A data transmission method and system using a combination of national secret algorithm and DL / T476 protocol

Abstract

The present invention belongs to the field of application technology of secure transmission of power intelligent inspection data, and specifically discloses a data transmission method and system using a combination of a national secret algorithm and a DL / T476 protocol, including the following steps: S1, deploying an image data acquisition module and an intelligent recognition algorithm module on the edge computing terminal device on the new energy power generation station side; S2, using a randomly generated SM4 key to encrypt the inspection result with the SM4 algorithm; S3, encrypting the SM4 key with the SM2 algorithm; S4, parsing the DL / T476 data message at the intelligent inspection center on the new energy area side; S5, forming an inspection report and a report through message decryption by the intelligent inspection center and DL / T476 protocol parsing. The beneficial effect of the present invention is that the national secret algorithm is integrated with the DL / T476 protocol, so that the domestic cryptographic application is embedded in the power communication protocol, the endogenous security direction ensures the communication security, solves the risks of data forgery, deception, tampering, etc. that are difficult to protect against by traditional border security protection, and expands the application of commercial cryptography in the field of power communication.

Description

Technical Field

[0001] The present invention belongs to the technical field of secure transmission application of electric power intelligent inspection data, and specifically relates to a data transmission method and system using a combination of a national secret algorithm and a DL / T476 protocol, especially secure transmission of intelligent inspection result data of new energy stations. Background Art

[0002] The rapid growth of renewable energy installed capacity has brought pressure on the operation and maintenance management of renewable energy power generation companies. Renewable energy power generation companies are often located in remote areas, with wind turbines distributed in many places and in harsh environments. Affected by factors such as transportation and natural environment, equipment operation and maintenance are difficult.

[0003] Smart inspection is an important area of ​​digital transformation and development for power companies. It uses artificial intelligence, edge computing, 5G communications and other technologies, and builds a smart inspection system based on automatic inspection based on machine vision perception technology to replace traditional manual inspection methods. Use front-end cameras, robots and other devices to collect on-site video images, deploy edge computing terminal devices at new energy stations, carry intelligent recognition algorithms based on deep learning, monitor the status of on-site equipment in real time, discover problems in a timely manner, reduce the workload of operation and maintenance personnel, and provide technical support for the unmanned operation of new energy stations.

[0004] The intelligent inspection center application is deployed in the regional new energy center, while the edge computing terminal devices are deployed in various new energy stations, which are physically far away. The inspection results sent up by this communication have the characteristics of long distance, cross-regional, and multiple network nodes. At the same time, the new energy regional center and the station side mainly communicate through the power VPN network. The VPN network is a dedicated network channel opened in the Internet space, which has a large security risk and faces the risk of DDoS attacks from the public network. In addition, traditional border protection devices are also difficult to deal with data security risks such as data interruption, theft, and tampering caused by hacker attacks.

[0005] Based on the above problems, the present invention provides a data transmission method and system using a combination of a national encryption algorithm and a DL / T476 protocol. Summary of the invention

[0006] Purpose of the invention: The purpose of the present invention is to provide a data transmission method and system using a combination of a national secret algorithm and a DL / T476 protocol, using a series of national secret algorithms such as SM2, SM3, and SM4 to encrypt the inspection result data at the station side, the encryption algorithm is combined with the DL / T476 power protocol to form a ciphertext data packet, which is transmitted to the application center of the intelligent inspection center on the regional center side via a dedicated channel of the public network to solve the problems raised in the above-mentioned background technology.

[0007] Technical solution: The first aspect of the present invention provides a data transmission method using a combination of a national secret algorithm and a DL / T476 protocol, comprising the following steps: S1, deploying an image data acquisition module and an intelligent recognition algorithm module on the edge computing terminal device at the new energy power generation station side. S2, using a randomly generated SM4 key to encrypt the inspection result with the SM4 algorithm, and the SM4 key generation adopts a "one-time one-key" SM4 key generation method based on a true random number generator LRNG. S3, encrypting the SM4 key with the SM2 algorithm, and signing the SM3 summary information of the inspection result with the SM2 algorithm; the inspection result, SM4 key, and the relevant data of the summary signature encrypted by the SM4 algorithm are combined into a data message according to the DL / T476 protocol format. S4, the intelligent inspection center side parses the DL / T476 data message, obtains the encrypted inspection result, SM4 key, and signature data, decrypts the SM4 key with the SM2 algorithm, decrypts the inspection result with the SM4 key decrypted by SM2, and simultaneously verifies the signature data using the SM2 and SM3 algorithms. S5. After the intelligent inspection center decrypts the message and DL / T476 protocol is parsed, the data is decrypted and the signature is verified correctly, and then stored in the database inspection result table, and an inspection report and statement are formed; if the data is decrypted or the signature verification fails, it is also stored in the database exception table for later inspection. Among them, the image data acquisition module is developed based on the computer vision library OpenCV technology, and uses the frame extraction method to collect the image data of the front-end camera, and forwards it to the intelligent recognition algorithm module through the internal interface; the image data is intelligently analyzed based on the target recognition algorithm to identify inspection items such as equipment status and instrument readings, and form the inspection results in JSON format according to the established inspection rules.

[0008] In the technical solution, the true random number generator LRNG is used in S2 to randomly generate the SM4 security key; under the Linux operating system, the LRNG includes a main entropy pool, a blocking entropy pool and a non-blocking entropy pool, and collects four entropy source events from the outside world, including mouse movement, keyboard tapping, interruption and disk input and output operations, and adds the entropy source event type code and event occurrence time into the entropy pool. The LRNG entropy estimation method is to generally calculate the time difference of the entropy source event to estimate the entropy value, and the algorithm is as follows:

[0009] (1) Calculate the time difference: (Formula 1), where t Indicates entropy source events i Time of occurrence, t i-1 Indicates entropy source events i Last time it happened, λ i Indicates an event i and last event i -1 time difference occurs; (2) select the minimum difference: (Formula 2), where Δi Indicates the minimum time difference between the occurrence of the entropy source event; (3) Calculate the entropy value: (Formula 3), where E i Indicates an event i The entropy value of LRNG is obtained through the kernel layer output interface get_random_bytes and the user layer / dev / random or / dev / urandom file interface.

[0010] In the technical solution, the "data item" format of the APDU of extended data that complies with the DL / T476 protocol is adopted in S3, and the APDU data format is divided into three types: (1) APDU of protocol control: used for establishing, releasing, abandoning or resetting the connection between the communicating parties; (2) APDU of basic data: used for receiving, sending and response control of data; (3) APDU of extended data: used for inquiry; Among them, the APDU of protocol control in the DL / T476 protocol is used to establish the connection between the new energy regional center and the station and maintain communication, and the encrypted and signed inspection result data is placed in the APDU of extended data for transmission, and the "data item" in the APDU of extended data carries the ciphertext data of the inspection result.

[0011] In the technical solution, the LRNG is used to generate the SM4 algorithm in S2. KEY and I v After doing complexity check, encryption and decryption calculations are performed. The complexity check adopts the repetition rate check principle. Assume that each Byte data is X i , among which N indivual X i The same value M , then the repetition rate formula is as follows: (Formula 4); where X i = M Repetition rate Y When it is less than 0.618, it is used normally, otherwise it is abandoned. The purpose of the check is to ensure the random generation of KEY and I v complexity.

[0012] The second aspect of the present invention provides a data transmission system that uses a national secret algorithm combined with the DL / T476 protocol, which is used to execute the data transmission method that uses a national secret algorithm combined with the DL / T476 protocol, including several edge computing terminals installed in new energy stations and an intelligent inspection center application display module installed in the new energy regional center, wherein the edge computing terminal is composed of a data acquisition module and an algorithm analysis module, and the data acquisition module and the station-side algorithm analysis module run on the edge computing terminal device. The main functions of the two modules are video and image data acquisition, and the use of an intelligent recognition algorithm based on a deep learning framework to analyze the collected image data, automatically identify equipment status, instrument readings, etc.; the intelligent inspection center application display module is used to receive the analysis result data of the station-side algorithm analysis module, store and display it in the system, and the data transmission adopts a remote data transmission method based on a combination of the national secret algorithm and the DL / T476 protocol.

[0013] Compared with the prior art, the data transmission method and system of the present invention using the national secret algorithm combined with the DL / T476 protocol have the following beneficial effects: (1) adding SM3 signature and SM4, SM2 encryption processes in the APDU of the extended data of DL / T476 to realize the integrated application of the national secret algorithm in the key data communication of remote intelligent inspection of electric power, so as to deal with the security risks such as data leakage and tampering caused by the remote transmission of key data of electric power inspection, and shield malicious attacks through the secure and reliable authentication of decryption / signature verification failure, realize the self-immunity of the system, and protect the overall security of the system; (2) the national secret algorithm is integrated with the DL / T476 protocol, so that the domestic cryptographic application is embedded in the electric power communication protocol, and the inherent security direction ensures the communication security, solves the risks of data forgery, deception, tampering, etc. that are difficult to protect by traditional boundary security protection, and expands the application of commercial cryptography in the field of electric power communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0015] Figure 1 This is a structural diagram of a data transmission system that combines the national secret algorithm with the DL / T476 protocol.

[0016] Figure 2 It is a flow structure diagram of a data transmission method of the present invention that combines a national secret algorithm with a DL / T476 protocol. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0018] In the description of the present invention, it should be noted that the orientations or positional relationships indicated by the terms "top", "bottom", "one side", "the other side", "front", "back", "middle part", "inside", "top end", "bottom end", etc. are based on the orientations or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention; the terms "first", "second", and "third" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance; in addition, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances. Example

[0019] like Figure 2 The data transmission method shown uses a combination of a national secret algorithm and a DL / T476 protocol, including the following steps: S1, deploying an image data acquisition module and an intelligent recognition algorithm module on the edge computing terminal device at the renewable energy power generation station side. The image data acquisition module is developed based on the computer vision library OpenCV technology, and mainly uses the frame extraction method to collect the image data of the front-end camera, and forwards it to the intelligent recognition algorithm module through the internal interface; the image data is intelligently analyzed based on the target recognition algorithm to identify the device status, and the intelligent inspection results in JSON text format are formed according to the established inspection rules.

[0020] S2. Use the randomly generated SM4 key to perform SM4 encryption on the inspection results. The SM4 key generation adopts the "one-time one-key" SM4 key generation method based on the true random number generator LRNG.

[0021] S3. Encrypt the SM4 secret key with the SM2 algorithm, and sign the SM3 summary information of the inspection result with the SM2 algorithm; compose a data message with the SM4 encrypted inspection result, the SM4 secret key, and the relevant data of the summary signature according to the DL / T476 protocol format.

[0022] S4. The intelligent inspection center parses the DL / T476 data message, obtains the encrypted inspection result, SM4 key, and signature data, decrypts the SM4 key using the SM2 algorithm, decrypts the inspection result with the SM4 key decrypted by SM2, and simultaneously verifies the signature data using SM2 and SM3.

[0023] S5. After the intelligent inspection center decrypts the message and DL / T476 protocol is parsed, the data is decrypted and the signature is verified correctly and stored in the database inspection result table, and an inspection report and statement are formed; if the data is decrypted or the signature verification fails, it is also stored in the database exception table.

[0024] In addition, the data packet format that combines the national encryption algorithm with the DL / T476 protocol is reflected in the application protocol data unit (APDU), which is divided into three types:

[0025] (1) Protocol-controlled APDU: used to establish, release, abandon or reset the connection between the two communicating processes;

[0026] (2) APDU of basic data: used for data reception, transmission and response control;

[0027] (3) APDU with extended data: used for inquiry, etc.

[0028] Among them, the APDU controlled by the protocol in the DL / T476 specification is used to establish the connection between the new energy regional center and the station and maintain communication. Considering that the APDU of the extended data can carry business data in a flexible format, the present invention puts the encrypted and signed inspection result data into the APDU of the extended data for transmission. The "data item" in the APDU of the extended data carries the ciphertext data.

[0029] The APDU message format is:

[0030] (1) APDU controlled by protocol:

[0031] The APDU format of the protocol control is:

[0032]

[0033] The header format is:

[0034]

[0035] (2) APDU with extended data:

[0036] The format of the extended data APDU is:

[0037]

[0038] The "data item" format of the APDU with extended data is:

[0039]

[0040] The data header identifies the function type of the message and the service type and time of the data. The signature area is the SM2 signature data of the remote control command summary information, signed by the initiator's local private key and verified by the receiver's peer public key.

[0041] In addition, the SM4 key application method based on LRNG's "one-time one-password" is used. The SM4 algorithm is a symmetric encryption algorithm, and its encryption and decryption processes are mutually inverse. The "one-time one-password" method is to randomly generate a different key each time to encrypt the plaintext. The key that implements the "one-time one-password" mechanism is a theoretically secure key.

[0042] At the same time, considering that the CBC mode in the SM4 algorithm is more secure than the ECB mode, the present invention selects the CBC mode encryption and decryption method. The CBC mode SM4 algorithm includes a 32-bit secret key KEY and a 32-bit initialization vector I v Each time the SM4 algorithm uses a randomly generated KEY and I v , to improve the security of the encryption algorithm.

[0043] In the Linux operating system, LRNG contains the main entropy pool, blocking entropy pool and non-blocking entropy pool, and collects four types of entropy source events from the outside world, including mouse movement, keyboard tapping, interruption and disk input and output operations. The entropy source event type code and event occurrence time are added to the entropy pool. The LRNG entropy estimation method is to estimate the entropy value by generally calculating the time difference of the entropy source event. The algorithm is as follows:

[0044] (1) Calculate the time difference: (Formula 1), where t Indicates entropy source events i Time of occurrence, t i-1 Indicates entropy source events i Last time it happened, λ i Indicates an event i and last event i -1 time difference occurs;

[0045] (2) Select the minimum difference: (Formula 2), where Δi Indicates the minimum time difference of the selected entropy source event;

[0046] (3) Calculate entropy value: (Formula 3), whereE i Indicates an event i The entropy value of

[0047] Among them, LRNG is obtained through the kernel layer output interface get_random_bytes and the user layer / dev / random or / dev / urandom file interface. This paper uses LRNG to generate the SM4 algorithm KEY and I v After doing complexity check, encryption and decryption calculations are performed. Complexity check adopts the principle of repetition rate check.

[0048] Assume that each Byte data is X i , among which N indivual X i The same value M , then the repetition rate formula is as follows:

[0049] (Formula 4),

[0050] in, X i = M Repetition rate Y When it is less than 0.618, it is used normally, otherwise it is abandoned. The purpose of the check is to ensure random generation KEY and I v complexity.

[0051] like Figure 1 A data transmission system shown uses a combination of national encryption algorithms and DL / T476 protocols, including several edge computing terminals installed in new energy sites and an intelligent inspection center application display module installed in the new energy regional center.

[0052] The data transmission system of the present invention is mainly aimed at the field of renewable energy power generation. It fully integrates technologies such as the Internet of Things, edge computing, artificial intelligence, and digitization to build an intelligent inspection software platform. It uses front-end sensing devices such as cameras, robots, and drones to collect audio and video multimodal data, which are analyzed by intelligent recognition algorithms deployed in edge computing terminal devices. It automatically identifies inspection items such as new energy station equipment and instrument readings, and uploads the inspection results to the new energy area intelligent inspection center application for storage and display, thereby realizing intelligent inspection instead of manual inspection.

[0053] The edge computing terminal of the present invention mainly includes three parts: a data acquisition module, an algorithm analysis module, and a remote transmission module.

[0054] Among them, the data acquisition module and the algorithm analysis module run on the edge computing terminal device. The main functions of the two modules are video and image data acquisition, and the use of intelligent recognition algorithms based on a deep learning framework to analyze the collected image data and automatically identify the device status and environmental status.

[0055] The intelligent inspection center application display module of the present invention runs the new energy regional center, and its main function is to receive the analysis result data of the algorithm analysis module on the wind farm station side, store it and display it in the system. The remote transmission software module is generally based on TCP, HTTP and other protocols, and transmits the inspection results of the station side to the intelligent inspection center application of the new energy regional center through the power-specific virtual network channel. The transmission protocol manufacturer is self-prepared. The present invention adopts a remote data transmission method based on the combination of the national secret algorithm and the DL / T476 protocol.

[0056] It should be noted that, in this article, terms such as "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0057] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A data transmission method using a combination of a national secret algorithm and DL / T476 protocol, characterized in that: The following steps are included: S1. Deploy image data acquisition module and intelligent recognition algorithm module on the edge computing terminal device at the renewable energy power generation station side; S2. Encrypt the inspection results with the SM4 algorithm using the randomly generated SM4 key. The SM4 key generation method based on the true random number generator LRNG is used. S3, encrypt the SM4 secret key with the SM2 algorithm, and sign the SM3 summary information of the inspection result with the SM2 algorithm; the inspection result encrypted by the SM4 algorithm, the SM4 secret key, and the relevant data of the summary signature are combined into a data message according to the DL / T476 protocol format; S4, the intelligent inspection center parses the DL / T476 data message, obtains the encrypted inspection result, SM4 key, and signature data, decrypts the SM4 key using the SM2 algorithm, decrypts the inspection result using the SM4 key decrypted by SM2, and simultaneously verifies the signature data using the SM2 and SM3 algorithms; S5. After the intelligent inspection center decrypts the message and DL / T476 protocol is parsed, the data is decrypted and the signature is verified correctly, and then stored in the inspection result table of the database, and an inspection report and statement are formed; if the data is decrypted or the signature verification fails, it is also stored in the database exception table for later inspection; Among them, the image data acquisition module is developed based on the computer vision library OpenCV technology. It uses frame extraction to collect image data from the front-end camera and forwards it to the intelligent recognition algorithm module through the internal interface. The image data is intelligently analyzed based on the target recognition algorithm to identify the equipment status and instrument reading inspection items, and form the inspection results in JSON format according to the established inspection rules.

2. According to claim 1, a data transmission method using a combination of a national secret algorithm and a DL / T476 protocol is characterized in that: In the S2, a true random number generator LRNG is used to randomly generate the SM4 security key; In the Linux operating system, LRNG includes the main entropy pool, the blocking entropy pool, and the non-blocking entropy pool. It collects four types of entropy source events from the outside world, including mouse movement, keyboard tapping, interruption, and disk input and output operations. The entropy source event type code and event occurrence time are added to the entropy pool. The LRNG entropy estimation method is to estimate the entropy value by generally calculating the time difference of the entropy source event. The algorithm is as follows: (1) Calculate the time difference: (Formula 1), where t i Indicates entropy source events i Time of occurrence, t i-1 Indicates entropy source events i Last time it happened, λ i Indicates an event i and last event i -1 time difference occurs; (2) Select the minimum difference: (Formula 2), where Δi Indicates the minimum time difference of the selected entropy source event; (3) Calculate entropy value: (Formula 3), where E i Indicates an event i The entropy value of LRNG is obtained through the kernel layer output interface get_random_bytes and the user layer / dev / random or / dev / urandom file interface.

3. According to claim 1, a data transmission method using a combination of a national secret algorithm and a DL / T476 protocol is characterized in that: The S3 adopts the "data item" format of the APDU of the extended data in accordance with the DL / T476 specification. The APDU data format is divided into three types; (1) APDU for protocol control: used to establish, release, abandon or reset the connection between the two communicating processes; (2) APDU for basic data: used for receiving, sending and response control of data; (3) APDU with extended data: used for inquiry; Among them, the APDU controlled by the protocol in the DL / T476 specification is used to establish the connection between the station and the new energy regional center and maintain communication. The encrypted and signed inspection result data is placed in the APDU of extended data for transmission. The "data item" in the APDU of extended data carries the ciphertext data of the inspection result.

4. According to claim 2, a data transmission method using a combination of a national secret algorithm and a DL / T476 protocol is characterized in that: The S2 uses LRNG to generate the SM4 algorithm KEY and I v , and after doing complexity check, encryption and decryption calculations are performed. The complexity check adopts the repetition rate check principle; Assume that each Byte data is X i , among which N indivual X i The same value M , then the repetition rate formula is as follows: (Formula 4); in, X i = M Repetition rate Y It is used normally when it is less than 0.618, otherwise it is abandoned. The purpose of the check is to ensure the complexity of randomly generating KEY and Iv.

5. A data transmission system using a combination of a national secret algorithm and a DL / T476 protocol, used to execute a data transmission method using a combination of a national secret algorithm and a DL / T476 protocol as described in any one of claims 1 to 4, characterized in that: It consists of several edge computing terminals installed in new energy stations and application display modules of the intelligent inspection center installed in the new energy regional center. The edge computing terminal consists of a data acquisition module and an algorithm analysis module. The data acquisition module and the station-side algorithm analysis module run on the edge computing terminal device. The main functions of the two modules are to read videos and collect pictures, and to analyze the collected picture data using an intelligent recognition algorithm based on a deep learning framework, and automatically identify equipment status and instrument reading inspection items. The application display module of the intelligent inspection center is used to receive the analysis result data of the algorithm analysis module on the new energy station side, store and display it in the system. The data transmission adopts a remote data transmission method based on the combination of national secret algorithm and DL / T476 protocol.

Images