A distribution network data transmission method, device, equipment and storage medium

Abstract

The present application discloses a distribution network data transmission method, apparatus, device and storage medium, which relates to the field of communication technology, including: generating a plurality of first keys and sending a first key parameter containing the first key to a preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameter and the second key; obtaining the first identity certificate sent by the distribution network master station, and judging whether the first identity certificate is valid; if valid, using the first identity certificate to communicate with the second distribution network substation to transmit data; if invalid, sending a certificate update request to the distribution network master station, so that the distribution network master station directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using a preset time protocol. This application makes the identity cancellation and update process more convenient by only updating the timestamp in the identity certificate, avoiding the excessive time and power consumption caused by the secondary generation of keys.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a distribution network data transmission method, device, equipment and storage medium. Background Art

[0002] The development of new information technologies such as cloud computing, the Internet of Things, and big data has posed significant challenges to the security architectures of many traditional industries. The power industry is massive, with frequent communications. In particular, with the recent emergence of the Internet of Power Things (IoT), the number of grid-connected devices has increased significantly. However, current grid communications still primarily utilize cleartext messaging, making power data reflecting national and regional economic and industrial performance highly vulnerable to theft, posing a threat to national information security. Within the power system, distribution networks present the greatest data protection challenges due to their vast geographical reach, distributed network structure, and extremely complex terminal types. Distribution network transmission messages typically consist of a start byte, length, control field, function code, address field, checksum, and terminator. This makes data decryption nearly costless for attackers. Furthermore, attackers can forge various faults, such as accidental trips, equipment anomalies, telemetry over-limits, and Sequence of Events (SOEs), forcing master stations or terminal devices to erroneously operate, causing widespread power outages and other power incidents. To ensure the information security of the distribution network master station system, its communication information must be encrypted. For example, this can be done using the ECC (Elliptic Curve Cryptography) public key cryptography algorithm to encrypt messages into ciphertext before sending them. The recipient then decrypts the messages using the private key to restore them to plaintext. To mitigate man-in-the-middle attacks, the system also requires an identity authentication system. However, the currently mainstream PKI (Public Key Infrastructure) identity authentication system, with its complex application and cancellation process and extensive certificate library, is not suitable for the limited communication bandwidth and storage modules of distribution network terminals. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a distribution network data transmission method, device, equipment and storage medium, which can only update the timestamp in the identity card, avoiding the excessive time and power consumption caused by the secondary key generation. The specific solution is as follows:

[0004] In a first aspect, the present application discloses a distribution network data transmission method, which is applied to a first distribution network substation, comprising:

[0005] When connected to the grid for the first time, a plurality of first keys are generated and first key parameters containing the plurality of first keys are sent to a preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key;

[0006] Obtaining the first identity certificate sent by the distribution network master station, and determining whether the first identity certificate is valid;

[0007] If valid, using the first identity certificate to communicate with the second distribution network substation to transmit data;

[0008] If invalid, a certificate update request is sent to the distribution network master station so that after receiving the certificate update request, the distribution network master station directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using the preset time protocol to obtain an updated identity certificate.

[0009] Optionally, the using the first identity certificate to communicate with the second distribution network substation to transmit data includes:

[0010] Sending a communication request including the first identity certificate and the second key parameter to the second distribution network substation, so that the second distribution network substation performs an identity authentication operation on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, encrypting the target plaintext data using the second key parameter in the communication request to obtain encrypted data and sending it to the first distribution network substation;

[0011] An identity authentication operation is performed on the second distribution network substation, and after successful authentication, the encrypted data is decrypted to obtain the target plaintext data to complete the communication.

[0012] Optionally, performing identity authentication on the second distribution network substation and, after successful authentication, decrypting the encrypted data to obtain the target plaintext data to complete the communication includes:

[0013] Performing identity authentication on the second distribution network substation through the distribution network master station using the second identity certificate corresponding to the second distribution network substation sent by the second distribution network substation;

[0014] After successful authentication, the encrypted data is decrypted to obtain the target plaintext data, and the second identity certificate is stored in a local preset certificate library to complete the communication.

[0015] Optionally, performing identity authentication on the second distribution network substation and decrypting the encrypted data to obtain the target plaintext data after successful authentication includes:

[0016] The second distribution network substation is authenticated using the second identity certificate corresponding to the second distribution network substation pre-stored in the local preset certificate library, and after successful authentication, the encrypted data is decrypted to obtain the target plaintext data to complete the communication.

[0017] Optionally, before performing the identity authentication operation on the second distribution network substation using the second identity certificate corresponding to the second distribution network substation pre-stored in the local preset certificate library, the method further includes:

[0018] Determining whether the current second identity certificate is valid by using the preset timestamp of the second identity certificate in the preset certificate library;

[0019] If the second identity certificate is currently invalid, deleting the second identity certificate from the preset certificate library, and saving the updated second identity certificate applied for by the second distribution network substation to the distribution network master station to the preset certificate library;

[0020] If the current second identity certificate is valid, the step of performing identity authentication operation on the second distribution network substation using the second identity certificate in the preset certificate library is triggered.

[0021] Optionally, the distribution network data transmission method further includes:

[0022] After obtaining the key parameters sent by other distribution network substations and / or the distribution network master station, a corresponding signature verification operation is performed on the parameters using a preset signature algorithm.

[0023] Optionally, the process of determining whether any identity certificate is valid includes:

[0024] Based on the preset timestamp in the identity certificate, it is determined whether the usage time of the identity certificate exceeds the preset certificate validity time specified in the preset time protocol. If so, the identity certificate is determined to be invalid.

[0025] In a second aspect, the present application discloses a distribution network data transmission device, which is applied to a first distribution network substation, comprising:

[0026] a certificate generation module, configured to generate a plurality of first keys and send first key parameters containing the plurality of first keys to a preset distribution network master station when the distribution network master station is connected to the grid for the first time, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key;

[0027] a first certificate determination module, configured to obtain the first identity certificate sent by the distribution network master station and determine whether the first identity certificate is valid;

[0028] a data transmission module, wherein when the first identity certificate is valid, the user uses the first identity certificate to communicate with the second distribution network substation to transmit data;

[0029] The certificate update module is used to send a certificate update request to the distribution network master station when the first identity certificate is invalid, so that after the distribution network master station receives the certificate update request, it directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using the preset time protocol to obtain an updated identity certificate.

[0030] In a third aspect, the present application discloses an electronic device, comprising:

[0031] Memory, used to store computer programs;

[0032] A processor is used to execute the computer program to implement the aforementioned distribution network data transmission method.

[0033] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, which implements the aforementioned distribution network data transmission method when executed by a processor.

[0034] It can be seen that when the present application is connected to the grid for the first time, several first keys are generated and first key parameters containing several first keys are sent to the preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key; obtains the first identity certificate sent by the distribution network master station, and determines whether the first identity certificate is valid; if valid, uses the first identity certificate to communicate with the second distribution network substation to transmit data; if invalid, sends a certificate update request to the distribution network master station, so that after the distribution network master station receives the certificate update request, it directly updates the timestamp of the first identity certificate based on the first key parameters and the second key using the preset time protocol to obtain an updated identity certificate. It can be seen from this that this application generates several first keys when the first distribution network substation is connected to the grid for the first time, and generates a corresponding first identity certificate through the second key generated by the distribution network master station and its own first key. Before the second distribution network substation transmits data, it is necessary to first determine whether the first identity certificate is valid. If invalid, there is no need to generate the first key and the second key again. After receiving the certificate update request sent by the first distribution network substation, the distribution network master station can directly update the timestamp in the first identity certificate based on the first key and the second key generated when the grid is first connected and using the preset time protocol. In this way, avoiding regeneration of parameters can reduce resource occupancy and time consumption, which not only ensures the legitimacy of the distribution network substation and the security of data, but also prevents power grid information data from being stolen or tampered with by criminals and man-in-the-middle attacks by criminals. In addition, the identity update operation process is very convenient, without the need for cumbersome steps and a huge certificate library, which greatly reduces the computing and communication burden of the master station. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0036] Figure 1 This is a flow chart of a distribution network data transmission method disclosed in this application;

[0037] Figure 2 This is a flow chart of a specific distribution network data transmission method disclosed in this application;

[0038] Figure 3 This is a flow chart of a specific distribution network data transmission method disclosed in this application;

[0039] Figure 4 This is a structural diagram of a distribution network data transmission device disclosed in this application;

[0040] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0042] In order to ensure the information security of the distribution network master station system, its communication information needs to be encrypted, such as using the ECC public key cryptography algorithm to encrypt the message into ciphertext and then send it. The receiver uses the private key to decrypt it and restore it to plaintext. In order to resist man-in-the-middle attacks, the system also needs to include an identity authentication system. However, the currently mainstream PKI identity authentication system, with its complex application and cancellation process and huge certificate library, is not suitable for the limited communication bandwidth and storage modules of the distribution network terminal. Therefore, this application can avoid the complex cancellation process and huge certificate library by constructing a simple identity authentication operation between distribution network substations.

[0043] See also Figure 1 As shown, the embodiment of the present application discloses a distribution network data transmission method, which is applied to a first distribution network substation, including:

[0044] Step S11: When connected to the grid for the first time, generate several first keys and send first key parameters containing several first keys to a preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key.

[0045] In this embodiment, when the first distribution network substation is connected to the grid for the first time, the first distribution network substation uses the SM2 encryption algorithm, the ED25519 signature algorithm and the SM1 symmetric algorithm to generate a pair of SM2 encryption public keys A and SM2 encryption private keys a, a pair of first ED25519 signature public keys B and first ED25519 signature private keys b, and two SM1 encryption keys K1 and K2, and sends the first key parameters including the SM2 encryption public key A, the ED25519 signature public key B, the SM1 encryption key K1 and the SM1 encryption key K2 to the preset distribution network master station. The distribution network substation can be a substation user or a terminal device user. It should be noted that the SM1 encryption key K1 and the SM1 encryption key K2 are random number strings, and the calculation method of the SM2 encryption public and private keys and the ED25519 signature public and private keys is as follows:

[0046] A=a×G1

[0047] B=b×G2

[0048] Among them, G1 is the base point coordinate of the elliptic curve on the selected SM2 prime field Fp, and G2 is the base point coordinate of the selected twisted Edwards curve.

[0049] In this embodiment, after the preset distribution network master station obtains the first key parameter, it generates a pair of second ED25519 signature public key C and second ED25519 signature private key c, i.e., the second key, and performs the following calculation based on the SM2 encryption public key A, the first ED25519 signature public key B, the SM1 encryption key K1, and the SM1 encryption key K2 to determine the first identity certificate corresponding to the first distribution network substation and the corresponding parameters:

[0050] A'=A+f(K1,time)×G1

[0051] B'=B+f(K2,time)×G2

[0052] P=B'+C

[0053] message=SM2_encrypt((ED25519_sign(P,c)||c),A')

[0054] Rs0=ED25519_sign(message,c)

[0055] Among them, A' and B' are intermediate data and have no specific practical meaning; time is a timestamp calculated according to a preset time protocol, and the timestamp can be specified as a binary representation of year, month, and day; P is the public key for identity authentication of the first distribution network substation, that is, the first identity certificate of the first distribution network substation; ED25519_sign(α, β) is to sign the text α using the ED25519 signature algorithm using the private key β; SM2_encrypt(α, β) is to encrypt the text α using the SM2 encryption algorithm using the public key β; message is the encrypted text obtained by encrypting using the SM2 encryption algorithm; Rs0 is the first signature value obtained by signing the message using the ED25519 signature algorithm; the definition of function f is as follows:

[0056]

[0057] In the calculation formula of the above function f, <<n means shifting left by n bits; represents XOR; || represents cascade; function f' is SM1_encrypt is encrypted using the SM1 encryption algorithm, where SM1 is built into the distribution network master station or each distribution network substation in the form of an IP core encryption chip; the second parameter includes the second ED25519 signature public key C, the encrypted text message, and the first signature value Rs0 obtained through the above calculation process. After the calculation is completed, the distribution network master station sends the identity certificate P of the first distribution network substation and the parameters including the second ED25519 signature public key C, the encrypted text message, and the first signature value Rs0 to the first distribution network substation. In this way, when the first distribution network substation is connected to the grid for the first time, the corresponding key pair can be generated and the identity authentication process can be completed through the distribution network master station, ensuring the legitimacy of the distribution network substation.

[0058] Step S12: Obtain the first identity certificate sent by the distribution network master station, and determine whether the first identity certificate is valid.

[0059] In this embodiment, after the first distribution network substation obtains the first identity certificate and parameters including the second ED25519 signature public key C, the encrypted text message, and the first signature value Rs0 sent by the distribution network master station, it determines the identity authentication private key of its own first identity certificate based on the parameters and determines whether the first identity certificate is valid. The calculation process for determining the identity authentication private key is as follows:

[0060] a'=a+f(K1,time)

[0061] b'=b+f(K2,time)

[0062] (Rs1,c)=SM2_decrypt(message,a')

[0063] p=b'+c

[0064] Where a' and b' are intermediate data and have no specific practical significance; (Rs1, c) is the decrypted text, SM2_decrypt(message, a') is the decryption operation of message using a' using the SM2 encryption algorithm, and p is the identity authentication private key of the first distribution network substation. Furthermore, the legitimacy of the identity authentication public key P and the identity authentication private key p of the first distribution network substation are deduced as follows:

[0065] P=B'+C

[0066] =B+f(K2,time)*G2+C

[0067] =b*G2+f(K2,time)*G2+c*G2

[0068] =(b+f(K2,time)+c)*G2

[0069] =(b'+c)*G2

[0070] =p*G2

[0071] In this embodiment, the process of determining whether any identity certificate is valid may include: determining whether the usage time of the identity certificate exceeds the preset certificate validity time specified in the preset time protocol based on the preset timestamp in the identity certificate, and if so, determining that the identity certificate is invalid. It can be understood that each distribution network substation's identity certificate has a preset timestamp, which can be understood as the identity certificate generation date, and the preset time protocol specifies the validity period of the certificate. By determining the usage time of the identity certificate, it can be determined whether the identity certificate is valid. For example, assuming that the preset timestamp of a certain identity certificate is 2022 / 12 / 5, and the preset time protocol specifies that the validity period of the identity certificate is 15 days, that is, the identity certificate expires on 2022 / 12 / 20. If the current time is 2022 / 12 / 10, the usage time of the identity certificate is 5 days, and the identity certificate can be determined to be valid. If the current time is 2022 / 12 / 21, it exceeds the validity period of the identity certificate, and the identity certificate can be determined to be invalid. It is understandable that the above method can be used to determine whether the identity certificate of any distribution network substation is valid, and the user can set the preset time protocol based on personal needs.

[0072] Step S13: If valid, use the first identity certificate to communicate with the second distribution network substation to transmit data.

[0073] In this embodiment, if the first identity certificate is valid, the first identity certificate can be used to communicate with the second distribution network substation to transmit corresponding data. The second distribution network substation can use the first identity certificate to verify whether the first distribution network substation is legitimate and then communicate.

[0074] Step S14: If invalid, send a certificate update request to the distribution network master station, so that after receiving the certificate update request, the distribution network master station directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using a preset time protocol to obtain an updated identity certificate.

[0075] In this embodiment, if the first identity certificate is invalid, it means that the usage time of the first identity certificate exceeds the preset validity time, and a certificate update request can be sent to the distribution network master station. After the distribution network master station receives the certificate update request, the first distribution network substation and the distribution network master station do not need to regenerate the corresponding keys required to generate the first identity certificate, that is, the SM2 encryption public key A and SM2 encryption private key a, the first ED25519 signature public key B and the first ED25519 signature private key b, two SM1 encryption keys K1 and K2 generated by the first distribution network substation when it is first connected to the grid, and the second ED25519 signature public key C and the second ED25519 signature private key c generated by the distribution network master station can be directly used to update the timestamp in the first identity certificate using the preset time protocol to obtain an updated identity certificate. In this way, by avoiding re-generating keys and directly using the previously generated keys to update the timestamp in the ID card, the key pair generation process, which consumes the most power and takes the longest time, can be avoided. There is no need for a cumbersome identity cancellation process, and the identity certificate can be updated while ensuring data security and the legality of the distribution network substation.

[0076] It can be seen that when the present application is connected to the grid for the first time, several first keys are generated and first key parameters containing several first keys are sent to the preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key; obtains the first identity certificate sent by the distribution network master station, and determines whether the first identity certificate is valid; if valid, uses the first identity certificate to communicate with the second distribution network substation to transmit data; if invalid, sends a certificate update request to the distribution network master station, so that after the distribution network master station receives the certificate update request, it directly updates the timestamp of the first identity certificate based on the first key parameters and the second key using the preset time protocol to obtain an updated identity certificate. It can be seen from this that this application generates several first keys when the first distribution network substation is connected to the grid for the first time, and generates a corresponding first identity certificate through the second key generated by the distribution network master station and its own first key. Before the second distribution network substation transmits data, it is necessary to first determine whether the first identity certificate is valid. If invalid, there is no need to generate the first key and the second key again. After receiving the certificate update request sent by the first distribution network substation, the distribution network master station can directly update the timestamp in the first identity certificate based on the first key and the second key generated when the grid is first connected and using the preset time protocol. In this way, avoiding regeneration of parameters can reduce resource occupancy and time consumption, which not only ensures the legitimacy of the distribution network substation and the security of data, but also prevents power grid information data from being stolen or tampered with by criminals and man-in-the-middle attacks by criminals. In addition, the identity update operation process is very convenient, without the need for cumbersome steps and a huge certificate library, which greatly reduces the computing and communication burden of the master station.

[0077] Based on the above embodiments, it can be seen that this application can complete the identity certificate update operation by only updating the timestamp in the identity certificate. If the identity certificate is in a valid state, the identity certificate can be used to communicate with other distribution network substations. The process of communicating with the second distribution network substation will be described in detail below.

[0078] See also Figure 2 As shown, the embodiment of the present application discloses a specific distribution network data transmission method, which is applied to a first distribution network substation, including:

[0079] Step S21: When connected to the grid for the first time, generate several first keys and send first key parameters containing several first keys to a preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key.

[0080] Step S22: Obtain the first identity certificate sent by the distribution network master station, and determine whether the first identity certificate is valid.

[0081] Step S23: If valid, a communication request containing the first identity certificate and the second key parameter is sent to the second distribution network substation, so that the second distribution network substation performs identity authentication on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, the encrypted data obtained by encrypting the target plaintext data using the second key parameter in the communication request is sent to the first distribution network substation.

[0082] In this embodiment, if the first identity certificate of the first distribution network substation is valid, communication with the second distribution network substation can be performed, and the following calculation is performed:

[0083] Rs2=ED25519_sign(A,p)

[0084] Rs2 is a second signature value obtained by signing the SM2 encryption public key A generated by the first distribution substation and the identity authentication private key of the first distribution substation using the ED25519 signature algorithm. After the calculation is completed, a communication request containing the first identity certificate P and second key parameters is sent to the second distribution substation. The second key parameters include the SM2 encryption public key A generated by the first distribution substation and the second signature value Rs2 obtained through the above calculation process. After the second distribution network substation obtains the first identity certificate P and the second key parameter in the communication request, it performs an identity authentication operation on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, uses the SM2 encryption public key A in the second key parameter to encrypt the target plaintext data plaint to obtain the encrypted data cipher, and then uses the second distribution network substation's own identity authentication private key d, that is, the authenticated ED25519 signature private key d, to sign the encrypted data cipher to obtain a third signature value Rs3, and sends the encrypted data cipher and the third signature value Rs3 to the first distribution network substation. The above calculation process formula is as follows:

[0085] cipher=SM2_encrypt(plaint,A)

[0086] Rs3 = ED25519_sign (cipher, d)

[0087] It should be pointed out that if the first distribution network substation and the second distribution network substation are communicating for the first time or the identity certificate corresponding to the second distribution network substation stored in the local preset certificate library in the first distribution network substation has expired and been deleted, it is necessary to send the current second identity certificate D of the second distribution network substation to the first distribution network substation at the same time as sending the encrypted data cipher and the third signature value Rs3, so that the first distribution network substation can use the second identity certificate D to perform identity authentication operations on the second distribution network substation.

[0088] Step S24: using the second identity certificate corresponding to the second distribution network substation sent by the second distribution network substation and performing an identity authentication operation on the second distribution network substation through the distribution network master station.

[0089] In this embodiment, if the first distribution network substation and the second distribution network substation are communicating for the first time, the second distribution network substation needs to send its own second identity certificate D to the first distribution network substation at the same time as sending the encrypted data. When the first distribution network substation obtains the second identity certificate D, it verifies whether the second identity certificate D is valid through the distribution network master station to perform the identity authentication operation of the second distribution network substation to ensure the legitimacy of the second distribution network substation.

[0090] Step S25: After successful authentication, the encrypted data is decrypted to obtain the target plaintext data, and the second identity certificate is stored in a local preset certificate library to complete the communication.

[0091] In this embodiment, after successful identity authentication, the encrypted data cipher is decrypted using the self-generated SM2 encryption private key a to obtain the target plaintext data plaint. The calculation formula is as follows:

[0092] plaint=SM2_decrypt(cipher,a)

[0093] After obtaining the target plaintext data, the second identity certificate is stored in the local preset certificate library. In this way, when the first distribution network substation communicates with the second distribution network substation in the future, it is not necessary to determine the legitimacy of the certificate through the distribution network master station. It is directly determined whether the second identity certificate corresponding to the second distribution network substation exists in the local preset certificate library to determine whether it can communicate with the second distribution network substation. The preset certificate library can be regarded as a trust list. The distribution network substations corresponding to the identity certificates stored in the preset certificate library can communicate directly without verifying the legitimacy through the distribution network master station. Since the communication objects of the distribution network substations and terminals are usually limited or even fixed, it is only necessary to save a certain number of certificates to meet the needs. In this way, the distribution network substations and terminal devices only need to save a few certificates to meet the communication needs, avoiding the storage or communication burden brought by the huge certificate library.

[0094] Step S26: If invalid, send a certificate update request to the distribution network master station, so that after receiving the certificate update request, the distribution network master station directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using the preset time protocol to obtain an updated identity certificate.

[0095] For the specific processes of steps S21 to S22 and step S26, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0096] It can be seen that when the first distribution network substation communicates with the second distribution network substation for the first time, the present application obtains the second identity certificate of the second distribution network substation and saves it to the local preset certificate library, so that when the first distribution network substation communicates with the second distribution network substation in the future, there is no need to determine the legitimacy of the certificate through the distribution network master station. Whether communication with the second distribution network substation can be determined directly by whether the second identity certificate corresponding to the second distribution network substation exists in the local preset certificate library. In this way, the distribution network substation and the terminal equipment only need to save a few certificates to meet the communication needs, avoiding the storage or communication burden brought by the huge certificate library.

[0097] Based on the above embodiment, it can be seen that when the distribution network substations communicate for the first time, the second identity certificate corresponding to the second distribution network substation can be obtained from the parameters actively sent by the second distribution network substation. If the distribution network substations communicate again, they can directly obtain the identity certificate stored in their own preset certificate library for identity authentication. The following will describe in detail the process of obtaining the identity certificate in their own preset certificate library and performing identity authentication. Figure 3 As shown, the embodiment of the present application discloses a specific distribution network data transmission method, which is applied to a first distribution network substation, including:

[0098] Step S31: When connected to the grid for the first time, generate several first keys and send first key parameters containing several first keys to a preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key.

[0099] Step S32: Obtain the first identity certificate sent by the distribution network master station, and determine whether the first identity certificate is valid.

[0100] Step S33: If valid, a communication request containing the first identity certificate and the second key parameter is sent to the second distribution network substation, so that the second distribution network substation performs identity authentication on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, the encrypted data obtained by encrypting the target plaintext data using the second key parameter in the communication request is sent to the first distribution network substation.

[0101] Step S34: using the preset timestamp of the second identity certificate in the local preset certificate library to determine whether the current second identity certificate is valid.

[0102] In this embodiment, before using the second identity certificate in the local preset certificate library for identity authentication, it is necessary to first determine whether the second identity certificate has expired, that is, whether the preset timestamp of the second identity certificate is valid.

[0103] Step S35: If the second identity certificate is currently invalid, the second identity certificate is deleted from the preset certificate library, and the updated second identity certificate applied for by the second distribution network substation to the distribution network master station is saved in the preset certificate library.

[0104] In this embodiment, if the second identity certificate is currently invalid, the second identity certificate is deleted from the preset certificate repository. The second distribution network substation then re-authenticates itself with the distribution network master station to obtain an updated identity certificate. It should be noted that if the second distribution network substation is not a first-time grid-connected site, neither the second distribution network substation nor the distribution network master station need to regenerate their own keys. The keys generated during the initial grid-connected identity authentication can be used. The updated identity certificate can be obtained by simply updating the preset timestamp in the second identity certificate according to a preset time protocol and regenerating an authentication key pair. Both the preset timestamp and the preset time protocol can be set based on the user's needs. The second distribution network substation sends the updated identity certificate to the first distribution network substation, allowing the first distribution network substation to save the updated identity certificate to the local preset certificate repository and perform subsequent communication operations. This avoids the most power-consuming and time-consuming public-private key pair generation process and eliminates the cumbersome identity deregistration process, significantly reducing the computational and communication burdens on the master station.

[0105] Step S36: If the second identity certificate is currently valid, the second identity certificate corresponding to the second distribution network substation pre-stored in the preset certificate library is used to perform an identity authentication operation on the second distribution network substation, and after the authentication is successful, the encrypted data is decrypted to obtain the target plaintext data to complete the communication.

[0106] In this embodiment, if the second identity certificate is currently valid, the second identity certificate corresponding to the second distribution network substation, pre-stored in the preset certificate library, can be used to directly authenticate the second distribution network substation. After successful authentication, the encrypted data is decrypted to obtain the target plaintext data to complete communication. It should be noted that if the first and second distribution network substations both have each other's identity certificates stored in their local preset certificate libraries, and both identity certificates are within their validity periods, there is no need to perform identity authentication with the distribution network master station to determine the legitimacy of the identity certificates, and direct communication can be carried out to transmit data.

[0107] Step S37: If the first identity certificate is invalid, a certificate update request is sent to the distribution network master station, so that after the distribution network master station receives the certificate update request, it directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using a preset time protocol to obtain an updated identity certificate.

[0108] In this embodiment, the distribution network data transmission method may further include: after obtaining the key parameters sent by other distribution network substations and / or the distribution network master station, performing a corresponding signature verification operation on the parameters using a preset signature algorithm. That is, after each distribution network substation obtains the key parameters sent by other distribution network substations or the distribution network master station, it is necessary to first perform a signature verification operation on the key in the key parameters. For example, in step S12, when the first distribution network substation obtains the key parameters sent by the distribution network master station, it is necessary to first perform a signature verification operation on the second ED25519 signature public key C, the encrypted text message, and the first signature value Rs0 in the key parameters. The formula is as follows:

[0109] ED25519_verify(message,Rs0,C)

[0110] The signature value β of the text α is verified using the ED25519 algorithm using the public key γ. Based on the above steps, it can be seen that when the second distribution network substation obtains the second key parameters in step S23, it also needs to perform a signature verification operation, namely ED25519_verify(A, Rs2, P). In step S24, when the first distribution network substation obtains the corresponding key parameters sent by the second distribution network substation, the corresponding formula for the signature verification operation can be ED25519_verify(cipher, Rs3, D). In this way, by performing identity authentication operations on the distribution network master station before the first and second distribution network substations communicate, and performing mutual identity authentication operations, the legitimacy of the distribution network substations and data security can be guaranteed, and power grid information data can be prevented from being stolen or tampered with by criminals and man-in-the-middle attacks by criminals. The identity authentication process is also very convenient, without the need for cumbersome steps and a large certificate library, greatly reducing the computing and communication burden of the master station.

[0111] For the specific processes of steps S31 to S33 and step S37, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0112] It can be seen that this application can be automatically deleted from the local preset certificate library after the identity authentication expires, and through the preset SM1 encryption chip, the identity certificate update operation can be completed by simply replacing the preset timestamp in the identity certificate. Moreover, if both parties have the other party's identity certificate stored in their preset certificate libraries and are both within the validity period, they can communicate directly without re-authentication. In this way, the public-private key pair generation process, which consumes the most power and takes the longest time, can be avoided, and there is no need for a cumbersome identity cancellation process, which greatly reduces the computing and communication burden of the main station.

[0113] refer to Figure 4The embodiment of the present application further discloses a distribution network data transmission device, which is applied to a first distribution network substation and includes:

[0114] The certificate generation module 11 is configured to generate a plurality of first keys and send first key parameters containing the plurality of first keys to a preset distribution network master station when the distribution network master station is connected to the grid for the first time, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key;

[0115] A first certificate determination module 12 is configured to obtain the first identity certificate sent by the distribution network master station and determine whether the first identity certificate is valid;

[0116] The data transmission module 13 uses the first identity certificate to communicate with the second distribution network substation to transmit data when the first identity certificate is valid;

[0117] The certificate update module 14 is used to send a certificate update request to the distribution network master station when the first identity certificate is invalid, so that after the distribution network master station receives the certificate update request, it directly updates the timestamp of the first identity certificate based on the first key parameter and the second key using the preset time protocol to obtain an updated identity certificate.

[0118] It can be seen that when the present application is connected to the grid for the first time, several first keys are generated and first key parameters containing several first keys are sent to the preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key; obtains the first identity certificate sent by the distribution network master station, and determines whether the first identity certificate is valid; if valid, uses the first identity certificate to communicate with the second distribution network substation to transmit data; if invalid, sends a certificate update request to the distribution network master station, so that after the distribution network master station receives the certificate update request, it directly updates the timestamp of the first identity certificate based on the first key parameters and the second key using the preset time protocol to obtain an updated identity certificate. It can be seen from this that this application generates several first keys when the first distribution network substation is connected to the grid for the first time, and generates a corresponding first identity certificate through the second key generated by the distribution network master station and its own first key. Before the second distribution network substation transmits data, it is necessary to first determine whether the first identity certificate is valid. If invalid, there is no need to generate the first key and the second key again. After receiving the certificate update request sent by the first distribution network substation, the distribution network master station can directly update the timestamp in the first identity certificate based on the first key and the second key generated when the grid is first connected and using the preset time protocol. In this way, avoiding regeneration of parameters can reduce resource occupancy and time consumption, which not only ensures the legitimacy of the distribution network substation and the security of data, but also prevents power grid information data from being stolen or tampered with by criminals and man-in-the-middle attacks by criminals. In addition, the identity update operation process is very convenient, without the need for cumbersome steps and a huge certificate library, which greatly reduces the computing and communication burden of the master station.

[0119] In some specific embodiments, the data transmission module 13 may specifically include:

[0120] a request sending submodule, configured to send a communication request including the first identity certificate and the second key parameter to the second distribution network substation, so that the second distribution network substation performs an identity authentication operation on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, encrypts the target plaintext data using the second key parameter in the communication request to obtain encrypted data and sends it to the first distribution network substation;

[0121] The data acquisition submodule is used to perform identity authentication on the second distribution network substation, and after successful authentication, decrypt the encrypted data to obtain the target plaintext data to complete the communication.

[0122] In some specific embodiments, the data acquisition submodule may specifically include:

[0123] An identity authentication unit, configured to use the second identity certificate corresponding to the second distribution network substation sent by the second distribution network substation and perform an identity authentication operation on the second distribution network substation through the distribution network master station;

[0124] The data decryption unit is used to decrypt the encrypted data to obtain the target plaintext data after successful authentication, and store the second identity certificate in a local preset certificate library to complete the communication.

[0125] In some specific embodiments, the data acquisition submodule can be specifically used to perform identity authentication operations on the second distribution network substation using the second identity certificate corresponding to the second distribution network substation pre-saved in the local preset certificate library, and after successful authentication, decrypt the encrypted data to obtain the target plaintext data to complete the communication.

[0126] In some specific embodiments, the distribution network data transmission device may further include:

[0127] A second certificate judgment module, configured to judge whether the current second identity certificate is valid by using a preset timestamp of the second identity certificate in the preset certificate library;

[0128] a certificate deletion module, configured to delete the second identity certificate from the preset certificate library when the current second identity certificate is invalid, and save the updated second identity certificate applied by the second distribution network substation to the distribution network master station to the preset certificate library;

[0129] The operation triggering module is used to trigger the step of performing an identity authentication operation on the second distribution network substation using the second identity certificate in the preset certificate library when the current second identity certificate is valid.

[0130] In some specific embodiments, the distribution network data transmission device may further include:

[0131] The parameter signature verification module is used to perform corresponding signature verification operations on the parameters using a preset signature algorithm after obtaining the key parameters sent by other distribution network substations and / or the distribution network master station.

[0132] In some specific embodiments, the certificate judgment module can be used to judge whether the usage time of the identity certificate exceeds the preset certificate validity period specified in the preset time agreement based on the preset timestamp in the identity certificate. If so, the identity certificate is determined to be invalid.

[0133] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0134] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the distribution network data transmission method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0135] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0136] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0137] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the network distribution data transmission method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program capable of completing other specific tasks.

[0138] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned disclosed method for transmitting data in a distribution network. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0139] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0140] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0141] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0142] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0143] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A distribution network data transmission method, characterized in that: Applicable to the first distribution network substation, including: When connected to the grid for the first time, a plurality of first keys are generated and first key parameters containing the plurality of first keys are sent to a preset distribution network master station, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key; Obtaining the first identity certificate sent by the distribution network master station, and determining whether the first identity certificate is valid; If valid, using the first identity certificate to communicate with the second distribution network substation to transmit data; If invalid, sending a certificate update request to the distribution network master station, so that after receiving the certificate update request, the distribution network master station directly updates the timestamp of the first identity certificate using a preset time protocol based on the first key parameter and the second key to obtain an updated identity certificate; The using the first identity certificate to communicate with the second distribution network substation to transmit data includes: Sending a communication request including the first identity certificate and the second key parameter to the second distribution network substation, so that the second distribution network substation performs an identity authentication operation on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, encrypting the target plaintext data using the second key parameter in the communication request to obtain encrypted data and sending it to the first distribution network substation; An identity authentication operation is performed on the second distribution network substation, and after successful authentication, the encrypted data is decrypted to obtain the target plaintext data to complete the communication.

2. The distribution network data transmission method according to claim 1, characterized in that: The performing of identity authentication on the second distribution network substation and, after successful authentication, decrypting the encrypted data to obtain the target plaintext data to complete the communication includes: Performing identity authentication on the second distribution network substation through the distribution network master station using the second identity certificate corresponding to the second distribution network substation sent by the second distribution network substation; After successful authentication, the encrypted data is decrypted to obtain the target plaintext data, and the second identity certificate is stored in a local preset certificate library to complete the communication.

3. The distribution network data transmission method according to claim 1, characterized in that: The performing identity authentication on the second distribution network substation and decrypting the encrypted data to obtain the target plaintext data after successful authentication includes: The second distribution network substation is authenticated using the second identity certificate corresponding to the second distribution network substation pre-stored in the local preset certificate library, and after successful authentication, the encrypted data is decrypted to obtain the target plaintext data to complete the communication.

4. The distribution network data transmission method according to claim 3, characterized in that: Before performing identity authentication on the second distribution network substation using the second identity certificate corresponding to the second distribution network substation pre-stored in the local preset certificate library, the method further includes: Determining whether the current second identity certificate is valid by using the preset timestamp of the second identity certificate in the preset certificate library; If the second identity certificate is currently invalid, deleting the second identity certificate from the preset certificate library, and saving the updated second identity certificate applied for by the second distribution network substation to the distribution network master station to the preset certificate library; If the current second identity certificate is valid, the step of performing identity authentication operation on the second distribution network substation using the second identity certificate in the preset certificate library is triggered.

5. The distribution network data transmission method according to claim 1, characterized in that: Also includes: After obtaining the key parameters sent by other distribution network substations and / or the distribution network master station, a corresponding signature verification operation is performed on the parameters using a preset signature algorithm.

6. The distribution network data transmission method according to any one of claims 1 to 5, characterized in that: The process of determining whether any identity certificate is valid includes: Based on the preset timestamp in the identity certificate, it is determined whether the usage time of the identity certificate exceeds the preset certificate validity time specified in the preset time protocol. If so, the identity certificate is determined to be invalid.

7. A distribution network data transmission device, characterized in that: Applicable to the first distribution network substation, including: a certificate generation module, configured to generate a plurality of first keys and send first key parameters containing the plurality of first keys to a preset distribution network master station when the distribution network master station is connected to the grid for the first time, so that the distribution network master station generates a second key and generates a first identity certificate of the first distribution network substation based on the first key parameters and the second key; a first certificate determination module, configured to obtain the first identity certificate sent by the distribution network master station and determine whether the first identity certificate is valid; a data transmission module, wherein when the first identity certificate is valid, the user uses the first identity certificate to communicate with the second distribution network substation to transmit data; a certificate update module, configured to, when the first identity certificate is invalid, send a certificate update request to the distribution network master station, so that after receiving the certificate update request, the distribution network master station directly updates the timestamp of the first identity certificate using a preset time protocol based on the first key parameter and the second key to obtain an updated identity certificate; The data transmission module specifically includes: a request sending submodule, configured to send a communication request including the first identity certificate and the second key parameter to the second distribution network substation, so that the second distribution network substation performs an identity authentication operation on the first distribution network substation through the distribution network master station and the first identity certificate, and after successful authentication, encrypts the target plaintext data using the second key parameter in the communication request to obtain encrypted data and sends it to the first distribution network substation; The data acquisition submodule is used to perform identity authentication on the second distribution network substation, and after successful authentication, decrypt the encrypted data to obtain the target plaintext data to complete the communication.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the distribution network data transmission method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store a computer program, which, when executed by a processor, implements the distribution network data transmission method according to any one of claims 1 to 6.

Images