Dual-copy power network security audit methods, systems, media and equipment

Abstract

This invention discloses a dual-copy power network security audit method, system, medium, and device. It generates copy I and copy II based on audit data from power system terminals to be audited and verified. Copy I is signed on-chain audit evidence data stored on a blockchain, while copy II is signed and indexed original audit data stored in an off-chain audit database. During auditing, copy I is retrieved from the blockchain, and copy II is retrieved from the off-chain audit database. Copy I and copy II are compared to obtain the audit result. Advantages: Audit data in the blockchain-based network security audit platform cannot be arbitrarily modified or deleted, exhibiting independent evidence storage and retrieval, reliable evidence data, and high risk identification capabilities. The dual-copy mechanism of on-chain and off-chain audit data enables effective evidence storage and retrieval of power network security audit data.

Description

Technical Field

[0001] This invention relates to a dual-copy power network security auditing method, system, medium, and equipment, belonging to the field of power system auditing technology. Background Technology

[0002] With the development of new power systems, various types of terminals are ubiquitously interconnected, and electronic data takes on complex and diverse forms, posing challenges to the effectiveness of power network security audits. Traditional blockchain-based audit systems fail to demonstrate the "mapping relationship" between audit data and off-chain data. When the off-chain environment changes, auditors cannot be promptly informed and able to collect evidence. Furthermore, power network security audit systems handle diverse data types; traditional blockchain systems, primarily focused on transaction data processing, struggle to effectively handle complex unstructured data. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a dual-copy power network security audit method, system, medium and equipment.

[0004] To address the aforementioned technical problems, this invention provides a dual-copy power network security auditing method, comprising:

[0005] Based on the audit data of the power system terminal to be audited and verified, copies I and II are generated; wherein, copy I is the signed on-chain audit evidence stored on the blockchain, and copy II is the signed original audit data with on-chain index stored in an off-chain audit database;

[0006] During the audit, copy I is obtained from the blockchain, and copy II is obtained from the off-chain audit database;

[0007] The audit results are obtained by comparing the copy I and the copy II.

[0008] Furthermore, based on the audit data of the power system terminals to be audited and verified, copies I and II are generated, including:

[0009] The audit data is digitally signed to obtain signed audit evidence data, and the signed audit evidence data is stored on the blockchain through an on-chain oracle.

[0010] The audit data is digitally signed and indexed to obtain original audit data with a signature and on-chain index. The original audit data with a signature and on-chain index is then stored in the off-chain audit database.

[0011] Furthermore, the step of obtaining copy I from the blockchain and copy II from the off-chain audit database during the audit includes:

[0012] The on-chain audit evidence storage data with signatures obtained from the blockchain corresponding to the power system terminal is subjected to consistency verification based on evidence fingerprint. After the verification is passed, a copy I corresponding to the power system terminal is obtained.

[0013] Before using the original audit data with signatures and on-chain indexes corresponding to the power system terminal obtained from the off-chain audit database, signature verification is required. After successful verification, a copy II corresponding to the power system terminal is obtained.

[0014] Furthermore, the comparison of copy I and copy II to obtain the audit result includes:

[0015] The power system terminal corresponding to copy I and the power system terminal corresponding to copy II are compared and linked through an index. After the comparison is successful, evidence calculation, voucher verification and event tracing are performed. The audit results are obtained based on the results of evidence calculation, voucher verification and event tracing.

[0016] Furthermore, the metadata of the original evidence storage data in the copy I is organized in the form of blocks, and the blocks include block headers, evidence trees, evidence fingerprints and additional data;

[0017] The block header includes a block identifier, block height, timestamp, previous block pointer, evidence root, and evidence fingerprint pointer. The block identifier uniquely identifies a block on the blockchain. The block height indicates the distance between the current block and the genesis block. The timestamp records the time information of evidence being uploaded to the blockchain. The previous block pointer points to the block header of the previous block. The evidence root stores the hash value of the evidence information in the current block. The evidence fingerprint pointer points to the evidence fingerprint information of the evidence items contained in this block.

[0018] The evidence storage tree includes an evidence storage root obtained from the block header, a tree-structured hash node, and leaf nodes. The leaf node is the MD5 digest of the replica type II evidence storage item. The leaf node has a unique parent node, and its value is the corresponding hash value.

[0019] The evidence fingerprint is used to store the consistency verification information of the evidence data of the power system terminal to be audited and verified.

[0020] The additional data is custom information specified for power network security audit operations.

[0021] Furthermore, the digital signature is an evidence fingerprint injection and on-chain storage process, including:

[0022] Choose a prime number q∈Z q Choose a non-singular elliptic curve over a finite field GF(q); select a random integer r∈Z. q Using the system private key within the current security period T, calculate the signature public key K. pub =rG; Select a common hash function H1: {0, 1}*→G1*, H2:G T →{0,1} n Among them, Z q Let G be an integer group of order q, G be a generator on a non-singular elliptic curve, G1 be an additive group, GT be a multiplicative group, H1 and H2 represent hash functions H1 and H2 respectively, and n be the ciphertext length.

[0023] Given a user identifier as User_ID,

[0024] Its corresponding public key P ID For an element in G1 generated by the hash function H1, it is represented as: P ID =H1(User_ID||hash(Data_Set)||Time_Stamp); Data_Set is the evidence dataset, Time_Stamp is the timestamp, and hash() is any hash function other than H1 and H2;

[0025] Its corresponding private key S ID For: S ID =rP ID =rH1(User_ID||hash(Data_Set)||Time_Stamp);

[0026] Before the data in copy I is uploaded to the blockchain, an evidence fingerprint is injected, including:

[0027] Obtain the hash digest Su of the copy II data of the fingerprint to be injected, denoted as:

[0028] Su=hash(join{Data_ID|ID∈Data_Set})

[0029] `join` combines audit data items corresponding to different data identifiers using string concatenation, where `Data_ID` is the identifier of the audit data item.

[0030] Using private key S ID Encrypt the hash digest Su using an identity-based encryption method, including:

[0031] Choose a random number k, calculate the ciphertext component C1, expressed as: C1 = kP ID ;

[0032] Calculate the ciphertext component C2, which is expressed as: Where is a bilinear mapping;

[0033] The upstream oracle calls the smart contract to store the evidence fingerprint and data on the chain. The content stored on the chain is copy I, which is expressed as: <C1, C2, audit evidence data>.

[0034] Furthermore, the consistency check based on the evidence fingerprint includes:

[0035] According to the ciphertext component C1, the ciphertext component C2 and the public key P ID , calculate the hash digest Su of the copy II data of the fingerprint to be injected.

[0036] According to the corresponding User_ID and Data_ID data obtained from copy II, calculate

[0037] Su' = hash(join{Data_ID|ID∈Data_Set});

[0038] Judge whether Su' is equal to Su. If it holds, it indicates that the evidence data is consistent. Otherwise, return an evidence verification exception. Su' represents the verification calculation result of the hash digest of the copy II data.

[0039] A dual-copy power network security audit system based on blockchain includes:

[0040] A generation module for generating copy I and copy II based on the audit data of the power system terminal to be audited and verified; where copy I is the signed on-chain audit evidence data stored on the blockchain, and copy II is the original audit data with signatures and on-chain indexes stored in the off-chain audit database;

[0041] An acquisition module, when conducting an audit, acquires copy I from the blockchain and acquires copy II from the off-chain audit database;

[0042] A comparison module for comparing copy I and copy II to obtain an audit result.

[0043] Furthermore, the generation module is used for

[0044] Perform digital signature processing on the audit data to obtain signed audit evidence data, and store the signed audit evidence data on the blockchain through the upstream oracle;

[0045] The audit data is digitally signed and indexed to obtain original audit data with a signature and on-chain index. The original audit data with a signature and on-chain index is then stored in the off-chain audit database.

[0046] Furthermore, the acquisition module is used for

[0047] The on-chain audit evidence storage data with signatures obtained from the blockchain corresponding to the power system terminal is subjected to consistency verification based on evidence fingerprint. After the verification is passed, a copy I corresponding to the power system terminal is obtained.

[0048] Before using the original audit data with signatures and on-chain indexes corresponding to the power system terminal obtained from the off-chain audit database, signature verification is required. After successful verification, a copy II corresponding to the power system terminal is obtained.

[0049] Furthermore, the comparison module,

[0050] This is used to compare and associate the corresponding copy I and the corresponding copy II of the power system terminal through an index. After the comparison is successful, evidence calculation, voucher verification and event tracing are performed. The audit results are obtained based on the results of evidence calculation, voucher verification and event tracing.

[0051] Furthermore, the metadata of the original evidence storage data in the copy I is organized in the form of blocks, and the blocks include block headers, evidence trees, evidence fingerprints and additional data;

[0052] The block header includes a block identifier, block height, timestamp, previous block pointer, evidence root, and evidence fingerprint pointer. The block identifier uniquely identifies a block on the blockchain. The block height indicates the distance between the current block and the genesis block. The timestamp records the time information of evidence being uploaded to the blockchain. The previous block pointer points to the block header of the previous block. The evidence root stores the hash value of the evidence information in the current block. The evidence fingerprint pointer points to the evidence fingerprint information of the evidence items contained in this block.

[0053] The evidence storage tree includes an evidence storage root obtained from the block header, a tree-structured hash node, and leaf nodes. The leaf node is the MD5 digest of the replica type II evidence storage item. The leaf node has a unique parent node, and its value is the corresponding hash value.

[0054] The evidence fingerprint is used to store the consistency verification information of the evidence data of the power system terminal to be audited and verified.

[0055] The additional data is custom information specified for power network security audit operations.

[0056] Furthermore, the generation module includes:

[0057] Initialization unit, used to select prime number q∈Z q Choose a non-singular elliptic curve over a finite field GF(q); select a random integer r∈Z. q Using the system private key within the current security period T, calculate the signature public key K. pub =rG; Select a common hash function H1: {0, 1}*→G1*, H2:G T →{0,1} n Among them, Z q Let G be an integer group of order q, G be a generator on a non-singular elliptic curve, G1 be an additive group, GT be a multiplicative group, H1 and H2 represent hash functions H1 and H2 respectively, and n be the ciphertext length.

[0058] The user identifier is User_ID;

[0059] Its corresponding public key P ID For an element in G1 generated by the hash function H1, it is represented as: P ID =H1(User_ID||hash(Data_Set)||Time_Stamp); Data_Set is the evidence dataset, Time_Stamp is the timestamp, and hash() is any hash function other than H1 and H2;

[0060] Its corresponding private key S ID For: S ID =rP ID =rH1(User_ID||Data_Set||Time_Stamp);

[0061] The digital signature unit is used to inject an evidence fingerprint before the data of copy I is uploaded to the blockchain, including:

[0062] Obtain the hash digest Su of the copy II data of the fingerprint to be injected, denoted as:

[0063] Su=hash(join{Data_ID|ID∈Data_Set})

[0064] `join` combines audit data items corresponding to different data identifiers using string concatenation, where `Data_ID` is the identifier of the audit data item.

[0065] Using private key S ID Encrypt the identity using the hash digest Su, including:

[0066] Choose a random number k, calculate the ciphertext component C1, expressed as: C1 = kP ID ;

[0067] Calculate the ciphertext component C2, expressed as: Wherein, is a bilinear mapping;

[0068] The upstream oracle calls the smart contract to store the fingerprint and data on the chain, and the content stored on the chain is copy I, expressed as: <C1, C2, audit evidence data>.

[0069] Furthermore, the comparison module includes:

[0070] A first calculation unit, configured to calculate, according to the ciphertext component C1, the ciphertext component C2 and the public key P ID , to obtain the hash digest Su of the copy II data of the fingerprint to be injected; <00s;In the network security audit platform based on the blockchain, the audit data cannot be modified and deleted randomly, and has the properties of independent evidence storage and collection, reliable evidence data, high risk recognition, etc. Through the dual-copy mechanism of on-chain audit data and off-chain audit data, the effective evidence storage and collection of power network security audit data are realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 ​​​​​​​​​​​​​​​​​​​​​This is a schematic diagram of the process of the present invention;

[0080] Figure 2 This is a framework diagram of the invention.

[0081] Figure 3 A diagram of the replica II data structure;

[0082] Figure 4 This is a data structure diagram for copy I. Detailed Implementation

[0083] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0084] like Figure 1 As shown, a dual-copy power network security auditing method includes:

[0085] Based on the audit data of the power system terminal to be audited and verified, copies I and II are generated; wherein, copy I is the signed on-chain audit evidence stored on the blockchain, and copy II is the signed original audit data with on-chain index stored in an off-chain audit database;

[0086] During the audit, copy I is obtained from the blockchain, and copy II is obtained from the off-chain audit database;

[0087] The audit results are obtained by comparing the copy I and the copy II.

[0088] In this invention, power system terminal audit data is transmitted to the audit platform via an embedded data acquisition interface. The platform stores the data using dual copies based on a blockchain and an off-chain audit database. Only metadata with evidentiary fingerprints is stored on the blockchain. During audit verification, the on-chain audit data is compared with the off-chain data to obtain a reliable audit result. Figure 2 As shown.

[0089] Specifically, it includes the following steps:

[0090] Step 1: The audit data (such as business records, logs, etc.) submitted by the audited node is submitted to the data interface of the audit system through the basic data collection module.

[0091] Step Two: The data interface digitally signs the original data and then stores it as evidence. The audit data for evidence storage is saved in two equal copies. Copy I is the signed audit evidence data, which, after being injected with evidence data fingerprints, is hashed to obtain the audit credential. This data is stored on-chain via an on-chain oracle. Copy II is the original audit data with a signature and on-chain index, stored in an off-chain audit database.

[0092] Step 3: Replica I data is stored on the blockchain by calling a smart contract through an on-chain oracle. The blockchain adopts a consortium blockchain, and the consensus algorithm is RAFT. The blockchain distributed ledger is synchronously stored in new power system nodes such as scheduling nodes, new energy nodes, energy storage terminal nodes, adjustable load terminal nodes, and operator nodes. The ledger data is stored using the InterPlanetary File System (IPFS).

[0093] Step Four: The audit component compares on-chain and off-chain data to obtain audit results. Data retrieved from the blockchain undergoes a consistency check on its evidence fingerprint before use; upon successful verification, copy I is obtained. Data obtained from off-chain audit data undergoes signature verification before use; upon successful verification, copy II is obtained. Copy I and copy II are correlated and compared using an index. After successful comparison, evidence calculation, credential verification, and event tracing are performed. These results support verification and tracing services.

[0094] Step 5: The audit component interfaces with the audit module in the network security management platform through a data interaction interface to realize the audit function of the network security management platform.

[0095] Furthermore, the evidence data is stored in a specific format, as follows:

[0096] (1) Original audit evidence data format (copy II)

[0097] The data item storage format of Copy II is as follows: Figure 3 As shown. Replica II data can be identified as an 8-tuple Data_i =<User_ID,Data_ID,Type,Length,Time_Stamp,Data,D_sig,EoD> express.

[0098] in:

[0099] User_ID: User identifier.

[0100] Data_ID: Identifier of audit data.

[0101] Type: Indicates the source of the audit data; different sources have different numbers.

[0102] Length: Describes the length of the numeric portion, in bytes.

[0103] Time_Stamp: Identifies the time when the evidence data was generated.

[0104] Data: Includes the auditee's data logs and behavioral records. The data content is of variable length and is determined based on the node's business characteristics.

[0105] D_sig: Signs the content of the data field using a digital signature algorithm.

[0106] EoD: End marker for evidence storage, set to 111.

[0107] (2) Blockchain Data Storage Notification Data Format (Copy I)

[0108] Blockchain data storage only stores the metadata of the original stored data, which is organized in the form of blocks, as follows:

[0109] The block consists of a block header, a proof tree, proof fingerprints, and additional data, with the previous block pointer pointing to the previous block's block header. The proof tree contains a proof root and a tree-structured hash node. Leaf nodes D1, D2, D3, and D4 are the MD5 digests of the replica type II proof items. Each leaf node has a unique parent node whose value is the corresponding hash value. The specific calculation method is as follows:

[0110]

[0111] A block identifier uniquely identifies a block on the chain.

[0112] The evidence fingerprint pointer points to the evidence fingerprint information of the evidence item contained in this block. Additional data is custom information specified for power network security auditing services; it does not participate in the block's hash value calculation, and its specific content is determined based on the on-chain configuration.

[0113] Block height represents the distance of the current block from the genesis block, and can accurately describe the position of the current block on the chain. The height of the genesis block is 0.

[0114] The data in copy I is stored in JSON format.

[0115] Furthermore, the evidence fingerprint injection and verification process is as follows:

[0116] 1. Evidence fingerprint injection and on-chain storage process

[0117] The evidence fingerprint injection employs an identity-based encryption scheme. The identity of the audited terminal node is used as the encryption public key, and the corresponding private key is used to encrypt the on-chain data identifier and timestamp. The system also includes a key management center responsible for generating and updating identity-based keys. Let the user identifier be User_ID, and the dataset be represented as:

[0118] Data_Set = {Data_ID} i :Time_Stamp i |i∈N}

[0119] Here, a dataset refers to a set of multiple audit data items corresponding to the same block (N is the number of data items in each dataset), and each fingerprint injection is measured in units of the number of data items stored in one block. The evidence fingerprint injection process specifically includes the following steps:

[0120] Step 11): Initialization process. The key management center generates encryption parameters based on the identity encryption scheme: select a prime number q∈Z. q Choose a non-singular elliptic curve over a finite field GF(q); select a random integer r∈Z. q Using the system private key within the current security period T, calculate the signature public key K. pub =rG, where G is a generator on an elliptic curve; select common hash functions H1: {0, 1}*→G1*, H2:G T →{0,1} n Where G1 is the additive group, G T It is a multiplication group.

[0121] Given a user identifier named User_ID, its corresponding public key P ID For the element P in G1 generated by the hash function H1: ID =H1(User_ID||hash(Data_Set)||Time_Stamp);

[0122] Private key S ID For: S ID =rP ID =rH1(User_ID||Data_Set||Time_Stamp). Where hash() can be any hash function other than H1 and H2, such as SHA-3, MD5, or SM3.

[0123] Step 12): Before copy I data is uploaded to the blockchain, evidence fingerprints are injected, including the following sub-steps:

[0124] Sub-step 1: Obtain the hash digest of the copy II data of the fingerprint to be injected:

[0125] Su=hash(join{Data-ID|ID∈Data_Set})

[0126] Sub-step 2: Using private key S ID Encrypt the digest information using an identity-based encryption method:

[0127] Calculate ciphertext component C1: Select a random number k and calculate C1 = kP;

[0128] Computation ciphertext component C2: in

[0129] The upstream oracle calls the smart contract to store the fingerprint and data on the chain, and the content stored on the chain is: <C1, C2, copy I>.

[0130] 2. Process of verifying the consistency of data fingerprints

[0131] Step 21): According to the ciphertext components C1, C2 and the public key P ID , calculate

[0132] Step 22): According to the corresponding User_ID and Data_ID data obtained from copy II, calculate

[0133] Su' = hash(join{Data-ID|ID∈Data_Set})

[0134] Judge whether Su' = Su holds. If it holds, it indicates that the stored data is consistent; otherwise, return an exception in the stored evidence verification.

[0135] By embedding the data acquisition module into the audited node, real-time data access to the business platform in the new power system is achieved, and the acquisition, mining, storage, and automated intelligent auditing of audit data are realized. In the blockchain-based network security audit platform, the audit data cannot be modified or deleted arbitrarily, and it has the properties of independent evidence storage and collection, reliable stored evidence data, high risk recognition, etc. Through the dual-copy mechanism of on-chain audit data and off-chain audit data, the effective storage and collection of power network security audit data are realized.

[0136] Correspondingly, the present invention also provides a dual-copy power network security audit system, including:

[0137] A generation module, used to generate copy I and copy II based on the audit data of the power system terminal to be audited and verified; wherein, copy I is the signed on-chain audit stored evidence data stored on the blockchain, and copy II is the original audit data with signature and on-chain index stored in the off-chain audit database;

[0138] An acquisition module, when conducting an audit, acquires copy I from the blockchain and acquires copy II from the off-chain audit database;

[0139] A comparison module, used to compare copy I and copy II to obtain an audit result. <了

[0140] Furthermore, the generation module is used to

[0141] Perform digital signature processing on the audit data to obtain signed audit stored evidence data, and store the signed audit stored evidence data on the blockchain through the upstream oracle;

[0142] The audit data is digitally signed and indexed to obtain original audit data with a signature and on-chain index. The original audit data with a signature and on-chain index is then stored in the off-chain audit database.

[0143] Furthermore, the acquisition module is used for

[0144] The on-chain audit evidence storage data with signatures obtained from the blockchain corresponding to the power system terminal is subjected to consistency verification based on evidence fingerprint. After the verification is passed, a copy I corresponding to the power system terminal is obtained.

[0145] Before using the original audit data with signatures and on-chain indexes corresponding to the power system terminal obtained from the off-chain audit database, signature verification is required. After successful verification, a copy II corresponding to the power system terminal is obtained.

[0146] Furthermore, the comparison module,

[0147] This is used to compare and associate the corresponding copy I and the corresponding copy II of the power system terminal through an index. After the comparison is successful, evidence calculation, voucher verification and event tracing are performed. The audit results are obtained based on the results of evidence calculation, voucher verification and event tracing.

[0148] Furthermore, the metadata of the original evidence storage data in the copy I is organized in the form of blocks, and the blocks include block headers, evidence trees, evidence fingerprints and additional data;

[0149] The block header includes a block identifier, block height, timestamp, previous block pointer, evidence root, and evidence fingerprint pointer. The block identifier uniquely identifies a block on the blockchain. The block height indicates the distance between the current block and the genesis block. The timestamp records the time information of evidence being uploaded to the blockchain. The previous block pointer points to the block header of the previous block. The evidence root stores the hash value of the evidence information in the current block. The evidence fingerprint pointer points to the evidence fingerprint information of the evidence items contained in this block.

[0150] The evidence storage tree includes an evidence storage root obtained from the block header, a tree-structured hash node, and leaf nodes. The leaf node is the MD5 digest of the replica type II evidence storage item. The leaf node has a unique parent node, and its value is the corresponding hash value.

[0151] The evidence fingerprint is used to store the consistency verification information of the evidence data of the power system terminal to be audited and verified.

[0152] The additional data is custom information specified for power network security audit operations.

[0153] Furthermore, the generation module includes:

[0154] Initialization unit, used to select prime number q∈Z q Choose a non-singular elliptic curve over a finite field GF(q); select a random integer r∈Z. q Using the system private key within the current security period T, calculate the signature public key K. pub =rG; Select a common hash function H1: {0, 1}*→G1*, H2:G T →{0,1} n Among them, Z q Let G be an integer group of order q, G be a generator on a non-singular elliptic curve, G1 be an additive group, GT be a multiplicative group, H1 and H2 represent hash functions H1 and H2 respectively, and n be the ciphertext length.

[0155] The user identifier is User_ID;

[0156] Its corresponding public key P ID For an element in G1 generated by the hash function H1, it is represented as: P ID =H1(User_ID||hash(Data_Set)||Time_Stamp); Data_Set is the evidence dataset, Time_Stamp is the timestamp, and hash() is any hash function other than H1 and H2;

[0157] Its corresponding private key S ID For: S ID =rP ID =rH1(User_ID||Data_Set||Time_Stamp);

[0158] The digital signature unit is used to inject an evidence fingerprint before the data of copy I is uploaded to the blockchain, including:

[0159] Obtain the hash digest Su of the copy II data of the fingerprint to be injected, denoted as:

[0160] Su=hash(join{Data_ID|ID∈Data_Set})

[0161] `join` combines audit data items corresponding to different data identifiers using string concatenation, where `Data_ID` is the identifier of the audit data item.

[0162] Using private key S ID Encrypt the identity using the hash digest Su, including:

[0163] Select a random number k and calculate the ciphertext component C1, which is expressed as: C1 = kP ID ;

[0164] Calculate the ciphertext component C2, which is expressed as: Wherein, is a bilinear mapping;

[0165] The on-chain oracle calls the smart contract to store the fingerprint and data on the chain. The on-chain content is the copy I, which is expressed as: <C1, C2, audit and deposit data>.

[0166] Furthermore, the comparison module includes:

[0167] The first calculation unit is used to calculate the hash digest Su of the copy II data of the fingerprint to be injected according to the ciphertext component C1, the ciphertext component C2 and the public key P ID ,;

[0168] The second calculation unit is used to calculate according to the corresponding User_ID and Data_ID data obtained from the copy II

[0169] Su' = hash(join{Data-ID|ID∈Data_Set});

[0170] Judge whether Su' is equal to Su. If it holds, it indicates that the deposit data is consistent. Otherwise, return the deposit verification exception. Su' represents the verification calculation result of the hash digest of the copy II data.

[0171] Correspondingly, the present invention also provides a computer-readable storage medium storing one or more programs. The one or more programs include instructions, and when the instructions are executed by a computing device, the computing device executes any one of the methods in the above method.

[0172] Correspondingly, the present invention also provides a computing device, including:

[0173] One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors. The one or more programs include instructions for executing any one of the methods in the above method.

[0174] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0175] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0176] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0177] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0178] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A dual-copy power network security auditing method, characterized in that, The method comprises the following steps: generating a copy I and a copy II of the audit data of the power system terminal to be audited based on the verification; when the audit is performed, obtaining the copy I from the blockchain and obtaining the copy II from the off-chain audit database; comparing the copy I and the copy II to obtain an audit result; the method for generating a copy I and a copy II of the audit data of the power system terminal to be audited based on the verification comprises the following steps: performing digital signature processing on the audit data to obtain signed audit evidence data, and storing the signed audit evidence data on the blockchain through a chain-up oracle; performing digital signature and index generation processing on the audit data to obtain original audit data with a signature and an on-chain index, and storing the original audit data with the signature and the on-chain index in the off-chain audit database; when the audit is performed, obtaining the copy I from the blockchain and obtaining the copy II from the off-chain audit database comprises the following steps: performing consistency verification on the signed on-chain audit evidence data corresponding to the power system terminal obtained from the blockchain based on the evidence fingerprint, and obtaining the copy I corresponding to the power system terminal after the verification is passed; the original audit data with the signature and the on-chain index corresponding to the power system terminal obtained from the off-chain audit database needs to be signed before use, and the copy II corresponding to the power system terminal is obtained after the verification is passed; the digital signature is an evidence fingerprint injection and evidence storage chain-up process, which comprises the following steps: Selecting prime numbers , selecting a non-singular elliptic curve on a finite field ; selecting a random integer as a system private key in a current security period T, calculating a signature public key ; selecting a public hash function ; wherein, is a q-order integer group, G is a generator on a non-singular elliptic curve, G1 is an additive group, GT is a multiplicative group, H1 and H2 represent hash function H1 and hash function H2 respectively, and n is a ciphertext length; a given user identifier is User_ID, its corresponding public key is an element in G1 generated by mapping through hash function H1, denoted as: ; is a set of evidence data, is a timestamp, and hash() is an arbitrary hash function other than H1 and H2. its corresponding private key is: ; before the data of the copy I is stored on the chain, the evidence fingerprint is injected, which comprises the following steps: obtaining a hash digest of a copy of the fingerprint to be injected is represented as: ； The joint of the audit data items corresponding to different data identifiers is implemented by string connection, an audit data item identifier; Using the private key Computing a hash digest Performing identity-based encryption, comprising: selecting a random number k, computing a ciphertext component C1, denoted as: ; The cryptographic component C2, denoted as: wherein, , is a bilinear mapping; the chain-up oracle calls the smart contract to store the evidence fingerprint and the data on the chain, and the chain-up content is the copy I, which is represented as <C1, C2, audit evidence data>.

2. The doublet power network security auditing method of claim 1, wherein, when the audit is performed, obtaining the copy I from the blockchain and obtaining the copy II from the off-chain audit database comprises the following steps: performing consistency verification on the signed on-chain audit evidence data corresponding to the power system terminal obtained from the blockchain based on the evidence fingerprint, and obtaining the copy I corresponding to the power system terminal after the verification is passed; the original audit data with the signature and the on-chain index corresponding to the power system terminal obtained from the off-chain audit database needs to be signed before use, and the copy II corresponding to the power system terminal is obtained after the verification is passed; 3. The doublet power network security auditing method of claim 2, wherein, comparing the copy I and the copy II to obtain an audit result comprises the following steps: the copy I corresponding to the power system terminal and the copy II corresponding to the power system terminal are associated and compared through the index, and after the comparison is passed, evidence calculation, certificate verification and event tracing are performed, and an audit result is obtained according to the results of the evidence calculation, the certificate verification and the event tracing.

4. The dual-copy power network security audit method according to claim 1, wherein The copy I accesses the metadata of the original storage data, and is organized in the form of blocks, and the blocks include a block header, a storage tree, a storage fingerprint, and additional data; The block header includes a block identifier, a block height, a timestamp, a previous block pointer, a storage root, and a storage fingerprint pointer; the block identifier is used to uniquely specify a block on the block chain; the block height is used to represent the distance of the current block from the genesis block; the timestamp is used to record the time information of the storage on-chain; the previous block pointer is used to point to the block header of the previous block; the storage root is used to store the hash value of the storage information in the current block; and the storage fingerprint pointer is used to point to the storage fingerprint information of the storage items contained in the block; The storage tree includes the storage root obtained from the block header, Hash nodes and leaf nodes in a tree structure, and the leaf node is an MD5 digest of a copy II type storage item, and the leaf node has a unique parent node, and the value of the leaf node is a corresponding hash value; The storage fingerprint is used to save the consistency verification information of the storage data of the power system terminal to be audited and verified; The additional data is custom information specified for the power network security audit service.

5. The dual-replica power network security auditing method of claim 2, wherein, The consistency verification based on the evidence fingerprint includes: According to the ciphertext component C1, the ciphertext component C2 and the public key , a hash digest of the copy II data of the pseudo-injection fingerprint is calculated ; According to the corresponding User_ID and Data_ID data obtained from the copy II, the hash value of the storage data of the power system terminal to be audited and verified is calculated ； determining whether equal , if true, indicating that the evidence data has consistency, otherwise returning an evidence verification exception, represents the verification calculation result of the hash digest of the copy II data.

6. A dual-copied power network security auditing system, characterized by, including: A generation module is configured to generate a copy I and a copy II based on audit data of a power system terminal to be audited and verified; wherein the copy I is signed on-chain audit storage data stored on a block chain, and the copy II is original audit data stored in an off-chain audit database with signature and on-chain index; An acquisition module is configured to acquire the copy I from the block chain and the copy II from the off-chain audit database during auditing; A comparison module is configured to compare the copy I and the copy II to obtain an audit result; The generation module is configured to perform digital signature processing on the audit data to obtain signed audit storage data, and store the signed audit storage data on the block chain through a chain prediction machine; perform digital signature and index generation processing on the audit data to obtain original audit data with signature and on-chain index, and store the original audit data with signature and on-chain index in the off-chain audit database; The generation module includes: Initialization unit, for selecting prime number , selecting a non-singular elliptic curve on finite field ; selecting random integer as the system private key in the current security period T, calculating the signature public key ; selecting public hash function ; wherein, is the integer group of order q, G is the generator on the non-singular elliptic curve, G1 is the additive group, GT is the multiplicative group, H1 and H2 represent hash function H1 and hash function H2 respectively, and n is the ciphertext length. a given user identifier User_ID; its corresponding public key is an element in G1 generated by mapping through hash function H1, denoted as: ; is a set of evidence data, is a timestamp, and hash() is an arbitrary hash function other than H1 and H2. its corresponding private key is: ; A digital signature unit is configured to inject an evidence fingerprint before the data of the copy I is stored on the chain, including: obtaining a hash digest of a copy of the fingerprint to be injected is represented as: ； The joint of the audit data items corresponding to different data identifiers is implemented by string connection, an audit data item identifier; Using the private key Computing a hash digest Encrypting the identity, comprising: selecting a random number k, computing a ciphertext component C1, denoted as: ; The cryptographic component C2, denoted as: wherein, , is a bilinear mapping; A chain prediction machine calls a smart contract to store the evidence fingerprint and the data on the chain, and the chain content is the copy I, which is represented as: <C1, C2, audit storage data>.

7. The dual-replica power network security auditing system of claim 6, wherein, The acquisition module is configured to perform consistency verification on the signed on-chain audit storage data corresponding to the power system terminal acquired from the block chain based on the evidence fingerprint, and obtain the copy I corresponding to the power system terminal after the verification is passed; The original audit data with signature and on-chain index corresponding to the power system terminal acquired from the off-chain audit database need to be signed before use, and the copy II corresponding to the power system terminal is obtained after the verification is passed.

8. The dual-replica power network security auditing system of claim 6, wherein, The comparison module, The comparison module is configured to associate and compare the copy I and the copy II through indexes, and perform evidence calculation, certificate verification and event tracing after comparison.

9. The dual-copy power network security auditing system of claim 6, wherein, The copy I stores metadata of original stored evidence data, and is organized in the form of blocks, the blocks including a block header, a stored evidence tree, stored evidence fingerprints and additional data; The block header includes a block identifier, a block height, a timestamp, a previous block pointer, a stored evidence root and a stored evidence fingerprint pointer; the block identifier is configured to uniquely specify a block on a block chain; the block height is configured to indicate a distance of a current block from a genesis block; the timestamp is configured to record time information of stored evidence on-chain; the previous block pointer is configured to point to a block header of a previous block; the stored evidence root is configured to store a hash value of stored evidence information in the current block; and the stored evidence fingerprint pointer is configured to point to stored evidence fingerprint information of stored evidence items contained in the block; The stored evidence tree includes the stored evidence root obtained from the block header, Hash nodes and leaf nodes in a tree structure, the leaf nodes being MD5 digests of copy II type stored evidence items, and the leaf nodes having unique parent nodes with values of corresponding hash values; The stored evidence fingerprints are configured to save consistency verification information of stored evidence data of power system terminals to be audited and verified; The additional data is self-defined information specified for power network security auditing services.

10. The duplicate power network security auditing system of claim 7, wherein, The comparison module includes: a first computing unit configured to compute a hash digest of a copy II of the fingerprint to be injected, based on the ciphertext component C1, the ciphertext component C2 and the public key ;​ The second calculation unit is configured to calculate ； determining whether equal , if true, it indicates that the evidence data has consistency, otherwise returns an evidence verification exception, represents the verification calculation result of the hash digest of the copy II data.

11. A computer-readable storage medium storing one or more programs, wherein the one or more programs comprise instructions executable by one or more computers to perform all the operations of the method of claim 1. The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform any of the methods of claims 1-5.

12. A computing device, comprising: comprise: one or more processors, memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for performing any of the methods of claims 1-5.

Images