A safety protection system for power distribution terminal operation and maintenance tools

Abstract

The present invention relates to a security protection system for operation and maintenance tools of a power distribution terminal, comprising a USB Key, an operation and maintenance tool and a power distribution terminal, wherein the USB Key is used to provide security protection for the operation and maintenance tool; the power distribution terminal performs identity authentication on the power distribution terminal based on the USB Key, and encrypts and decrypts data interacting with the power distribution terminal based on the USB Key; the power distribution terminal generates a corresponding certificate request file with the support of the operation and maintenance tool, and realizes the import and export of certificates.

Description

Technical Field

[0001] The present invention belongs to the technical field of power distribution automation and relates to a safety protection system for power distribution terminal operation and maintenance tools. Background Art

[0002] In the development process of smart grid, information technology as a supporting technology plays an important role in the construction, operation and management of smart grid. The close connection between power network and communication network not only brings technological innovation to the power business system, but also brings great challenges to the security of power network.

[0003] As a future development trend of power system, distribution automation has broad prospects. The distribution automation system mainly uses current electronic information technology as a means to integrate the online and offline data of the distribution network as well as the user and grid data to achieve the normal operation of the distribution system, which all rely on the distribution terminal to monitor, protect and control the data.

[0004] However, during the on-site operation and maintenance of distribution terminals, operation and maintenance personnel usually use portable devices to inspect the terminal's operating status and maintain software functions. However, the local operation and maintenance tools of the distribution terminals currently do not have any security measures and protection mechanisms. The operation and maintenance software is extremely easy to be invaded, tampered with, or even copied and simulated, forming security protection loopholes. Summary of the invention

[0005] In order to solve the above problems in the prior art, the present invention provides a power distribution terminal operation and maintenance tool safety protection system.

[0006] The technical solution adopted by the present invention is specifically as follows:

[0007] A power distribution terminal operation and maintenance tool safety protection system, including a USB Key, an operation and maintenance tool and a power distribution terminal, wherein

[0008] The USB Key is used to provide security protection for the operation and maintenance tool; the distribution terminal performs identity authentication on the distribution terminal based on the USB Key, and encrypts and decrypts data interacting with the distribution terminal based on the USB Key; the distribution terminal generates a corresponding certificate request file with the support of the operation and maintenance tool, and realizes the import and export of certificates.

[0009] Furthermore, when the operation and maintenance tool is used, a corresponding USB Key needs to be inserted, and the user is required to enter his / her user name / password. The operation and maintenance tool can be used only after the USB Key verifies the user name / password.

[0010] Furthermore, the data interaction between the distribution terminal and the operation and maintenance tool adopts the SM1 algorithm to perform data encryption and decryption operations.

[0011] Furthermore, the USB Key stores a key of the algorithm.

[0012] Furthermore, the USB Key also stores the certificate of the operation and maintenance tool.

[0013] The beneficial effects of the present invention are: improving the safety protection level of distribution terminal operation and maintenance tools, meeting the increasingly high lean management needs, and ensuring the safe operation of the distribution automation system. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application, but do not constitute an improper limitation of the present invention. In the drawings:

[0015] Figure 1 It is a logical structure diagram of the system of the present invention.

[0016] Figure 2 It is a flow chart of the identity authentication of the operation and maintenance tool and the power distribution terminal of the present invention.

[0017] Figure 3 It is a flow chart of the operation and maintenance tool of the present invention extracting terminal information to generate a certificate request file.

[0018] Figure 4 It is a flow chart of the operation and maintenance tool of the present invention restoring the terminal symmetric key. DETAILED DESCRIPTION

[0019] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, wherein the illustrative embodiments and descriptions are only used to explain the present invention but are not intended to limit the present invention.

[0020] See attached Figure 1 , which shows the basic structure of the system of the present invention. The power distribution terminal operation and maintenance tool security protection system of the present invention includes a USB Key, an operation and maintenance tool and a power distribution terminal. The present invention provides security protection for the operation and maintenance tool based on the USB Key, and the USB Key is pre-installed with the power distribution application CA certificate, the certificate management tool asymmetric key pair (including private key and certificate), and the on-site operation and maintenance uplink key and the on-site operation and maintenance downlink key.

[0021] The power distribution application CA certificate is used to verify the validity of all certificates, the certificate management tool asymmetric key pair is used for identity authentication between the operation and maintenance tool and the terminal, and the on-site operation and maintenance uplink key and on-site operation and maintenance downlink key are used for encryption and decryption of data transmission between the operation and maintenance tool and the power distribution terminal.

[0022] When the operation and maintenance tool is needed to perform on-site operation and maintenance of the distribution terminal, the operation and maintenance personnel first need to insert the above-mentioned USB Key into the operation and maintenance tool, and then enter the PIN code corresponding to the USB Key on the operation and maintenance tool. When the USB Key verifies the entered PIN, the operation and maintenance personnel can log in to the operation and maintenance management interface.

[0023] Identity authentication between distribution terminals and operation and maintenance tools

[0024] After logging in, in order to perform on-site operation and maintenance of the distribution terminal, identity authentication is required between the distribution terminal and the operation and maintenance tool. On the other hand, the distribution terminal is generally considered to be trustworthy, so the identity authentication mentioned here is actually one-way, that is, the distribution terminal authenticates the identity of the operation and maintenance tool to ensure that the operation and maintenance tool is safe and reliable. The specific process is combined with the attached Figure 2 The instructions are as follows:

[0025] (1) The operation and maintenance tool sends an authentication application to the power distribution terminal, wherein the authentication application includes the operation and maintenance tool certificate and the operation and maintenance tool ID.

[0026] The operation and maintenance tool certificate is stored in the USB Key, and after the USB Key is inserted into the operation and maintenance tool, the operation and maintenance management software reads it from the USB Key.

[0027] The operation and maintenance tool ID is the unique identifier of the operation and maintenance tool itself, and the operation and maintenance tool certificate also has an ID. For legal use, the two should be the same. Therefore, the USB Key and the operation and maintenance tool should match, so that the ID of the operation and maintenance tool certificate in the USB Key is the same as the operation and maintenance tool ID.

[0028] (2) The power distribution terminal verifies the legitimacy of the operation and maintenance tool certificate. If it is not legal, the authentication fails and the power distribution terminal rejects the operation of the operation and maintenance tool. If it is legal, the subsequent steps are continued.

[0029] Specifically, the distribution terminal first uses the CA certificate to verify the legitimacy of the operation and maintenance tool certificate itself, and then verifies whether the ID in the operation and maintenance tool certificate is the same as the operation and maintenance tool ID. If they are the same, the operation and maintenance tool certificate is legal, otherwise it is illegal.

[0030] (3) The power distribution terminal generates a random number R and sends it to the operation and maintenance tool. The operation and maintenance tool signs the random number R through the USB Key and sends the signature result to the power distribution terminal.

[0031] Specifically, the USB Key stores the private key corresponding to the operation and maintenance tool certificate, so the operation and maintenance tool can send the random number R to the USB Key, and the USB Key uses the private key to digitally sign R, and then returns the signature result to the operation and maintenance tool, which then returns it to the power distribution terminal.

[0032] Preferably, the digital signature uses the domestic asymmetric cryptographic algorithm SM2.

[0033] (4) The power distribution terminal verifies the signature result. If the verification fails, the authentication fails and the power distribution terminal rejects the operation of the operation and maintenance tool. If the verification passes, the identity authentication of the operation and maintenance tool is completed and a verification pass message is returned to the operation and maintenance tool.

[0034] Specifically, since the power distribution terminal has received the operation and maintenance tool certificate and verified its legitimacy in the aforementioned step 2, the power distribution terminal can use the operation and maintenance tool certificate to verify the signature result.

[0035] (5) After the identity authentication is passed, the distribution terminal monitors the data interaction between the operation and maintenance tool and the distribution terminal. If there is no data interaction between the operation and maintenance tool and the distribution terminal within a predefined time length, the distribution terminal automatically revokes the identity authentication of the operation and maintenance tool.

[0036] After the identity authentication is revoked, if the operation and maintenance tool needs to operate the power distribution terminal again, it needs to re-authenticate, that is, re-execute the above steps 1-4.

[0037] Data encryption and decryption between power distribution terminals and operation and maintenance tools

[0038] Considering the characteristics of large data volume transmitted between the distribution terminal and the operation and maintenance tool, the domestic commercial symmetric encryption algorithm SM1 is used for data encryption and decryption in the data interaction between the distribution terminal and the operation and maintenance tool. Among them, the encryption and decryption function of the operation and maintenance tool is realized by calling the API interface function of the USB Key.

[0039] The encryption and decryption use the on-site operation and maintenance uplink key and the on-site operation and maintenance downlink key, which are stored in the USB Key and also in the power distribution terminal.

[0040] Specifically, when the on-site operation and maintenance tool sends data to the distribution terminal, the operation and maintenance tool calls the USB Key, and the USBKey uses the on-site operation and maintenance downlink key to encrypt the data sent to the distribution terminal, generate an encrypted message, and then send the encrypted message to the distribution terminal. After receiving the encrypted message, the distribution terminal uses the operation and maintenance tool ID as a dispersion factor and decrypts it with the on-site operation and maintenance downlink key to obtain the plaintext data.

[0041] When the distribution terminal sends data to the on-site operation and maintenance tool, the distribution terminal uses the on-site operation and maintenance uplink key to encrypt the data, generate an encrypted message, and send the encrypted message to the operation and maintenance tool. After receiving the encrypted message, the operation and maintenance tool calls the USB Key, which uses the on-site operation and maintenance uplink key to decrypt the message from the distribution terminal and obtain the plaintext data.

[0042] Self-protection of operation and maintenance tools

[0043] In order to protect the security of the operation and maintenance tool itself, the operation and maintenance tool of the present invention must be inserted with a corresponding USBKey when in use, and the user is required to enter his / her username / password. The operation and maintenance tool can only be used after the username / password is verified by the USB Key.

[0044] Generate a certificate request file for the power distribution terminal

[0045] The operation and maintenance tool of the present invention can also provide a function of generating a certificate request file for the power distribution terminal. After completing the identity authentication between the operation and maintenance tool and the power distribution terminal, the operation and maintenance tool can extract the power distribution terminal information to generate a certificate request file. Figure 3 The instructions are as follows:

[0046] (1) The operation and maintenance tool sends a command to extract the terminal key version to the distribution terminal, requesting the distribution terminal to return its key version.

[0047] (2) The power distribution terminal reads the key version number in its chip and returns the key version number in plain text to the operation and maintenance tool.

[0048] (3) The operation and maintenance tool sends a command to extract the terminal serial number to the power distribution terminal.

[0049] (4) The power distribution terminal returns the serial number of the power distribution terminal to the operation and maintenance tool in plain text.

[0050] (5) The operation and maintenance tool sends a command to the power distribution terminal to extract the serial number of the terminal's built-in security chip;

[0051] (6) The power distribution terminal returns the serial number of the built-in security chip to the operation and maintenance tool in plain text;

[0052] (7) The operation and maintenance tool sends an instruction to the power distribution terminal to extract the public key of the terminal's built-in security chip;

[0053] (8) The power distribution terminal extracts the public key of the built-in security chip, encrypts the public key using the on-site operation and maintenance uplink key, and sends the ciphertext to the operation and maintenance tool;

[0054] (9) The operation and maintenance tool decrypts the ciphertext through the USB Key to obtain the public key information, and enters other main information (various parameters of the distribution terminal itself, etc.) through the interface, and generates a signed certificate request data based on the distribution terminal information obtained in the above steps;

[0055] (10) The operation and maintenance tool encrypts the certificate request data through a USB key and sends it to the power distribution terminal;

[0056] (11) After receiving the encrypted certificate request data, the power distribution terminal first decrypts it to obtain the certificate request data to be signed, and then the power distribution terminal digitally signs the certificate request data with a private key and returns the signature result to the operation and maintenance tool;

[0057] (12) The operation and maintenance tool receives the signature result and generates a complete certificate request file.

[0058] Certificate import and export

[0059] Through the operation and maintenance tool, the power distribution application CA certificate, master station certificate, gateway certificate, and terminal certificate can be imported into the power distribution terminal, or the power distribution terminal certificate can be exported. When importing certificates, only one certificate can be imported at a time, and multiple certificates cannot be imported at the same time.

[0060] Recover the symmetric key of the power distribution terminal

[0061] When the key of the distribution terminal is damaged, the key can be restored through the operation and maintenance tool. The specific steps are as follows: Figure 4 The instructions are as follows:

[0062] (1) The operation and maintenance tool sends a command to obtain the key version number to the distribution terminal;

[0063] (2) The power distribution terminal reads the key version number from the built-in security chip, generates a terminal random number R1, and returns the key version number and the terminal random number R1 to the operation and maintenance tool;

[0064] (3) The operation and maintenance tool uses the terminal random number R1 to calculate the MAC of the key to be recovered, generates a key recovery package, encrypts the key recovery package using the USB Key, and sends it to the power distribution terminal;

[0065] (4) The power distribution terminal decrypts the encrypted key recovery package to obtain the key recovery package, performs a key recovery operation based on the key recovery package, and returns a key recovery execution result to the operation and maintenance tool.

[0066] The above description is only a preferred embodiment of the present invention, so all equivalent changes or modifications made according to the structure, characteristics and principles described in the scope of the patent application of the present invention are included in the scope of the patent application of the present invention.

Claims

1. A power distribution terminal operation and maintenance tool safety protection system, characterized in that: Including USB Key, operation and maintenance tools and power distribution terminal, among which The USB Key is used to provide security protection for the operation and maintenance tool; the power distribution terminal performs identity authentication on the power distribution terminal based on the USB Key, and encrypts and decrypts data interacting with the power distribution terminal based on the USB Key; The power distribution terminal generates a corresponding certificate request file with the support of the operation and maintenance tool, and implements the import and export of the certificate; The identity authentication further includes: (1) The operation and maintenance tool sends an authentication application to the power distribution terminal, wherein the authentication application includes the operation and maintenance tool certificate and the operation and maintenance tool ID; the operation and maintenance tool certificate is stored in a USB Key, and after the USB Key is inserted into the operation and maintenance tool, the operation and maintenance management software reads it from the USB Key; (2) The power distribution terminal first uses the CA certificate to verify the legitimacy of the operation and maintenance tool certificate itself, and then verifies whether the ID in the operation and maintenance tool certificate is the same as the operation and maintenance tool ID. If they are the same, the operation and maintenance tool certificate is legal, otherwise it is illegal; (3) The power distribution terminal generates a random number R and sends it to the operation and maintenance tool. The operation and maintenance tool signs the random number R through the USBKey and sends the signature result to the power distribution terminal; (4) The power distribution terminal verifies the signature result. If the verification fails, the authentication fails and the power distribution terminal rejects the operation of the operation and maintenance tool. If the verification passes, the identity authentication of the operation and maintenance tool is completed and a verification pass message is returned to the operation and maintenance tool. (5) After the identity authentication is passed, the power distribution terminal monitors the data interaction between the operation and maintenance tool and the power distribution terminal. If there is no data interaction between the operation and maintenance tool and the power distribution terminal within a predefined time length, the power distribution terminal automatically revokes the identity authentication of the operation and maintenance tool. After the identity authentication is revoked, if the operation and maintenance tool needs to operate the power distribution terminal again, it needs to re-authenticate, that is, re-execute the above steps (1)-(4); The USB Key encryption and decryption of data exchanged with the power distribution terminal further includes that when the field operation and maintenance tool sends data to the power distribution terminal, the operation and maintenance tool calls the USB Key, and the USB Key uses the field operation and maintenance downlink key to encrypt the data sent to the power distribution terminal to generate an encrypted message, and then sends the encrypted message to the power distribution terminal. After receiving the encrypted message, the power distribution terminal uses the operation and maintenance tool ID as a dispersion factor and uses the field operation and maintenance downlink key to decrypt and obtain plain text data; After completing the identity authentication between the operation and maintenance tool and the power distribution terminal, the operation and maintenance tool extracts the power distribution terminal information to generate a certificate request file, which is as follows: (1) The operation and maintenance tool sends a command to extract the terminal key version to the power distribution terminal, requesting the power distribution terminal to return its key version; (2) The power distribution terminal reads the key version number in its chip and returns the key version number in plain text to the operation and maintenance tool; (3) The operation and maintenance tool sends a command to extract the terminal serial number to the power distribution terminal; (4) The power distribution terminal returns the serial number of the power distribution terminal to the operation and maintenance tool in plain text; (5) The operation and maintenance tool sends a command to the power distribution terminal to extract the serial number of the terminal's built-in security chip; (6) The power distribution terminal returns the serial number of the built-in security chip to the operation and maintenance tool in plain text; (7) The operation and maintenance tool sends an instruction to the power distribution terminal to extract the public key of the terminal's built-in security chip; (8) The power distribution terminal extracts the public key of the built-in security chip, encrypts the public key using the on-site operation and maintenance uplink key, and sends the ciphertext to the operation and maintenance tool; (9) The operation and maintenance tool decrypts the ciphertext through the USB Key to obtain the public key information, and enters various parameters of the distribution terminal itself through the interface, and generates a signed certificate request data based on the distribution terminal information obtained in the above steps; (10) The operation and maintenance tool encrypts the certificate request data through a USB key and sends it to the power distribution terminal; (11) After receiving the encrypted certificate request data, the power distribution terminal first decrypts it to obtain the certificate request data to be signed, and then the power distribution terminal digitally signs the certificate request data with a private key and returns the signature result to the operation and maintenance tool; (12) The operation and maintenance tool receives the signature result and generates a complete certificate request file.

2. The system according to claim 1, characterized in that When the operation and maintenance tool is used, the corresponding USBKey needs to be inserted, and the user is required to enter his / her username / password. The operation and maintenance tool can only be used after the username / password is verified by the USB Key.

3. The system according to claim 1, characterized in that The data interaction between the distribution terminal and the operation and maintenance tool uses the SM1 algorithm to perform data encryption and decryption operations.

4. The system according to claim 3, characterized in that The USB Key stores the key of the algorithm.

5. The system according to claim 1, characterized in that The USB Key also stores the certificate of the operation and maintenance tool.

Images