Intelligent substation security communication method and system based on edge computing

Abstract

The application discloses an intelligent substation security communication method and system based on edge computing, proposes an intelligent substation security communication strategy based on edge computing, provides shared proxy computing services for resource-limited terminal devices, greatly reduces the time for the terminal devices to process security messages, and can well meet the high-specification delay requirements of communication messages. In view of the access risk control problems of the edge server and the terminal device, a lightweight two-way identity authentication protocol is proposed, which is low in security risk, high in real-time authentication efficiency and light in weight, and is more suitable for real-time interaction of the substation transceiving time-sensitive business subject and the edge server. Moreover, considering that the server is low in risk level and high in performance, and the terminal device is high in risk level and low in performance, an asymmetric two-way authentication mode of weak authentication for the server and strong authentication for the terminal device is proposed, so that the calculation burden of the terminal device is reduced, and the authentication efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent substation security communication technology, and in particular, to an intelligent substation security communication method and system based on edge computing, electronic equipment, and computer-readable storage medium. Background Technology

[0002] With the construction and development of new power systems, smart substations based on the IEC 61850 standard are continuously advancing towards networking, intelligence, and transparency, greatly improving their operability and compatibility. However, due to the high coupling between the information layer and the physical layer, significant risks have been introduced to the secure and stable operation of communication networks, increasing the likelihood of malicious attacks on power networks. Smart substations have become key sites for network attack and defense. The promulgation of the IEC 62351 standard has provided a solution to the communication security problem of smart substations, but the application of security protection measures inevitably leads to reduced computational efficiency and increased communication latency, thereby reducing the real-time performance of communication messages. Communication timeouts can cause adverse effects such as decision-making errors and escalation of incidents. Therefore, it is necessary to balance real-time efficiency and security level in the security protection strategy for communication messages. Although existing research has explored effective directions for the secure delivery and real-time response of communication services in smart substations, there are still many shortcomings. On the one hand, most existing research is based on international cryptographic systems, which poses a security risk of being exploited by backdoor attacks. On the other hand, the security requirements for communication messages are not comprehensively considered, and there is a lack of effective defense strategies against network attacks. Summary of the Invention

[0003] This invention provides a smart substation secure communication method and system based on edge computing, electronic equipment, and computer-readable storage medium to solve the technical problem that existing smart substation communication cannot meet the requirements of high security and low latency response.

[0004] According to one aspect of the present invention, a smart substation security communication method based on edge computing is provided, comprising the following:

[0005] Configure edge servers for smart substations to provide proxy services;

[0006] The edge server and the terminal equipment of the smart substation are registered with a trusted third-party institution through a secure channel;

[0007] Multiple terminal devices in each subdomain register their identities with the corresponding edge server through a secure channel;

[0008] Asymmetric two-way authentication is performed between the terminal device and the edge server. If the authentication is successful, the edge server starts the proxy computing service. If the authentication fails, the terminal device handles the message task itself.

[0009] Based on the security attributes of the messages sent by the terminal device, the message tasks that require proxy calculation in the results are sent to the edge server, and the edge server performs proxy calculation on the received message tasks.

[0010] Furthermore, the process of registering the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel includes the following:

[0011] Each terminal device in each subdomain sends a registration request containing its own identity to the corresponding edge server. The edge server performs encrypted calculations based on the public key of the third-party trusted institution, the identity of the terminal device, and the identity of the edge server to generate ciphertext, and then sends it to the third-party trusted institution to request verification of the legitimacy of the terminal device.

[0012] After the third-party trusted institution verifies the identity of the terminal device and the identity of the edge server, it distributes its shared key with multiple terminal devices in the subdomain to the edge server. Based on the public key in the third key pair, its own identity, and the shared key, it performs encryption calculations to generate ciphertext and sends it to the edge server. It also stores the shared key in its own database.

[0013] After receiving the ciphertext, the edge server decrypts it using the private key in the third key pair to recover the shared key. It then performs a sharding operation on the shared key according to the number of terminal devices it proxies, dividing it into multiple shared subkeys. Each terminal device in the corresponding subdomain is assigned a shared subkey, and each terminal device is configured with a shadow identity identifier.

[0014] Based on the number of terminal devices proxied by the edge server, a corresponding number of identifier fragments are extracted from the identity identifier of the edge server. A hash identity identifier is calculated based on the shared subkey and the identifier fragments. The shadow identity identifier, the shared subkey, and the hash identity identifier are merged through a secure channel and sent to different terminal devices accordingly. A registration information table is generated based on the shadow identity identifier, the shared subkey, the hash identity identifier, and the identity identifier of the terminal device and stored in its own database.

[0015] After receiving its corresponding shadow identity, shared subkey, and hash identity, the terminal device calculates the user authentication code using its private password and identity. Based on the shared subkey, it encrypts the identity to obtain the encrypted identity information. Based on the user authentication code and the shared subkey, it calculates the shared subkey variant and stores the shared subkey variant, user authentication code, shadow identity, encrypted identity information, and hash identity in its own database.

[0016] Furthermore, the process of performing asymmetric two-way authentication between the terminal device and the edge server specifically involves:

[0017] After the user enters their username and password, the user identity information code is calculated. The user identity information code is compared with the user authentication code. If they are the same, the user authentication is successful. The shared subkey is then recovered based on the user identity information code and the shared subkey variant.

[0018] The terminal device generates key ciphertext information based on the identity ciphertext information and the shared subkey, extracts the current timestamp, and merges the shadow identity identifier, key ciphertext information, identity ciphertext information and the current timestamp to generate a device authentication code, which is then sent to the edge server.

[0019] After receiving the device authentication code, the edge server determines whether the network latency requirement is met based on the difference between the receiving time and the sending time. If it is met, it retrieves the corresponding shared subkey from its own database based on the shadow identity. It then calculates key verification information based on the retrieved shared subkey and the received encrypted identity information. The key verification information is compared with the encrypted key information. If they are the same, the information is decrypted based on the shared subkey and the encrypted identity information to obtain the terminal device's identity identifier. The server then determines whether the terminal device's identity identifier belongs to a legitimate device in the registration information table. If it does, the terminal device's authentication is successful.

[0020] The edge server calculates the server identity information based on the stored hash identity identifier and shared subkey, extracts the current timestamp, and merges the hash identity identifier, server identity information and current timestamp into a server authentication code before sending it to the terminal device.

[0021] After receiving the server authentication code, the terminal device determines whether the network latency requirement is met based on the difference between the receiving time and the sending time. If it is met, it compares the received hash identity identifier with its own stored hash identity identifier. If they are the same, it uses its own stored shared subkey and hash identity identifier to calculate the server authentication information. It then compares the server authentication information with the received server identity information. If they are the same, the server authentication is successful.

[0022] Furthermore, the process of configuring an edge server for a smart substation to provide proxy services specifically involves:

[0023] The communication network of the smart substation is divided into different subdomains. Each subdomain forms a security protection boundary by configuring defense resources. For each subdomain, an edge server is configured to provide proxy services.

[0024] Furthermore, the process of registering the identities of the edge server and the terminal equipment of the smart substation through a secure channel with a trusted third-party organization specifically involves:

[0025] Each terminal device sends a registration request containing its own identity identifier to a trusted third-party organization for identity registration. After determining that the terminal device is legitimate, the trusted third-party organization randomly generates a first key pair for encryption and decryption and a second key pair for signing and verification.

[0026] A trusted third-party institution extracts its own public key and merges the first key pair, the second key pair, and its own public key into a first identity registration code, which is then sent to the terminal device. The first key pair, the second key pair, and the identity identifier of the terminal device are associated and stored in its own database.

[0027] Each edge server sends a registration request containing its own identity identifier to a trusted third-party organization for identity registration. After determining the legitimacy of the edge server, the trusted third-party organization randomly generates a third key pair for it.

[0028] A trusted third-party organization extracts its own public key and merges the third key pair with its own public key to form a second identity registration code, which is then sent to the edge server. The third key pair is then associated with the identity identifier of the edge server and stored in its own database.

[0029] Furthermore, the process of sending the message tasks requiring proxy calculation in the result to the edge server based on the security attributes of the messages sent by the terminal device specifically involves:

[0030] Based on the security attributes of the security message, the terminal device uses a time-series logic model to segment the security message into sub-messages with a single security attribute that can make independent offloading decisions.

[0031] Based on the special security attributes of sub-messages, the terminal device makes offloading decisions based on the message calculation offloading model and sends the message tasks that need to be proxied for calculation in the decision results to the edge server.

[0032] Furthermore, the process by which the edge server performs proxy calculations on the received message tasks is specifically as follows:

[0033] After receiving a request message from a terminal device, the edge server places it into a waiting queue according to a dynamic priority-based queue waiting model.

[0034] The edge server sequentially retrieves and processes request message tasks in the queue according to computing needs;

[0035] The edge server sends the processing results back to the corresponding terminal device to complete the proxy computing service;

[0036] After receiving all the proxy results from the edge server and completing its own message processing tasks, the terminal device restores the original complete security message according to the reverse process of the time-series logic model.

[0037] In addition, the present invention also provides a smart substation security communication system based on edge computing, comprising:

[0038] The edge server configuration module is used to configure edge servers for smart substations to provide proxy services.

[0039] The first identity registration module is used to register the identities of edge servers and smart substation terminal devices with a trusted third-party organization through a secure channel;

[0040] The second identity registration module is used to register the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel.

[0041] The two-way authentication module is used to perform asymmetric two-way authentication between the terminal device and the edge server. If the authentication is successful, the edge server starts the proxy computing service; if the authentication fails, the terminal device handles the message task itself.

[0042] The message task sending module is used to send the message tasks that need to be proxied for calculation to the edge server based on the security attributes of the messages sent by the terminal device.

[0043] In addition, the present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method described above by calling the computer program stored in the memory.

[0044] In addition, the present invention also provides a computer-readable storage medium for storing a computer program for secure communication of smart substations based on edge computing, wherein the computer program executes the steps of the method described above when running on a computer.

[0045] The present invention has the following effects:

[0046] This invention presents a secure communication method for smart substations based on edge computing. It proposes a secure communication strategy for smart substations based on edge computing, introducing a server proxy computing model from edge computing to provide shared proxy computing services for resource-constrained terminal devices. This compensates for the performance limitations of terminal devices, significantly reducing the time spent processing secure messages and effectively meeting the high latency requirements of communication messages. Simultaneously, addressing the access risk management issues of edge servers and terminal devices, a lightweight two-way authentication protocol is proposed. This protocol offers low security risk, high real-time authentication efficiency, and lightweight attributes, making it more suitable for real-time interaction between time-sensitive business entities in substations and edge servers. Furthermore, considering the characteristics of servers (lower risk level and higher performance) and terminal devices (higher risk level and lower performance), an asymmetric two-way authentication mode is proposed, employing weak authentication for servers and strong authentication for terminal devices. This reduces the computational burden on terminal devices and improves authentication efficiency.

[0047] In addition, the edge computing-based smart substation security communication system of the present invention also has the above-mentioned advantages.

[0048] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The invention will now be described in further detail with reference to the figures. Attached Figure Description

[0049] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0050] Figure 1 This is a flowchart illustrating a preferred embodiment of the secure communication method for smart substations based on edge computing according to the present invention.

[0051] Figure 2 yes Figure 1 A schematic diagram of the sub-process of step S2.

[0052] Figure 3 This is a schematic diagram of the data flow of the terminal device and the edge server registering their identities with a trusted third-party organization in a preferred embodiment of the present invention.

[0053] Figure 4 yes Figure 1 A schematic diagram of the sub-process of step S3.

[0054] Figure 5 This is a schematic diagram of the data flow of a terminal device registering its identity on an edge server in a preferred embodiment of the present invention.

[0055] Figure 6 yes Figure 1A schematic diagram of the sub-process of step S4.

[0056] Figure 7 This is a schematic diagram of the data flow for two-way authentication between the terminal device and the edge server in a preferred embodiment of the present invention.

[0057] Figure 8 yes Figure 1 A schematic diagram of the sub-process of step S5.

[0058] Figure 9 yes Figure 1 A schematic diagram of another sub-process of step S5.

[0059] Figure 10 This is a schematic diagram of the module structure of a smart substation security communication system based on edge computing, according to a preferred embodiment of the present invention. Detailed Implementation

[0060] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, the present invention can be implemented in many different ways as defined and covered below.

[0061] Understandable, such as Figure 1 As shown, a preferred embodiment of the present invention provides a secure communication method for smart substations based on edge computing, comprising the following:

[0062] Step S1: Configure an edge server for the smart substation to provide proxy services;

[0063] Step S2: Register the identities of the edge server and the terminal equipment of the smart substation with a trusted third-party institution through a secure channel;

[0064] Step S3: Register the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel;

[0065] Step S4: Perform asymmetric two-way authentication between the terminal device and the edge server. If the authentication is successful, the edge server will start the proxy computing service. If the authentication fails, the terminal device will handle the message task itself.

[0066] Step S5: Based on the security attributes of the messages sent by the terminal device, send the message tasks that need to be proxied in the results to the edge server. The edge server then performs proxy calculations on the received message tasks.

[0067] It is understood that the edge computing-based smart substation security communication method in this embodiment proposes an edge computing-based smart substation security communication strategy. It introduces a server proxy computing mode from edge computing to provide shared proxy computing services for resource-constrained terminal devices, compensating for the performance limitations of terminal devices and significantly reducing the time for terminal devices to process security messages, thus effectively meeting the high latency requirements of communication messages. Simultaneously, addressing the access risk management issue between edge servers and terminal devices, a lightweight two-way authentication protocol is proposed. This protocol has low security risk, high real-time authentication efficiency, and lightweight attributes, making it more suitable for real-time interaction between substation time-sensitive business entities (such as the main protection and control equipment for GOOSE services) and edge servers. Furthermore, considering the characteristics of servers having lower risk levels and higher performance, while terminal devices have higher risk levels and lower performance, an asymmetric two-way authentication mode is proposed, performing weak authentication on the server and strong authentication on the terminal device. This reduces the computational burden on terminal devices and improves authentication efficiency.

[0068] Optionally, in step S1, the process of configuring an edge server for the smart substation to provide proxy services specifically includes:

[0069] The intelligent substation communication network is divided into different subdomains. Each subdomain forms a security protection boundary by configuring defense resources, thus creating a relatively isolated communication subnetwork. For each subdomain, an edge server is configured to provide proxy services. This ensures sufficient proxy services for each terminal device in the intelligent substation communication network, effectively reducing the time for terminal devices to process security messages and meeting the high latency requirements of communication messages. It also allows for area-based security risk management of the entire communication network, improving the overall security of the intelligent substation communication network. It can be understood that for any subdomain, assuming that the edge server S in that subdomain can provide G types of services, the service types can be represented as... The corresponding processing speed can be expressed as Furthermore, the set of terminal equipment in a smart substation can be represented as follows: Let n represent the number of terminal devices. The terminal devices in a smart substation include MU IED, P&C IED, and STIED, etc. For any terminal device R in any subdomain... i Assume that the communication messages it participates in sending and receiving constitute a comprehensive task D. i Its sub-message task is represented as D. ij {i=1,…,n;j=1,…,m}, and sub-message task D ij It can be represented as: , among which, I ij Indicates sub-message task D ijIdentification identifier, P ij Indicates sub-message task D ij The original priority, Q ij Indicates sub-message task D ij Data size, S ij Indicates sub-message task D ij The types of services requested from the edge server S, such as encryption, decryption, signing, and signature verification, and lightweight operations such as message freshness factor verification and integrity checks, can be handled by the terminal device R. i Completed independently, K ij This indicates that edge server S is paired with sub-message task D. ij The key used for processing calculations, A ij This indicates that edge server S is paired with sub-message task D. ij The algorithm used for processing and calculation, B is Indicates terminal device R i The connection bandwidth between the edge server S and the edge server S Indicates sub-message task D ij The delay requirement.

[0070] Understandable, such as Figure 2 As shown, in step S2, the process of registering the identities of the edge server and the terminal equipment of the smart substation through a secure channel with a trusted third-party organization specifically involves:

[0071] Step S21: Each terminal device sends a registration request containing its own identity identifier to a third-party trusted institution for identity registration. After determining that the terminal device is legitimate, the third-party trusted institution randomly generates a first key pair for encryption and decryption and a second key pair for signing and verification.

[0072] Step S22: The trusted third-party institution extracts its own public key, merges the first key pair, the second key pair, and its own public key into a first identity registration code, sends it to the terminal device, and stores the first key pair, the second key pair, and the identity identifier of the terminal device in its own database;

[0073] Step S23: Each edge server sends a registration request containing its own identity identifier to a third-party trusted institution for identity registration. After determining the legitimacy of the edge server, the third-party trusted institution randomly generates a third key pair for it.

[0074] Step S24: The trusted third-party institution extracts its own public key, merges the third key pair with its own public key into a second identity registration code, sends it to the edge server, and associates the third key pair with the identity identifier of the edge server and stores it in its own database.

[0075] Specifically, such as Figure 3As shown, for any terminal device R i Generate and generate a registration request. Register your identity with a trusted third-party organization (TA). Indicates terminal device R i The registration request sent, I i Indicates terminal device R i The identity identifier, the third-party trusted institution TA first judges the terminal device R i The legitimacy of the identity, and then for the terminal device R i Randomly generate the first key pair for encryption and decryption. and a second key pair used for signing and verification ,in, and Representing terminal device R i The encryption key and decryption key, and Representing terminal device R i The signature key and the verification key.

[0076] Then, the trusted third-party organization (TA) extracts its own public key. To terminal device R i Send first identity registration code and the first key pair, the second key pair, and the terminal device R i The identity identifier is associated with and stored in its own database, specifically represented as... .

[0077] Next, for any edge server S, a registration request is generated and sent. Register your identity with a trusted third-party organization (TA). This indicates a registration request sent by edge server S, I S To represent the identity of edge server S, a trusted third-party organization TA first verifies the legitimacy of edge server S's identity, and then randomly generates a third key pair for it. ,in, Represents the public key. This represents the private key.

[0078] Then, the trusted third-party organization (TA) extracts its own public key. Send a second identity registration code to the edge server S and the third key pair and the identity identifier of the edge server S S The association is stored in its own database, specifically represented as... .

[0079] Understandable, such as Figure 4As shown, in step S3, the process of registering the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel includes the following:

[0080] Step S31: A terminal device in each subdomain sends a registration request containing its own identity to the corresponding edge server. The edge server performs encryption calculations based on the public key of the third-party trusted institution, the identity of the terminal device, and the identity of the edge server to generate ciphertext, and then sends it to the third-party trusted institution to request verification of the legitimacy of the terminal device.

[0081] Step S32: After the third-party trusted institution verifies the identity of the terminal device and the identity of the edge server, it distributes its shared key with multiple terminal devices in the subdomain to the edge server, and performs encryption calculation based on the public key in the third key pair, its own identity, and the shared key to generate ciphertext, which is then sent to the edge server. The shared key is also stored in its own database.

[0082] Step S33: After receiving the ciphertext, the edge server decrypts it using the private key in the third key pair to recover the shared key. It then performs a fragmentation operation on the shared key according to the number of terminal devices it proxies, dividing it into multiple shared subkeys. It assigns a shared subkey to each terminal device in the corresponding subdomain and configures a shadow identity for each terminal device.

[0083] Step S34: Extract the corresponding number of identifier fragments from the identity identifier of the edge server according to the number of terminal devices proxied by the edge server, calculate the hash identity identifier based on the shared subkey and the identifier fragments, merge the shadow identity identifier, the shared subkey and the hash identity identifier through the secure channel and send them to different terminal devices accordingly, and generate a registration information table based on the shadow identity identifier, the shared subkey and the hash identity identifier and the identity identifier of the terminal device and store it in its own database.

[0084] Step S35: After receiving its corresponding shadow identity identifier, shared subkey and hash identity identifier, the terminal device calculates the user authentication code using its private password and identity identifier, encrypts the identity identifier based on the shared subkey to obtain the ciphertext information of the identity, calculates the shared subkey variant based on the user authentication code and the shared subkey, and associates and stores the shared subkey variant, user authentication code, shadow identity identifier, ciphertext information of the identity and hash identity identifier in its own database.

[0085] Specifically, such as Figure 5 As shown, through any terminal device R in each subdomain i Send registration request and one's own identity I iThe data is routed to edge server S, which uses the public key of a trusted third-party organization TA. Perform cryptographic calculations Generate ciphertext Send to a trusted third-party organization to request access to the terminal device R. i Identity representation I i The legitimacy of the document needs to be verified.

[0086] The identity identifier of the terminal device by a trusted third-party organization i and the identity identifier of the edge server S After successful verification, the edge server distributes its shared key with multiple terminal devices in that subdomain. and perform encrypted calculations. It is then sent to the edge server, where it stores the shared key. .in, It represents the identity identifier of a trusted third-party organization.

[0087] The edge server receives Then, it first calls its own private key. Decrypt and recover the shared key. Next, the shared key is configured according to the number of terminal devices n it proxies. Performing a sharding operation can be represented as This yields n shared subkeys. For each terminal device R... i Allocate a shared subkey And the identity identifier I for each terminal device i Configure a shadow identity , can be represented as .

[0088] Then, based on the number n of terminal devices proxied by the edge server, the identity I of the edge server is used... s Extract n identifier fragments, and the set of identifier fragments is represented as follows: And calculate the corresponding hash identity identifier. Finally, the shadow identity, shared subkey, and hash identity are merged and sent to different terminal devices in the corresponding subdomains via a secure channel, for example, ... The corresponding message is sent to the terminal device R. i Furthermore, the edge server will secretly store the registration information table. In its own database.

[0089] Next, terminal device R i In receiving Then, first enter the private password W. i and its own identity identifier I iCalculate the user authentication code β i , Then, identify its own identity I i Perform encrypted calculations to generate ciphertext identity information: Then, the allocated shared subkey is computed via XOR. The variant yields a shared subkey variant. It also associates and stores the shared subkey variant, user authentication code, shadow identity identifier, identity ciphertext information, and hash identity identifier in its own database. This storage can be represented as... .

[0090] Understandable, such as Figure 6 As shown, in step S4, the process of performing asymmetric two-way authentication between the terminal device and the edge server specifically involves:

[0091] Step S41: After the user enters their username and password, the user identity information code is calculated. The user identity information code is compared with the user authentication code. If they are the same, the user authentication is successful. The shared subkey is recovered based on the user identity information code and the shared subkey variant.

[0092] Step S42: The terminal device generates key ciphertext information based on the identity ciphertext information and the shared subkey, extracts the current timestamp, merges the shadow identity identifier, key ciphertext information, identity ciphertext information and the current timestamp to generate a device authentication code, and then sends it to the edge server;

[0093] Step S43: After receiving the device authentication code, the edge server determines whether the network latency requirement is met based on the difference between the receiving time and the sending time. If it is met, it retrieves the corresponding shared subkey from its own database based on the shadow identity identifier. It then calculates key verification information based on the retrieved shared subkey and the received encrypted identity information. The key verification information and the encrypted key information are compared. If they are the same, the information is decrypted based on the shared subkey and the encrypted identity information to obtain the terminal device's identity identifier. The server then determines whether the terminal device's identity identifier belongs to a legitimate device in the registration information table. If it does, the terminal device's authentication is successful.

[0094] Step S44: The edge server calculates the server identity information based on the stored hash identity identifier and shared subkey, extracts the current timestamp, merges the hash identity identifier, server identity information and current timestamp into a server authentication code and sends it to the terminal device;

[0095] Step S45: After receiving the server authentication code, the terminal device determines whether the network latency requirement is met based on the difference between the receiving time and the sending time. If it is met, it compares whether the received hash identity identifier is the same as the hash identity identifier stored in its own memory. If they are the same, it uses the shared subkey stored in its own memory and the hash identity identifier to calculate the server authentication information. It then compares whether the server authentication information is the same as the received server identity information. If they are the same, the server authentication is successful.

[0096] Specifically, such as Figure 7 As shown, during asymmetric two-way authentication, the legitimacy of the user's identity on the terminal device is verified first, and then the user enters their username. and password First, a hash calculation is performed to obtain the user's identity information code. , Terminal device R i Compare user identity information code With user authentication code If they are the same, the user's authentication is successful. Then, the shared subkey is recovered by XORing the user's identity information code and the variant of the shared subkey, specifically represented as: .

[0097] Then, terminal device R i Calculate or directly access encrypted identity information Then, key ciphertext information is generated through hash calculation. , Extract the current timestamp T i1 Generate device authentication code V i , And send it to the edge server.

[0098] Next, the edge server verifies the terminal device R. i The edge server receives the device authentication code V to verify the identity. i Then, the network latency requirement is first determined based on the difference between the receiving time and the sending time, i.e., whether the following formula holds true: ,in, Indicates the reception time of the edge server. Indicates terminal device R i The network latency interval between the server and the edge server S. If true, then the shadow identity registered in its own database is identified. And based on the shadow identity identifier Find the corresponding shared subkey Then based on the shared subkey and received encrypted identity information Perform hash calculations to obtain key verification information. , And compare key verification information and key ciphertext information If they are the same, it means the identity is encrypted. and key verification information None of them had been tampered with. Finally, the shared subkey was invoked. For encrypted identity information Perform decryption operation, that is, execute The terminal device R was restored. i Identity I i And determine the identity identifier I obtained after decryption. i Does it belong to the registration information table? If the device is a legitimate device, the edge server will authenticate the terminal device.

[0099] After the edge server successfully authenticates the terminal device, it generates a server authentication code V. Si And send to terminal device R i , ,in, and These represent the first and second identity information of the edge server, respectively. Indicates the current timestamp. That is, the first identity information is a hash identity identifier. That is, the second identity information is obtained by hashing the hash identity identifier and the shared subkey.

[0100] Terminal device R i Upon receiving the server authentication code V Si Next, the network latency requirement is determined based on the difference between the receiving and sending times, i.e., whether the following formula holds true: , This indicates the reception time of the terminal device Ri. If the condition is met, the received data is compared. With its own stored hash identity identifier If they are the same, continue verification; otherwise, stop verification and issue a warning. Then, use the shared subkey stored within itself. and the received hash identity identifier Perform hash calculations to obtain server authentication information. Compare server authentication information Second identity information with edge server Are they the same? If they are the same, then it means... and Verification of the edge server can be completed if it has not been tampered with.

[0101] It is understood that in the asymmetric two-way authentication mode of this invention, completing the authentication of the terminal device involves one encryption / decryption operation and two hash operations. The terminal device participates in one encryption operation and one hash operation, but the encryption operation can be pre-completed and stored in a database. After the user recovers the key, the encrypted identity can be retrieved for subsequent calculations, without consuming real-time time. The server participates in one decryption operation and one hash operation. Due to the server's strong performance, the time overhead of completing this authentication process is not high. Completing the server's authentication only involves two hash operations, one for the terminal device and one for the server. Furthermore, completing the terminal user's identity verification only involves one hash calculation and one lightweight XOR key recovery operation. The time overhead of the XOR operation is negligible compared to other operations, as shown in Table 1. Moreover, the real-time authentication process only uses lightweight operations such as symmetric encryption / decryption, XOR, and hash, resulting in higher real-time authentication efficiency and a lightweight nature, making it more suitable for real-time interaction between substation time-sensitive business entities (such as the main protection and control equipment for GOOSE business) and edge servers. In addition, considering the weak security protection capabilities of terminal devices, a variant of the shared key is used for storage. The real shared key is then restored and used for two-way verification with the edge server after the username and command entered by the terminal user are verified. This greatly reduces the risk of key leakage and further improves the level of security protection.

[0102] Table 1. Operational Cost Table

[0103]

[0104] Understandable, such as Figure 8 As shown, in step S5, the process of sending the message tasks requiring proxy calculation in the result to the edge server based on the security attributes of the messages sent by the terminal device specifically involves:

[0105] Step S51: Based on the security attributes of the security message, the terminal device uses a time-series logic model to segment the security message into sub-messages with a single security attribute that can independently make offloading decisions.

[0106] Step S52: Based on the special security attributes of the sub-message, the terminal device makes an offloading decision based on the message calculation offloading model and sends the message tasks that need to be proxied for calculation in the decision result to the edge server.

[0107] Understandable, such as Figure 9 As shown, in step S5, the process by which the edge server performs proxy calculations on the received message tasks is specifically as follows:

[0108] Step S501: After receiving the request message task from the terminal device, the edge server puts it into the waiting queue according to the queue waiting model based on dynamic priority;

[0109] Step S502: The edge server sequentially retrieves and processes the request message tasks in the queue according to the computing requirements;

[0110] Step S503: The edge server sends the processing result back to the corresponding terminal device to complete the proxy computing service;

[0111] Step S504: After receiving all the proxy results and completing the message tasks processed by the edge server, the terminal device restores the original complete security message according to the reverse process of the time sequence logic model.

[0112] In addition, the edge server will also judge the difference in attack volume between the attack area and the non-attack area. If the attack volume in the attack area is significantly greater than that in the non-attack area, it will be determined that there is network supply.

[0113] In addition, such as Figure 10 As shown, another embodiment of the present invention also provides a smart substation security communication system based on edge computing, preferably employing the method described above, including:

[0114] The edge server configuration module is used to configure edge servers for smart substations to provide proxy services.

[0115] The first identity registration module is used to register the identities of edge servers and smart substation terminal devices with a trusted third-party organization through a secure channel;

[0116] The second identity registration module is used to register the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel.

[0117] The two-way authentication module is used to perform asymmetric two-way authentication between the terminal device and the edge server. If the authentication is successful, the edge server starts the proxy computing service; if the authentication fails, the terminal device handles the message task itself.

[0118] The message task sending module is used to send the message tasks that need to be proxied for calculation to the edge server based on the security attributes of the messages sent by the terminal device.

[0119] It is understood that the edge computing-based smart substation security communication system in this embodiment proposes an edge computing-based smart substation security communication strategy. It introduces a server proxy computing model from edge computing to provide shared proxy computing services for resource-constrained terminal devices, compensating for the performance limitations of terminal devices and significantly reducing the time for terminal devices to process security messages, thus effectively meeting the high latency requirements of communication messages. Simultaneously, addressing the access risk management issue between edge servers and terminal devices, a lightweight two-way authentication protocol is proposed. This protocol features low security risk, high real-time authentication efficiency, and lightweight attributes, making it more suitable for real-time interaction between substation time-sensitive business entities (such as the main protection and control equipment for GOOSE services) and edge servers. Furthermore, considering the characteristics of servers having lower risk levels and higher performance, while terminal devices have higher risk levels and lower performance, an asymmetric two-way authentication mode is proposed, employing weak authentication for servers and strong authentication for terminal devices. This reduces the computational burden on terminal devices and improves authentication efficiency.

[0120] In addition, another embodiment of the present invention provides an electronic device including a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method described above by calling the computer program stored in the memory.

[0121] In addition, another embodiment of the present invention provides a computer-readable storage medium for storing a computer program for secure communication of smart substations based on edge computing, wherein the computer program executes the steps of the method described above when running on a computer.

[0122] Common computer-readable storage media include: floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, any other optical media, punch cards, paper tape, any other physical media with perforated patterns, random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), flash erasable programmable read-only memory (FLASH-EPROM), any other memory chips or cartridges, or any other media readable by a computer. Instructions may further be transmitted or received by a transmission medium. The term transmission medium can include any tangible or intangible medium used to store, encode, or carry instructions for machine execution, and includes digital or analog communication signals or intangible media that facilitate communication of such instructions. Transmission media include coaxial cables, copper wires, and optical fibers, which contain conductors for transmitting a bus of computer data signals.

[0123] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0124] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0125] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0126] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0127] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0128] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0129] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A secure communication method for smart substations based on edge computing, characterized in that, Includes the following: Configure edge servers for smart substations to provide proxy services; The edge server and the terminal equipment of the smart substation are registered with a trusted third-party institution through a secure channel; Multiple terminal devices in each subdomain register their identities with the corresponding edge server through a secure channel; Asymmetric two-way authentication is performed between the terminal device and the edge server. If the authentication is successful, the edge server starts the proxy computing service. If the authentication fails, the terminal device handles the message task itself. Based on the security attributes of the messages sent by the terminal device, the message tasks that need to be proxied in the results are sent to the edge server, and the edge server performs proxy calculations on the received message tasks. The process of sending the message tasks requiring proxy calculation in the result to the edge server based on the security attributes of the messages sent by the terminal device is specifically as follows: Based on the security attributes of the message, the terminal device uses a time-series logic model to segment the message into sub-messages with a single security attribute that can make independent offloading decisions. Based on the special security attributes of sub-messages, the terminal device makes offloading decisions based on the message calculation offloading model and sends the message tasks that need to be proxied for calculation in the decision results to the edge server.

2. The smart substation security communication method based on edge computing as described in claim 1, characterized in that, The process of registering the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel includes the following: Each terminal device in each subdomain sends a registration request containing its own identity to the corresponding edge server. The edge server performs encrypted calculations based on the public key of the third-party trusted institution, the identity of the terminal device, and the identity of the edge server to generate ciphertext, and then sends it to the third-party trusted institution to request verification of the legitimacy of the terminal device. After the third-party trusted institution verifies the identity of the terminal device and the identity of the edge server, it distributes a shared key to the edge server and multiple terminal devices in the subdomain. Based on the public key in the third key pair, its own identity, and the shared key, it performs encryption calculations to generate ciphertext and sends it to the edge server. The shared key is also stored in its own database. The third key pair is randomly generated by the third-party trusted institution after determining the legitimacy of the edge server. After receiving the ciphertext, the edge server decrypts it using the private key in the third key pair to recover the shared key. It then performs a sharding operation on the shared key according to the number of terminal devices it proxies, dividing it into multiple shared subkeys. Each terminal device in the corresponding subdomain is assigned a shared subkey, and each terminal device is configured with a shadow identity identifier. Based on the number of terminal devices proxied by the edge server, a corresponding number of identifier fragments are extracted from the identity identifier of the edge server. A hash identity identifier is calculated based on the shared subkey and the identifier fragments. The shadow identity identifier, the shared subkey, and the hash identity identifier are merged through a secure channel and sent to different terminal devices accordingly. A registration information table is generated based on the shadow identity identifier, the shared subkey, the hash identity identifier, and the identity identifier of the terminal device and stored in its own database. After receiving its corresponding shadow identity, shared subkey, and hash identity, the terminal device calculates the user authentication code using its private password and identity. Based on the shared subkey, it encrypts the identity to obtain the encrypted identity information. Based on the user authentication code and the shared subkey, it calculates the shared subkey variant and stores the shared subkey variant, user authentication code, shadow identity, encrypted identity information, and hash identity in its own database.

3. The smart substation security communication method based on edge computing as described in claim 2, characterized in that, The process of performing asymmetric two-way authentication between the terminal device and the edge server is as follows: After the user enters their username and password, the user identity information code is calculated. The user identity information code is compared with the user authentication code. If they are the same, the user authentication is successful. The shared subkey is then recovered based on the user identity information code and the shared subkey variant. The terminal device generates key ciphertext information based on the identity ciphertext information and the shared subkey, extracts the current timestamp, and merges the shadow identity identifier, key ciphertext information, identity ciphertext information and the current timestamp to generate a device authentication code, which is then sent to the edge server. After receiving the device authentication code, the edge server determines whether the network latency requirement is met based on the difference between the receiving time and the sending time. If it is met, it retrieves the corresponding shared subkey from its own database based on the shadow identity. It then calculates key verification information based on the retrieved shared subkey and the received encrypted identity information. The key verification information is compared with the encrypted key information. If they are the same, the information is decrypted based on the shared subkey and the encrypted identity information to obtain the terminal device's identity identifier. The server then determines whether the terminal device's identity identifier belongs to a legitimate device in the registration information table. If it does, the terminal device's authentication is successful. The edge server calculates the server identity information based on the stored hash identity identifier and shared subkey, extracts the current timestamp, and merges the hash identity identifier, server identity information and current timestamp into a server authentication code before sending it to the terminal device. After receiving the server authentication code, the terminal device determines whether the network latency requirement is met based on the difference between the receiving time and the sending time. If it is met, it compares the received hash identity identifier with its own stored hash identity identifier. If they are the same, it uses its own stored shared subkey and hash identity identifier to calculate the server authentication information. It then compares the server authentication information with the received server identity information. If they are the same, the server authentication is successful.

4. The smart substation security communication method based on edge computing as described in claim 1, characterized in that, The process of configuring an edge server for a smart substation to provide proxy services is as follows: The communication network of the smart substation is divided into different subdomains. Each subdomain forms a security protection boundary by configuring defense resources. For each subdomain, an edge server is configured to provide proxy services.

5. The smart substation security communication method based on edge computing as described in claim 1, characterized in that, The process of registering the identities of edge servers and smart substation terminal devices through a secure channel with a trusted third-party organization is as follows: Each terminal device sends a registration request containing its own identity identifier to a trusted third-party organization for identity registration. After determining that the terminal device is legitimate, the trusted third-party organization randomly generates a first key pair for encryption and decryption and a second key pair for signing and verification. A trusted third-party institution extracts its own public key and merges the first key pair, the second key pair, and its own public key into a first identity registration code, which is then sent to the terminal device. The first key pair, the second key pair, and the identity identifier of the terminal device are associated and stored in its own database. Each edge server sends a registration request containing its own identity identifier to a trusted third-party organization for identity registration. After determining the legitimacy of the edge server, the trusted third-party organization randomly generates a third key pair for it. A trusted third-party organization extracts its own public key and merges the third key pair with its own public key to form a second identity registration code, which is then sent to the edge server. The third key pair is then associated with the identity identifier of the edge server and stored in its own database.

6. The smart substation security communication method based on edge computing as described in claim 1, characterized in that, The process by which the edge server performs proxy calculations on the received message tasks is as follows: After receiving a request message from a terminal device, the edge server places it into a waiting queue according to a dynamic priority-based queue waiting model. The edge server sequentially retrieves and processes request message tasks in the queue according to computing needs; The edge server sends the processing results back to the corresponding terminal device to complete the proxy computing service; After receiving all the proxy results from the edge server and completing its own message processing tasks, the terminal device restores the original complete security message according to the reverse process of the time-series logic model.

7. A smart substation security communication system based on edge computing, employing the smart substation security communication method based on edge computing as described in any one of claims 1 to 6, characterized in that, include: The edge server configuration module is used to configure edge servers for smart substations to provide proxy services. The first identity registration module is used to register the identities of edge servers and smart substation terminal devices with a trusted third-party organization through a secure channel; The second identity registration module is used to register the identities of multiple terminal devices in each subdomain with the corresponding edge server through a secure channel. The two-way authentication module is used to perform asymmetric two-way authentication between the terminal device and the edge server. If the authentication is successful, the edge server starts the proxy computing service; if the authentication fails, the terminal device handles the message task itself. The message task sending module is used to send the message tasks that need to be proxied for calculation to the edge server based on the security attributes of the messages sent by the terminal device.

8. An electronic device, characterized in that, The method includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method as described in any one of claims 1 to 6 by calling the computer program stored in the memory.

9. A computer-readable storage medium for storing a computer program for secure communication in smart substations based on edge computing, characterized in that, The computer program, when run on a computer, performs the steps of the method as described in any one of claims 1 to 6.

Images