A user data encryption method and system based on DES algorithm

Abstract

The present invention provides a user data encryption method and system based on a DES algorithm. The user data encryption method based on a DES algorithm includes the following steps: S1: a central coordinator CCO receives original data, determines whether the length of the original data is less than or equal to a first set value, if yes, performs DES encryption on the entire data, and then executes step S3, if no, executes step S2; S2: intercepts data of the first set value length from the original data, and performs DES encryption, and the encrypted data and the unencrypted data are combined into combined data according to certain rules; S3: determines whether the length of the encrypted data in step S1 or the combined data in step S2 is greater than a second set value, if no, executes step S4, if yes, performs lossless data compression processing on the data, and then executes step S4; S4: encapsulates the data and sends it to the corresponding STA. The present invention effectively improves the security of data transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of power line broadband carrier communication, and in particular to a user data encryption method based on a DES algorithm, and also to a user data encryption system for implementing the user data encryption method based on the DES algorithm. Background Art

[0002] In the enterprise energy efficiency management system, in order to ensure the security and reliability of user data, the implementation of user data encryption is a necessary measure, and a user data encryption scheme is indispensable, which can effectively protect user data from being illegally eavesdropped and modified, and provide accurate data and security for the enterprise energy efficiency management system. This measure is conducive to promoting the improvement of enterprise management level and the reduction of operating costs, promoting the rational use of energy, and achieving the purpose of energy conservation, emission reduction, and energy conservation and consumption reduction.

[0003] The broadband carrier communication equipment currently in use on the market mainly transmits data transparently. This data transmission method has great security risks and is prone to illegal eavesdropping and modification of user data by the outside world, affecting the stability and reliability of the enterprise energy efficiency management system. Summary of the invention

[0004] In order to solve the problems in the prior art, the present invention provides a user data encryption method and system based on the DES algorithm.

[0005] The user data encryption method based on the DES algorithm of the present invention comprises the following steps:

[0006] S1: The central coordinator CCO receives the original data and determines whether the length of the original data is less than or equal to the first set value. If yes, DES encryption is performed on the entire data, and then step S3 is executed. If not, step S2 is executed.

[0007] S2: intercepting data of a first set value length from the original data, and performing DES encryption, and combining the encrypted data with the unencrypted data into combined data according to a certain rule;

[0008] S3: Determine whether the length of the data encrypted in step S1 or the combined data in step S2 is greater than a second set value. If not, execute step S4. If yes, perform lossless data compression on the data and then execute step S4.

[0009] S4: Encapsulate the data and send it to the corresponding STA.

[0010] Furthermore, before executing step S1, the central coordinator CCO and the STA also include an encryption authentication step. After the authentication is passed, step S1 is executed again.

[0011] Furthermore, the central coordinator CCO and STA are carrier communication devices, and the central coordinator CCO and STA implement RSA encryption authentication and DES key distribution through an extended protocol between the two.

[0012] Furthermore, the central coordinator CCO circulates through the STAs connected to it. If the current STA has completed identity authentication and DES key distribution, it detects the next STA. When it detects that the site STA has not completed identity authentication, it enters the identity authentication process, polls to the next one, and then traverses the STA again after a set interval.

[0013] Furthermore, the encryption authentication and DES key distribution method of the central coordinator CCO and STA includes the following sub-steps:

[0014] A1: The central coordinator CCO sends a request IDA command through the extended protocol;

[0015] A2: Receives the IDA identity information sent by STA, builds CS information based on RSA identity authentication, and then sends the CS command to STA through the extended protocol;

[0016] A3: After receiving the EB information fed back by STA, authenticate the STA. After the identity authentication is passed, use the STA public key to encrypt the DES key, and send the encrypted data to STA through the extended protocol to send the DES key command;

[0017] A4: Receiving the response confirmation frame from STA indicates that this STA has successfully received the DES key and then detects the next STA.

[0018] Furthermore, in steps A1-A4, each time the central coordinator CCO sends a command, a response threshold period is set. When a STA response frame is received or the response threshold period is exceeded, the central coordinator CCO executes the next sub-step.

[0019] Furthermore, after receiving the CS information sent by the central coordinator, the STA uses RSA key signature verification and identity authentication for the central coordinator CCO. After the signature verification and identity authentication are passed, the STA constructs the EB information according to the RSA identity authentication and sends it to the central coordinator CCO.

[0020] Furthermore, after receiving the encrypted DES key data, the STA uses its own RSA private key to decrypt it, and uses parity check to verify the correctness of the decrypted DES key. After confirming that it is correct, the STA replies with a response confirmation frame.

[0021] The present invention also provides a user data encryption system based on the DES algorithm, which is used to implement the user data encryption method based on the DES algorithm, comprising:

[0022] The original data judgment module is used to judge whether the length of the received original data is less than the first set value.

[0023] Encryption combination module: used to encrypt or encrypt and combine original data. If the length of the original data is less than or equal to the first set value, the entire data is encrypted by DES. If the length of the data is greater than the first set value, DES encryption is performed. The encrypted data and the unencrypted data are combined into combined data according to certain rules.

[0024] A judgment module: used to judge whether the length of the encrypted data or the combined data is greater than a second set value;

[0025] Lossless data compression processing module: used for performing lossless data compression processing on data exceeding a second set value;

[0026] Encapsulation and sending module: used to encapsulate and send data.

[0027] Furthermore, it also includes an encryption authentication module: used to implement RSA encryption authentication and DES key distribution between STA and the system through an extended protocol.

[0028] Compared with the prior art, the beneficial effects of the present invention are as follows: based on the existing HPLC high-speed broadband carrier communication equipment, the present invention achieves data encryption function by integrating RSA identity authentication process and DES encryption and decryption algorithm and extending broadband carrier communication protocol;

[0029] In data transmission control, considering the time required for encrypting data in practical applications, the present invention adopts full encryption and semi-encryption modes for communication. For data with too long data length, the present invention only encrypts the data field of the carrier meter reading frame, thereby ensuring data transmission efficiency. In addition, since the data length after DES encryption is twice the length of the original data, in order to improve the success rate of high-frequency meter reading, this product also introduces a lossless data compression algorithm to effectively reduce the number of MPDU frames;

[0030] In view of the fact that the existing low-voltage power line broadband carrier communication protocol does not support RSA authentication and the standard RSA authentication process is not suitable for the use scenarios of broadband carrier communication equipment, the present invention supports authentication and DES key distribution between CCO and STA by expanding the message ID and creatively optimizing the RSA authentication process, thereby improving the security of data communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the present invention or the solutions in the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 This is a schematic diagram of the hardware modification before delivery of the present invention;

[0033] Figure 2 This is a flow chart of an RSA identity authentication and DES key distribution method according to an embodiment of the present invention;

[0034] Figure 3 This is a flow chart of the user data encryption method based on the DES algorithm of the present invention;

[0035] Figure 4 This is the general message structure diagram of this application layer. DETAILED DESCRIPTION

[0036] Unless otherwise defined, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present invention or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0037] Reference to "embodiments" in the present invention means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it mutually exclusive, independent, or alternative to other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in the present invention may be combined with other embodiments.

[0038] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings.

[0039] The purpose of the present invention is to utilize the existing HPLC high-speed broadband carrier communication equipment in the low-voltage distribution network, in conjunction with the RSA algorithm, DES algorithm, openssl open source tools, etc., to encrypt and decrypt the usage process data of water, gas (steam), wind, and especially electric energy, and solve the existing user data security problems.

[0040] like Figure 1 As shown, the present invention makes creative improvements to the HPLC high-speed broadband carrier communication equipment that communicate with each other, so that it can realize the technical solution of the present invention. As an embodiment of the present invention, the HPLC high-speed broadband carrier communication equipment of the present invention includes CCO and STA, wherein CCO is a central coordinator, which plays the role of a master node in the communication network and is responsible for completing functions such as networking control and network maintenance management, and its corresponding device entity is a concentrator. STA is a site, which plays the role of a slave node in the communication network, and its corresponding device entity is a communication unit, including an electric energy meter dual-mode communication unit, a type I collector, a dual-mode communication unit or a dual-mode type II collector, etc.

[0041] The CCO and STA of the present invention will have built-in keys before leaving the production base, thereby realizing RSA encryption authentication, DES key distribution, and user data encryption communication.

[0042] The methods for built-in keys are:

[0043] (1) On a PC with Ubuntu system installed, use the openssl open source tool and the command "openssl genrsa-out***.pem 1024" to generate RSA keys in batches. The RSA keys are published to the tooling equipment. The RSA key of each carrier communication device is unique.

[0044] (2) Construct a 64-bit DES key, where the eighth bit of each byte is a parity bit;

[0045] (3) When the carrier communication equipment leaves the factory, the key is set in the module through the tooling equipment. The CCO sets its own RSA key and DES key, and the STA sets its own RSA key.

[0046] After the key is successfully built-in, it can be put into use in on-site networking.

[0047] In addition, the present invention not only improves the hardware, but also expands the message ID in the application layer communication protocol of the low-voltage power line broadband carrier communication interoperability technical specification, so that it can support the RSA algorithm and thus realize identity authentication.

[0048] The structure of the message exchange between CCO and STA in this example is as follows: Figure 4 As shown, this example expands the second part of the message ID, defines the meaning of the message ID for identity authentication, and sets the message port number. The message extended by the application layer communication protocol in this example is shown in Table 1.

[0049] Message ID meaning Message port number 0x0002 Request IDA 0x11 0x00C1 Send CS 0x11 0x00C2 Send DES key 0x11

[0050] Table 1

[0051] like Figure 2 As shown, in this example, before the CCO communicates with the STA, identity authentication is performed. After the authentication is passed, the DES key is distributed, and then secure communication is performed based on DES.

[0052] As an embodiment of the present invention, the specific process of identity authentication and DES key distribution between CCO and STA in this example is as follows:

[0053] (1) All STA names managed by the CCO will be stored at the CCO to form an archive table. The CCO will loop through the STAs in the archive table. If the STA has completed identity authentication and DES key distribution, it will detect the next STA. After polling the last STA, it will rest for a certain period of time, such as one minute, and then traverse the archive table again;

[0054] (2) When it is detected that the STA has not completed identity authentication, the identity authentication process is entered, and the CCO actively sends a "Request IDA" command to the STA through the extended protocol;

[0055] (3) After receiving the request IDA command, STA sends its own identity IDA to CCO;

[0056] (4) After receiving the IDA from STA, CCO constructs CS based on RSA identity authentication, and then sends it to STA through the extended protocol "Send CS" command. In this example, CS is the data signed by CCO using its own private key;

[0057] (5) When STA receives CS from CCO, it verifies the signature and authenticates the identity of CCO. After the signature and identity authentication are passed, STA constructs EB based on RSA identity authentication and sends it to CCO. In this example, EB is the data encrypted by STA using CCO's public key;

[0058] (6) After receiving the EB, the CCO authenticates the STA. After the authentication is passed, the CCO uses the STA public key to encrypt the DES key and sends the encrypted data to the STA through the extended protocol "Send DES key" command;

[0059] (7) After receiving the encrypted DES key data, the STA uses its own RSA private key to decrypt it. The decrypted DES key is verified to be correct using a parity check. After confirming that it is correct, the STA replies with a response confirmation frame.

[0060] (8) When CCO receives the response confirmation frame, it indicates that this STA has successfully received the DES key and then detects the next STA.

[0061] Preferably, each time the CCO sends a command in this example, a STA response timeout period is required. Therefore, this example sets a response threshold period, and the CCO must receive a STA response frame or exceed the response threshold period before executing the next operation, so as to avoid STA concentratedly sending carrier frames, resulting in low success rate and network congestion, and improve the success rate of DES key distribution. This example uses a cyclic traversal method for identity authentication to avoid the situation where communication cannot be achieved due to one of the authentication failures.

[0062] like Figure 3 As described above, after the DES key distribution of the present invention is completed, the user data encryption based on the DES algorithm can be started and then mutual communication can be carried out. Considering the time required for encrypting data in practical applications, this product currently uses a semi-encrypted method for communication, and only encrypts the data field of the carrier meter reading frame. In addition, since the data length after DES encryption is twice the length of the original data, in order to improve the success rate of high-frequency meter reading, this product also introduces a lossless data compression algorithm to effectively reduce the number of MPDU frames. After the original data is encrypted, combined, and compressed, it is also necessary to encapsulate the data to ensure that the receiving party can correctly obtain the original data.

[0063] As a preferred embodiment of the present invention, the user data encryption method based on the DES algorithm of the present invention comprises the following steps:

[0064] S1: The central coordinator CCO receives the original data, which may be a meter reading message, and then determines whether the length of the original data is less than or equal to 128 bytes. If yes, DES encryption is performed on the entire meter reading data, and then step S3 is executed. If not, step S2 is executed.

[0065] S2: intercept 128 bytes of data from the original data, and perform DES encryption on the data. The encrypted data is combined with the unencrypted data according to certain rules to form semi-encrypted combined data.

[0066] S3: Determine whether the length of the data encrypted in step S1 or the combined data in step S2 is greater than a second set value, such as 440 bytes. If not, execute step S4. If yes, perform lossless data compression on the data and then execute step S4.

[0067] S4: Data is encapsulated and sent to the corresponding STA via the carrier.

[0068] In step S2, the semi-encrypted data and encrypted data in this example can be processed by inserting short data into long data in byte steps, and then in step S4, when encapsulating the data, a 3-byte data header is added before the data, which respectively represents the compression algorithm, combination rule, and original data length, so that the receiving party STA can restore the data to the original data and obtain the original data information.

[0069] The present invention also provides a user data encryption system based on the DES algorithm, which is arranged in the CCO and is used to implement the user data encryption method based on the DES algorithm, comprising:

[0070] The original data judgment module is used to judge whether the length of the received original data is less than the first set value.

[0071] Encryption combination module: used to encrypt or encrypt and combine original data. If the length of the original data is less than or equal to the first set value, the entire data is encrypted by DES. If the length of the data is greater than the first set value, DES encryption is performed. The encrypted data and the unencrypted data are combined into combined data according to certain rules.

[0072] A judgment module: used to judge whether the length of the encrypted data or the combined data is greater than a second set value;

[0073] Lossless data compression processing module: used for performing lossless data compression processing on data exceeding a second set value;

[0074] Encapsulation and sending module: used to encapsulate and send data.

[0075] It also includes an encryption authentication module: used to implement RSA encryption authentication and DES key distribution between STA and the STA through an extended protocol.

[0076] As can be seen from the above, compared with the existing equipment, the present invention has the following innovative features:

[0077] 1. Low cost

[0078] There is no need to modify the hardware of the existing carrier communication equipment, only a PC and existing tooling equipment are needed. The 1024-bit RSA key is obtained using the openssl open source tool of the Ubuntu system. The RSA key is used for identity authentication between the CCO and the STA, and all other functions are completed by the software.

[0079] 2. High stability

[0080] The identity authentication and key distribution process is actively initiated by CCO. CCO controls and decides a certain time and a certain STA to perform identity authentication to avoid STAs sending requests in a concentrated manner, resulting in a low success rate and causing network congestion.

[0081] 3. High compatibility

[0082] STAs that support encryption and those that do not support encryption can be mixed. The CCO confirms whether encryption is required during data transmission based on the RSA authentication result.

[0083] The specific implementation modes described above are preferred implementation modes of the present invention, and are not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to the specific implementation modes, and all equivalent changes made according to the present invention are within the protection scope of the present invention.

Claims

1. A user data encryption method based on the DES algorithm, characterized in that: The steps include: S1: The central coordinator CCO receives the original data and determines whether the length of the original data is less than or equal to the first set value. If yes, DES encryption is performed on the entire data, and then step S3 is executed. If not, step S2 is executed. S2: intercepting data of a first set value length from the original data, and performing DES encryption, and combining the encrypted data with the unencrypted data into combined data according to a preset rule; S3: Determine whether the length of the data encrypted in step S1 or the combined data in step S2 is greater than a second set value. If not, execute step S4. If yes, perform lossless data compression on the data and then execute step S4. S4: Data is encapsulated and sent to the corresponding STA. The encryption authentication and DES key distribution method of the central coordinator CCO and STA includes the following sub-steps: A1: The central coordinator CCO sends a request IDA command through the extended protocol; A2: Receives the IDA identity information sent by STA, builds CS information based on RSA identity authentication, and then sends the CS command to STA through the extended protocol; A3: After receiving the EB information fed back by STA, authenticate the STA. After the identity authentication is passed, use the STA public key to encrypt the DES key, and send the encrypted data to STA through the extended protocol to send the DES key command; A4: Receiving the response confirmation frame from STA indicates that this STA has successfully received the DES key and then detects the next STA.

2. The user data encryption method based on the DES algorithm according to claim 1 is characterized in that: Before executing step S1, the central coordinator CCO and the STA also perform encryption authentication steps. After the authentication is passed, step S1 is executed again.

3. The user data encryption method based on the DES algorithm according to claim 2 is characterized in that: The central coordinator CCO and STA are carrier communication devices, and the central coordinator CCO and STA implement RSA encryption authentication and DES key distribution through an extended protocol between the two.

4. The user data encryption method based on the DES algorithm according to claim 3 is characterized in that: The central coordinator CCO circulates through the STAs connected to it. If the current STA has completed identity authentication and DES key distribution, it detects the next STA. When it detects that the station STA has not completed identity authentication, it enters the identity authentication process. After polling to the last one, it traverses the STA again after a set interval.

5. The user data encryption method based on the DES algorithm according to claim 1 is characterized in that: In steps A1-A4, each time the central coordinator CCO sends a command, a response threshold period is set. When a STA response frame is received or the response threshold period is exceeded, the central coordinator CCO executes the next sub-step.

6. The user data encryption method based on the DES algorithm according to claim 1 is characterized in that: After receiving the CS information sent by the central coordinator, STA uses RSA key signature verification and identity authentication for the central coordinator CCO. After the signature verification and identity authentication are passed, STA constructs EB information based on RSA identity authentication and sends it to the central coordinator CCO.

7. The user data encryption method based on the DES algorithm according to claim 1 is characterized in that: After receiving the encrypted DES key data, the STA uses its own RSA private key to decrypt it. The decrypted DES key is verified for correctness using parity check. After confirming that it is correct, the STA replies with an acknowledgement frame.

8. A user data encryption system based on the DES algorithm, used to implement the user data encryption method based on the DES algorithm according to any one of claims 1 to 7, characterized in that: The user data encryption system is arranged in the central coordinator CCO, and includes: The original data judgment module is used to judge whether the length of the received original data is less than the first set value. Encryption combination module: used to encrypt or encrypt the original data. If the length of the original data is less than or equal to the first set value, the entire data is encrypted by DES. If the length of the data is greater than the first set value, the data of the first set value length is intercepted from the original data and DES encrypted. The encrypted data and the unencrypted data are combined into combined data according to preset rules. A judgment module: used to judge whether the length of the encrypted data or the combined data is greater than a second set value; Lossless data compression processing module: used for performing lossless data compression processing on data exceeding a second set value; Encapsulation and sending module: used to encapsulate and send data, The encryption authentication and DES key distribution method of the central coordinator CCO and STA includes the following sub-steps: A1: The central coordinator CCO sends a request IDA command through the extended protocol; A2: Receives the IDA identity information sent by STA, builds CS information based on RSA identity authentication, and then sends the CS command to STA through the extended protocol; A3: After receiving the EB information fed back by STA, authenticate the STA. After the identity authentication is passed, use the STA public key to encrypt the DES key, and send the encrypted data to STA through the extended protocol to send the DES key command; A4: Receiving the response confirmation frame from STA indicates that this STA has successfully received the DES key and then detects the next STA.

9. The user data encryption system based on the DES algorithm according to claim 8, characterized in that: It also includes an encryption authentication module: used to implement RSA encryption authentication and DES key distribution between STA and the STA through an extended protocol.

Images