Method and system for encrypted storage of power data
By performing dynamic time-series feature sequence grouping and asymmetric encryption on power data, generating session keys and associating and encapsulating them, the security weakness of power data encryption storage schemes is solved, achieving fine-grained encryption isolation and high-security storage.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- STATE GRID ZHEJIANG ELECTRIC POWER CO LTD HANGZHOU POWER SUPPLY CO
- Filing Date
- 2026-05-21
- Publication Date
- 2026-06-23
AI Technical Summary
Existing power data encryption and storage solutions are weak in security and are prone to large-scale exposure of user privacy and leakage of critical operational information due to key leaks. They are unable to meet the high standards of data security, compliance and fine-grained access control required by new power systems.
By acquiring the data to be encrypted from the power system, a session key is generated based on dynamic time-series feature sequence grouping and processing. The session key is then encrypted a second time using an asymmetric encryption algorithm. Combined with initialization vector and associated encapsulation technology, fine-grained encryption isolation and dual-layer key protection are achieved.
It achieves secure and stable storage of power data, improves forward confidentiality, anti-attack capabilities and compliance security level, limits the impact of key leakage, and supports fine-grained access control.
Smart Images
Figure CN122268674A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of power system information security technology, and in particular to a method and system for encrypting and storing power data. Background Technology
[0002] With the widespread application of smart meters, distribution automation terminals, and electricity information collection systems, the highly sensitive time-series data continuously generated by the power system not only involves user privacy but may also be used to infer industrial production rhythms, critical infrastructure operation status, and even support cyberattacks. Therefore, the security of power data storage has risen to the level of energy security and data compliance, and urgently requires high-strength encryption protection.
[0003] In existing technologies, the collected power data is encrypted once and stored using a single static key. However, this method has weak security. If the key is leaked due to compromised power system terminal equipment, internal system leaks, or a compromised cryptographic algorithm, attackers can decrypt all historical and future encrypted data, resulting in large-scale exposure of user privacy and leakage of critical operational information. This makes it difficult to meet the high standards of data security, compliance, and fine-grained access control required by modern power systems. Summary of the Invention
[0004] This invention provides a method and system for encrypted storage of power data to solve the technical problem of weak security in existing encryption algorithms, so as to achieve the effect of secure and stable encrypted storage of power data.
[0005] To address the aforementioned technical problems, this invention provides, in one aspect, a method for encrypted storage of power data, comprising: Obtain the power data to be encrypted from the target power system; Based on the historical operating status data of the target power system, determine the dynamic time-series characteristic sequence; Using the dynamic time-series feature sequence as a standard, the power data to be encrypted is grouped to obtain each group of power data to be encrypted. Based on the analysis results of the historical operation status data, the session key for each group of data to be encrypted is determined; Based on each session key, each corresponding data group to be encrypted is encrypted to obtain ciphertext data. The ciphertext encryption process is configured to encrypt each data group to be encrypted based on an initialization vector, which is determined by the dynamic temporal feature sequence and the feature information of each data group to be encrypted. Based on the master key in the asymmetric encryption algorithm, all the session keys are encrypted separately to obtain the encrypted session key; All the ciphertext data and the encrypted session key are associated and encapsulated, and the association and encapsulation result is stored in a secure database.
[0006] As one preferred embodiment, determining the dynamic time-series characteristic sequence based on the historical operating status data of the target power system includes: The historical operating status data of the target power system is subjected to feature extraction processing to obtain operating condition feature data; Based on the timestamp, the operating condition feature data is time-series aligned to obtain the feature data to be aggregated; The feature data to be aggregated is subjected to sliding window aggregation processing to obtain the dynamic time-series feature sequence.
[0007] As one preferred embodiment, determining the session key for each group of data to be encrypted based on the analysis results of the historical operating status data includes: The historical operating status data is analyzed to obtain semantic tags for each operating condition; Input the semantic labels of each of the aforementioned operating conditions into the key derivation function to obtain the key derivation parameters; Based on the key derivation parameters, each group of data to be encrypted is processed to obtain the corresponding session key.
[0008] As one preferred embodiment, the step of encrypting each corresponding group of data to be encrypted based on each session key to obtain ciphertext data includes: Local feature extraction is performed on the current data group to be encrypted to obtain the feature information; The initialization vector is obtained by combining and transforming the time-series feature information corresponding to the current data group to be encrypted in the dynamic time-series feature sequence and the feature information; Based on the session key and the initialization vector corresponding to the current data group to be encrypted, the ciphertext encryption process is performed on the data group to be encrypted to obtain the ciphertext data.
[0009] As one preferred embodiment, the step of encrypting all the session keys based on the master key in the asymmetric encryption algorithm to obtain encrypted session keys includes: The validity of the master key in the asymmetric encryption algorithm is verified to obtain a valid key; Based on the valid key, the key encryption process is performed on all the session keys respectively to obtain the encrypted representation result corresponding to each session key; All the encrypted representations are processed in a structured manner to obtain the encrypted session key.
[0010] Another aspect of the present invention provides an encrypted storage system for power data, comprising: The data acquisition module is used to acquire the power data to be encrypted from the target power system. The feature sequence determination module is used to determine the dynamic time-series feature sequence based on the historical operating status data of the target power system; The data grouping module is used to group the power data to be encrypted using the dynamic time-series feature sequence as a standard, so as to obtain each data group to be encrypted of the power data to be encrypted. The session key determination module is used to determine the session key for each group of data to be encrypted based on the analysis results of the historical operation status data. The ciphertext encryption processing module is used to perform ciphertext encryption processing on each corresponding data group to be encrypted based on each session key to obtain ciphertext data. The ciphertext encryption processing is configured to encrypt each data group to be encrypted based on an initialization vector, wherein the initialization vector is determined by the dynamic temporal feature sequence and the feature information of each data group to be encrypted. The key encryption processing module is used to perform key encryption processing on all the session keys based on the master key in the asymmetric encryption algorithm to obtain encrypted session keys; The association encapsulation module is used to associate and encapsulate all the ciphertext data and the encrypted session key, and store the association and encapsulation results in a secure database.
[0011] As one preferred embodiment, the feature sequence determination module includes: The feature extraction unit is used to perform feature extraction processing on the historical operating status data of the target power system to obtain operating condition feature data. The time alignment unit is used to perform time alignment processing on the operating condition feature data based on the timestamp to obtain the feature data to be aggregated; An aggregation processing unit is used to perform sliding window aggregation processing on the feature data to be aggregated to obtain the dynamic time-series feature sequence.
[0012] As one preferred embodiment, the session key determination module includes: The data analysis unit is used to analyze the historical operating status data to obtain semantic tags for each operating condition; The key derivation parameter determination unit is used to input the semantic labels of each of the operating conditions into the key derivation function to obtain the key derivation parameters; A session key unit is determined, which is used to process each of the data groups to be encrypted based on the key derivation parameters to obtain the corresponding session key.
[0013] As one preferred embodiment, the ciphertext encryption processing module includes: A local feature extraction unit is used to extract local features from the current data group to be encrypted to obtain the feature information; The combination transformation processing unit is used to perform combination transformation processing on the time-series feature information corresponding to the current data group to be encrypted in the dynamic time-series feature sequence and the feature information to obtain the initialization vector; The ciphertext encryption processing unit is used to perform the ciphertext encryption processing on the data group to be encrypted based on the session key and the initialization vector corresponding to the current data group to be encrypted, so as to obtain the ciphertext data.
[0014] As one preferred embodiment, the key encryption processing module includes: The validity verification unit is used to verify the validity of the master key in the asymmetric encryption algorithm to obtain a valid key. A key encryption processing unit is configured to perform key encryption processing on all the session keys based on the valid key, so as to obtain the encryption representation result corresponding to each session key; The structuring processing unit is used to perform structuring processing on all the encrypted representation results to obtain the encrypted session key.
[0015] Compared to existing technologies, the beneficial effects of the embodiments of the present invention are at least one of the following: The present invention achieves fine-grained encryption isolation by performing grouping processing on the power data to be encrypted based on dynamic time-series feature sequences and generating a session key for each data group to be encrypted, thus solving the security risk of full data exposure due to single-point leakage caused by traditional static keys; The present invention enhances the randomness and uniqueness of ciphertext data by introducing an initialization vector; The present invention constructs a two-layer key protection mechanism by using the master key in an asymmetric encryption algorithm to perform secondary encryption on each session key, thus solving the problem that session keys are easily stolen during storage or transmission; The present invention ensures the consistency of data and key binding by associating and encapsulating ciphertext data with the corresponding encrypted session key and storing it uniformly in a secure database, thereby improving the forward confidentiality, anti-attack capability, and compliance security level of power data in the storage stage. Attached Figure Description
[0016] Figure 1 This is a flowchart illustrating an encrypted storage method for power data in one embodiment of the present invention; Figure 2This is a schematic diagram of the structure of an encrypted storage system for power data in one embodiment of the present invention; Figure label: Among them, 11. Data acquisition module; 12. Feature sequence determination module; 13. Data grouping module; 14. Session key determination module; 15. Ciphertext encryption processing module; 16. Key encryption processing module; 17. Association encapsulation module. Detailed Implementation
[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.
[0018] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.
[0019] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. The terms "vertical," "horizontal," "left," "right," "upper," "lower," and similar expressions used herein are for illustrative purposes only and do not indicate or imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.
[0020] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.
[0021] With the deepening of the construction of new power systems, intelligent sensing devices such as smart meters, distribution automation terminals, electricity consumption information collection systems, and wide-area measurement systems are being deployed on a large scale in the power grid. The power system is continuously generating massive amounts of highly sensitive time-series data with unprecedented frequency and precision. This data not only contains basic information such as user electricity load curves and voltage and current fluctuations, but also implies deeper semantics such as production shifts of industrial enterprises, equipment start-up and shutdown patterns, and regional economic activity. It can even be used to infer the operational status and vulnerability of critical infrastructure. Therefore, the security of power data storage has risen to the level of energy security and data compliance, urgently requiring high-strength encryption protection.
[0022] However, the data encryption and storage schemes commonly used in current power systems still have significant security vulnerabilities. The mainstream approach typically relies on a globally unified static symmetric key, distributed by a central key management system (KMS) to each data acquisition or edge storage node. All collected raw power data is encrypted once and then stored in the cloud or local database. While this method is simple to implement, it suffers from serious security flaws: if the key is leaked, all historical and future data can be decrypted in bulk; furthermore, this scheme lacks security support for dynamic data updates and encrypted retrieval, failing to meet forward and backward privacy requirements; its access control mechanism is crude and its policies are exposed in plaintext, making them easily reverse-engineered and unable to support cross-domain collaborative analysis; moreover, the lack of encrypted integrity and verifiability makes the data susceptible to undetected tampering.
[0023] One embodiment of the present invention provides a method for encrypted storage of power data. For details, please refer to [link to relevant documentation]. Figure 1 , Figure 1 The diagram shown illustrates a flowchart of an encrypted storage method for power data according to one embodiment of the present invention. The method includes steps S1 to S7: S1. Obtain the power data to be encrypted from the target power system; S2. Determine the dynamic time-series characteristic sequence based on the historical operating status data of the target power system; S3. Using the dynamic time-series feature sequence as a standard, the power data to be encrypted is grouped to obtain each data group to be encrypted. S4. Based on the analysis results of the historical operating status data, determine the session key for each group of data to be encrypted; S5. Based on each session key, perform ciphertext encryption processing on each corresponding data group to be encrypted to obtain ciphertext data. The ciphertext encryption process is configured to perform encryption processing on each data group to be encrypted based on an initialization vector. The initialization vector is determined by the dynamic time-series feature sequence and the feature information of each data group to be encrypted. S6. Based on the master key in the asymmetric encryption algorithm, perform key encryption processing on all the session keys respectively to obtain the encrypted session key; S7. Perform association and encapsulation processing on all the ciphertext data and the encryption session key, and store the association and encapsulation processing result in a secure database.
[0024] Furthermore, in step S1, raw data with business value and high sensitivity is collected from the actual operating environment of the power system. This provides input for subsequent dynamic key generation based on operating status and the implementation of fine-grained encryption and access control. Specifically, the power data to be encrypted originates from heterogeneous devices such as smart meters, distribution automation terminals, electricity information collection systems, and wide-area measurement devices. It covers multiple fields including timestamps, device identifiers, geographical location tags, business types, and data payloads. It includes both continuous voltage and current value sequences and event-type text records such as fault alarms or operation logs. The data owner aggregates this raw data to the local preprocessing node through a secure communication channel. During this process, the confidentiality and integrity of the transmission link are ensured to prevent data from being eavesdropped on or tampered with during the collection stage. The reason why it is necessary to clearly obtain and define the objects to be encrypted is that different data have significantly different sensitivity levels and usage scenarios in the power grid. For example, residential user load curves involve personal privacy, while substation switch status is related to the security of critical infrastructure. If they are not distinguished and are processed uniformly, it will lead to a waste of security resources or insufficient protection. By acquiring the power data to be encrypted in a structured manner, the system can accurately identify the time attributes, source attribution, and business semantics of each data point, thereby providing precise contextual support for subsequent steps such as combining historical operating status analysis to generate dynamic time-series feature sequences, dividing time windows, extracting high-confidence keywords, and deriving session keys.
[0025] In this system, the data owner is the controller of the raw power data, responsible for securely submitting the data to be encrypted to the local encrypted storage system, and is the data initiator of the entire encrypted storage process. The data owner aggregates the collected raw power data to the local preprocessing node through a dedicated secure communication channel, ensuring the confidentiality and integrity of the transmission link during this process to prevent eavesdropping or tampering during data collection. The power data of different data owners exhibit significant differences in sensitivity levels, security protection requirements, and access control rules. For example, grid-side fault data is critical infrastructure data and requires the highest level of encryption; residential electricity consumption data is personal privacy data and must meet privacy protection requirements; enterprise electricity consumption data is commercial data and cross-domain access must be restricted. After clearly defining the data owner, the encrypted storage system of this invention can adaptively adjust the encryption strategy according to the needs of different data owners, avoiding insufficient security protection or resource waste due to ambiguous data ownership, while also complying with relevant data compliance requirements in the power industry.
[0026] This step, on the one hand, enables clear sorting and classification management of data assets, allowing encryption strategies to be adaptively adjusted according to data content; on the other hand, it lays the foundation for a strong binding between time windows and access policies, ensuring that only authorized users with specific roles, located in designated areas, performing compliant tasks, and within the valid time interval can decrypt data within the corresponding window.
[0027] Furthermore, in step S2, determining the dynamic time-series feature sequence based on the historical operating status data of the target power system is a crucial preliminary step for realizing semantic-aware encryption and fine-grained access control of power data. Its core objective is to extract high-order semantic features from massive historical operating data that characterize the evolution of the power grid's operating status at different times, thereby providing contextual semantic basis for the dynamic derivation of subsequent session keys and data grouping.
[0028] Specifically, the historical operational status data is first cleaned and standardized. A temporal attention denoising network is used to distinguish between random noise and valid mutations, and the isolated forest algorithm is combined to identify and remove extreme anomalies such as sensor failures, outputting a high-quality numerical sequence. Then, for textual fields, a pre-trained BERT model in the power industry is used to extract professional terminology, while for numerical fields, the K-means algorithm is used to dynamically divide numerical intervals to generate operational condition feature data based on power business rules. On this basis, the original timestamps attached to each operational condition feature data are mapped to a preset standardized time granularity grid, which can be flexibly configured to the second, minute, or hour level according to business needs. For data with missing time points, a linear interpolation prediction completion strategy is used to fill in the missing data, ensuring that all feature dimensions have valid values at each time scale. For cases where there are multiple sampled values at the same time point, a weighted average is used to fuse them, ultimately outputting a continuous, synchronous, and structurally aligned feature data sequence with aggregation on the time axis. Subsequently, the system performs sliding window aggregation processing on the data sequence with aggregated features. This involves defining a fixed-length time window that slides gradually along the time axis. Within each window position, statistically significant aggregated indicators are calculated for each feature dimension, including mean, standard deviation, maximum value, minimum value, rate of change, and number of mutations. These indicators can effectively characterize the stability, fluctuation intensity, and abnormal activity of the power grid operation during that time period. The set of aggregated indicators corresponding to each window is organized into a high-dimensional feature vector. The feature vectors generated by all windows are arranged in chronological order, thus forming a complete dynamic time-series feature sequence.
[0029] Among them, the pre-trained BERT model in the power field is a core model for extracting professional semantic features from text-based operational status data of power systems, such as fault alarms, equipment operation logs, and operating condition description texts. Its basic architecture is a general BERT model, which is a bidirectional Transformer encoder architecture. At the input layer, the original text in the power field is transformed into a numerical vector that the model can recognize, and a power professional vocabulary and operating condition semantic labels are added. At the Transformer encoding layer, bidirectional contextual semantic features are extracted from the input vector, and a power system semantic self-attention mask is added. Higher attention weights are set for core operating condition keywords in the power text (such as "fault", "over-limit", "peak"), so that the model prioritizes extracting semantic features that are strongly related to the operating conditions of the power grid. At the output layer, the operating condition feature data of the power text is extracted.
[0030] Operating condition feature data is a structured feature set obtained by extracting, cleaning, and standardizing multi-dimensional features from historical power system operating status data. It is core data that accurately characterizes the operating status, operating condition type, and operating characteristics of the power grid at different time points / periods, and also serves as the foundational input data for subsequent time-series alignment and sliding window aggregation to generate dynamic time-series feature sequences. Operating condition feature data consists of two parts: numerical operating condition features and textual operating condition features. These correspond to numerical monitoring data and textual descriptive data in the historical power system operating status data, respectively. Numerical monitoring data includes voltage, current, and load, while textual descriptive data includes operating condition and fault descriptions.
[0031] Furthermore, in step S3, the dynamic time-series feature sequence is used as a standard for grouping the power data to be encrypted. This is to achieve deep coupling between power data encryption and the actual operating state of the power grid, enabling the security strategy to adaptively adjust with system operating conditions. The sensitivity and business value of power data vary significantly in different operating periods. If coarse-grained grouping is performed using a fixed time window or device source, it cannot reflect the actual changes in security requirements.
[0032] Specifically, the process first parses the semantic labels of the operating conditions corresponding to each time window in the dynamic time-series feature sequence, such as normal steady state, peak load, voltage over-limit, or fault recovery, and extracts the aggregated feature vectors generated within that window. Then, based on the timestamps carried by the power data to be encrypted, it is precisely mapped to the corresponding time window in the dynamic time-series feature sequence. All power data falling into the same window are grouped into a logical unit, forming a data group to be encrypted. Data within this group shares the same operating context, security level, and access control requirements. This achieves alignment between encryption granularity and business semantics, enabling subsequently derived session keys to accurately reflect the operational risks of that period, such as generating stronger keys during fault handling. Furthermore, because each data group is strictly bound to a specific time window and its implicit multi-dimensional attribute strategy, even if an attacker obtains the key for one group, they cannot decrypt data in other operating states, effectively limiting the scope of key leakage.
[0033] Because traditional static key schemes would result in the loss of all data if leaked, and the data security requirements of power systems vary significantly under different operating conditions—for example, data sensitivity during peak load periods or fault recovery phases is much higher than during stable operation periods—using a unified key for encryption would neither reflect the differences in security levels nor meet the compliance requirements for enhanced protection of critical data. Therefore, determining the session key for each data group to be encrypted based on the analysis of historical operating data is the core step in achieving dynamic encryption and adaptive risk protection of power data.
[0034] Specifically, in step S4, historical operating status data is first analyzed to obtain semantic tags for each operating condition. Then, each operating condition semantic tag, along with its corresponding timestamp identifier and the system-preset master key, is input into the key derivation function. This function uses a hash function to irreversibly map the input information, generating a fixed-length key derivation parameter with high entropy. This parameter ensures that even if the semantic tags of two time windows are similar, any difference will result in completely different output derivation parameters, thus eliminating key predictability. Next, based on this key derivation parameter, the system performs a deterministic key generation operation for each data group to be encrypted. By calling the hash function again, a session key dedicated to that data group is output. This session key is only valid within its corresponding time window. Session keys corresponding to data groups in different operating states or time periods are independent and unrelated, and cannot be mathematically derived to reconstruct each other, nor can they be reused across windows. This mechanism not only achieves precise binding between the key and the actual operational semantics of the power grid, but also fundamentally limits the scope of security impact caused by the leakage of a single key, providing a solid and flexible key foundation for subsequent implementation of fine-grained access control, security index construction, and cross-domain policy mapping.
[0035] Key derivation functions are specialized algorithms in cryptography. Their core function is to generate fixed-length, high-entropy, pseudo-random binary parameters from one or more input sources through one-way, irreversible cryptographic operations. Key derivation functions transform low-entropy textual operational information such as status labels and timestamps into high-entropy binary parameters, satisfying the randomness requirement of the encryption key and ensuring that attackers cannot deduce the original operational information and system master key from the output key derivation parameters, thus enhancing security.
[0036] While the key derivation parameters are not the final session keys, they are crucial for achieving dynamic, fine-grained, and highly secure session keys. Generated from operating condition semantic tags, their pseudo-randomness is entirely determined by the operating condition information, realizing the core logic that "different operating conditions result in different derivation parameters, and consequently, different session keys," thus deeply coupling encryption with the power grid's operating status. Furthermore, each data group to be encrypted corresponds to a unique key derivation parameter. Even if two data groups have similar operating condition information, minor differences will generate completely different derivation parameters through the avalanche effect of the key derivation function, ensuring that session keys are independent and limiting the impact of key leakage.
[0037] To ensure the security and privacy of power data in a cloud storage environment, while also meeting the requirements for dynamic updates and cross-domain access, it is crucial to adopt a method based on the session key combined with an initialization vector when encrypting each data group to be encrypted. Specifically, in step S5, the encryption operation is first performed on each data group to be encrypted based on the session key obtained through the key derivation function in the previous steps. The Authentication Encryption with Associated Data (AEAD) algorithm is used here, which not only provides confidentiality guarantees for the data but also verifies the authenticity and integrity of the data, effectively preventing tampering.
[0038] In the implementation process, it is crucial to determine a unique initialization vector for each data set to be encrypted. This initialization vector is not randomly generated, but is jointly determined by a dynamic temporal feature sequence and feature information extracted from the data set. The dynamic temporal feature sequence includes information such as timestamps and equipment operating status, reflecting the background environment in which the data was generated; while the feature information of the data set itself may include load levels, voltage levels, fault types, etc., which are directly related to the specific content and value of the data. By combining these two parts of information to construct the initialization vector, it can be ensured that even for the same original data, the ciphertext generated after encryption at different times or under different environments will be completely different. This is because any tiny change will lead to a different initialization vector, thus making the final ciphertext result highly unpredictable and unique.
[0039] Although session keys are generated temporarily and have a limited scope, they can still be intercepted by attackers if stored or transmitted in plaintext, leading to the mass decryption of the corresponding data groups' ciphertext. Therefore, encrypting all session keys separately using the master key in an asymmetric encryption algorithm is to achieve secure distribution, storage, and controlled decryption of session keys, thereby constructing a secure isolation mechanism at the key management level in a hybrid encryption system.
[0040] Specifically, in step S6, the validity of the master key in the asymmetric encryption algorithm is first verified to ensure that the public key used is authentic, trustworthy, and in a secure and usable state. Preferably, this verification process includes checking whether the digital certificate attached to the master key is installed within the power system, confirming that the certificate is currently valid, and verifying that it has not been revoked or blacklisted through an online certificate status protocol or certificate revocation list; simultaneously, comparing the fingerprint information of the master key with the security record pre-registered in the key management center to prevent attacks or key replacement. Subsequently, based on the valid key, key encryption processing is performed on all session keys respectively. Each session key is used as an independent plaintext input, calling the asymmetric encryption algorithm to generate a one-to-one corresponding encrypted representation result. This process ensures that even if multiple session keys have similar or identical content, their encryption outputs will be different due to the randomness of the algorithm, thereby avoiding the leakage of ciphertext patterns. Next, all encrypted representation results are structured, logically associating and formatting each encrypted representation result with the unique identifier of its corresponding data group to be encrypted, the corresponding time window number, the encryption timestamp, and the hash fingerprint of the master key used, forming a structured data unit with complete context information. This unit is encoded using a standardized data model, supports efficient parsing and security auditing, and ultimately serves as the official encrypted session key.
[0041] The encrypted data itself only provides confidentiality protection, while the encryption session key is the sole credential for decryption. If the two are stored separately or lack a clear binding relationship, the data cannot be accurately restored by legitimate users, or the correspondence between the key and the data will be difficult to determine in the event of an attack, thus compromising the integrity of the entire security system. Therefore, associating and encapsulating all encrypted data and the encryption session key, and storing the processing results in a secure database, is to achieve secure, orderly, traceable, and controlled access to power data in a cloud environment.
[0042] Specifically, in step S7, a unique logical identifier is first generated for each group of data to be encrypted. This identifier includes a time window number, device source code, and service type label. Then, using this identifier as a key, the corresponding ciphertext data block is structurally integrated with its encryption session key to form a composite storage unit containing ciphertext payload, encryption session key, data metadata, and integrity verification label. This unit is serialized using a unified data format to ensure correct parsing even in cross-platform environments. Finally, this composite storage unit is uploaded and persistently stored in a secure database with access control, log auditing, and anti-tampering capabilities via a secure communication channel. The database is indexed by time window or regional attributes to support efficient retrieval. This step achieves a strong binding between ciphertext and decryption credentials, ensuring that only authorized users who simultaneously obtain both and meet access policies can complete end-to-end decryption, effectively preventing key mismatch or data confusion. Furthermore, since each storage unit carries complete context information, the system can support ciphertext filtering and cross-domain policy matching based on time, region, or service type without decryption, improving the availability of encrypted data.
[0043] Another embodiment of the present invention provides an encrypted storage system for power data. For details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 The diagram shown illustrates the structure of an encrypted storage system for power data according to one embodiment of the present invention. The system includes: Data acquisition module 11 is used to acquire the power data to be encrypted from the target power system; The feature sequence determination module 12 is used to determine a dynamic time-series feature sequence based on the historical operating status data of the target power system. Data grouping module 13 is used to group the power data to be encrypted using the dynamic time-series feature sequence as a standard to obtain each data group to be encrypted of the power data to be encrypted. The session key determination module 14 is used to determine the session key for each group of data to be encrypted based on the analysis results of the historical operating status data. The ciphertext encryption processing module 15 is used to perform ciphertext encryption processing on each corresponding data group to be encrypted based on each session key to obtain ciphertext data. The ciphertext encryption processing is configured to encrypt each data group to be encrypted based on an initialization vector, wherein the initialization vector is determined by the dynamic temporal feature sequence and the feature information of each data group to be encrypted. The key encryption processing module 16 is used to perform key encryption processing on all the session keys based on the master key in the asymmetric encryption algorithm to obtain encrypted session keys. The association encapsulation module 17 is used to perform association encapsulation processing on all the ciphertext data and the encrypted session key, and store the association encapsulation processing result in a secure database.
[0044] Furthermore, in the above embodiments, the feature sequence determination module includes: The feature extraction unit is used to perform feature extraction processing on the historical operating status data of the target power system to obtain operating condition feature data. The time alignment unit is used to perform time alignment processing on the operating condition feature data based on the timestamp to obtain the feature data to be aggregated; An aggregation processing unit is used to perform sliding window aggregation processing on the feature data to be aggregated to obtain the dynamic time-series feature sequence.
[0045] Furthermore, in the above embodiments, the session key determination module includes: The data analysis unit is used to analyze the historical operating status data to obtain semantic tags for each operating condition; The key derivation parameter determination unit is used to input the semantic labels of each of the operating conditions into the key derivation function to obtain the key derivation parameters; A session key unit is determined, which is used to process each of the data groups to be encrypted based on the key derivation parameters to obtain the corresponding session key.
[0046] Furthermore, in the above embodiments, the ciphertext encryption processing module includes: A local feature extraction unit is used to extract local features from the current data group to be encrypted to obtain the feature information; The combination transformation processing unit is used to perform combination transformation processing on the time-series feature information corresponding to the current data group to be encrypted in the dynamic time-series feature sequence and the feature information to obtain the initialization vector; The ciphertext encryption processing unit is used to perform the ciphertext encryption processing on the data group to be encrypted based on the session key and the initialization vector corresponding to the current data group to be encrypted, so as to obtain the ciphertext data.
[0047] Furthermore, in the above embodiments, the key encryption processing module includes: The validity verification unit is used to verify the validity of the master key in the asymmetric encryption algorithm to obtain a valid key. A key encryption processing unit is configured to perform key encryption processing on all the session keys based on the valid key, so as to obtain the encryption representation result corresponding to each session key; The structuring processing unit is used to perform structuring processing on all the encrypted representation results to obtain the encrypted session key.
[0048] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: (1) This invention achieves fine-grained encryption isolation by performing grouping processing on the power data to be encrypted based on dynamic time-series feature sequences and generating a session key for each data group to be encrypted, thus solving the security risk of the entire data being fully exposed due to a single point of leakage caused by traditional static keys. (2) By introducing an initialization vector, the present invention enhances the randomness and uniqueness of the encrypted data; by using the master key in the asymmetric encryption algorithm to perform secondary encryption on each session key, this application constructs a two-layer key protection mechanism, which solves the problem that session keys are easily stolen during storage or transmission. (3) This invention ensures the consistency of data and key binding by associating and encapsulating ciphertext data with the corresponding encrypted session key and storing it in a secure database, thereby improving the forward confidentiality, anti-attack capability and compliance security level of power data in the storage process.
[0049] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.
Claims
1. A method for encrypted storage of power data, characterized in that, include: Obtain the power data to be encrypted from the target power system; Based on the historical operating status data of the target power system, determine the dynamic time-series characteristic sequence; Using the dynamic time-series feature sequence as a standard, the power data to be encrypted is grouped to obtain each group of power data to be encrypted. Based on the analysis results of the historical operation status data, the session key for each group of data to be encrypted is determined; Based on each session key, each corresponding data group to be encrypted is encrypted to obtain ciphertext data. The ciphertext encryption process is configured to encrypt each data group to be encrypted based on an initialization vector, which is determined by the dynamic temporal feature sequence and the feature information of each data group to be encrypted. Based on the master key in the asymmetric encryption algorithm, all the session keys are encrypted separately to obtain the encrypted session key; All the ciphertext data and the encrypted session key are associated and encapsulated, and the association and encapsulation result is stored in a secure database.
2. The method for encrypting and storing power data as described in claim 1, characterized in that, The step of determining the dynamic time-series characteristic sequence based on the historical operating status data of the target power system includes: The historical operating status data of the target power system is subjected to feature extraction processing to obtain operating condition feature data; Based on the timestamp, the operating condition feature data is time-series aligned to obtain the feature data to be aggregated; The feature data to be aggregated is subjected to sliding window aggregation processing to obtain the dynamic time-series feature sequence.
3. The method for encrypting and storing power data as described in claim 1, characterized in that, The step of determining the session key for each group of data to be encrypted based on the analysis results of the historical operating status data includes: The historical operating status data is analyzed to obtain semantic tags for each operating condition; Input the semantic labels of each of the aforementioned operating conditions into the key derivation function to obtain the key derivation parameters; Based on the key derivation parameters, each group of data to be encrypted is processed to obtain the corresponding session key.
4. The method for encrypting and storing power data as described in claim 1, characterized in that, The step of encrypting each corresponding data group to be encrypted based on each session key to obtain ciphertext data includes: Local feature extraction is performed on the current data group to be encrypted to obtain the feature information; The initialization vector is obtained by combining and transforming the time-series feature information corresponding to the current data group to be encrypted in the dynamic time-series feature sequence and the feature information; Based on the session key and the initialization vector corresponding to the current data group to be encrypted, the ciphertext encryption process is performed on the data group to be encrypted to obtain the ciphertext data.
5. The method for encrypting and storing power data as described in claim 1, characterized in that, The master key in the asymmetric encryption algorithm is used to encrypt all the session keys to obtain encrypted session keys, including: The validity of the master key in the asymmetric encryption algorithm is verified to obtain a valid key; Based on the valid key, the key encryption process is performed on all the session keys respectively to obtain the encrypted representation result corresponding to each session key; All the encrypted representations are processed in a structured manner to obtain the encrypted session key.
6. A power data encryption storage system, characterized in that, include: The data acquisition module is used to acquire the power data to be encrypted from the target power system. The feature sequence determination module is used to determine the dynamic time-series feature sequence based on the historical operating status data of the target power system; The data grouping module is used to group the power data to be encrypted using the dynamic time-series feature sequence as a standard, so as to obtain each data group to be encrypted of the power data to be encrypted. The session key determination module is used to determine the session key for each group of data to be encrypted based on the analysis results of the historical operation status data. The ciphertext encryption processing module is used to perform ciphertext encryption processing on each corresponding data group to be encrypted based on each session key to obtain ciphertext data. The ciphertext encryption processing is configured to encrypt each data group to be encrypted based on an initialization vector, wherein the initialization vector is determined by the dynamic temporal feature sequence and the feature information of each data group to be encrypted. The key encryption processing module is used to perform key encryption processing on all the session keys based on the master key in the asymmetric encryption algorithm to obtain encrypted session keys; The association encapsulation module is used to associate and encapsulate all the ciphertext data and the encrypted session key, and store the association and encapsulation results in a secure database.
7. The encrypted storage system for power data as described in claim 6, characterized in that, The feature sequence determination module includes: The feature extraction unit is used to perform feature extraction processing on the historical operating status data of the target power system to obtain operating condition feature data. The time alignment unit is used to perform time alignment processing on the operating condition feature data based on the timestamp to obtain the feature data to be aggregated; An aggregation processing unit is used to perform sliding window aggregation processing on the feature data to be aggregated to obtain the dynamic time-series feature sequence.
8. The encrypted storage system for power data as described in claim 6, characterized in that, The session key determination module includes: The data analysis unit is used to analyze the historical operating status data to obtain semantic tags for each operating condition; The key derivation parameter determination unit is used to input the semantic labels of each of the operating conditions into the key derivation function to obtain the key derivation parameters; A session key unit is determined, which is used to process each of the data groups to be encrypted based on the key derivation parameters to obtain the corresponding session key.
9. The encrypted storage system for power data as described in claim 6, characterized in that, The ciphertext encryption processing module includes: A local feature extraction unit is used to extract local features from the current data group to be encrypted to obtain the feature information; The combination transformation processing unit is used to perform combination transformation processing on the time-series feature information corresponding to the current data group to be encrypted in the dynamic time-series feature sequence and the feature information to obtain the initialization vector; The ciphertext encryption processing unit is used to perform the ciphertext encryption processing on the data group to be encrypted based on the session key and the initialization vector corresponding to the current data group to be encrypted, so as to obtain the ciphertext data.
10. The encrypted storage system for power data as described in claim 6, characterized in that, The key encryption processing module includes: The validity verification unit is used to verify the validity of the master key in the asymmetric encryption algorithm to obtain a valid key. A key encryption processing unit is configured to perform key encryption processing on all the session keys based on the valid key, so as to obtain the encryption representation result corresponding to each session key; The structuring processing unit is used to perform structuring processing on all the encrypted representation results to obtain the encrypted session key.