requirements of the encrypted data; Step 2: Based on the attribute tags and context information of users and devices, dynamically manage and adjust access rights, reference the encrypted data provided by the dynamic encryption and key management module, and perform fine-grained permission control on each user and device to prevent unauthorized access requests from entering the system; Step 3: Obtain access logs and context information of the adaptive access control module, analyze the access behavior of users and devices, identify single-point anomalies and multi-node associated abnormal behaviors based on deep learning and graph neural network models, and mark suspicious activities; Step 4: Ensure data privacy in the process of sharing and collaborative computing through federated learning and homomorphic encryption technology, obtain data encrypted by the dynamic encryption and key management modules to achieve privacy protection, and pass the encrypted storage requirements to the distributed storage and intelligent backup and recovery modules to support distributed storage and backup; Step 5: Use blockchain and IPFS technology to achieve distributed storage of encrypted data, receive encrypted data from the privacy-protected data sharing and collaborative computing module, and use a multi-copy backup mechanism for storage management based on the backup requirements of smart grid data to meet the requirements of fault tolerance and data recovery.

[0015] The present invention provides a data security management system and method in a smart grid, which has the following beneficial effects: 1. The present invention uses dynamic encryption and adaptive key management to adjust the encryption algorithm and key length in real time according to data sensitivity and network environment, and combines quantum key distribution technology to ensure the high security and anti-quantum attack capability of the key, thereby ensuring the security and real-time performance of data transmission, bringing innovative improvements to the data transmission security of smart grids.

[0016] 2. The present invention adopts an adaptive access control mechanism, combines the multi-dimensional attributes of users, devices and environments to generate dynamic access strategies, and can adjust permissions according to the real-time context environment. At the same time, permission operations are recorded in the blockchain to ensure non-tamperability and traceability, greatly enhancing the security management flexibility of the smart grid and providing a highly innovative permission control method.

[0017] 3. The present invention introduces federated learning and homomorphic encryption technology in data sharing and collaborative computing, supports each node to perform model training locally, shares parameters without transmitting original data, realizes secure data sharing, and then ensures privacy in the process of data analysis and collaborative computing, meeting the high security requirements of smart grid data sharing.

[0018] 4. The present invention records access control changes and operation logs in the blockchain to ensure the immutability and traceability of the logs, significantly enhance the security audit capability of the system, make the operation of the smart grid transparent and compliant, facilitate post-tracing and auditing, and improve the reliability and management efficiency of data security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a system framework diagram of the present invention; Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0020] In order to make the technical personnel in the technical field understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in combination with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a partial embodiment of the present invention, not a complete embodiment. Based on the embodiment of the present invention, other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present invention.

[0021] The present invention is described in detail below in conjunction with the accompanying drawings: Example: Please refer to the attached Figure 1 and attached Figure 2 The embodiment of the present invention provides a data security management system in a smart grid, including: Dynamic encryption and key management module, used to encrypt and manage smart grid data. According to the sensitivity of the data, the encryption algorithm is determined and the corresponding key is generated. The dynamic encryption and key management module ensures the security of data access by passing the encrypted data and key information to the adaptive access control module. The adaptive access control module is used to manage the access rights of users and devices and perform dynamic authorization based on attribute tags and context information. The adaptive access control module performs fine-grained permission control based on the encrypted data provided by the dynamic encryption and key management module to prevent unauthorized access. Multi-level intelligent intrusion detection module, used to detect abnormal behaviors during data transmission and access, and identify single-point and multi-node attacks based on deep learning and graph neural network models. The multi-level intelligent intrusion detection module analyzes access behaviors and marks suspicious activities by obtaining logs and context information from the adaptive access control module; The privacy-preserving data sharing and collaborative computing module is used to protect user privacy during data sharing and collaborative computing. Based on federated learning and homomorphic encryption technology, the privacy-preserving data sharing and collaborative computing module obtains data encrypted by the dynamic encryption and key management module to maintain data privacy protection during data sharing, and provides encrypted data storage requirements to the distributed storage and intelligent backup and recovery module; The distributed storage and intelligent backup and recovery module is responsible for distributed storage and data backup and recovery. It realizes distributed data storage through blockchain and IPFS technology, and improves the fault tolerance of the system through multi-copy backup. The distributed storage and intelligent backup and recovery module receives data encrypted by the privacy-protected data sharing and collaborative computing module, and performs distributed storage management according to the backup requirements of smart grid data.

[0022] Benefits of dynamic encryption and key management module: Achieve high security and real-time performance, ensure the flexibility of data encryption and the ability to resist quantum attacks, and provide strong security protection for data transmission in smart grids; Benefits of the adaptive access control module: It realizes fine-grained permission control and flexible authorization management, ensures the immutability and traceability of permission management, improves the security and transparency of permission management in smart grids, and effectively prevents the abuse of permissions; The benefits of the multi-level intelligent intrusion detection module are that it can quickly detect single-point anomalies and multi-node related attacks during data transmission and access, significantly reduce false positives and missed positives, and enhance the overall security of the system; Benefits of privacy-preserving data sharing and collaborative computing modules Avoid leakage of sensitive information and provide security and privacy protection for data sharing in smart grids; The benefits of distributed storage and intelligent backup and recovery modules are to achieve decentralized data storage, improve data integrity and immutability, ensure high availability and stability of data in smart grids, and reduce the risks caused by data loss or damage.

[0023] The dynamic encryption and key management module includes: Dynamic encryption submodule, used to determine different encryption algorithms according to the sensitivity level of the data, to meet the balance between real-time performance and security; Dynamic encryption meets the following conditions: , in, Indicates data The encryption method is is the data unit to be encrypted, Indicates highly sensitive data. For Advanced Encryption Standard, It is an asymmetric encryption algorithm. Indicates medium-sensitivity data. For Advanced Encryption Standard, Indicates low sensitivity data, It is a fast stream encryption algorithm; The quantum key distribution submodule uses the BB84 protocol to generate highly secure keys for encrypted transmission of highly sensitive data.

[0024] The benefits of the dynamic encryption submodule can effectively reduce computing overhead, while ensuring the security of highly sensitive data and the processing efficiency of less sensitive data, improving the response speed of smart grids in high-frequency data transmission, and meeting data security requirements in different scenarios; Provides adaptive selection criteria for encryption schemes to ensure that highly sensitive data uses advanced encryption combinations to improve data security; medium-sensitive data uses the lighter AES-128 algorithm to reduce computing resources; and low-sensitive data uses the lightweight ChaCha20 algorithm to improve system processing efficiency and real-time response capabilities; The benefits of the quantum key distribution submodule are that it can ensure that the key cannot be eavesdropped during transmission, has the ability to resist quantum computing attacks, and enhances the confidentiality and anti-attack capabilities of data transmission, preventing the risk of eavesdropping or tampering; Through the BB84 protocol, the key has the characteristic of anti-eavesdropping during the generation and transmission process. The existence of eavesdropping will cause the key generation to fail, thereby ensuring the integrity and security of the key. In addition, the BB84 protocol relies on the characteristics of quantum physics to make the key resistant to quantum computing attacks, significantly enhancing the confidentiality and anti-attack capabilities of data transmission, and providing a solid encryption foundation for smart grids.

[0025] The quantum key distribution in the dynamic encryption and key management module meets the following conditions: The sender generates a bit string , and determine the polarization basis ; The receiver compares the polarization basis with the sender's basis and obtains the final key string through screening. , in, represents a bit string, represents the polarization basis, Indicates the generated shared key; The sender generates a bit string and randomly determines the polarization basis to encode the bits, and each bit is sent to the receiver on a specific polarization basis; Without knowing the polarization basis of the sender, the receiver randomly determines the polarization basis to measure the received bit string. The receiver's measurement result will match the sender's polarization basis with a certain probability. The adaptive access control module includes: The attribute label and policy generation submodule is used to generate dynamic policies based on multi-dimensional attribute labels. The multi-dimensional attribute labels include user identity, user role, device location, access time, data sensitivity and environmental context. The attribute label and policy generation submodule passes the generated policies to the context awareness and real-time authorization submodule for real-time permission evaluation. The policy is defined as: , in, Indicates the user identity. Indicates the user role, Indicates the location of the device. Indicates the access time. Indicates the sensitivity of the data. Represents environmental context; The context-aware and real-time authorization submodule is used to make real-time authorization adjustments based on the current context. Its permission probability is defined as: , in, is the access request, S is the policy set, is the context-based authorization probability distribution; The blockchain record and permission management submodule generates log records for each permission allocation, change and revocation operation, and implements tamper-proof permission management through blockchain records.

[0026] The benefits of the quantum key distribution submodule are particularly suitable for scenarios with extremely high security requirements, ensuring that data transmission cannot be eavesdropped on and is resistant to quantum attacks, and providing extremely high encryption protection for highly sensitive data in smart grids; The BB84 protocol uses the characteristics of quantum physics to achieve anti-eavesdropping of key distribution. If there is eavesdropping, the receiver's measurement results will be disturbed, resulting in key generation failure. It can automatically detect eavesdropping risks and provide high security and anti-quantum attack capabilities for the encrypted transmission of highly sensitive data in smart grids. The benefits of the attribute label and policy generation submodules ensure that the system can adapt to complex access scenario requirements in real time. The system can allocate permissions to users in a more refined manner, enhance the flexibility and security of permission control, ensure accurate allocation of permissions for different roles in different situations, and improve the access security management effect of smart grids; By converting multi-dimensional attributes into policy generation conditions, user identities and roles in different situations can dynamically influence policies, making access control more refined, especially suitable for smart grid environments with diverse permission requirements; The benefits of the context-aware and real-time authorization submodule are that it can monitor environmental information in real time, automatically adjust the authorization accordingly, adapt to complex dynamic situations, improve the accuracy of access control, ensure that the authority allocation in the smart grid meets security requirements, and effectively reduce the possibility of misuse of authority; It provides a context-based dynamic authorization probability model, and makes conditional judgments on requests through context information to ensure that the authority allocation conforms to the real-time environment, realize the dynamic adaptability of authority control, synchronize authorization with environmental changes, and effectively reduce the risk of mis-authorization or authority abuse. It is an important guarantee for refined authority control in smart grids. The benefits of the blockchain record and permission management submodule are to provide reliable data records for subsequent audits and traceability, effectively enhance the transparency and compliance of the system, and provide a highly secure audit mechanism for permission management in smart grids.

[0027] The multi-level intelligent intrusion detection module includes: The single-point anomaly detection submodule is used to detect the abnormal behavior of a single device or node in the smart grid. It receives the flow data and behavior data from the adaptive access control module and the distributed storage module, and performs feature extraction and anomaly detection on the input data through the convolutional neural network. Suppose the input data is , the feature extraction formula is: , in, Represents input data, represents the convolution kernel, represents the convolution operation, represents the activation function, represents the bias term, represents the extracted features; The multi-node association detection submodule detects multi-node attacks based on the graph neural network model. The node features are set as , the update formula is: , in, is the feature vector of node v at the k+1th layer, is the activation function, is the weight matrix of the kth layer, is the neighbor set of node v, is the feature vector of node u in layer k, is the bias term.

[0028] Benefits of the single-point anomaly detection submodule: Single-point anomaly detection can efficiently extract spatial features from traffic data and identify potential abnormal behaviors. The detection method based on deep learning is more accurate than the traditional rule-based detection method, which can effectively reduce false positives and false negatives, improve the system's detection accuracy for single-point anomalies, and ensure the safety and stability of the smart grid; The benefits of the formula for feature extraction using convolutional neural networks are that the system can automatically identify abnormal features in network traffic, avoid the reliance of traditional rule detection on manual feature setting, and improve the flexibility and detection effect of anomaly detection; The multi-node association detection submodule has the advantage of being able to identify association behaviors between multiple nodes, and is particularly suitable for detecting complex distributed attacks. Compared with single-point detection, multi-node detection can capture potential multi-node coordinated attacks, improve the overall security protection effect of smart grids, and is an important means of defending against complex multi-node attacks. The benefit of the node feature update formula of the graph neural network is that it realizes the transmission and update of correlation information between nodes, allowing the system to identify and detect potential multi-node coordinated attacks and improve the system's detection capabilities for distributed and correlated attacks.

[0029] The privacy-preserving data sharing and collaborative computing modules include: The federated learning submodule is used to achieve privacy-preserving data sharing and collaborative computing. It updates global model parameters through parameter transmission rather than data transmission. The parameter update formula is: , in, are global model parameters, Indicates the total number of nodes, is the gradient of the kth node; The homomorphic encryption submodule is used for direct calculation in the encrypted state to satisfy the homomorphic encryption additivity. The formula is: , in, and is plain text data, is the homomorphic encryption function, is the ciphertext of data x, is the ciphertext of data y, is the multiplication operation between ciphertexts; Differential privacy protection submodule, assuming the analysis result is , add noise to meet privacy protection requirements: , in, It means the mean is 0 and the variance is Normally distributed noise.

[0030] Benefits of the Federated Learning Submodule: Avoid centralized data transmission, reduce the risk of data leakage, and at the same time, protect the privacy and security of data, ensuring the privacy of multi-party collaborative data analysis in the smart grid environment; The benefits of the parameter update formula of federated learning are that it avoids the risk of centralized data transmission and greatly reduces the possibility of data leakage. It is an important method for collaborative computing of privacy-preserving data. The benefits of the homomorphic encryption submodule are that it effectively prevents data leakage and is suitable for cross-node collaborative computing scenarios in smart grids, providing solid security for data transmission and sharing; The benefits of homomorphic encryption that satisfies the calculation formula of addition are to ensure the privacy and security of data during transmission and calculation, provide important support for privacy protection in smart grid data sharing, ensure that data operations are completed in a fully encrypted state, and improve data security; The benefit of the differential privacy protection submodule is that it ensures that data privacy is not leaked. By adding random noise to the analysis results, it effectively protects individual privacy information in the data and ensures privacy during the data analysis process.

[0031] The distributed storage and intelligent backup and recovery modules include: The blockchain and IPFS distributed storage submodule is used to generate the data file hash address H(F) through IPFS and record it in the blockchain; The multi-copy redundant storage submodule performs redundant storage of data files based on Reed-Solomon encoding, satisfying the following data recovery formula: , in, and is plain text data, is the homomorphic encryption function, is the ciphertext of data x, is the ciphertext of data y, It is the multiplication operation between ciphertexts.

[0032] Benefits of blockchain and IPFS distributed storage submodules Ensure the security and integrity of data indexes, provide efficient data retrieval methods, avoid single point failure problems, and effectively improve data availability and storage reliability; Describes the process of generating hash addresses for data files through IPFS. The system can efficiently index data files. At the same time, the blockchain is used to record hash addresses to ensure the security and non-tamperability of data storage and index information, improve data integrity and traceability, and is an important method for realizing distributed storage of smart grids. Benefits of the multi-copy redundant storage submodule: Effectively improve the system's fault tolerance and data recoverability. The system still reconstructs the complete data file through redundant coding, providing highly reliable backup and recovery capabilities for the smart grid; The benefit of the data recovery formula based on Reed-Solomon coding is that it provides an efficient fault-tolerant mechanism for the distributed storage of smart grids, ensuring that the system can reliably recover data when some storage nodes fail, enhancing the system's fault tolerance and high data availability, and is a key technology for data backup and recovery.

[0033] The dynamic encryption submodule includes real-time key management function, which can adjust the key length adaptively. The adaptive adjustment satisfies the following relationship: , in, is the key length, is the sensitivity level of the data, is the sensitivity coefficient, is the base key length; The distributed storage and intelligent backup and recovery module further includes an automated backup and recovery management submodule, which is used to periodically perform data integrity checks in the system and automatically trigger the backup and recovery process when data damage or loss is detected. The recovery process includes the following steps: Periodic backup operations: perform data backup and verify data consistency at specified intervals; Fault detection and automatic recovery, based on the node status monitoring system in the smart grid, automatically activates the backup recovery process when a node fails or data is abnormal, and uses multiple copies and redundant coding to rebuild and recover data.

[0034] Benefits of the dynamic encryption submodule: Dynamic adjustment of encryption strength is achieved to improve the encryption strength of data. In normal scenarios, the key length is reduced, encryption efficiency is optimized, computing resources are saved, and the security and real-time performance of data transmission are effectively balanced, making data encryption in smart grids more flexible and efficient. Define an adaptive adjustment mechanism for key length to ensure that the key length automatically increases or decreases as the sensitivity of the data changes. When transmitting highly sensitive data, the formula increases the encryption strength by increasing the key length, while when transmitting less sensitive data, the key length is reduced to optimize computing efficiency. The benefit of the automated backup and recovery management submodule is that it can automatically activate multiple copies and redundant coding mechanisms for data reconstruction and recovery, ensuring high data availability and integrity. The automated backup and recovery process can significantly reduce human intervention and improve system reliability and emergency response speed.

[0035] A data security management method in a smart grid, comprising: Step 1: Determine the encryption algorithm according to the sensitivity of the smart grid data, generate the corresponding encryption key, encrypt the data, and pass the encrypted data and key information to the next step to ensure that subsequent access operations comply with the security requirements of the encrypted data; Step 2: Based on the attribute tags and context information of users and devices, dynamically manage and adjust access rights, reference the encrypted data provided by the dynamic encryption and key management module, and perform fine-grained permission control on each user and device to prevent unauthorized access requests from entering the system; Step 3: Obtain access logs and context information of the adaptive access control module, analyze the access behavior of users and devices, identify single-point anomalies and multi-node associated abnormal behaviors based on deep learning and graph neural network models, and mark suspicious activities; Step 4: Ensure data privacy in the process of sharing and collaborative computing through federated learning and homomorphic encryption technology, obtain data encrypted by the dynamic encryption and key management modules to achieve privacy protection, and pass the encrypted storage requirements to the distributed storage and intelligent backup and recovery modules to support distributed storage and backup; Step 5: Use blockchain and IPFS technology to achieve distributed storage of encrypted data, receive encrypted data from the privacy-protected data sharing and collaborative computing module, and use a multi-copy backup mechanism for storage management based on the backup requirements of smart grid data to meet the requirements of fault tolerance and data recovery.

[0036] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data security management system in a smart grid, characterized in that: include: Dynamic encryption and key management module, used to encrypt and manage smart grid data. According to the sensitivity of the data, the encryption algorithm is determined and the corresponding key is generated. The dynamic encryption and key management module ensures the security of data access by passing the encrypted data and key information to the adaptive access control module. The adaptive access control module is used to manage the access rights of users and devices and perform dynamic authorization based on attribute tags and context information. The adaptive access control module performs fine-grained permission control based on the encrypted data provided by the dynamic encryption and key management module to prevent unauthorized access. Multi-level intelligent intrusion detection module, used to detect abnormal behaviors during data transmission and access, and identify single-point and multi-node attacks based on deep learning and graph neural network models. The multi-level intelligent intrusion detection module analyzes access behaviors and marks suspicious activities by obtaining logs and context information from the adaptive access control module; The privacy-preserving data sharing and collaborative computing module is used to protect user privacy during data sharing and collaborative computing. Based on federated learning and homomorphic encryption technology, the privacy-preserving data sharing and collaborative computing module obtains data encrypted by the dynamic encryption and key management module to maintain data privacy protection during data sharing, and provides encrypted data storage requirements to the distributed storage and intelligent backup and recovery module; The distributed storage and intelligent backup and recovery module is responsible for distributed storage and data backup and recovery. It realizes distributed data storage through blockchain and IPFS technology, and improves the fault tolerance of the system through multi-copy backup. The distributed storage and intelligent backup and recovery module receives data encrypted by the privacy-protected data sharing and collaborative computing module, and performs distributed storage management according to the backup requirements of smart grid data.

2. A data security management system in a smart grid according to claim 1, characterized in that: The dynamic encryption and key management module includes: Dynamic encryption submodule, used to determine different encryption algorithms according to the sensitivity level of the data, to meet the balance between real-time performance and security; The dynamic encryption meets the following conditions: ， in, Indicates data The encryption method is is the data unit to be encrypted, Indicates highly sensitive data. For Advanced Encryption Standard, It is an asymmetric encryption algorithm. Indicates medium-sensitivity data. For Advanced Encryption Standard, Indicates low sensitivity data, It is a fast stream encryption algorithm; The quantum key distribution submodule uses the BB84 protocol to generate highly secure keys for encrypted transmission of highly sensitive data.

3. A data security management system in a smart grid according to claim 2, characterized in that: The quantum key distribution in the dynamic encryption and key management module meets the following conditions: The sender generates a bit string , and determine the polarization basis ; The receiver compares the polarization basis with the sender's basis and obtains the final key string through screening. , in, represents a bit string, represents the polarization basis, Indicates the generated shared key; The sender generates a bit string and randomly determines the polarization basis to encode the bits, and each bit is sent to the receiver on a specific polarization basis; Without knowing the polarization basis of the sender, the receiver randomly determines the polarization basis to measure the received bit string, and the measurement result of the receiver will match the polarization basis of the sender with a certain probability.

4. The data security management system in a smart grid according to claim 1, characterized in that: The adaptive access control module comprises: The attribute label and policy generation submodule is used to generate dynamic policies based on multi-dimensional attribute labels. The multi-dimensional attribute labels include user identity, user role, device location, access time, data sensitivity and environmental context. The attribute label and policy generation submodule passes the generated policies to the context awareness and real-time authorization submodule for real-time permission evaluation. The policy is defined as: ， in, Indicates the user identity. Indicates the user role, Indicates the location of the device. Indicates the access time. Indicates the sensitivity of the data. Represents environmental context; The context-aware and real-time authorization submodule is used to make real-time authorization adjustments based on the current context. Its permission probability is defined as: ， in, is the access request, S is the policy set, is the context-based authorization probability distribution; The blockchain record and permission management submodule generates log records for each permission allocation, change and revocation operation, and implements tamper-proof permission management through blockchain records.

5. The data security management system in a smart grid according to claim 1, characterized in that: The multi-level intelligent intrusion detection module includes: The single-point anomaly detection submodule is used to detect the abnormal behavior of a single device or node in the smart grid. It receives the flow data and behavior data from the adaptive access control module and the distributed storage module, and performs feature extraction and anomaly detection on the input data through the convolutional neural network. Suppose the input data is , the feature extraction formula is: ， in, Represents input data, represents the convolution kernel, represents the convolution operation, represents the activation function, represents the bias term, represents the extracted features; The multi-node association detection submodule detects multi-node attacks based on the graph neural network model. The node features are set as , the update formula is: ， in, is the feature vector of node v at the k+1th layer, is the activation function, is the weight matrix of the kth layer, is the neighbor set of node v, is the feature vector of node u in the kth layer, is the bias term.

6. A data security management system in a smart grid according to claim 1, characterized in that: The privacy-preserving data sharing and collaborative computing module includes: The federated learning submodule is used to achieve privacy-preserving data sharing and collaborative computing. It updates global model parameters through parameter transmission rather than data transmission. The parameter update formula is: ， in, are global model parameters, Indicates the total number of nodes, is the gradient of the kth node; The homomorphic encryption submodule is used for direct calculation in the encrypted state to satisfy the homomorphic encryption additivity. The formula is: ， in, and is plain text data, is the homomorphic encryption function, is the ciphertext of data x, is the ciphertext of data y, is the multiplication operation between ciphertexts; Differential privacy protection submodule, assuming the analysis result is , add noise to meet privacy protection requirements: ， in, It means the mean is 0 and the variance is Normally distributed noise.

7. A data security management system in a smart grid according to claim 1, characterized in that: The distributed storage and intelligent backup and recovery module includes: The blockchain and IPFS distributed storage submodule is used to generate the data file hash address H(F) through IPFS and record it in the blockchain; The multi-copy redundant storage submodule performs redundant storage of data files based on Reed-Solomon encoding, satisfying the following data recovery formula: ， in, To reconstruct the original data or file, represents the decoding algorithm, Represents an encoded data segment.

8. The data security management system in a smart grid according to claim 2, characterized in that: The dynamic encryption submodule includes a real-time key management function, which can adjust the key length adaptively. The adaptive adjustment satisfies the following relationship: ， in, is the key length, is the sensitivity level of the data, is the sensitivity coefficient, The base key length.

9. The data security management system in a smart grid according to claim 1, characterized in that: The distributed storage and intelligent backup and recovery module further includes an automated backup and recovery management submodule, which is used to periodically perform data integrity checks in the system and automatically trigger a backup and recovery process when data damage or loss is detected. The recovery process includes the following steps: Periodic backup operations: perform data backup and verify data consistency at specified intervals; Fault detection and automatic recovery, based on the node status monitoring system in the smart grid, automatically activates the backup recovery process when a node fails or data is abnormal, and uses multiple copies and redundant coding to rebuild and recover data.

10. A data security management method in a smart grid, according to a data security management system in a smart grid according to any one of claims 1 to 9, characterized in that: include: Step 1: Determine the encryption algorithm according to the sensitivity of the smart grid data, generate the corresponding encryption key, encrypt the data, and pass the encrypted data and key information to the next step to ensure that subsequent access operations comply with the security requirements of the encrypted data; Step 2: Based on the attribute tags and context information of users and devices, dynamically manage and adjust access rights, reference the encrypted data provided by the dynamic encryption and key management module, and perform fine-grained permission control on each user and device to prevent unauthorized access requests from entering the system; Step 3: Obtain access logs and context information of the adaptive access control module, analyze the access behavior of users and devices, identify single-point anomalies and multi-node associated abnormal behaviors based on deep learning and graph neural network models, and mark suspicious activities; Step 4: Ensure data privacy in the process of sharing and collaborative computing through federated learning and homomorphic encryption technology, obtain data encrypted by the dynamic encryption and key management modules to achieve privacy protection, and pass the encrypted storage requirements to the distributed storage and intelligent backup and recovery modules to support distributed storage and backup; Step 5: Use blockchain and IPFS technology to achieve distributed storage of encrypted data, receive encrypted data from the privacy-protected data sharing and collaborative computing module, and use a multi-copy backup mechanism for storage management based on the backup requirements of smart grid data to meet the requirements of fault tolerance and data recovery.

Images