PMU power system communication method based on national secret algorithm
By using the communication method based on the State Secret algorithm in the PMU power system, the complete public and private key of the State Secret SM2 is generated and verified, and the session key negotiation is carried out, the problems of certificate management and key hosting in the traditional public key cryptography system are solved, and the problem of certificate management and key hosting is realized. The secure communication of the PMU power system ensures the lightweight and security of the communication.
Patent Information
- Application Number
- CN202211114292.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-09-13
- Publication Date
- 2025-01-07
- Estimated Expiration
- 2042-09-13
AI Technical Summary
The traditional public key cryptography system and identity-based public key cryptography system have problems in public key certificate management and key hosting in PMU power system communication, resulting in insufficient security and the risk of legal authorization of malicious behavior.
Using the PMU power system communication method based on the State Secret algorithm, the information sending device and the receiving device apply to the key management service to obtain the State Secret SM2 private key, and combine the local private value to generate the State Secret SM2 complete public and private key, and perform the session key. Negotiation and signature verification to achieve encrypted communication.
This method eliminates certificate management, solves the problem of key custody, combines the national secret algorithm for signature and verification, ensures the communication security of the PMU power system and realizes lightweight and secure authentication communication.
Smart Images
Figure CN115484033B_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a PMU power system communication method based on a national secret algorithm, belonging to the technical field of communication security. Background Art
[0002] With the development of smart grid, the scale of power system is expanding, and the types of devices connected to the power grid are increasing dramatically. PMU (Phasor Measurement Units) system is a unit for measuring power grid data in the power system, which includes a variety of devices such as synchronous vector measurement device, vector data concentrator, time synchronization device, etc. The multiple and complex terminal access brings security risks to the PMU system. Therefore, in order to ensure the communication security between PMU system terminals, it is urgent to study a secure communication method suitable for PMU power system.
[0003] In the traditional public key cryptography system, in order to ensure the one-to-one correspondence between the user's public key and the identity, a third party called a certificate center is required to issue a public key certificate for each user's public key. Considering the communication and computing overhead caused by the issuance, transmission, verification, storage and revocation of certificates, the identity-based public key cryptography system cancels the public key certificate in the traditional public key cryptography system by allowing users to use their own readable identity information as the public key. However, the identity-based public key cryptography system requires that the user's private key be generated by a third party, which inevitably brings about the problem of key escrow.
[0004] In summary, the traditional public key cryptography system and the identity-based public key cryptography system have security defects due to public key certificate management and key escrow, which may allow malicious behavior with legal authorization, and the security of the key needs to be enhanced. The above problems are issues that should be considered and solved in the communication process of PMU power system. Summary of the invention
[0005] The purpose of the present invention is to provide a PMU power system communication method based on a national secret algorithm to solve the problems in the prior art of high communication and calculation overhead and the need to enhance the security of the key.
[0006] The technical solution of the present invention is:
[0007] A PMU power system communication method based on a national secret algorithm comprises the following steps:
[0008] S1, the information sending device and the information receiving device, as the communicating parties, apply to the key management service of the PMU power system to obtain the national secret SM2 private key;
[0009] S2. The communicating parties combine the local secret value to generate the national secret SM2 complete public-private key, and register the public key and ID to the system key management service;
[0010] S3, the information sending device queries the key management service whether there is a session key between it and the information receiving device. If so, it uses the session key for encrypted communication and attaches its own ID and public key information; if not, it proceeds to the next step S4 to negotiate the session key;
[0011] S4, the information sending device generates a session key, encrypts and signs the session key, and then sends the encrypted session key, signature result, public key and ID information to the information receiving device;
[0012] S5. The information receiving device first verifies the information at the key management service based on the public key information of the information sending device. After the verification is passed, it is determined that the received information is key negotiation information or contains encrypted communication information. If it is key negotiation information, the session key is negotiated and saved to the key management service; if it contains encrypted communication information, the session key is queried at the key management service and decrypted.
[0013] Furthermore, in step S1, the information sending device and the information receiving device, as the communicating parties, apply to the key management service of the PMU power system to obtain the national secret SM2 private key, specifically,
[0014] S11. Establish a PMU power system key management service system, input the system security parameter k, and the key management service generates a prime number q and a key management service defined in a finite field F. q Elliptic curve E(F q ), G is the elliptic curve E(F q ) is an additive group of order q consisting of points on is the system master key, calculate the master public key P KGC =xG, which is kept secret by the key management service; select a secure and collision-resistant hash function H 2 :{0,1} * →{0,1} k , where G q is a prime field containing q elements, is the n-th order additive cyclic group Z n The Abelian group formed by the reversible elements in G, n is the order of G, H 2 is a hash function, public system parameters params = {F q ,E(F q ),n,G,P KGC ,H 1 ,H 2};
[0015] S12. The information sending device and the information receiving device respectively apply for private keys from the key management service. The key management service generates a private key and sends the generated private key to the information sending device and the information receiving device respectively through a secure channel.
[0016] Further, in step S12, the information sending device and the information receiving device respectively apply for a private key from the key management service, the key management service generates a private key, and sends the generated private key to the information sending device and the information receiving device respectively through a secure channel, specifically,
[0017] S121, terminal device A, as the information sending device, submits its identity ID to the key management service A ;
[0018] S122, random selection of key management service in, By Z n The multiplicative group of all non-zero elements in ; calculate Y A =y A G,q A =H 1 (ID A ,Y A ),u A =y A +xq A , where y A is a randomly selected secret value, G is the elliptic curve E(F q ) is an additive group of order q, Y A By y A The generated public key, u A is the generated private key, q A It is the result of hash calculation based on ID and public key; and (u A , Y A ) is sent to terminal device A;
[0019] S123, terminal device A verifies u A G=Y A +q A P KGC , where G is the elliptic curve E(F q ) is an additive group of order q, Y A is a randomly chosen secret value y A The generated public key, q A It is the result of hash calculation based on ID and public key. KGC Is the master public key? If true, receive the private key u A Similarly, terminal device B, as an information receiving device, obtains the private key u B .
[0020] Furthermore, in step S2, the communicating parties generate the national secret SM2 complete public-private key in combination with the local secret value, and register the public key and ID with the system key management service, specifically,
[0021] S21. The two communicating parties generate secret values respectively, and the information sending device randomly selects the secret value The information receiving device randomly selects a secret value
[0022] S22, the communicating parties generate complete private keys respectively, and the information sending device sends the private key u A and the secret value v A Combined, we get the complete private key d A =(u A ,v A ); Similarly, the information receiving device obtains the complete private key d B =(u B ,v B );
[0023] S23, both parties generate complete public keys respectively, and the information sending device calculates X A =u A G,T A =v A G, where X A The terminal device A uses the partial private key u A The generated partial public key, T A The terminal device A selects the secret value v A Generate a partial public key to obtain the complete public key P A =(X A ,T A ); Similarly, the information receiving device obtains the complete public key P B =(X B ,T B ), where X B The terminal device B uses the partial private key u B The generated partial public key, T B The terminal device B selects the secret value v B The generated partial public key;
[0024] S24. The information sending device and the information receiving device respectively register the generated complete public key to the system key management service and provide ID information.
[0025] Further, in step S4, the information sender generates a session key and encrypts and signs the session key, and then sends the encrypted session key, signature result, public key and ID information to the information receiving device, specifically,
[0026] S41, the information sending device verifies the identity of the information receiving device with the help of the key management service, that is, based on the identity ID of the information receiving device B Query to obtain its public key P B , if found, the verification is successful;
[0027] S42, the information sending device randomly selects a random number r and encrypts it using the public key of the information receiving device, that is, in, To perform SM2 public key encryption on the random number r using the public key of the information receiving device B;
[0028] S43. The information sending device generates a summary r′ of the random number r using the SM3 cryptographic hash algorithm: r′=H(r), where H() is a cryptographic hash function; then uses the private key to sign the summary r′ to obtain a signature result r″: in, To use the private key of the information sending device A to perform SM2 signature on the summary r′; set Message = r * ||r″||P A , where r * is the result of encrypting the random number r with the public key of the information receiving device B using the SM2 public key. A It is the public key of the information sending device A, which is sent to the information receiving device.
[0029] Further, in step S5, the information receiving device first verifies the public key information of the information sending device to the key management service. Specifically, the information receiving device verifies whether the public key of the information sending device is legal, that is, extracts the public key P of the information sending device in the Message. A Query the key management service. If it exists, the verification is successful. Otherwise, the verification fails and an error message is returned, ending the key negotiation process.
[0030] Furthermore, in step S5, when it is key negotiation information, the session key is negotiated and saved to the key management service, specifically,
[0031] S51, the information receiving device extracts the r in the Message * , use your own private key to decrypt and get a random number in, To use the private key pair r of information receiving device B * Decrypt the SM2 private key;
[0032] S52, the information receiving device extracts the signature result r″ in the Message and calculates And verify whether H(r) is equal to If they are the same, the verification is successful. After the verification is passed, the random number r is used as the private value for the subsequent symmetric encryption communication key generation between the two parties and saved to the key management service; otherwise, the verification fails, an error message is returned, and the key negotiation process ends.
[0033] Furthermore, in step S1, the key management service is deployed in a cluster.
[0034] The beneficial effects of the present invention are as follows: this PMU power system communication method based on the national secret algorithm can not only avoid the management of certificates, but also solve the problem of key hosting in the identity-based encryption system. At the same time, combined with the national secret algorithm for signing, verification and encryption, the authentication communication of the PMU power system can be made both lightweight and secure. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1 It is a flow chart of a PMU power system communication method based on a national secret algorithm according to an embodiment of the present invention;
[0036] Figure 2 is a schematic diagram illustrating PMU power system communication in an embodiment;
[0037] Figure 3 It is a schematic diagram illustrating that two communicating parties apply to the key management service for obtaining the national secret SM2 private key in the embodiment.
[0038] Figure 4 It is a schematic diagram illustrating that the communicating parties generate the national secret SM2 complete public-private key by combining the local private value in the embodiment.
[0039] Figure 5 It is a schematic diagram for explaining the negotiation of session keys between two communicating parties in the embodiment. DETAILED DESCRIPTION
[0040] The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0041] Example
[0042] A PMU power system communication method based on national secret algorithm, such as Figure 1 , including the following steps,
[0043] S1, the information sending device and the information receiving device, as the communicating parties, apply to the key management service of the PMU power system to obtain the national secret SM2 private key, such as Figure 3 .
[0044] S11. Establish a PMU power system key management service system, input the system security parameter k, and the key management service generates a prime number q and a key management service defined in a finite field F. q Elliptic curve E(F q ), G is the elliptic curve E(Fq ) is an additive group of order q consisting of points on is the system master key, calculate the master public key P KGC =xG, which is kept secret by the key management service; select a secure and collision-resistant hash function H 2 :{0,1} * →{0,1} k , where G q is a prime field containing q elements, is the n-th order additive cyclic group Z n The Abelian group formed by the reversible elements in G, n is the order of G, H 2 is a hash function, public system parameters params = {F q ,E(F q ),n,G,P KGC ,H 1 ,H 2};
[0045] S12, the information sending device and the information receiving device apply for a private key from the key management service respectively, the key management service generates a private key, and sends the generated private key to the information sending device and the information receiving device respectively through a secure channel. Figure 3 .
[0046] S121, terminal device A, as the information sending device, submits its identity ID to the key management service A ;
[0047] S122, random selection of key management service in, By Z n The multiplicative group of all non-zero elements in ; calculate Y A =y A G,q A =H 1 (ID A ,Y A ),u A =y A +xq A , where y A is a randomly selected secret value, G is the elliptic curve E(F q ) is an additive group of order q, Y A By y A The generated public key, u A is the generated private key, q A It is the result of hash calculation based on ID and public key; and (u A , Y A ) is sent to terminal device A;
[0048] S123, terminal device A verifies u A G=Y A +q A P KGC , where G is the elliptic curve E(F q ) is an additive group of order q, Y A is a randomly chosen secret value y A The generated public key, q A It is the result of hash calculation based on ID and public key. KGC Is the master public key? If true, receive the private key u A Similarly, terminal device B, as an information receiving device, obtains the private key u B .
[0049] like Figure 2 , use the key management service to provide unified key management for the terminal devices of the PMU power system. The key management service can be deployed in a cluster to improve the performance of the service. At the same time, two databases are used for read-write separation, and redis cache is used to speed up data reading.
[0050] S2. The communicating parties combine the local secret value to generate the national secret SM2 complete public-private key, and register the public key and ID to the system key management service; Figure 4 .
[0051] S21. The two communicating parties generate secret values respectively, and the information sending device randomly selects the secret value The information receiving device randomly selects a secret value
[0052] S22, the communicating parties generate complete private keys respectively, and the information sending device sends the private key u A and the secret value v A Combined, we get the complete private key d A =(u A ,v A ); Similarly, the information receiving device obtains the complete private key d B =(u B ,v B );
[0053] S23, both parties generate complete public keys respectively, and the information sending device calculates X A =u A G,T A =v A G, where X A The terminal device A uses the partial private key u A The generated partial public key, T A The terminal device A selects the secret value vA Generate a partial public key to obtain the complete public key P A =(X A ,T A ); Similarly, the information receiving device obtains the complete public key P B =(X B ,T B ), where X B The terminal device B uses the partial private key u B The generated partial public key, T B The terminal device B selects the secret value v B The generated partial public key;
[0054] S24. The information sending device and the information receiving device respectively register the generated complete public key to the system key management service and provide ID information.
[0055] In step S2, the key management service saves the public key and ID information registered by the communicating parties to the database. In order to improve the reading efficiency, a copy of this information can be cached in redis.
[0056] S3, the information sending device queries the key management service whether there is a session key between it and the information receiving device. If so, it uses the session key for encrypted communication and attaches its own ID and public key information; if not, it proceeds to the next step S4 to negotiate the session key;
[0057] S4, the information sending device generates a session key, encrypts and signs the session key, and then sends the encrypted session key, signature result, public key and ID information to the information receiving device;
[0058] S41, the information sending device verifies the identity of the information receiving device with the help of the key management service, that is, based on the identity ID of the information receiving device B Query to obtain its public key P B , if found, the verification is successful;
[0059] S42, the information sending device randomly selects a random number r and encrypts it using the public key of the information receiving device, that is, in, To perform SM2 public key encryption on the random number r using the public key of the information receiving device B;
[0060] S43. The information sending device generates a summary r′ of the random number r using the SM3 cryptographic hash algorithm: r′=H(r), where H() is a cryptographic hash function; then uses the private key to sign the summary r′ to obtain a signature result r″: in, To use the private key of the information sending device A to perform SM2 signature on the summary r′; set Message = r * ||r″||P A , where r * is the result of encrypting the random number r with the public key of the information receiving device B using the SM2 public key. A It is the public key of the information sending device A, which is sent to the information receiving device.
[0061] S5. The information receiving device first verifies the information at the key management service based on the public key information of the information sending device. After the verification is passed, it is determined that the received information is key negotiation information or contains encrypted communication information. If it is key negotiation information, the session key is negotiated and saved to the key management service; if it contains encrypted communication information, the session key is queried at the key management service and decrypted.
[0062] In step S5, the information receiving device first verifies the public key information of the information sending device to the key management service. Specifically, the information receiving device verifies whether the public key of the information sending device is legal, that is, extracts the public key P of the information sending device in the Message. A Query the key management service. If it exists, the verification is successful. Otherwise, the verification fails and an error message is returned, ending the key negotiation process.
[0063] In step S5, if it is key negotiation information, the session key is negotiated and saved to the key management service, specifically,
[0064] S51, the information receiving device extracts the r in the Message * , use your own private key to decrypt and get a random number in, To use the private key pair r of information receiving device B * Decrypt the SM2 private key;
[0065] S52, the information receiving device extracts the signature result r″ in the Message and calculates And verify whether H(r) is equal to If they are the same, the verification is successful. After the verification is passed, the random number r is used as the private value for the symmetric encryption communication key generated by both parties and saved to the key management service; otherwise, the verification fails and an error message is returned and the key negotiation process ends. Among them, symmetric encryption can use the national secret SM4 algorithm. After the verification is successful, the session key can be saved to the key management service for a period of time, so that the next time the two parties communicate, the session key is used for encrypted communication.
[0066] This PMU power system communication method based on the national secret algorithm not only eliminates the need for certificate management, but also solves the problem of key hosting in the identity-based encryption system. At the same time, it combines the national secret algorithm for signing, verification, and encryption, which enables the terminals in the PMU power system to safely complete identity authentication. The negotiated session key is then used to encrypt the communication information, making the authentication communication of the PMU power system both lightweight and secure.
[0067] This PMU power system communication method based on the national secret algorithm first obtains the national secret SM2 private key from the key management service in the PMU power system by both communicating parties, then generates the national secret SM2 complete public-private key pair locally based on the local private value and part of the private key and registers with the key management service, providing the ID and public key. After that, the information sender generates a session key and encrypts and signs the session key to send it to the receiver. Finally, the receiver verifies the sender's public key and the signature and decrypts it to obtain the session key and use it for subsequent encrypted communications. This method can clearly ensure the data security of each terminal in the PMU power system during communication, and ensure that the data transmission process will not be eavesdropped, forged or tampered with. It has broad practical value and application prospects in the field of smart grids.
[0068] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A PMU power system communication method based on a national secret algorithm, characterized in that: The following steps are included: S1. The information sending device and the information receiving device, as the communicating parties, apply to the key management service of the PMU power system to obtain the national secret SM2 private key; specifically, S11. Establish a PMU power system key management service system, input the system security parameter k, and the key management service generates a prime number q and a key management service defined in a finite field F. q Elliptic curve E(F q ), G is the elliptic curve E(F q ) is an additive group of order q consisting of points on is the system master key, calculate the master public key P KGC =xG, which is kept secret by the key management service; select a secure and collision-resistant hash function H2:{0,1} * →{0,1} k , where G q is a prime field containing q elements, is the n-th order additive cyclic group Z n The Abelian group formed by the reversible elements in G, n is the order of G, H2 is the hash function, and the public system parameters params = {F q ,E(F q ),n,G,P KGC ,H1,H2}; S12, the information sending device and the information receiving device respectively apply for a private key from the key management service, the key management service generates a private key, and sends the generated private key to the information sending device and the information receiving device respectively through a secure channel; specifically, S121, terminal device A, as the information sending device, submits its identity ID to the key management service A ; S122, random selection of key management service in, By Z n The multiplicative group of all non-zero elements in ; calculate Y A =y A G,q A =H1(ID A ,Y A ),u A =y A +xq A , where y A is a randomly selected secret value, G is the elliptic curve E(F q ) is an additive group of order q, Y A By y A The generated public key, u A is the generated private key, q A It is the result of hash calculation based on ID and public key; and (u A , Y A ) is sent to terminal device A; S123, terminal device A verifies u A G=Y A +q A P KGC , where G is the elliptic curve E(F q ) is an additive group of order q, Y A is a randomly chosen secret value y A The generated public key, q A It is the result of hash calculation based on ID and public key. KGC Is the master public key? If true, receive the private key u A Similarly, terminal device B, as an information receiving device, obtains the private key u B ; S2. The communicating parties combine the local secret value to generate the national secret SM2 complete public-private key, and register the public key and ID to the system key management service; specifically, S21. The two communicating parties generate secret values respectively, and the information sending device randomly selects the secret value The information receiving device randomly selects a secret value S22, the communicating parties generate complete private keys respectively, and the information sending device sends the private key u A and the secret value v A Combined, we get the complete private key d A =(u A ,v A ); Similarly, the information receiving device obtains the complete private key d B =(u B ,v B ); S23, both parties generate complete public keys respectively, and the information sending device calculates X A =u A G,T A =v A G, where X A The terminal device A uses the partial private key u A The generated partial public key, T A The terminal device A selects the secret value v A Generate a partial public key to obtain the complete public key P A =(X A ,T A ); Similarly, the information receiving device obtains the complete public key P B =(X B ,T B ), where X B The terminal device B uses the partial private key u B The generated partial public key, T B The terminal device B selects the secret value v B The generated partial public key; S24, the information sending device and the information receiving device respectively register the generated complete public key with the system key management service and provide ID information; S3, the information sending device queries the key management service whether there is a session key between it and the information receiving device. If so, it uses the session key for encrypted communication and attaches its own ID and public key information; if not, it proceeds to the next step S4 to negotiate the session key; S4, the information sending device generates a session key and encrypts and signs the session key, and then sends the encrypted session key, signature result, public key and ID information to the information receiving device; specifically, S41, the information sending device verifies the identity of the information receiving device with the help of the key management service, that is, based on the identity ID of the information receiving device B Query to obtain its public key P B , if found, the verification is successful; S42, the information sending device randomly selects a random number r and encrypts it using the public key of the information receiving device, that is, in, To perform SM2 public key encryption on the random number r using the public key of the information receiving device B; S43. The information sending device generates a summary r' of the random number r using the SM3 cryptographic hash algorithm: r'=H(r), where H() is a cryptographic hash function; and then uses the private key to sign the summary r' to obtain a signature result r": in, To use the private key of the information sending device A to perform SM2 signature on the summary r'; set Message = r * ||r"||P A , where r * is the result of encrypting the random number r with the public key of the information receiving device B using the SM2 public key. A The public key of the information sending device A is sent to the information receiving device; S5. The information receiving device first verifies the information of the information sending device and the public key information at the key management service. After the verification is passed, it is determined that the received information is key negotiation information or contains encrypted communication information. If it is key negotiation information, the session key is negotiated and saved to the key management service; if it contains encrypted communication information, the session key is queried at the key management service and decrypted; In step S5, if it is key negotiation information, the session key is negotiated and saved to the key management service, specifically, S51, the information receiving device extracts the r in the Message * , use your own private key to decrypt and get a random number in, To use the private key pair r of information receiving device B * Decrypt the SM2 private key; S52, the information receiving device extracts the signature result r" in the Message, and calculates And verify whether H(r) is equal to If they are the same, the verification is successful. After the verification is passed, the random number r is used as the private value for the subsequent symmetric encryption communication key generation between the two parties and saved to the key management service; otherwise, the verification fails, an error message is returned, and the key negotiation process ends.
2. The PMU power system communication method based on the national secret algorithm as claimed in claim 1, characterized in that: In step S5, the information receiving device first verifies the public key information of the information sending device to the key management service. Specifically, the information receiving device verifies whether the public key of the information sending device is legal, that is, extracts the public key P of the information sending device in the Message. A Query the key management service. If it exists, the verification is successful. Otherwise, the verification fails and an error message is returned, ending the key negotiation process.
3. The PMU power system communication method based on the national secret algorithm as claimed in claim 1, characterized in that: In step S1, the key management service is deployed in a cluster.