Safety control system 2M communication encryption method and system based on dynamic encryption

Abstract

The invention discloses a security control system 2M communication encryption method and a security control system 2M communication encryption system based on dynamic encryption, which realize encryption and decryption of inter-station 2M communication data by combining the high efficiency of symmetric encryption and the security of asymmetric encryption. The safety control system communication interface conversion device comprises a central processing unit (CPU), a field programmable gate array (FPGA), an Ethernet PHY physical layer chip and the like. The FPGA of the communication interface conversion device is integrated with a communication encryption and decryption IP core and is responsible for realizing encryption and decryption of application communication data, generation of a shared session key, dynamic updating and verification processes and improving the reliability and safety of communication; the CPU is connected with the FPGA through a parallel bus and is responsible for the unpacking and packing processing function of interface conversion application layer data. According to the method, symmetric encryption and asymmetric encryption are combined, and the secret key is dynamically updated, so that the method is suitable for practical engineering, the security problem and the replay attack problem in conventional communication can be solved, and the security and reliability of the system are improved.

Description

Technical Field

[0001] The present invention relates to secure communication, and in particular to a 2M communication encryption method and system for a security control system based on dynamic encryption. Background Art

[0002] With the construction of UHV power grid, the power grid and communication network form a strongly coupled system, so the possibility of complex chain failures increases. The improvement of stabilization and protection technology plays an important supporting role in the construction of UHV power grid.

[0003] The inter-station hosts form a stable control system through a dedicated 2M channel network to achieve safe and stable control of the large power grid. Figure 1 As shown, it is widely used in 220kV and above power grid tripping and switching, DC coordination control, overload control, frequency and voltage emergency control, oscillation decoupling control, wide area standby automatic switching and other systems. However, the current inter-station 2M communication is based on the power private network to exchange data in plain text, which poses a security risk in terms of security and anti-attack.

[0004] The communication interface conversion device serves as a bridge for communication between system stations. It includes a central processing unit CPU and a field programmable gate array FPGA. It communicates with the station's stabilization control host through standard 100M Ethernet, and converts the communication data packets sent by the host into 8 channels of 2M data, which are output through an independent 2M communication port to communicate with the remote party.

[0005] In the power system, 2M communication between stations is a key link to ensure the stable operation of the power grid. However, traditional communication methods often face challenges due to security risks such as data leakage, tampering and replay attacks. Therefore, an efficient and secure encrypted communication method is needed to ensure data integrity and confidentiality.

[0006] In the existing technology, such as the Chinese patent application with application number 202111337490.0, it discloses a national secret algorithm FPGA deployment method and system based on reconfigurable computing, which is characterized by deploying multiple national secret algorithm IP cores on demand, providing the optimal national secret algorithm IP core, and meeting the resource, power consumption and speed requirements of the encryption algorithm in high-speed and energy-saving operating modes in different time periods and different services; although a flexible national secret algorithm IP core deployment solution is provided, no specific method for implementing various encryption algorithm combinations is given, and no in-depth communication method research is conducted on the 2M communication device of the security control system.

[0007] The existing inter-station communication method of the security and stability control system, such as the Chinese patent application with application number 202111050107.3, discloses an optical fiber / E1 conversion device and an inter-station communication method of the security and stability control system, which is characterized by focusing on the logic implementation method of the interface conversion application layer of the communication interface device, but does not involve the encryption and decryption technology of 2M communication interaction; another example is the Chinese patent application with application number 202110621074.7, which discloses an encryption method and device for 2M communication of the security control system, which is characterized by introducing a method similar to SM4 communication encryption, in which the sender and receiver use the hash equation SHA256 to generate the check code for encrypted communication based on the transmitted secret key, count value and information body. However, it is mainly based on the software implementation of the general-purpose processor, and the algorithm processing efficiency is low. The addition of encryption means and the introduction of the hash equation SHA256 to generate the check code have an impact on the real-time transmission of the original application data, especially when it is necessary to communicate with different remote devices at the same time. The encryption means based on the software program has a particularly prominent impact on the real-time communication, and the security of its encryption key update method is poor and the reliability is not high. Summary of the invention

[0008] Purpose of the invention: In view of the above shortcomings, the present invention provides a safe, efficient and reliable 2M communication encryption method and system for a security control system based on dynamic encryption.

[0009] Technical solution: To solve the above problems, the present invention adopts a 2M communication encryption method for a security control system based on dynamic encryption, which includes the following steps:

[0010] Use the asymmetric encryption SM2 algorithm to generate a pair of public and private keys and a random number;

[0011] Send the generated public and private keys and random numbers to the communication partner, and receive the public and private keys and random numbers generated by the communication partner;

[0012] Use the elliptic curve Diffie-Hellman key exchange protocol to generate a session key by combining your own private key and the public key of the communication partner, and use the session key to encrypt the communication partner's random number;

[0013] Send the encrypted random number to the communication object, and receive the encrypted random number from the communication object;

[0014] Use the session key to decrypt the random number encrypted by the communication partner and obtain the decrypted random number. If the decrypted random number is verified to be consistent with the random number initially generated by itself, it means that the session key generated by the communication partner is correctly shared to obtain the shared key.

[0015] Conduct 2M communication with the communication partner and use the symmetric encryption SM4 algorithm to encrypt and decrypt the application communication data interacting between the two parties based on the shared key.

[0016] Further, the 2M communication with the communication object includes receiving 2M communication data and sending 2M communication data;

[0017] The receiving process of the 2M communication data is as follows: receiving the data message of the communication object, parsing, verifying, decrypting the data message and storing it in the secondary buffer;

[0018] The sending process of the 2M communication data is as follows: the application data to be sent is filled into the data sending storage buffer of the corresponding channel according to the channel number, the application data to be sent is encrypted, encoded after encryption, and then output to the communication object.

[0019] Furthermore, the shared key used in the 2M communication with the communication object is periodically updated, and the generation and update interaction process of the updated shared key is achieved by reusing the original application data transmission channel.

[0020] Furthermore, the data message received by the communication object is received by the CPU of the communication interface conversion device, and the CPU processes the application data message received by each channel according to the application logic package and returns it to the MAC transceiver module of the FPGA through the PCIe bus. The MAC transceiver module transmits the data to the stable control host in UDP message format through Ethernet PHY.

[0021] The present invention also adopts a 2M communication encryption system for a security control system based on dynamic encryption, comprising:

[0022] The key preparation module is used to generate a pair of public and private keys and a random number using the asymmetric encryption SM2 algorithm;

[0023] The key interaction module is used to send the generated public and private keys and random numbers to the communication object, and receive the public and private keys and random numbers generated by the communication object; it is also used to send the encrypted random number to the communication object, and receive the encrypted random number from the communication object;

[0024] The key generation module is used to use the elliptic curve Diffie-Hellman key exchange protocol, combine its own private key and the public key of the communication object, generate a session key, and encrypt the random number of the communication object through the session key;

[0025] The key verification module is used to use the session key to decrypt the random number encrypted by the communication partner and obtain the decrypted random number. If the decrypted random number is verified to be consistent with the random number initially generated by itself, the session key generated by the communication partner is correctly shared to obtain the shared key;

[0026] The communication module is used to perform 2M communication with the communication object and use the symmetric encryption SM4 algorithm to encrypt and decrypt the application communication data interacting between the two parties based on the shared key.

[0027] Further, it includes a plurality of 2M interface modules in the FPGA field programmable gate array and a remote communication interface device interacting with the corresponding 2M interface modules, wherein the 2M interface module and the corresponding remote communication interface device perform 2M communication including receiving 2M communication data and sending 2M communication data;

[0028] The receiving process of the 2M communication data is as follows: the 2M interface module receives the data message corresponding to the remote communication interface device, parses, verifies, decrypts the data message and stores it in the secondary buffer;

[0029] The sending process of the 2M communication data is as follows: the CPU of the communication interface conversion device fills the application data to be sent into the data sending storage buffer of the corresponding channel according to the channel number, encrypts the application data to be sent, encodes it after encryption, and then outputs it to the corresponding remote communication interface device through the 2M interface module.

[0030] Furthermore, the CPU of the communication interface conversion device receives application message data from the 2M interface modules of each channel and UDP messages from the communication with the stable control host, and the CPU performs corresponding logical judgment and disassembly and assembly operations according to the type and content of the data message;

[0031] The CPU of the communication interface conversion device packages the application data messages received by each channel according to the application logic and then transmits them back to the MAC transceiver module of the FPGA through the PCIe bus. The MAC transceiver module transmits the data to the stabilization and control host in the UDP message format through the Ethernet PHY. At the same time, it receives the UDP message sent by the stabilization and control host, disassembles the package, organizes the application message data to be sent to a distant place according to the application logic, and fills it into the corresponding 2M channel sending buffer.

[0032] The present invention also adopts a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0033] The present invention also adopts a computer-readable storage medium on which a computer program is stored, and the computer program implements the steps of the above method when executed by a processor.

[0034] Beneficial effects: Compared with the prior art, the significant advantage of the present invention is that it combines the national secret algorithms SM2 and SM4, which ensures the security of key interaction and distribution, and the efficient and real-time encryption. The high-performance processing capability of FPGA is used to realize the production, update, verification of session keys and encryption and decryption of message data, which ensures the security of communication on the basis of ensuring the real-time performance of 2M application data communication between stations. The dynamic update of session keys effectively prevents the security risks that may be caused by the long-term use of the same key. The IP core of FPGA and the CPU software program are seamlessly connected, and key negotiation, key encryption and decryption, and key dynamic update interaction reuse the original application data message communication channel, and the CPU software program is "unaware", which reduces the difficulty and cost of implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of a stabilization control system based on 2M inter-station communication of a communication interface device in the prior art.

[0036] Figure 2 It is a schematic diagram of the process of encrypted communication in the present invention.

[0037] Figure 3 The figure is a schematic diagram of the process of generating a shared session key for the inter-station communication interface conversion device in the present invention.

[0038] Figure 4 It is a schematic diagram of the communication phase of the encryption process of the inter-station communication interface conversion device in the present invention.

[0039] Figure 5 It is a schematic diagram of the multi-channel 2M message receiving and processing flow in the present invention.

[0040] Figure 6 It is a schematic diagram of the multi-channel 2M message sending process in the present invention.

[0041] Figure 7 It is a schematic diagram of the structure of the communication interface conversion device in the present invention. DETAILED DESCRIPTION

[0042] Example 1

[0043] like Figure 2 As shown, in this embodiment, a 2M communication encryption method for a security control system based on dynamic encryption is implemented to encrypt and decrypt inter-station communication data by combining the efficiency of symmetric encryption and the security of asymmetric encryption. The method includes the following steps:

[0044] Step 1: Confirm that the channel communication link is connected.

[0045] Step 2: Session key generation: During the handshake phase, both parties authenticate each other and negotiate a shared session key before starting to apply data encryption transmission. During the power-on initialization phase of the communication interface converter, the FPGAs of both parties generate public and private key pairs using asymmetric encryption technology (SM2 algorithm), and then negotiate a shared session key by exchanging public keys using the elliptic curve Diffie-Hellman key exchange protocol. Figure 3 As shown, the specific steps are:

[0046] Step 2-1: Initialization phase:

[0047] The communicating parties A and B each use the asymmetric encryption SM2 algorithm to generate a pair of public and private keys: A generates a public key PK A and private key SK A , B generates a public key PK B and private key SK B At the same time, the communicating parties A and B initialize and generate a random number for each of them for subsequent session key verification. A and B send their respective certificates (including the generated public key PK A and PK B ) and the generated random number are sent to the other party through the agreed message format.

[0048] The dynamic update and interaction of the session key multiplexes the application data message communication channel. The application data length is up to 48 bytes, which is filled and sent by the CPU side according to the fixed value configuration and actual application needs. The session key interaction message is up to 36 bytes, which is filled by the FPGA according to the session key generation and update process mechanism. If the session key interaction message is long, it is transmitted in packets and interrupts. The overall communication message frame format is as follows:

[0049] Application data (48 bytes) Session key update interaction message data (36 bytes) CRC_H CRC_L

[0050] The key initialization request message, A→B, has the following format:

[0051] meaning content Length (bytes) Frame Header 0xA551 2 Channel Address Channel number (0x5AA0~0x5AA7) 2 Checksum The sum and negation of all the above words 2

[0052] The key initialization request confirmation message, B→A, has the following format:

[0053] meaning content Length (bytes) Frame Header 0xA552 2 Channel Address Channel number (0x5AA0~0x5AA7) 2 Checksum The sum and negation of all the above words 2

[0054] Step 2-2: Session establishment phase

[0055] A and B obtain each other's certificates and random numbers through direct exchange. A and B use the elliptic curve Diffie-Hellman key exchange protocol to combine their own private keys and the other party's public key to generate a session key K A and K B .

[0056] Step 2-3: Session key sharing and verification

[0057] A and B use their respective calculated session keys K A and K B Encrypt the random number received from the other party in step 2-2 and send it to the other party. Both parties use the session key K calculated by themselves A and K B Decryption verifies whether the random number is generated by each party in step 2-1 to confirm whether both parties have successfully shared the same session key K AB (K AB =K A =K B ). If the verification is successful, both parties confirm the session key K AB Correctly shared, K AB as a shared key.

[0058] Identity authentication and key negotiation message 1 (authentication during key exchange), A<->B, format is as follows:

[0059] meaning content Length (bytes) Frame Header 0xA553 2 Channel Address Channel number (0x5AA0~0x5AA7) 2 Verification Information A digital certificate + random information (four bytes) data 100 Checksum The sum and negation of all the above words 2

[0060] Shared key verification return message 1, (session key verification return), A->B, the format is as follows:

[0061] meaning content Length (bytes) Frame Header 0xA554 2 Channel Address Channel number (0x5AA0~0x5AA7) 2 Session key encryption information Random information encrypted based on the session key 4 Checksum The sum and negation of all the above words 2

[0062] Shared key verification return message 2, (session key verification return), B->A, the format is as follows:

[0063]

[0064] Shared key verification return message 3, (session key verification return), A->B, the format is as follows:

[0065] meaning content Length (bytes) Frame Header 0xA556 2 Channel Address Channel number (0x5AA0~0x5AA7) 2 Session key verification return result Session key verification result information 4 Checksum The sum and negation of all the above words 2

[0066] The session key is dynamically updated periodically to prevent the security risks that may be caused by long-term use of the same key. The generation and update interaction of the new session key is realized by reusing the original application data transmission channel to ensure the real-time and security of the key update; at the same time, it avoids the increase of new physical key transmission channels and reduces the implementation cost. The flow chart of the dynamic update of the session key of the communication interface conversion device of this patent is as follows: Figure 4 shown.

[0067] A and B agree in advance on a fixed period to update the session key. When the session key needs to be updated, A and B will repeat the process in steps 2-1, 2-2, and 2-3, and use the elliptic curve Diffie-Hellman key exchange protocol to negotiate a new session key K. AB ′.

[0068] New session key K AB The generation and update interaction process of ′ is realized by reusing the original application data transmission channel. Once the new session key K AB After being verified by both parties, the two parties in 2M communication switch to using the new session key to encrypt and decrypt 2M application data, and discard the old session key K AB .

[0069] Step 3: Apply data encryption and decryption for communication transmission.

[0070] Symmetric encryption technology (SM4 algorithm) is used based on the shared key K generated in step 2-3. AB , encrypt and decrypt the application communication data exchanged between the two parties. The 2M interface module of the FPGA is responsible for the interaction with the external remote 2M communication. Each 2M interface module independently controls the encryption and decryption of the corresponding channel application communication data and the dynamic update management of the corresponding channel shared session key. The CPU of the communication interface conversion device, as the core of the entire system, receives the application message data from the 2M message processing module of each channel and the Ethernet UDP message from the communication with the stable control host. The CPU performs corresponding logical judgment and disassembly and assembly operations according to the type and content of the data message. The CPU of the communication interface conversion device processes the remote application data message received by each 2M channel according to the application logic package, and then returns it to the MAC (media access controller) transceiver module of the FPGA through the PCIe bus. The MAC transceiver module transmits the data to the stable control host in UDP message format through the Ethernet PHY. At the same time, the UDP message sent by the stable control host is received, and the package is disassembled, and the 2M application message to be sent to the remote is organized according to the application logic, and filled in the corresponding 2M channel sending buffer.

[0071] In this embodiment, the stable control communication interface conversion device supports independent transmission and reception of 8 2M interface modules at most. The communication process between the two parties includes 2M communication data reception and 2M communication data transmission.

[0072] like Figure 5As shown, the specific process of 2M communication data reception is: the 2M encoding module 1 of the FPGA receives the data message of the remote communication interface device 1, performs necessary encoding and format conversion, and ensures that the data meets the requirements of the subsequent processing module. Similarly, the 2M encoding module 2 processes the transmission data with the interface device 2, and the 2M encoding module 8 processes the transmission data message with the interface device 8. The corresponding protocol conversion and parsing process is: 2M message input->FPGA clock extraction->HDB3 physical layer decoding->1B4B spread spectrum decoding->HDLC data link layer decoding->message parsing->CRC check->FPGA 2M data decryption module->data storage secondary buffer.

[0073] like Figure 6 As shown, the specific process of 2M communication data transmission is: the 2M encoding module 1 of the FPGA sends a data message to the remote communication interface device 1, performs necessary encoding and format conversion, and ensures that it meets the requirements of 2M data transmission communication. Similarly, the 2M encoding module 2 sends data to the remote communication interface device 2, and the 2M encoding module 8 processes and sends the transmission data message to the remote communication device 8. The corresponding protocol conversion and parsing process is: the CPU of the communication interface conversion device fills the application data to be sent into the data transmission storage buffer of the corresponding channel according to the channel number -> FPGA 2M data encryption module performs encryption processing -> HDLC data link layer encoding -> physical layer 1B4B spread spectrum encoding -> 2M message output.

[0074] Step 4: The communication link is disconnected and the session ends.

[0075] Example 2

[0076] like Figure 7 As shown, the communication interface conversion device includes a stable control host, a communication chassis and several remote communication interface devices. The communication chassis includes a CPU (application message disassembly / packetization module), Ethernet PHY, and FPGA. The FPGA includes a GMAC transceiver module, an encryption system, and several 2M interface modules. The CPU of the communication interface conversion device serves as the core of the entire system and receives application message data from the 2M message processing modules of each channel and Ethernet UDP messages from the communication with the stable control host. The CPU performs corresponding logical judgments and disassembly and assembly operations according to the type and content of the data message. The communication interface conversion device CPU transmits the remote application data message received by each 2M channel back to the MAC (media access controller) transceiver module of the FPGA through the PCIe bus according to the application logic package processing, and the MAC transceiver module transmits the data to the stable control host in the UDP message format through the Ethernet PHY. At the same time, the UDP message sent by the stable control host is received and disassembled, and the 2M application message to be sent to the remote is organized according to the application logic, and filled in the corresponding 2M channel sending buffer.

[0077] The encryption system in this embodiment adopts a security control system 2M communication encryption system based on dynamic encryption technology, including:

[0078] The key preparation module is used to generate a pair of public and private keys and a random number using the asymmetric encryption SM2 algorithm;

[0079] The key interaction module is used to send the generated public and private keys and random numbers to the communication object, and receive the public and private keys and random numbers generated by the communication object; it is also used to send the encrypted random number to the communication object, and receive the encrypted random number from the communication object;

[0080] The key generation module is used to use the elliptic curve Diffie-Hellman key exchange protocol, combine its own private key and the public key of the communication object, generate a session key, and encrypt the random number of the communication object through the session key;

[0081] The key verification module is used to use the session key to decrypt the random number encrypted by the communication partner, obtain the decrypted random number, and verify whether the decrypted random number is consistent with the random number initially generated by itself. If the verification is consistent, the session key generated by the communication partner is correctly shared to obtain a shared key;

[0082] The communication module is used to perform 2M communication with the communication object and use the symmetric encryption SM4 algorithm to encrypt and decrypt the application communication data interacting between the two parties based on the shared key.

[0083] Example 3

[0084] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0085] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0086] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0087] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0088] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

Claims

1. A 2M communication encryption method for a security control system based on dynamic encryption, characterized in that: The following steps are involved: Use the asymmetric encryption SM2 algorithm to generate a pair of public and private keys and a random number; Send the generated public and private keys and random numbers to the communication partner, and receive the public and private keys and random numbers generated by the communication partner; Use the elliptic curve Diffie-Hellman key exchange protocol to generate a session key by combining your own private key and the public key of the communication partner, and use the session key to encrypt the communication partner's random number; Send the encrypted random number to the communication object, and receive the encrypted random number from the communication object; Use the session key to decrypt the random number encrypted by the communication partner and obtain the decrypted random number. If the decrypted random number is verified to be consistent with the random number initially generated by itself, it means that the session key generated by the communication partner is correctly shared to obtain the shared key. Conduct 2M communication with the communication partner and use the symmetric encryption SM4 algorithm to encrypt and decrypt the application communication data interacting between the two parties based on the shared key.

2. According to the 2M communication encryption method of the security control system based on dynamic encryption according to claim 1, it is characterized in that: The 2M communication with the communication object includes receiving 2M communication data and sending 2M communication data; The receiving process of the 2M communication data is as follows: receiving the data message of the communication object, parsing, verifying, decrypting the data message and storing it in the secondary buffer; The sending process of the 2M communication data is as follows: the application data to be sent is filled into the data sending storage buffer of the corresponding channel according to the channel number, the application data to be sent is encrypted, encoded after encryption, and then output to the communication object.

3. According to the 2M communication encryption method of the security control system based on dynamic encryption according to claim 1, it is characterized in that: The shared key used in the 2M communication with the communication object is periodically updated, and the generation and update interaction process of the updated shared key is achieved by reusing the original application data transmission channel.

4. The 2M communication encryption method for security control system based on dynamic encryption according to claim 2 is characterized in that: The data message received by the communication object is received by the CPU of the communication interface conversion device. The CPU packages the application data messages received by each channel according to the application logic and returns them to the MAC transceiver module of the FPGA through the PCIe bus. The MAC transceiver module transmits the data to the stable control host in the UDP message format through the Ethernet PHY.

5. A 2M communication encryption system for security control system based on dynamic encryption, characterized in that: include: The key preparation module is used to generate a pair of public and private keys and a random number using the asymmetric encryption SM2 algorithm; The key interaction module is used to send the generated public and private keys and random numbers to the communication object, and receive the public and private keys and random numbers generated by the communication object; it is also used to send the encrypted random number to the communication object, and receive the encrypted random number from the communication object; The key generation module is used to use the elliptic curve Diffie-Hellman key exchange protocol, combine its own private key and the public key of the communication object, generate a session key, and encrypt the random number of the communication object through the session key; The key verification module is used to use the session key to decrypt the random number encrypted by the communication partner and obtain the decrypted random number. If the decrypted random number is verified to be consistent with the random number initially generated by itself, the session key generated by the communication partner is correctly shared to obtain the shared key; The communication module is used to perform 2M communication with the communication object and use the symmetric encryption SM4 algorithm to encrypt and decrypt the application communication data interacting between the two parties based on the shared key.

6. The 2M communication encryption system for security control system based on dynamic encryption according to claim 5 is characterized in that: It includes several 2M interface modules in the FPGA field programmable gate array and a remote communication interface device interacting with the corresponding 2M interface modules, wherein the 2M interface module and the corresponding remote communication interface device perform 2M communication including receiving 2M communication data and sending 2M communication data; The receiving process of the 2M communication data is as follows: the 2M interface module receives the data message corresponding to the remote communication interface device, parses, verifies, decrypts the data message and stores it in the secondary buffer; The sending process of the 2M communication data is as follows: the CPU of the communication interface conversion device fills the application data to be sent into the data sending storage buffer of the corresponding channel according to the channel number, encrypts the application data to be sent, encodes it after encryption, and then outputs it to the corresponding remote communication interface device through the 2M interface module.

7. The 2M communication encryption system for security control system based on dynamic encryption according to claim 6 is characterized in that: The CPU of the communication interface conversion device receives the application message data from the 2M interface modules of each channel and the UDP message from the communication with the stable control host. The CPU performs corresponding logical judgment and disassembly and assembly operations according to the type and content of the data message; The CPU of the communication interface conversion device packages the application data messages received by each channel according to the application logic and then transmits them back to the MAC transceiver module of the FPGA through the PCIe bus. The MAC transceiver module transmits the data to the stabilization and control host in the UDP message format through the Ethernet PHY. At the same time, it receives the UDP message sent by the stabilization and control host, disassembles the package, organizes the application message data to be sent to a distant place according to the application logic, and fills it into the corresponding 2M channel sending buffer.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images