A method for information security defense of substation measurement and control and PMU device

Abstract

The present invention discloses an information security defense method for substation measurement and control and PMU devices, which relates to the fields of cryptography and information security technology. According to the characteristics of substation measurement and control and PMU devices, a security component supporting SM2 certificate management is developed based on the OpenSSL framework expansion, and the SM2 algorithm signature, signature verification, encryption and decryption functions are set. Then, a digital certificate signature is set based on the OpenSSL engine, and a digital certificate management module is set at the same time. Then, an SSL key exchange negotiation function is set, and finally, the substation measurement and control and PMU device terminal is securely connected to the system and data transmission is encrypted. The power grid security defense method based on the SM2 algorithm and the SSL protocol proposed by the present invention can ensure the system security of the smart grid, has strong versatility and practicality, and has a positive impact on improving system defense, promoting the intelligence of distribution networks, improving power supply reliability, and enhancing the network security of modern smart distribution networks.

Description

Technical Field

[0001] The present invention belongs to the field of cryptography and information security technology, and in particular relates to an information security defense method for substation measurement and control and PMU devices. Background Art

[0002] With the development of smart grid in my country, the construction scale of power information system is expanding, the types and equipment of network access are increasing, and the complexity of power grid is increasing. As the basic production system, the power system needs to provide services to users continuously. If there is an accident in the information system security of the power grid, it will affect the normal production and supply of electricity, affect the daily life of the people, disrupt the social order, and damage the national economy and security. Therefore, ensuring the security of its system has become the top priority in the development of smart grid.

[0003] Using substation measurement and control and PMU devices to carry out calibration of electric energy, electric measurement and metering devices and their systems in intelligent substations is a key link to ensure the accuracy of electric energy measurement and electric measurement in intelligent substations. The current and voltage sampling of traditional substations is carried out in the voltage and current merging unit, while the sampling of intelligent substations is moved forward to the electronic transformer, and then the collected digital information is transmitted to the merging unit through optical fiber. Substation measurement and control and PMU devices, as electrical parameter and electric energy calculators, continuously provide data to the power grid system. In order to ensure the security of data information, it is urgent to study a safe and reliable information security defense method.

[0004] With the development of cryptographic technology and the improvement of computing power worldwide, the existing cryptographic system based on the 1024-bit RSA algorithm can no longer meet the current and future security application requirements. Although increasing the key length of the RSA algorithm can improve the security of the original system, the increase in key length will lead to a decrease in encryption and decryption speed, complex hardware implementation, and a non-negligible delay in the actual application of the RSA-based transmission protocol, which affects the service quality. Therefore, an information security defense method for substation measurement and control and PMU devices is needed to ensure the reliability and security of data transmission. Summary of the invention

[0005] The purpose of the present invention is to provide an information security defense method for substation measurement and control and PMU devices, thereby overcoming the disadvantage that the information transmission of existing substation measurement and control and PMU devices is not secure enough.

[0006] To achieve the above object, the present invention provides an information security defense method for substation measurement and control and PMU device, comprising the following steps:

[0007] According to the characteristics of substation measurement and control and PMU devices, a security component supporting SM2 certificate management is built based on the OpenSSL framework extension;

[0008] Set the signature, verification, encryption and decryption algorithms of the SM2 algorithm;

[0009] Set up digital certificates and digital certificate management modules based on the OpenSSL engine;

[0010] Setting the SSL protocol module according to the SM2 algorithm;

[0011] Set up the SSL protocol module through data encryption transmission method.

[0012] Preferably, the security component supports the SM2 elliptic curve public key cryptography algorithm.

[0013] Preferably, an SM2 algorithm encryption module is added to the security component.

[0014] Preferably, the signature, signature verification, encryption and decryption algorithms of the SM2 algorithm are set by elliptic curve parameters.

[0015] Preferably, the data encryption transmission method uses an encryption / decryption algorithm called AES for encryption.

[0016] Preferably, the digital certificate management module includes: creating a digital certificate; reading information; adding a certificate to a key library; deleting a certificate in a key library; issuing a certificate using a private key corresponding to a specified public key; updating the validity period of a certificate; revoking a certificate; and verifying validity.

[0017] Preferably, the SSL protocol module adopts a two-way identity authentication setting.

[0018] Preferably, the data encryption transmission method includes symmetrically encrypting the transmitted power grid message data.

[0019] Compared with the existing technology, the present invention has the following beneficial effects:

[0020] The information security defense method for substation measurement and control and PMU devices provided by the present invention is based on the characteristics of substation measurement and control and PMU devices, and develops a security component that supports SM2 certificate management based on the OpenSSL framework expansion, sets the SM2 algorithm signature, signature verification, encryption and decryption functions, and then sets the digital certificate signature based on the OpenSSL engine, and sets the digital certificate management module at the same time, and then sets the SSL key exchange negotiation function, and finally securely connects the substation measurement and control and PMU device terminals to the system and encrypts data transmission. The power grid security defense method based on the SM2 algorithm and the SSL protocol proposed by the present invention can ensure the system security of the smart grid, has strong versatility and practicality, and has a positive impact on improving system defense, promoting the intelligence of distribution networks, improving power supply reliability, and enhancing the network security of modern smart distribution networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only one embodiment of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a flow chart of an information security defense method for substation measurement and control and PMU device of the present invention;

[0023] Figure 2 It is a flow chart of the digital certificate signing, signature verification, encryption and decryption algorithm based on the OpenSSL engine of the present invention;

[0024] Figure 3 It is a flow chart of SM2 key negotiation based on power grid PMU terminal equipment of the present invention;

[0025] Figure 4 It is the structure of the SSL authentication code of the present invention;

[0026] Figure 5 It is a structural diagram of an information security defense model of a substation measurement and control and PMU device according to one of the embodiments of the present invention. DETAILED DESCRIPTION

[0027] The following is a clear and complete description of the technical solution in the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] like Figure 1 As shown, the information security defense method of the substation measurement and control and PMU device provided by the present invention includes the following steps:

[0029] S1. According to the characteristics of substation measurement and control and PMU devices, a security component supporting SM2 certificate management is built based on the OpenSSL framework extension;

[0030] The security component supports the SM2 elliptic curve public key cryptographic algorithm, and adds the SM2 algorithm encryption module in the security component; according to the characteristics of the OpenSSL framework, before adding the SM2 algorithm, it is necessary to add the OpenSSL algorithm engine and set the OID related to the SM2 certificate production in the engine file.

[0031] S2. Set the signature, verification, encryption and decryption algorithms of the SM2 algorithm;

[0032] like Figure 2 As shown in the figure, under the premise of understanding the OpenSSL source code, the data structure of the SM2 algorithm is added and the original encryption algorithm is replaced with the SM2 algorithm. The modifications include the digital signature algorithm, the key exchange protocol, and the public key encryption algorithm. The elliptic curve parameter definition is formulated for this series of algorithms, including the scale q of the finite field Fq, the definition of the two elements a, b∈Fq of the elliptic curve E(Fq) equation; the base point G=(xG,yG)(G≠0) on E(Fq); the order n of G and other options (such as the cofactor h of n, etc.), and the selection of the elliptic curve equation is y 2 =x 3 +ax+b.

[0033] Specifically, the SM2 algorithm process mainly includes: (1) generating a random number k∈[1,n-1]; (2) calculating the elliptic curve point C1=[K]G=(x1,y1); (3) calculating the elliptic curve point S=[h]P B ; (4) Determine whether S is equal to 0. If so, exit with an error. If not, calculate the elliptic curve point S = [h] P B ; (5) Calculate t = KDF (x2||y2, klen); (6) Determine whether t is all 0. If so, return to step (1). If not, calculate (7) Calculate C3 = Hash(x2||M||y2); (8) Output ciphertext C = C1||C3||C2.

[0034] S3. Setting the digital certificate and digital certificate management module according to the OpenSSL engine;

[0035] The digital certificate is an SM2 digital certificate, which includes: basic certificate domain, signature algorithm domain, and signature value domain.

[0036] The digital certificate management module includes: (1) creating a digital certificate; (2) reading information; (3) adding a certificate to the key library; (4) deleting a certificate from the key library; (5) issuing a certificate using the private key corresponding to the specified public key; (6) updating the certificate validity period; (7) revoking a certificate; and (8) validating the certificate.

[0037] S4, setting the SSL protocol module according to the SM2 algorithm;

[0038] like Figure 3The flowchart of SM2 key negotiation based on the power grid PMU terminal device is shown. According to the SM2 algorithm, the server public key Ps and the server random key R_b, the client public key Pc and the client random key R_a are generated. The server public key PS communicates in the form of a digital certificate, that is, relying on the ServerCertification message; the server random key R_b generates the corresponding key material R_b according to the SSL key negotiation protocol and sends it to the terminal; the client public key Pc relies on the ServerKeyExchange message to be sent to the data center, and the client random key R_a sends the key negotiation material R_a to the data center according to the SSL key negotiation protocol.

[0039] S5, setting the SSL protocol module through the data encryption transmission method;

[0040] The data encryption transmission method uses the symmetric encryption and decryption algorithm AES of the joint certificate and security chip to symmetric encrypt the power grid message data. In the actual transmission process of the message, the SSL record protocol is used to complete the data encryption. The SSL record protocol uses a shared key to perform message authentication code calculation on each data block. The design of the SSL authentication code is as follows: Figure 4 As shown, an SSL record protocol is added at the beginning of each encrypted data, and the shared key between the two parties will not be known by a third party. The research and design part of the message authentication code realizes secure transmission between the data center and the substation terminal and PMU device, ensuring secure data transmission.

[0041] The above-mentioned information security defense method for substation measurement and control and PMU devices is based on the characteristics of substation measurement and control and PMU devices. Secondly, a security component that supports SM2 certificate management is developed based on the OpenSSL framework extension, and the SM2 algorithm signature, signature verification, encryption and decryption functions are set. Then, a digital certificate signature is set based on the OpenSSL engine, and a digital certificate management module is set at the same time. Then, the SSL key exchange negotiation function is set, and finally, the substation measurement and control and PMU device terminal is securely connected to the system and data transmission is encrypted. The test results show that the power grid security defense strategy based on the SM2 algorithm and the SSL protocol proposed in the present invention can ensure the system security of the smart grid, has strong versatility and practicality, and has a positive impact on improving system defense, promoting the intelligence of the distribution network, improving power supply reliability, and enhancing the network security of the modern smart distribution network.

[0042] One embodiment, such as Figure 5 As shown, an information security defense model for substation measurement and control and PMU devices is applied to the above-mentioned information security defense method. The information security defense model includes: OpenSSL encryption library module, SM2 algorithm digital signature module, certificate management module, SSL protocol module, wherein:

[0043] The OpenSSL encryption library module is used to load the OpenSSL framework and build a security component that supports SM2 certificate management based on the OpenSSL framework extension. Before adding the SM2 algorithm, you need to add the OpenSSL algorithm engine and set the OID related to SM2 certificate production in the engine file.

[0044] The SM2 algorithm digital signature module is used to set the signature, signature verification, encryption and decryption algorithms of the SM2 algorithm;

[0045] The certificate management module is used to set up and manage digital certificates based on the OpenSSL engine.

[0046] The SSL protocol module is used to perform SM2 key negotiation settings based on the power grid PMU terminal device according to the SM2 algorithm to achieve encrypted transmission.

[0047] The above-mentioned information security defense model of substation measurement and control and PMU device first constructs the information security defense model of PMU device measurement and control data at the operating system level, and then sets up a security component that supports SM2 certificate management based on the OpenSSL framework extension, constructs SM2 algorithm signature, signature verification, encryption and decryption functions, and then sets up a digital certificate signature based on the OpenSSL engine, and sets up a digital certificate management module at the same time, and then sets up an SSL key exchange negotiation function, and finally securely connects the substation measurement and control and PMU device terminals to the system and encrypts data transmission. The test results show that the power grid security defense strategy based on the SM2 algorithm and SSL protocol proposed in the present invention can ensure the system security of the smart grid, has strong versatility and practicality, and has a positive impact on improving system defense, promoting the intelligence of distribution networks, improving power supply reliability, and enhancing the network security of modern smart distribution networks.

[0048] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the mobile terminal can be divided into different functional units or modules to complete all or part of the functions described above. The functional modules in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the modules in the above-mentioned mobile terminal can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0049] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0050] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0051] In the embodiments provided by the present invention, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0052] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0053] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0054] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0055] What is disclosed above is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or modifications within the technical scope disclosed in the present invention, which should be covered within the protection scope of the present invention.

Claims

1. A method for information security defense of substation measurement and control and PMU device, characterized in that: The following steps are involved: According to the characteristics of substation measurement and control and PMU devices, a security component supporting SM2 certificate management is built based on the OpenSSL framework extension; Set the signature, verification, encryption and decryption algorithms of the SM2 algorithm; Set up digital certificates and digital certificate management modules based on the OpenSSL engine; Setting the SSL protocol module according to the SM2 algorithm; Set up the SSL protocol module through data encryption transmission method.

2. The information security defense method for substation measurement and control and PMU device according to claim 1 is characterized in that: The security component supports the SM2 elliptic curve public key cryptography algorithm.

3. The information security defense method for substation measurement and control and PMU device according to claim 2 is characterized in that: Add an SM2 algorithm encryption module to the security component.

4. The information security defense method for substation measurement and control and PMU device according to claim 1 is characterized in that: The signature, verification, encryption and decryption algorithms of the SM2 algorithm are set through elliptic curve parameters.

5. The information security defense method for substation measurement and control and PMU device according to claim 1 is characterized in that: The data encryption transmission method adopts the symmetric encryption and decryption algorithm AES for encryption.

6. The information security defense method for substation measurement and control and PMU device according to claim 1 is characterized in that: The digital certificate management module includes: creating a digital certificate; reading information; adding a certificate to a key library; deleting a certificate in a key library; issuing a certificate using a private key corresponding to a specified public key; updating the certificate validity period; revoking a certificate; and verifying validity.

7. The information security defense method for substation measurement and control and PMU device according to claim 1 is characterized in that: The SSL protocol module adopts a two-way identity authentication setting.

8. The information security defense method for substation measurement and control and PMU device according to claim 1 is characterized in that: The data encryption transmission method includes symmetrically encrypting the transmitted power grid message data.

Images