Anti-quantum cryptography migration method and system for power system

Abstract

The invention relates to the technical field of data security, in particular to a quantum cryptography migration resisting method and system for a power system, and the method comprises the steps: carrying out the quantum threat risk assessment of a communication link based on the layering and partitioning architecture features of the power system; obtaining attribute data of the encryption component, and performing parallel migration risk analysis on the encryption component in combination with a quantum threat risk assessment result to generate an anti-quantum migration risk matrix; carrying out compatibility evaluation on a traditional public key algorithm and an anti-quantum cryptography algorithm based on algorithm features, and constructing a double-track encryption migration strategy; dynamically adjusting a double-track weight ratio, and constructing a double-track encryption hierarchical migration strategy based on a control hierarchy to which a communication link belongs; and executing the double-track encryption layered migration strategy and monitoring the migration effect, and performing self-adaptive correction on the double-track encryption layered migration strategy based on the migration effect. According to the method, a quantum threat assessment and double-track encryption layered migration mechanism is constructed, so that safe and smooth migration of the power system under the threat of quantum computing is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a power system anti-quantum password migration method and system. BACKGROUND

[0002] With the rapid development of quantum computing technology, the encryption system of the traditional power system communication network will face unprecedented challenges. Quantum computers can use Shor algorithm and Grover algorithm to achieve fast cracking of traditional public key cryptography, and then cause scheduling instruction tampering, relay protection misoperation and state monitoring data forgery of the power system through quantum attacks, and pose a pre-storage, post-cracking traceability risk to the long-term stored sensitive data of the power system. Therefore, it is necessary to perform anti-quantum password (Post-Quantum Cryptography, PQC) migration work on the power system communication network to resist the potential threat of quantum computing to the power system.

[0003] However, the scheduling automation, relay protection, state monitoring and distributed control links in the power system increasingly rely on secure communication, and different communication links, protocol architectures and device computing capabilities differ greatly, so direct anti-quantum password migration leads to problems such as system performance degradation, communication delay increase and device resource overload. Therefore, how to ensure the continuity of communication and the stability of the system, and realize the smooth migration of the power system from the traditional password algorithm to the anti-quantum password algorithm, has become a technical problem that needs to be solved in the current power data security field.

[0004] Existing anti-quantum migration schemes focus on algorithm replacement and protocol adaptation, but ignore the system-level security risks and performance dynamic balance in the migration process. On the one hand, different encryption components may have dependency conflicts and key synchronization risks during migration, which can easily form new attack surfaces; on the other hand, anti-quantum password algorithms generally have large key sizes and high computational overheads, and if the migration strategy does not fully consider the computing power differences of edge devices in the power system and the real-time communication requirements, it will cause the system performance to deteriorate after migration, and even affect the stable operation of the core control link, thereby causing the power system to face the risks of security strategy misalignment, business interruption and system reliability decline during anti-quantum password migration. SUMMARY

[0005] In order to overcome the defects and deficiencies of the prior art, the present application provides a power system anti-quantum password migration method and system, which realizes the smooth migration of the power system under the threat of quantum computing by constructing a quantum threat assessment and dual-rail encryption layered migration mechanism.

[0006] In order to achieve the above purpose, the technical scheme adopted by the present application is as follows: In a first aspect, the present application provides a quantum-resistant migration method for a power system, comprising: S100, obtaining communication link operation data of the power system and performing quantum threat risk assessment on the communication link based on the characteristics of the hierarchical and partitioned architecture of the power system; S200, obtaining encryption component attribute data corresponding to each type of communication link and performing parallel migration risk analysis on the encryption component in combination with the quantum threat risk assessment result to generate a quantum-resistant migration risk matrix; S300, performing compatibility assessment on the traditional public key algorithm and the quantum-resistant cryptographic algorithm based on algorithm characteristics, and constructing a dual-track encryption migration strategy in combination with the quantum-resistant migration risk matrix; S400, dynamically adjusting the weight proportion of the dual tracks based on the performance differences of the edge devices of the power system and constructing a dual-track encryption hierarchical migration strategy based on the control level to which the communication link belongs; S500, executing the dual-track encryption hierarchical migration strategy and performing migration effect monitoring, and adaptively modifying the dual-track encryption hierarchical migration strategy based on the migration effect.

[0007] Further, the quantum threat risk assessment on the communication link based on the defense architecture characteristics of the hierarchical and partitioned power system in step S100 comprises: S110, dividing the communication link into dispatching automation link, relay protection communication link, state monitoring link and distributed terminal link and extracting link operation data of each type of communication link based on the communication link operation data; S120, calculating quantum vulnerability indicators of each type of communication link based on the communication protocol type, key length, data update period and node credibility in the link operation data, quantifying the potential cracking risk of the communication link under quantum computing attack conditions; S130, calculating the attack surface expansion coefficient of the link under the cross-zone access and key node exposure conditions in combination with the control level and security domain boundary of each type of communication link in the hierarchical and partitioned architecture of the power system; S140, constructing a quantum threat risk model for the communication link based on the quantum vulnerability indicators and the attack surface expansion coefficient, and adaptively updating the quantum threat risk model in combination with the quantum attack evolution trend; S150, classifying each type of communication link according to the updated quantum threat risk model to generate a quantum threat classification diagram of the communication link of the power system, providing a basis for subsequent encryption component migration risk analysis and dual-track encryption strategy construction.

[0008] Further, the generation of the quantum-resistant migration risk matrix in step S200 comprises: S210, obtaining encryption component attribute data corresponding to each type of communication link, the encryption component attribute data including algorithm type, key management mode, hardware dependency characteristics, fault tolerance mechanism and protocol adaptation characteristics; S220, evaluate the component migration sensitivity based on the encryption component attribute data, and weight the component migration sensitivity based on the quantum threat risk evaluation result to obtain a migration sensitivity index, which is used to reflect the change trend of the exposure degree of the encryption component to quantum attack in the migration process; S230, analyze the coordination relationship of different encryption components under parallel migration conditions and construct a dependency topology structure among the encryption components, and quantify the synchronization delay risk, key synchronization conflict probability and potential attack propagation path among the encryption components; S240, determine the parallel migration risk coefficient among different encryption components based on the migration sensitivity index and the dependency topology structure among the encryption components, and evaluate the parallel migration risk caused by algorithm replacement, key rotation and protocol encapsulation update of the encryption components in the parallel migration process; S250, generate an anti-quantum migration risk matrix based on the parallel migration risk coefficient among the encryption components, which is used to describe the risk intensity distribution, encryption component coupling degree and migration priority in the migration process.

[0009] Further, the step S300 of constructing the dual-track encryption migration strategy comprises: S310, obtain algorithm characteristic data of the traditional public key algorithm and the anti-quantum cryptographic algorithm and construct an algorithm compatibility evaluation model, the algorithm characteristic data comprising key length, signature length, encryption rate, decryption rate and anti-quantum attack complexity; S320, perform compatibility evaluation on each candidate anti-quantum cryptographic algorithm and the existing communication protocol encapsulation format, key exchange mechanism and authentication system of the power system based on the algorithm compatibility evaluation model; S330, construct a dual-track encryption coordination model based on the compatibility evaluation result and the anti-quantum migration risk matrix, the dual-track encryption coordination model comprising a traditional public key algorithm track and an anti-quantum cryptographic algorithm track; S340, generate a dual-track encryption migration strategy based on the security performance index and the migration stability evaluation result output by the dual-track encryption coordination model.

[0010] Further, the specific steps of the S400 comprise: S410, obtain device operation data of the edge devices of the power system and construct a device performance evaluation model based on the computing power, storage capacity and communication load of the edge devices, which quantifies the resource occupation rate and real-time response capability of each edge device when performing dual-track encryption operation; S420, calculate the encryption overhead difference value of the traditional algorithm track and the anti-quantum algorithm track, and determine the initial proportion of the encryption weight of each type of communication link in combination with the device performance evaluation result; S430, based on the communication link communication demand, a multi-objective optimization function is constructed with real-time, throughput and security level as constraint conditions, and dynamic optimization is performed on the initial proportion of the encryption weight to generate an adaptive dual-track weight proportion for different business scenarios; S440, based on the adaptive dual-track weight proportion, the dual-track encryption migration strategy is optimized, a dual-track encryption hierarchical migration strategy is generated and mapped to the corresponding communication link and encryption component, and is used for realizing hierarchical and partitioned encryption migration deployment.

[0011] Further, the specific steps of S500 include: S510, key performance indicators of the communication link in the dual-track encryption hierarchical migration strategy execution process are acquired, and the key performance indicators include transmission delay, data throughput, data packet loss rate, encryption and decryption processing delay, and quantum security hash verification success rate; S520, a migration effect evaluation model is constructed based on the key performance indicators, a migration performance loss coefficient is calculated, and the system performance overhead introduced by the quantum-resistant cryptographic algorithm is quantified; S530, it is judged whether the migration performance loss coefficient exceeds a preset migration performance loss threshold of the corresponding communication link, if the migration performance loss coefficient is greater than the preset migration performance loss threshold, an encryption track rollback mechanism is triggered, and the communication link with abnormal performance is rolled back to a working mode mainly based on the traditional algorithm track; S540, based on the migration performance loss coefficient and the quantum security hash verification success rate, the algorithm parameter configuration, the encryption weight proportion and the algorithm track selection strategy in the dual-track encryption hierarchical migration strategy are adaptively corrected, and the corrected dual-track encryption hierarchical migration strategy is generated and executed.

[0012] In a second aspect, the present application provides a power system quantum-resistant cryptographic migration system, comprising: A quantum threat risk assessment module is configured to acquire communication link operation data of the power system and perform quantum threat risk assessment on the communication link based on the hierarchical and partitioned architecture characteristics of the power system; A migration risk matrix generation module is configured to acquire encryption component attribute data corresponding to various communication links and perform parallel migration risk analysis on the encryption components in combination with the quantum threat risk assessment results to generate a quantum-resistant migration risk matrix; A migration strategy construction module is configured to perform compatibility assessment on the traditional public key algorithm and the quantum-resistant cryptographic algorithm based on algorithm characteristics, and construct a dual-track encryption migration strategy in combination with the quantum-resistant migration risk matrix; A hierarchical migration strategy construction module is configured to dynamically adjust the dual-track weight proportion based on the performance difference of the power system edge device and construct a dual-track encryption hierarchical migration strategy based on the control level to which the communication link belongs; A migration effect monitoring module is configured to execute a dual-track encryption layered migration strategy and monitor the migration effect, and to adaptively correct the dual-track encryption layered migration strategy based on the migration effect.

[0013] In a third aspect, the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores a computer program that can be invoked by the processor, and the processor executes the power system quantum-resistant migration method by invoking the computer program stored in the memory.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to execute the power system quantum-resistant migration method.

[0015] Compared with the prior art, the present application has the following advantages and beneficial effects: (1) The present application introduces a quantum threat risk assessment and migration risk matrix construction mechanism under the layered and partitioned architecture of the power system, which can accurately identify the potential vulnerability and migration risk of different communication links and encryption components under the condition of quantum computing attacks, realize the quantitative evaluation and dynamic monitoring of the communication security state of the power system, effectively prevent the generation of new attack surfaces during the migration process, and thus ensure the continuous and safe operation of the power system under the condition of quantum threat evolution.

[0016] (2) The present application constructs a dual-track encryption layered migration strategy for the performance difference of edge devices of the power system, and realizes the dynamic optimization of algorithm track weight based on real-time performance monitoring and adaptive correction mechanism, which can realize the progressive deployment and intelligent switching of quantum-resistant algorithms among different levels of communication links, avoid the increase of delay and the decrease of throughput caused by algorithm migration, and significantly improve the quantum-resistant security protection capability of the power system communication. BRIEF DESCRIPTION OF DRAWINGS

[0017] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings: Figure 1 is a flowchart of the power system quantum-resistant migration method provided by the embodiments of the present application; Figure 2 is a structural schematic diagram of the power system quantum-resistant migration system provided by the embodiments of the present application; Figure 3 is a structural schematic diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0018] The technical solutions of the present application will be described in detail below with reference to the drawings and specific embodiments. It should be understood that the embodiments and specific features in the embodiments are detailed descriptions of the technical solutions of the present application, and are not limitations of the technical solutions of the present application. In the case of no conflict, the technical features in the embodiments and the embodiments can be combined with each other.

[0019] Please refer to Figure 1 , Figure 1 is the overall flowchart of the power system anti-quantum password migration method provided by the embodiment of the present application, which specifically includes the following steps: S100, obtaining the communication link operation data of the power system and performing quantum threat risk assessment on the communication link based on the hierarchical partition architecture characteristics of the power system; The communication network of the power system usually has the defense characteristics of vertical layering and horizontal partitioning, for example, the communication links between the main station dispatching system, the relay protection system, the supervisory control and data acquisition system, the condition monitoring system and the distributed terminal layer equipment have significant differences in real-time performance, security and control authority. By introducing the hierarchical partition architecture characteristics in the quantum threat assessment stage, the quantum risk assessment results can be matched with the actual operation safety boundary of the power system, thereby effectively avoiding the high-risk link misjudgment or resource allocation imbalance caused by the one-size-fits-all migration strategy, realizing the differentiated risk identification of different communication levels, providing accurate input basis for the subsequent anti-quantum password migration strategy, and enabling the migration strategy to be executed in stages according to the quantum threat level and system security level of different links. For example, the double-track encryption migration can be enabled for the dispatch backbone link and the relay protection communication link, and the delayed migration strategy can be used for the edge condition monitoring link, thereby reducing the performance loss while ensuring overall security. The quantum threat risk assessment on the communication link based on the defense architecture characteristics of the hierarchical partition of the power system includes: S110, dividing the communication link into dispatch automation link, relay protection communication link, condition monitoring link and distributed terminal link and extracting the link operation data of each type of communication link based on the communication link operation data; S120, based on the communication protocol type, key length, data update period and node credibility in the link operation data, calculate the quantum vulnerability index of each type of communication link, quantify the potential cracking risk of the communication link under the condition of quantum computing attack, specifically, according to the communication link operation data, extract the communication protocol type, key length, data update period and node credibility; combined with the quantum cracking complexity model of existing cryptographic algorithms, such as the decomposition complexity of public key algorithm based on Shor algorithm and the search complexity of symmetric encryption algorithm based on Grover algorithm, evaluate the security strength of the current encryption algorithm under the condition of quantum computing, wherein the shorter the key length, the longer the data update period, and the lower the node credibility, all of which will increase the quantum vulnerability of the link, by weighting the above factors, the overall vulnerability level of the communication link in the quantum computing environment is obtained, which is used to reflect the possibility of the link being cracked by quantum attack; S130, combined with the control level and security domain boundary of each type of communication link in the hierarchical partitioning architecture of the power system, calculate the attack surface expansion coefficient of the link under the condition of cross-zone access and key node exposure, specifically, based on the hierarchical partitioning architecture of the power system, identify the security domain boundary crossed by each communication link and the connection relationship with the key node; according to the cross-zone access frequency, the number of connected nodes, the trust level of the key node and its importance in the control level, evaluate the potential exposure range of the link, wherein the higher the cross-zone access frequency, the lower the trust level of the key node, and the higher the importance of the node, the greater the attack surface expansion risk, the attack surface expansion coefficient of the link is calculated by weighted fusion, which is used to represent the attack surface diffusion trend of the link under quantum attack; S140, based on the quantum vulnerability index and the attack surface expansion coefficient, construct the quantum threat risk model of the communication link, and adaptively update the quantum threat risk model combined with the evolution trend of quantum attack, specifically, normalize the quantum vulnerability index and the attack surface expansion coefficient to ensure the comparability of different dimension indicators; according to the importance of the link, the control level and the real-time requirement of the business, set the weight parameter, and weightedly sum the quantum vulnerability and the attack surface expansion risk to obtain the quantum threat comprehensive risk value of the communication link, which can be mapped to multiple risk levels to form the quantum threat classification map of the power system communication link, at the same time, combined with the evolution trend of quantum attack ability, periodically update to realize adaptive correction of risk assessment; S150, according to the updated quantum threat risk model, divide the quantum threat level of each type of communication link, generate the quantum threat classification map of the communication link of the power system, and provide basis for subsequent encryption component migration risk analysis and double-track encryption strategy construction.

[0020] S200, obtain the encryption component attribute data corresponding to various communication links and combine the quantum threat risk assessment result to perform parallel migration risk analysis on the encryption component, and generate an anti-quantum migration risk matrix; The traditional password migration strategy ignores the dependency relationship between different encryption components (such as communication authentication components, key exchange components, and data encryption components), and if different components are not subjected to collaborative risk assessment when migrating to anti-quantum cryptographic algorithms, it may cause key update out of step, protocol packaging mismatch, or security authentication failure, thereby forming a new attack surface in the migration transition phase. For example, when the relay protection communication link and the dispatch automation link simultaneously replace the algorithm, if the key rotation periods of the two are not synchronized, an attacker may initiate a man-in-the-middle attack using the unsynchronized key exchange phase, causing communication to be compromised or control instructions to be tampered with. By constructing an anti-quantum migration risk matrix, the present application can systematically depict the risk transmission paths and collaborative dependency relationships between encryption components, effectively reducing the collaborative uncertainty and potential attack diffusion risk in the process of simultaneous migration of multiple components, generating an anti-quantum migration risk matrix, including: S210, obtain the encryption component attribute data corresponding to various communication links, and the encryption component attribute data includes algorithm type, key management mode, hardware dependency feature, fault tolerance mechanism, and protocol adaptation characteristic; S220, based on the encryption component attribute data, assess the component migration sensitivity and weight the component migration sensitivity based on the quantum threat risk assessment result to obtain a migration sensitivity index, which is used to reflect the change trend of the exposure degree of the encryption component to quantum attacks in the migration process; S230, analyze the collaborative relationship of different encryption components under the condition of parallel migration and construct the dependency topology structure between encryption components, and quantify the synchronization delay risk, key synchronization conflict probability, and potential attack propagation path between encryption components; S240, determine the parallel migration risk coefficient between different encryption components based on the migration sensitivity index and the dependency topology structure between encryption components, and assess the parallel migration risk caused by algorithm replacement, key rotation, and protocol packaging update in the process of parallel migration of encryption components; S250, generate an anti-quantum migration risk matrix based on the parallel migration risk coefficient between encryption components, which is used to describe the risk intensity distribution, encryption component coupling degree, and migration priority in the migration process.

[0021] S300, perform compatibility assessment on the traditional public key algorithm and the anti-quantum cryptographic algorithm based on the algorithm characteristics, and construct a dual-track encryption migration strategy combined with the anti-quantum migration risk matrix; The main purpose of constructing the dual-track encryption migration strategy is to ensure that the power system can smoothly transition during the migration phase and enhance quantum protection capabilities without sacrificing communication security and real-time performance. Specifically, by analyzing the key length, encryption and decryption rate, signature length, and algorithm complexity of traditional algorithms (such as RSA and ECC) and quantum-resistant algorithms (such as CRYSTALS-Kyber, Dilithium, and FALCON), an algorithm compatibility evaluation model is established to determine the replaceability and packaging compatibility of different algorithms under existing power communication protocols (such as IEC 61850, DNP3, and Modbus). For example, for a delay-sensitive relay protection communication link, if the quantum-resistant algorithm has significantly higher calculation delay than the traditional algorithm during key exchange, the dual-track strategy is used to maintain the traditional algorithm as the main encryption channel and the quantum-resistant algorithm as the auxiliary encryption channel to balance security and real-time performance. The dual-track encryption migration strategy constructed in step S300 includes: S310, obtaining algorithm characteristic data of traditional public key algorithms and quantum-resistant cryptographic algorithms and constructing an algorithm compatibility evaluation model, the algorithm characteristic data including key length, signature length, encryption rate, decryption rate, and quantum attack resistance complexity; S320, based on the algorithm compatibility evaluation model, evaluating the compatibility of each candidate quantum-resistant cryptographic algorithm with the existing communication protocol packaging format, key exchange mechanism, and authentication system of the power system. Specifically, the encapsulation structure parameters, key distribution process, and authentication interface characteristics of the power system communication protocol are extracted, and the interaction mapping relationship between the communication protocol layer, the transmission layer, and the encryption algorithm layer is established. The characteristic data of each candidate quantum-resistant cryptographic algorithm is input into the algorithm compatibility evaluation model, and the multi-dimensional matching algorithm is used to analyze the adaptability of the algorithm to the existing communication packaging format, the replaceability of the algorithm to the existing key exchange mechanism, and the interface compatibility of the algorithm to the existing authentication system. The compatibility score matrix is output based on the calculation overhead, communication delay, and hardware implementation requirements of the algorithm, reflecting the overall compatibility of different quantum-resistant cryptographic algorithms under the existing system architecture. S330, based on the compatibility evaluation results and the quantum-resistant migration risk matrix, constructing a dual-track encryption collaboration model, which includes a traditional public key algorithm track and a quantum-resistant cryptographic algorithm track. S340, generate a double-track encryption migration strategy based on the security performance index and the migration stability evaluation result output by the double-track encryption collaborative model. Specifically, in the constructed double-track encryption collaborative model, the performance of the traditional algorithm track and the quantum-resistant algorithm track is simulated respectively, and the encryption delay, decryption delay, key synchronization rate, quantum attack resistance probability and encryption consistency index under different communication load conditions are calculated. Based on the security performance index and the migration stability evaluation result, a multi-objective optimization model is established, and the encryption task allocation ratio, key interaction frequency and algorithm switching threshold between the double tracks are optimized and solved with the maximum system security and the minimum migration performance loss as the objective functions. According to the optimization result, a double-track encryption migration strategy is generated to realize the dynamic collaborative operation of the traditional algorithm track and the quantum-resistant algorithm track under different control levels and business scenarios.

[0022] S400, dynamically adjust the double-track weight proportion based on the performance difference of the power system edge device and construct a double-track encryption hierarchical migration strategy based on the control level to which the communication link belongs. The core function is to ensure that the power system can smoothly transition during the quantum security migration stage, while enhancing the quantum protection capability without sacrificing communication security and real-time performance. Specifically, by analyzing the key length, encryption and decryption rate, signature length, algorithm complexity and other parameters of the traditional algorithm and the quantum-resistant algorithm, an algorithm compatibility evaluation model is established to determine the replaceability and packaging compatibility of different algorithms under the existing power communication protocol. For example, for a delay-sensitive relay protection communication link, if the quantum-resistant algorithm has a significantly higher calculation delay than the traditional algorithm during the key exchange stage, the traditional algorithm is kept as the main encryption channel and the quantum-resistant algorithm is kept as the auxiliary encryption channel to balance security and real-time performance. Further, combined with the quantum-resistant migration risk matrix, the invention constructs a double-track encryption collaborative model in which the traditional public key algorithm track and the quantum-resistant cryptographic algorithm track run in parallel according to the quantum threat level and migration risk weight of each communication link, effectively reducing the communication interruption risk and encryption performance fluctuation problem caused by direct algorithm switching, ensuring the data transmission security, link stability and business continuity of the power system during the migration period. The specific steps of S400 include: S410, obtain the device operation data of the power system edge device and construct a device performance evaluation model based on the computing power, storage capacity and communication load of the edge device, quantifying the resource occupation rate and real-time response capability of each edge device when performing double-track encryption operations; S420, calculate the encryption overhead difference between the traditional algorithm track and the quantum-resistant algorithm track and determine the initial encryption weight proportion of each type of communication link based on the device performance evaluation result; S430, based on the communication link communication demand, a multi-objective optimization function is constructed with real-time, throughput and security level as constraint conditions, the initial proportion of encryption weight is dynamically optimized, and an adaptive double-track weight proportion is generated for different business scenarios; S440, based on the adaptive double-track weight proportion, the double-track encryption migration strategy is optimized, a double-track encryption layered migration strategy is generated and mapped to the corresponding communication link and encryption component, and is used for realizing layered and partitioned encryption migration deployment.

[0023] S500, the double-track encryption layered migration strategy is executed and migration effect monitoring is performed, and the double-track encryption layered migration strategy is adaptively corrected based on the migration effect; Through the migration effect monitoring and feedback optimization mechanism, the algorithm parameter configuration, the encryption weight proportion and the track selection strategy in the double-track encryption layered migration strategy are adaptively corrected based on the migration performance loss coefficient and the quantum security hash verification success rate, compared with the double-track encryption migration strategy, the layered migration mode can dynamically optimize according to the real-time performance feedback of different communication levels, significantly reduces the resource waste and synchronization delay risk caused by system global switching, thereby guaranteeing the quantum security while minimizing the performance loss, improving the anti-quantum migration efficiency and safety stability of the power system, and the specific steps of S500 include: S510, key performance indicators of the communication link in the double-track encryption layered migration strategy execution process are acquired, and the key performance indicators include transmission delay, data throughput, data packet loss rate, encryption and decryption processing delay and quantum security hash verification success rate; S520, a migration effect evaluation model is constructed based on the key performance indicators, a migration performance loss coefficient is calculated, and the system performance overhead introduced by the anti-quantum cryptographic algorithm is quantified; S530, it is judged whether the migration performance loss coefficient exceeds a preset migration performance loss threshold of the corresponding communication link, if the migration performance loss coefficient is greater than the preset migration performance loss threshold, an encryption track rollback mechanism is triggered, and the communication link with abnormal performance is rolled back to a working mode mainly based on a traditional algorithm track; S540, the algorithm parameter configuration, the encryption weight proportion and the algorithm track selection strategy in the double-track encryption layered migration strategy are adaptively corrected based on the migration performance loss coefficient and the quantum security hash verification success rate, and the corrected double-track encryption layered migration strategy is generated and executed.

[0024] Please refer to Figure 2 , Figure 2 is a structural schematic diagram of the power system anti-quantum cryptographic migration system provided by the embodiment of the application, comprising: a quantum threat risk assessment module 210, configured to acquire communication link operation data of the power system and perform quantum threat risk assessment on the communication link based on a hierarchical partition architecture feature of the power system; a migration risk matrix generation module 220, configured to acquire encryption component attribute data corresponding to various communication links and perform parallel migration risk analysis on the encryption component in combination with the quantum threat risk assessment result, and generate an anti-quantum migration risk matrix; a migration strategy construction module 230, configured to perform compatibility assessment on a traditional public key algorithm and an anti-quantum cryptographic algorithm based on an algorithm feature, and construct a dual-track encryption migration strategy in combination with the anti-quantum migration risk matrix; a hierarchical migration strategy construction module 240, configured to dynamically adjust a dual-track weight proportion based on performance differences of edge devices of the power system, and construct a dual-track encryption hierarchical migration strategy based on a control level to which a communication link belongs; a migration effect monitoring module 250, configured to execute the dual-track encryption hierarchical migration strategy and perform migration effect monitoring, and perform adaptive correction on the dual-track encryption hierarchical migration strategy based on the migration effect.

[0025] In the embodiment of the present application, the quantum threat risk assessment module 210 is configured to acquire communication link operation data of the power system and perform quantum threat risk assessment on the communication link based on a hierarchical partition architecture feature of the power system, including: dividing the communication link into a dispatching automation link, a relay protection communication link, a state monitoring link and a distributed terminal link, and respectively extracting link operation data of various communication links based on the communication link operation data; calculating quantum vulnerability indexes of various communication links based on a communication protocol type, a key length, a data update period and a node credibility in the link operation data, and quantifying potential cracking risks of the communication link under quantum computing attack conditions; calculating attack surface expansion coefficients of the link under cross-zone access and key node exposure conditions in combination with control levels and security domain boundaries of various communication links in the hierarchical partition architecture of the power system; constructing a quantum threat risk model of the communication link based on the quantum vulnerability indexes and the attack surface expansion coefficients, and performing adaptive update on the quantum threat risk model in combination with a quantum attack evolution trend; performing quantum threat level division on various communication links according to the updated quantum threat risk model, generating a communication link quantum threat classification graph of the power system, and providing a basis for subsequent encryption component migration risk analysis and dual-track encryption strategy construction.

[0026] In the embodiment of the present application, the migration risk matrix generation module 220 is configured to obtain the encryption component attribute data corresponding to various communication links and perform parallel migration risk analysis on the encryption components in combination with the quantum threat risk assessment results to generate an anti-quantum migration risk matrix, including: Obtaining the encryption component attribute data corresponding to various communication links, the encryption component attribute data including algorithm type, key management mode, hardware dependency feature, fault tolerance mechanism and protocol adaptation characteristic; Based on the encryption component attribute data, evaluating the component migration sensitivity and weighting the component migration sensitivity based on the quantum threat risk assessment results to obtain a migration sensitivity index, which is used to reflect the change trend of the exposure degree of the encryption component to quantum attack in the migration process; Analyzing the coordination relationship of different encryption components under the condition of parallel migration and constructing the dependency topology structure between the encryption components, quantifying the synchronization delay risk, key synchronization conflict probability and potential attack propagation path between the encryption components; Based on the migration sensitivity index and the dependency topology structure between the encryption components, determining the parallel migration risk coefficient between different encryption components, and evaluating the parallel migration risk caused by algorithm replacement, key rotation and protocol encapsulation update of the encryption components in the parallel migration process; Based on the parallel migration risk coefficient between the encryption components, generating an anti-quantum migration risk matrix, which is used to describe the risk intensity distribution, encryption component coupling degree and migration priority in the migration process.

[0027] In the embodiment of the present application, the migration strategy construction module 230 is configured to perform compatibility evaluation on the traditional public key algorithm and the anti-quantum cryptographic algorithm based on the algorithm characteristics, and construct a double-track encryption migration strategy in combination with the anti-quantum migration risk matrix, including: Obtaining the algorithm characteristic data of the traditional public key algorithm and the anti-quantum cryptographic algorithm and constructing an algorithm compatibility evaluation model, the algorithm characteristic data including key length, signature length, encryption rate, decryption rate and anti-quantum attack complexity; Based on the algorithm compatibility evaluation model, performing compatibility evaluation on each candidate anti-quantum cryptographic algorithm and the existing communication protocol encapsulation format, key exchange mechanism and authentication system of the power system; Based on the compatibility evaluation results and the anti-quantum migration risk matrix, constructing a double-track encryption coordination model, the double-track encryption coordination model including a traditional public key algorithm track and an anti-quantum cryptographic algorithm track; Based on the security performance index and the migration stability evaluation results output by the double-track encryption coordination model, generating a double-track encryption migration strategy.

[0028] In the embodiment of the present application, the hierarchical migration strategy construction module 240 is configured to dynamically adjust the double-track weight proportion based on the performance difference of the edge devices of the power system and construct a double-track encryption hierarchical migration strategy based on the control level to which the communication link belongs, including: obtain device operation data of the edge devices of the power system, and construct a device performance evaluation model based on the computing capability, storage capacity and communication load of the edge devices, so as to quantify the resource occupation rate and real-time response capability of each edge device when performing the dual-track encryption operation; calculate the encryption overhead difference between the traditional algorithm track and the quantum-resistant algorithm track, and determine the encryption weight initial proportion of each communication link in combination with the device performance evaluation result; construct a multi-objective optimization function with real-time performance, throughput and security level as constraint conditions based on the communication demand of the communication link, dynamically optimize the encryption weight initial proportion, and generate an adaptive dual-track weight proportion for different service scenarios; optimize the dual-track encryption migration strategy based on the adaptive dual-track weight proportion, generate a dual-track encryption hierarchical migration strategy, and map the dual-track encryption hierarchical migration strategy to the corresponding communication link and encryption component, so as to realize hierarchical and partitioned encryption migration deployment.

[0029] In the embodiment of the present application, the migration effect monitoring module 250 is configured to execute the dual-track encryption hierarchical migration strategy and monitor the migration effect, and adaptively correct the dual-track encryption hierarchical migration strategy based on the migration effect, including: obtain the key performance indicators of the communication link in the execution process of the dual-track encryption hierarchical migration strategy, and the key performance indicators include transmission delay, data throughput, data packet loss rate, encryption and decryption processing delay, and quantum security hash verification success rate; construct a migration effect evaluation model based on the key performance indicators, calculate a migration performance loss coefficient, and quantify the system performance overhead introduced by the quantum-resistant cryptographic algorithm; determine whether the migration performance loss coefficient exceeds a preset migration performance loss threshold of the corresponding communication link, and if the migration performance loss coefficient is greater than the preset migration performance loss threshold, trigger an encryption track rollback mechanism to roll back the communication link with abnormal performance to a working mode mainly using the traditional algorithm track; adaptively correct the algorithm parameter configuration, encryption weight proportion and algorithm track selection strategy in the dual-track encryption hierarchical migration strategy based on the migration performance loss coefficient and the quantum security hash verification success rate, generate and execute the corrected dual-track encryption hierarchical migration strategy.

[0030] The above steps of implementing the corresponding functions of each parameter and each unit module in the power system quantum-resistant cryptographic migration system of the present application can refer to the parameters and steps in the embodiments of the power system quantum-resistant cryptographic migration method described above, and will not be repeated here.

[0031] Please refer to Figure 3The embodiments of the present application also provide an electronic device, which comprises a processor, an internal bus, a network interface, an internal memory, a storage, and a program or instructions stored on the storage and executable on the processor, and the program or instructions are executed by the processor to implement any of the power system quantum-resistant migration methods according to the embodiments of the present application. The processor can be a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), a graphics processing unit (GPU), or one or more integrated circuits, which are used to execute related programs to implement any of the power system quantum-resistant migration methods according to the embodiments of the present application.

[0032] The processor can also be an integrated circuit electronic device with signal processing capability. In the implementation process, each step of any of the power system quantum-resistant migration methods according to the embodiments of the present application can be completed by integrated logic circuits of hardware in the processor or instructions in the form of software.

[0033] The processor can also be a general processor, a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or any conventional processor. The steps of the disclosed methods in the embodiments of the present application can be directly embodied as hardware code processing executed by the processor, or executed by a combination of hardware and software modules in the code processing. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the functions required by the units included in the data processing device according to the embodiments of the present application, or executes any of the power system quantum-resistant migration methods according to the embodiments of the present application.

[0034] The internal bus can include a path for transmitting information between the components. The internal bus can be a PCI (Peripheral Component Interconnect) bus, an EISA (Extended Industry Standard Architecture) bus, or the like. The internal bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, Figure 3 Only one double-headed arrow is used in the figure to represent only one bus or one type of bus.

[0035] The network interface is used to realize the data interaction between the electronic device and the external communication network, and the network interface can adopt an Ethernet interface, a fiber interface, and a wireless communication interface.

[0036] The internal memory can provide temporary data read / write space for the electronic device, and the internal memory can adopt a random access memory (RAM), a cache, or other storage structures with fast read / write capabilities. The internal memory exchanges data with the processor at high speed through the internal bus.

[0037] The storage is used for long-term storage of the operating system, computer programs, and databases of the electronic device, to ensure the integrity and reliability of the data in the case of power failure or restart. The operating system can be an embedded Linux, a real-time operating system (RTOS), or other software platforms capable of managing system resources and supporting secure communication protocols. The computer program is used to implement any one of the power system quantum-resistant password migration methods in the embodiments of the present application. The database is used to store the running data of the computer program.

[0038] The embodiment of the present application provides a computer readable storage medium, which stores a computer program capable of being loaded and executed by a processor to implement the power system quantum-resistant password migration method provided in the above embodiment.

[0039] In the embodiment of the present application, the computer readable storage medium can be a tangible device that maintains and stores instructions for use by an instruction execution device. The computer readable storage medium can be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination of the above. Specifically, the computer readable storage medium can be a portable computer disk, a hard disk, a U disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a platform random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, an optical disk, a magnetic disk, a mechanical coding device, and any combination of the above.

[0040] The terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0041] The description above only concerns preferred embodiments of the application and the explanation of the principles of the technology used. The skilled person will understand that the scope of the application is not limited to the technical solutions formed by the specific combinations of the technical features described above, but also covers other technical solutions formed by any combinations of the technical features described above or their equivalent features without departing from the concept of the application. For example, the technical solutions formed by the mutual replacement of the above-mentioned features and the technical features applied in the application (but not limited to) having similar functions.

Claims

1. A quantum-resistant cryptographic migration method for power systems, characterized in that, include: S100: Obtain the operation data of the communication links of the power system and conduct a quantum threat risk assessment of the communication links based on the hierarchical and partitioned architecture characteristics of the power system; S200: Obtain the attribute data of encryption components corresponding to various communication links and combine them with the quantum threat risk assessment results to perform parallel migration risk analysis on encryption components and generate a quantum migration risk matrix. S300: Based on algorithm characteristics, a compatibility assessment is conducted between traditional public-key algorithms and quantum-resistant cryptographic algorithms, and a dual-track encryption migration strategy is constructed by combining a quantum-resistant migration risk matrix. S400 dynamically adjusts the dual-track weight ratio based on the performance differences of power system edge devices and constructs a dual-track encrypted hierarchical migration strategy based on the control level to which the communication link belongs. S500 executes a dual-track encrypted layered migration strategy and monitors the migration effect, and adaptively adjusts the dual-track encrypted layered migration strategy based on the migration effect.

2. The quantum-resistant cryptographic migration method for power systems according to claim 1, characterized in that, The quantum threat risk assessment of communication links based on the hierarchical and partitioned defense architecture characteristics of the power system described in step S100 includes: S110. Divide the communication links into dispatch automation links, relay protection communication links, status monitoring links and distributed terminal links, and extract the link operation data of each type of communication link based on the communication link operation data; S120. Calculate the quantum vulnerability index of various communication links based on the communication protocol type, key length, data update cycle and node credibility in the link operation data, and quantify the potential cracking risk of communication links under quantum computing attack conditions. S130. Based on the control level and security domain boundary of various communication links in the hierarchical and partitioned architecture of the power system, calculate the attack surface expansion coefficient of the link under the conditions of cross-regional access and exposure of key nodes. S140. Construct a quantum threat risk model for communication links based on quantum vulnerability indices and attack surface expansion coefficients, and adaptively update the quantum threat risk model in conjunction with the evolution trend of quantum attacks. S150. Based on the updated quantum threat risk model, classify various communication links into quantum threat levels and generate a quantum threat classification map of communication links in the power system, providing a basis for subsequent risk analysis of encryption component migration and construction of dual-track encryption strategy.

3. The quantum-resistant cryptographic migration method for power systems according to claim 1, characterized in that, The generation of the quantum migration risk matrix in step S200 includes: S210. Obtain the encryption component attribute data corresponding to various communication links. The encryption component attribute data includes algorithm type, key management mode, hardware dependency characteristics, fault tolerance mechanism and protocol adaptation characteristics. S220. The migration sensitivity of the component is evaluated based on the attribute data of the encrypted component, and the migration sensitivity of the component is weighted based on the quantum threat risk assessment results to obtain a migration sensitivity index, which is used to reflect the changing trend of the degree of exposure of the encrypted component to quantum attacks during the migration process. S230. Analyze the collaborative relationship between different encryption components under parallel migration conditions and construct the dependency topology between encryption components. Quantify the synchronization delay risk, key synchronization conflict probability and potential attack propagation path between encryption components. S240. Based on the migration sensitivity index and the dependency topology between encryption components, determine the parallel migration risk coefficient between different encryption components, and assess the parallel migration risk caused by algorithm replacement, key rotation and protocol encapsulation update during the parallel migration process of encryption components. S250. Generate a quantum-resistant migration risk matrix based on the parallel migration risk coefficient between cryptographic components, which is used to describe the risk intensity distribution, cryptographic component coupling degree, and migration priority during the migration process.

4. The quantum-resistant cryptographic migration method for power systems according to claim 1, characterized in that, The construction of the dual-track encrypted migration strategy in step S300 includes: S310. Obtain the algorithm feature data of traditional public key algorithms and quantum-resistant cryptographic algorithms and construct an algorithm compatibility evaluation model. The algorithm feature data includes key length, signature length, encryption rate, decryption rate and quantum attack resistance complexity. S320. Based on the algorithm compatibility evaluation model, the compatibility of each candidate quantum-resistant cryptographic algorithm with the existing communication protocol encapsulation format, key exchange mechanism and authentication system of the power system is evaluated. S330. Based on the compatibility assessment results and the quantum migration risk matrix, a dual-track encryption collaborative model is constructed. The dual-track encryption collaborative model includes a traditional public key algorithm track and a quantum-resistant cryptographic algorithm track. S340. Generate a dual-track encrypted migration strategy based on the security performance indicators and migration stability evaluation results output by the dual-track encrypted collaborative model.

5. The quantum-resistant cryptographic migration method for power systems according to claim 1, characterized in that, The specific steps of S400 include: S410. Obtain the equipment operation data of the power system edge devices and build an equipment performance evaluation model based on the computing power, storage capacity and communication load of the edge devices, and quantify the resource occupancy rate and real-time response capability of each edge device when performing dual-track encryption operation. S420. Calculate the difference in encryption overhead between the conventional algorithm track and the quantum-resistant algorithm track, and determine the initial encryption weight ratio for various communication links based on the equipment performance evaluation results. S430. Based on the communication requirements of the communication link, a multi-objective optimization function is constructed with real-time performance, throughput and security level as constraints. The initial ratio of encryption weight is dynamically optimized to generate an adaptive dual-track weight ratio for different business scenarios. S440: Optimize the dual-track encryption migration strategy based on the adaptive dual-track weight ratio, generate a dual-track encryption hierarchical migration strategy and map it to the corresponding communication link and encryption component to realize hierarchical partitioned encryption migration deployment.

6. The quantum-resistant cryptographic migration method for power systems according to claim 1, characterized in that, The specific steps of S500 include: S510. Obtain key performance indicators of the communication link during the execution of the dual-track encryption layered migration strategy. Key performance indicators include transmission delay, data throughput, packet loss rate, encryption / decryption processing latency, and quantum-safe hash verification success rate. S520. Construct a migration effect evaluation model based on key performance indicators, calculate the migration performance loss coefficient, and quantify the system performance overhead introduced by quantum-resistant cryptographic algorithms. S530. Determine whether the migration performance loss coefficient exceeds the preset migration performance loss threshold of the corresponding communication link. If the migration performance loss coefficient is greater than the preset migration performance loss threshold, trigger the encryption track rollback mechanism to roll back the communication link with abnormal performance to the working mode based on the traditional algorithm track. S540 adaptively modifies the algorithm parameter configuration, encryption weight ratio, and algorithm track selection strategy in the dual-track encryption layered migration strategy based on the migration performance loss coefficient and the quantum-safe hash verification success rate, and generates and executes the modified dual-track encryption layered migration strategy.

7. A quantum-resistant cryptographic transfer system for power systems, used to implement the quantum-resistant cryptographic transfer method for power systems as described in any one of claims 1-6, characterized in that, The system includes: The quantum threat risk assessment module is used to acquire operational data of communication links in the power system and conduct quantum threat risk assessments of the communication links based on the hierarchical and partitioned architecture characteristics of the power system. The migration risk matrix generation module is used to obtain the attribute data of encryption components corresponding to various communication links and combine the quantum threat risk assessment results to perform parallel migration risk analysis of encryption components and generate a quantum-resistant migration risk matrix. The migration strategy construction module is used to evaluate the compatibility of traditional public-key algorithms and quantum-resistant cryptographic algorithms based on algorithm characteristics, and to construct a dual-track encryption migration strategy in combination with the quantum-resistant migration risk matrix. The hierarchical migration strategy construction module is used to dynamically adjust the dual-track weight ratio based on the performance differences of power system edge devices and to construct a dual-track encrypted hierarchical migration strategy based on the control level to which the communication link belongs. The migration effect monitoring module is used to execute the dual-track encrypted layered migration strategy and monitor the migration effect, and adaptively adjust the dual-track encrypted layered migration strategy based on the migration effect.

8. An electronic device, comprising: A processor and a memory, wherein the memory stores a computer program that can be called by the processor; characterized in that the processor executes the quantum-resistant cryptographic migration method for power systems as described in any one of claims 1-6 by calling the computer program stored in the memory.

9. A computer-readable storage medium, characterized in that, The system stores instructions that, when executed on a computer, cause the computer to perform the quantum-resistant cryptographic migration method for power systems as described in any one of claims 1-6.

Images