A multi-layer encryption system and method for customer data in a smart IoT energy system

Abstract

This invention discloses a multi-layered encryption system and method for customer data in a smart IoT energy system. The method includes: a terminal device registering with a verification server based on its identity information; after successful registration, the terminal device and the verification server exchange key information; the terminal device encrypting the customer data type, customer data, and identity information using a public key to generate a first ciphertext; encrypting the first ciphertext according to a first encryption rule pre-agreed with an edge gateway to obtain a second ciphertext; encrypting the second ciphertext according to a second encryption rule pre-agreed with the edge gateway to obtain a third ciphertext; sending the third ciphertext to the edge gateway; and the edge gateway decrypting the third ciphertext step by step using the second decryption rule and the first decryption rule corresponding to the terminal device, and sending the decryption result to the verification server. This invention improves the security of customer data in the field of smart IoT energy.

Description

Technical Field

[0001] This invention relates to the field of smart energy technology, and in particular to a multi-encryption system and method for customer data in a smart IoT energy system. Background Technology

[0002] The Internet of Things (IoT) for energy is one of the key supporting technologies for the transformation of the smart energy internet (EoI), and low-power wide-area network (LPWA) IoT technology will play a crucial role in the field of smart energy internet. The energy and power sector generates a large amount of small data, including user-side data, power system edge data, and data from new smart energy technologies and services.

[0003] As the application of IoT technology in smart energy deepens, data security issues arising from IoT are also emerging in smart energy systems. Current smart IoT energy systems primarily focus on data collection, analysis, and energy forecasting, paying little attention to situations where unauthorized terminals send false data. False data directly impacts the accuracy of subsequent data analysis and energy forecasting.

[0004] In view of this, the present invention is hereby proposed. Summary of the Invention

[0005] This invention provides a multi-layer encryption system and method for customer data in a smart IoT energy system, in order to improve the security of customer data in the field of smart IoT energy.

[0006] This invention provides a multi-encryption method for customer data in a smart IoT energy system, applicable to smart IoT energy systems, which include multiple terminal devices, as well as a verification server and an edge gateway that are communicatively connected to each terminal device;

[0007] The method includes:

[0008] The terminal device registers with the verification server based on its identity information. After successful registration, the terminal device exchanges key information with the verification server.

[0009] The terminal device encrypts the customer data type, customer data, and identity information using a public key to generate a first ciphertext; encrypts the first ciphertext according to a first encryption rule pre-agreed with the edge gateway to obtain a second ciphertext; encrypts the second ciphertext according to a second encryption rule pre-agreed with the edge gateway to obtain a third ciphertext; and sends the third ciphertext to the edge gateway.

[0010] The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step to obtain the decryption result;

[0011] The edge gateway sends the decryption result to the verification server;

[0012] The verification server decrypts the decryption result using the private key corresponding to the terminal device to obtain the data uploaded by the terminal device.

[0013] Preferably, after successful registration, the terminal device exchanges key information with the verification server, including:

[0014] After successful registration, the verification server generates a public key and a private key, and binds the public key and private key with the identity information of the terminal device;

[0015] The verification server sends the public key to the terminal device.

[0016] Preferably, after the verification server sends the public key to the terminal device, it further includes:

[0017] The terminal device sends the first encryption rule and the second encryption rule to the verification server;

[0018] The verification server forwards the first encryption rule and the second encryption rule to the edge gateway.

[0019] Preferably, the first encryption rule includes deleting a second number of characters after every first number of characters in the first ciphertext to obtain a second ciphertext, and forming a codebook by sequentially deleting the characters; the first decryption rule includes adding a second number of characters after every first number of characters in the second ciphertext according to the codebook.

[0020] The second encryption rule includes adding a fourth number of characters after every third number of characters in the second ciphertext to obtain the third ciphertext; the second decryption rule includes deleting a fourth number of characters after every third number of characters in the third ciphertext.

[0021] The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step, obtaining the decryption result, including:

[0022] The edge gateway searches for the second decryption rule corresponding to the terminal device to decrypt the third ciphertext, obtaining the second ciphertext; and sends the second ciphertext to the terminal device.

[0023] After verifying the second ciphertext, the terminal device sends the password book to the edge gateway;

[0024] The edge gateway decrypts the second ciphertext according to the codebook and the first decryption rule to obtain the decryption result.

[0025] Preferably, the edge gateway sends the second ciphertext to the terminal device, including:

[0026] The edge gateway sends the second ciphertext and other strings to the terminal device;

[0027] After verifying the second ciphertext, the terminal device sends the password book to the edge gateway, including:

[0028] The terminal device determines that the data sent by the edge gateway includes a second ciphertext obtained through local encryption, and sends the ciphertext to the edge gateway.

[0029] Preferably, the customer data includes at least data on production equipment, data on energy-consuming customers, and energy configuration data.

[0030] Preferably, the terminal device sends the third ciphertext to the edge gateway, including:

[0031] The terminal device sends a message containing third ciphertext to the edge gateway according to the network protocol agreed upon with the edge gateway;

[0032] The edge gateway parses the third ciphertext from the message according to the network protocol, finds the second decryption rule and the first decryption rule corresponding to the terminal device, and decrypts the third ciphertext step by step to obtain the decryption result.

[0033] The present invention also provides a multi-encryption system for customer data in a smart IoT energy system, comprising: multiple terminal devices, and a verification server and an edge gateway that are communicatively connected to each terminal device;

[0034] The terminal device registers with the verification server based on its identity information. After successful registration, the terminal device exchanges key information with the verification server.

[0035] The terminal device encrypts the customer data type, customer data, and identity information using a public key to generate a first ciphertext; encrypts the first ciphertext according to a first encryption rule pre-agreed with the edge gateway to obtain a second ciphertext; encrypts the second ciphertext according to a second encryption rule pre-agreed with the edge gateway to obtain a third ciphertext; and sends the third ciphertext to the edge gateway.

[0036] The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step to obtain the decryption result;

[0037] The edge gateway sends the decryption result to the verification server;

[0038] The verification server decrypts the decryption result using the private key corresponding to the terminal device to obtain the data uploaded by the terminal device;

[0039] Preferably, the system further includes an energy management server;

[0040] The verification server sends the data uploaded by the terminal device to the energy management server;

[0041] The energy management server analyzes the received data and generates management policies, which are then sent to the terminal device via a gateway.

[0042] Preferably, the energy management server has a human-computer interaction interface to receive management policies input by the administrator.

[0043] The method provided by this invention is applied to smart IoT energy systems to encrypt data uploaded by terminal devices, thereby protecting data security. The terminal device first performs a single layer of encryption using a public key, then a second layer using a first encryption rule, and finally a third layer using a second encryption rule. This ensures that the data is fully encrypted and cannot be cracked. Joint decryption via an edge gateway and a verification server also verifies the identity of the terminal device, enabling the detection of unauthorized devices. This further guarantees the authenticity and validity of the data, as well as the accuracy of subsequent data analysis and energy forecasting. Attached Figure Description

[0044] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the structure of the multi-encryption system for customer data in the smart IoT energy system provided in this embodiment of the invention;

[0046] Figure 2 This is a flowchart of a multi-encryption method for customer data in a smart IoT energy system provided by an embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0048] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0049] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0050] This invention provides a multi-layered encryption method for customer data in a smart IoT energy system, applicable to situations where customer data needs to be encrypted in a smart IoT energy system. This method is applicable to smart IoT energy systems. For ease of description, the system to which it is applicable will be introduced first. Figure 1 This is a schematic diagram of the structure of a multi-encryption system for customer data in a smart IoT energy system provided in an embodiment of the present invention, including multiple terminal devices, and a verification server and an edge gateway that are communicatively connected to each terminal device.

[0051] This embodiment does not limit the type of terminal device; it can be a power generation equipment terminal, an energy consumption equipment terminal, or an energy configuration terminal, such as the terminal device of a power distribution company. Correspondingly, different types of terminal devices generate different customer data, which will not be exemplified here. Each terminal device communicates with both a verification server and an edge gateway. The verification server can be a single server or a server cluster, used for terminal device registration and data decryption.

[0052] Figure 2 This is a flowchart of a multi-layer encryption method for customer data in a smart IoT energy system provided by an embodiment of the present invention, used for encrypting and decrypting customer data, specifically including the following operations:

[0053] S110. The terminal device registers with the verification server based on its identity information. After successful registration, the terminal device exchanges key information with the verification server.

[0054] The terminal device's identity information includes the terminal device's hardware and software information and the login client's identity information (such as a company's unified social credit code or a resident ID card). The terminal device sends its identity information to the verification server, and registration is completed once the relevant registration terms are met. After successful registration, the verification server generates a public key and a private key, and binds the public key and private key to the terminal device's identity information; the verification server then sends the public key to the terminal device for asymmetric encryption of the data.

[0055] S120. The terminal device encrypts the type of customer data, customer data and the identity information using a public key to generate a first ciphertext; encrypts the first ciphertext according to a first encryption rule agreed upon with the edge gateway to obtain a second ciphertext; encrypts the second ciphertext according to a second encryption rule agreed upon with the edge gateway to obtain a third ciphertext; and sends the third ciphertext to the edge gateway.

[0056] Customer data types include, but are not limited to, numbers, strings, images, and text. For public-key encryption operations, please refer to existing technologies; details will not be elaborated here.

[0057] Asymmetric encryption is a commonly used encryption method in the industry. However, if either the public or private key is lost, data security cannot be guaranteed. Therefore, this embodiment employs a first and a second encryption rule for triple encryption based on public key encryption.

[0058] Specifically, after the verification server sends the public key to the terminal device, the terminal device sends the first encryption rule and the second encryption rule to the verification server. The verification server then forwards the first encryption rule and the second encryption rule to the edge gateway. Since the verification server is a trusted server, in this embodiment, the terminal device needs to obtain the public key from the verification server, and the edge gateway also needs to obtain the first / second encryption rule from the verification server. Obtaining this information from other nodes is not permitted to ensure security.

[0059] The first encryption rule and the second encryption rule can be defined by the terminal device, and this embodiment does not limit them. A preferred embodiment is provided below: The first encryption rule includes deleting a second number of characters after every first number of characters in the first ciphertext to obtain a second ciphertext, and forming a codebook by sequentially deleting the characters; the first decryption rule includes adding a second number of characters after every first number of characters in the second ciphertext according to the codebook; the second encryption rule includes adding a fourth number of characters after every third number of characters in the second ciphertext to obtain a third ciphertext; the second decryption rule includes deleting a fourth number of characters after every third number of characters in the third ciphertext.

[0060] The first, second, third, and fourth quantities can be customized. For example, the first ciphertext is ABCDEFGHIJK. First, delete one character after every four characters to obtain the second ciphertext ABCDFGHIK. The deleted EJ characters are stored in the codebook. Then, add two random characters after every three characters in the second ciphertext ABCDFGHIK. The added random characters can be the same or different each time, finally obtaining the third ciphertext ABC33DFGAAHIKBB.

[0061] The second decryption rule is the opposite of the second encryption rule, and the first decryption rule is the opposite of the first encryption rule; these will not be elaborated further here.

[0062] This invention integrates IoT technology into a smart energy system. The terminal device sends a message containing a third ciphertext to the edge gateway according to the network protocol agreed upon with the edge gateway. The network protocol can be XMPP (Extensible Messaging and Presence Protocol), an open-source network instant messaging protocol. Scope of application: Instant messaging applications, and can also be used in network management, games, remote system monitoring, etc. Features: (1) Client / server communication mode; (2) Distributed network; (3) Simple client, with most of the work done on the server side; (4) Data format of XML, a subset of Standard Generalized Markup Language.

[0063] S130. The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device and decrypts the third ciphertext step by step to obtain the decryption result.

[0064] The edge gateway parses the third ciphertext from the message according to the aforementioned network protocol. The edge gateway then searches for the second decryption rule corresponding to the terminal device to decrypt the third ciphertext, obtaining the second ciphertext. Finally, it decrypts the second ciphertext according to the first decryption rule and the codebook to obtain the decryption result. Since the codebook is extracted from the second ciphertext, and the codebook for each transmitted data is highly likely to be different, it needs to be obtained from the terminal device. Therefore, at S120, the terminal device can send the third ciphertext and the codebook together to the edge gateway.

[0065] Preferably, this embodiment considers the possibility of the edge gateway being hijacked and requires verification of the edge gateway. Therefore, the edge gateway searches for the second decryption rule corresponding to the terminal device to decrypt the third ciphertext, obtaining a second ciphertext; the second ciphertext is then sent to the terminal device; the terminal device verifies the second ciphertext by comparing the received second ciphertext with the locally generated second ciphertext in S120. If the comparison matches, the verification is successful, and the edge gateway is considered secure. The terminal device then sends the codebook to the edge gateway; the edge gateway decrypts the second ciphertext according to the codebook and the first decryption rule to obtain the decryption result.

[0066] Preferably, this embodiment considers the possibility of the link between the edge gateway and the terminal device being hijacked, and the second ciphertext potentially being leaked or tampered with. Therefore, the edge gateway sends the second ciphertext along with other strings to the terminal device; the other strings serve as interference. When the link is hijacked, the outside world is unaware that only a portion of the data is the second ciphertext and cannot obtain the true information. Then, the terminal device determines that the data sent by the edge gateway includes the locally encrypted second ciphertext and sends the password book to the edge gateway.

[0067] For example, the edge gateway receives the third ciphertext ABC33DFGAAHIKBB sent by the terminal device. Based on the second decryption rule, it decrypts the third ciphertext to obtain ABCDFGHIK. It then sends ABCDFGHIK along with other strings ABCDRTEIH and 12rhtyERC back to the terminal device. The terminal device determines that ABCDFGHIK matches the second ciphertext and sends a codebook including EJ to the edge gateway. The edge gateway decrypts the second ciphertext ABCDFGHIK based on the first decryption rule to obtain ABCDEFGHIJK, which, as the decryption result, matches the first ciphertext.

[0068] S140, the edge gateway sends the decryption result to the verification server.

[0069] S150. The verification server decrypts the decryption result using the private key corresponding to the terminal device to obtain the data uploaded by the terminal device.

[0070] Since the data uploaded by the terminal device includes identity information, and the terminal device has been pre-registered on the verification server, the verification server's result can be verified by comparing the identity information.

[0071] The method provided by this invention is applied to smart IoT energy systems to encrypt data uploaded by terminal devices, thereby protecting data security. The terminal device first performs a single layer of encryption using a public key, then a second layer using a first encryption rule, and finally a third layer using a second encryption rule. This ensures that the data is fully encrypted and cannot be cracked. Joint decryption via an edge gateway and a verification server also verifies the identity of the terminal device, enabling the detection of unauthorized devices. This further guarantees the authenticity and validity of the data, as well as the accuracy of subsequent data analysis and energy forecasting.

[0072] See also Figure 1 The system provided in this embodiment of the invention also includes an energy management server, which is communicatively connected to a gateway. The verification server sends data uploaded by the terminal device to the energy management server; the energy management server analyzes the received data and generates a management strategy, which is then sent to the terminal device through the gateway. After processing the data with noise reduction and smoothing, the energy management server analyzes and predicts the data to generate a management strategy, such as predicting recent energy consumption peaks, thereby providing the target production capacity for each production capacity device. The target production capacity is then sent to the corresponding production capacity device through the gateway. This embodiment does not limit the data analysis method or the method for generating the management strategy.

[0073] Preferably, the energy management server has a human-computer interaction interface to receive management policies input by the administrator. The administrator can develop high-precision energy management models and input them into the energy management server through the human-computer interaction interface to meet personalized management needs.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.

Claims

1. A multi-layer encryption method for customer data in a smart IoT energy system, characterized in that, Applicable to smart IoT energy systems, which include multiple terminal devices, as well as a verification server and an edge gateway that are communicatively connected to each terminal device; The method includes: The terminal device registers with the verification server based on its identity information. After successful registration, the terminal device exchanges key information with the verification server. The terminal device encrypts the customer data type, customer data, and identity information using a public key to generate a first ciphertext; encrypts the first ciphertext according to a first encryption rule pre-agreed with the edge gateway to obtain a second ciphertext; encrypts the second ciphertext according to a second encryption rule pre-agreed with the edge gateway to obtain a third ciphertext; and sends the third ciphertext to the edge gateway. The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step to obtain the decryption result; The edge gateway sends the decryption result to the verification server; The verification server decrypts the decryption result using the private key corresponding to the terminal device to obtain the data uploaded by the terminal device; The first encryption rule includes deleting a second number of characters after every first number of characters in the first ciphertext to obtain a second ciphertext, and forming a codebook by sequentially deleting the characters. The first decryption rule includes adding a second number of characters after every first number of characters in the second ciphertext according to the codebook. The second encryption rule includes adding a fourth number of characters after every third number of characters in the second ciphertext to obtain the third ciphertext; the second decryption rule includes deleting a fourth number of characters after every third number of characters in the third ciphertext. The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step, obtaining the decryption result, including: The edge gateway searches for the second decryption rule corresponding to the terminal device to decrypt the third ciphertext, obtaining the second ciphertext; and sends the second ciphertext to the terminal device. After verifying the second ciphertext, the terminal device sends the password book to the edge gateway; The edge gateway decrypts the second ciphertext according to the codebook and the first decryption rule to obtain the decryption result; The terminal device sends the third ciphertext to the edge gateway, including: The terminal device sends a message containing third ciphertext to the edge gateway according to the network protocol agreed upon with the edge gateway; The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step, obtaining the decryption result, including: The edge gateway parses the third ciphertext from the message according to the network protocol, finds the second decryption rule and the first decryption rule corresponding to the terminal device, and decrypts the third ciphertext step by step to obtain the decryption result.

2. The method according to claim 1, characterized in that, After successful registration, the terminal device exchanges key information with the verification server, including: After successful registration, the verification server generates a public key and a private key, and binds the public key and private key with the identity information of the terminal device; The verification server sends the public key to the terminal device.

3. The method according to claim 2, characterized in that, After the verification server sends the public key to the terminal device, it further includes: The terminal device sends the first encryption rule and the second encryption rule to the verification server; The verification server forwards the first encryption rule and the second encryption rule to the edge gateway.

4. The method according to claim 1, characterized in that, The edge gateway sends the second ciphertext to the terminal device, including: The edge gateway sends the second ciphertext and other strings to the terminal device; After verifying the second ciphertext, the terminal device sends the password book to the edge gateway, including: The terminal device determines that the data sent by the edge gateway includes a second ciphertext obtained through local encryption, and sends the ciphertext to the edge gateway.

5. The method according to claim 1, characterized in that, The customer data includes at least data on production equipment, data on energy-consuming customers, and energy configuration data.

6. A multi-layered encryption system for customer data in a smart IoT energy system, used to implement the method described in any one of claims 1-5, characterized in that, include: Multiple terminal devices, and verification servers and edge gateways that communicate with each terminal device; The terminal device registers with the verification server based on its identity information. After successful registration, the terminal device exchanges key information with the verification server. The terminal device encrypts the customer data type, customer data, and identity information using a public key to generate a first ciphertext; encrypts the first ciphertext according to a first encryption rule pre-agreed with the edge gateway to obtain a second ciphertext; encrypts the second ciphertext according to a second encryption rule pre-agreed with the edge gateway to obtain a third ciphertext; and sends the third ciphertext to the edge gateway. The edge gateway searches for the second decryption rule and the first decryption rule corresponding to the terminal device to decrypt the third ciphertext step by step to obtain the decryption result; The edge gateway sends the decryption result to the verification server; The verification server decrypts the decryption result using the private key corresponding to the terminal device to obtain the data uploaded by the terminal device.

7. The system according to claim 6, characterized in that, The system also includes an energy management server; The verification server sends the data uploaded by the terminal device to the energy management server; The energy management server analyzes the received data and generates management policies, which are then sent to the terminal device via a gateway.

8. The system according to claim 7, characterized in that, The energy management server has a human-computer interaction interface and receives management policies input by the administrator.

Images