A power secondary system business safety protection system and method

Abstract

The present invention relates to a power secondary system business security protection system and method, wherein the system includes: a cloud side and an edge side, wherein the cloud side and the edge side communicate and interact through an information security channel; the cloud side includes: a business master station and an encryption authentication device; a quantum key generation and distribution system for generating a first quantum session key; a quantum key transfer service module for transferring the first quantum session key to the business master station and the encryption authentication device; the encryption authentication device is used to encrypt the first quantum session key, and the business master station is used to transfer the encrypted first quantum session key to the edge side; the edge side includes: an edge device, which is provided with a first security chip, and the first security chip is used to decrypt the encrypted first quantum session key to obtain the first quantum session key; the business master station on the cloud side and the edge device on the edge side transmit business data based on the first quantum session key. The present invention can effectively improve the data security transmission capability of the power secondary system.

Description

Technical Field

[0001] The present invention relates to the technical field of power secondary system network security protection, and in particular to a power secondary system business security protection system and method. Background Art

[0002] At present, typical power secondary systems such as dispatching automation, distribution automation system, power consumption information collection system, load management system, etc. all use public infrastructure (PKI) and symmetric cryptographic infrastructure as the key source for business data encryption. The keys are generally generated based on physical noise sources. The key update cycle generated by PKI and existing symmetric cryptographic infrastructure is relatively long. For example, the public and private keys corresponding to PKI digital certificates are often used for 10 to 20 years. The session symmetric key master key generated by the symmetric cryptographic infrastructure and the session symmetric key generated by further negotiation with factors such as random numbers usually have the same life cycle as the identity authentication cycle, that is, as long as the terminal maintains a TCP connection with the master station and the identity authentication status is always valid, the session key will not be updated.

[0003] According to Kerckhoff's principle, "even if any details of the cryptographic system are known to others, as long as the key is not leaked, it should be a secure password", it can be seen that in the cryptographic system, the generation, use and management of keys are crucial. The loss of control of the key will cause the cryptographic system to fail, so the key must be strictly protected. However, quantum computing is receiving widespread attention from scientific research, industry, government and other fields at home and abroad. IBM, Google, Microsoft and other companies are actively conducting research on quantum computers. IBM's quantum computer has currently achieved 53 quantum bit calculations, and Google has achieved 72 quantum bit calculations. With the commercialization of quantum computers, the difficulty of cracking the traditional key generated based on physical noise sources will be reduced, threatening the security of the power secondary system. At the same time, new power systems are developing rapidly, and new resources such as distributed photovoltaics, energy storage devices, and electric vehicles are connected to the power system on a large scale. The access control devices of various types of resources are characterized by decentralized deployment, obvious differences in computing power, uneven security protection capabilities, and multiple asset ownership entities. This has led to a sudden increase in the intrusion paths of network attacks on the power secondary system, a lower attack threshold, and an increased risk of secure transmission of business data.

[0004] The existing patent CN115589283A discloses a quantum secure communication interaction system and method for distribution automation business. This method adopts the "nested, superimposed" channel encryption idea, which will cause additional traffic overhead and delay overhead to the power secondary system. At the same time, the quantum key on the terminal side of this method adopts the "application-distribution" usage mechanism. In addition to the uniformly deployed quantum key generation and distribution network, a quantum key mobile storage device is also deployed on the terminal side. Compared with the economically cost-sensitive and multi-faceted distribution terminal equipment, this method has a large economic investment. In this method, quantum keys are frequently transmitted, and the protection measures do not fully cover the transmission process of quantum keys, so there are still security issues such as leakage. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a power secondary system business security protection system and method, which can effectively improve the power secondary system data security transmission capability.

[0006] The technical solution adopted by the present invention to solve the technical problem is: to provide a power secondary system business security protection system, including a cloud side and an edge side, wherein the cloud side and the edge side communicate and interact through an information security channel; wherein:

[0007] The cloud side includes:

[0008] Power secondary business master station and encryption authentication device;

[0009] A quantum key generation and distribution system for generating a first quantum session key;

[0010] A quantum key transfer service module, used to transfer the first quantum session key to the power secondary business master station and the encryption authentication device;

[0011] The encryption authentication device is used to encrypt the first quantum session key, and the power secondary business master station is used to transmit the encrypted first quantum session key to the side;

[0012] The side includes:

[0013] The edge device is provided with a first security chip, and the first security chip is used to decrypt the encrypted first quantum session key to obtain the first quantum session key;

[0014] The power secondary business master station on the cloud side and the edge device on the edge side transmit business data based on the first quantum session key.

[0015] When transmitting the first quantum session key, the quantum key transfer service module uses the master station protection key to encrypt the first quantum session key.

[0016] The quantum key transfer service module includes:

[0017] The first judgment unit is used to judge whether the current session cycle between the power secondary service master station and the edge device is the first session cycle;

[0018] A first encryption unit is used to use the symmetric key generated by the cryptographic infrastructure as an initial master station protection key when the current session cycle between the power secondary business master station and the edge device is the first session cycle, and to encrypt the first quantum session key using the initial master station protection key;

[0019] The second encryption unit is used to use the first quantum session key of the previous session cycle between the power secondary business master station and the edge device as the master station protection key when the current session cycle between the power secondary business master station and the edge device is not the first session cycle, and use the master station protection key to encrypt the first quantum session key.

[0020] The power secondary system service security protection system further includes an end side, and the end side communicates and interacts with the edge side;

[0021] The first security chip has an optical quantum random number generator; the optical quantum random number generator is used to generate quantum random numbers; the edge device is also used to generate a second quantum session key based on the quantum random number, and encrypt the second quantum session key through the first security chip and transmit it to the end side;

[0022] The end side includes an end device, which is provided with a second security chip, and the second security chip is used to decrypt the encrypted second quantum session key to obtain the second quantum session key;

[0023] The end device on the end side and the edge device on the edge side transmit business data based on the second quantum session key.

[0024] When the first security chip encrypts the second quantum session key, the end device protection key is used to encrypt the second quantum session key.

[0025] The first security chip comprises:

[0026] The second judgment unit is used to judge whether the current session period between the edge device and the end device is the first session period;

[0027] A third encryption unit is used to use the symmetric key generated by the cryptographic infrastructure as the initial end device protection key when the session cycle between the current edge device and the end device is the first session cycle, and to encrypt the second quantum session key with the initial end device protection key;

[0028] The fourth encryption unit is used to use the second quantum session key in the previous session cycle between the edge device and the end device as the end device protection key when the current session cycle between the edge device and the end device is not the first session cycle, and use the end device protection key to encrypt the second quantum session key.

[0029] The technical solution adopted by the present invention to solve the technical problem is: to provide a power secondary system business security protection method, using the above-mentioned power secondary system business security protection system, including the following steps:

[0030] The power secondary business master station or the encryption authentication device sends a quantum session key application request to the quantum key transfer service module;

[0031] After receiving the quantum session key application request, the quantum key transfer service module requests the first quantum session key from the quantum key generation and distribution system;

[0032] The quantum key generation and distribution system generates a first quantum session key and transmits it to the quantum key transfer service module;

[0033] The quantum key transfer service module encrypts the first quantum session key using the master station protection key to obtain a first encryption key, and sends the first encryption key to the encryption authentication device through the master station;

[0034] The encryption authentication device uses the master station protection key to decrypt the first encryption key to obtain the first quantum session key, and uses the edge device protection key to encrypt the first quantum session key to obtain a second encryption key, and transmits the second encryption key to the edge device;

[0035] The first security chip of the edge device uses the edge device protection key to decrypt the second encryption key to obtain the first quantum session key.

[0036] Before the master station or the encryption authentication device sends a quantum session key application request to the quantum key transfer service module, a digital certificate two-way authentication step is also included, specifically including:

[0037] The power secondary service master station generates a first random number and sends the first random number to the edge device;

[0038] The edge device generates a second random number, combines the first random number with the second random number, signs the combination result to obtain a first signature result, and packages the first signature result, the second random number and the edge device digital certificate and sends them to the main station;

[0039] The power secondary business master station verifies the first signature result using the edge device digital certificate, and signs the second random number after the verification is passed to obtain a second signature result, and packages the second signature result and the master station digital certificate and sends them to the edge device;

[0040] The edge device verifies the second signature result using the master station digital certificate, and returns authentication confirmation information after the verification is successful.

[0041] The quantum key transfer service module encrypts the first quantum session key using the master station protection key, specifically including:

[0042] Determine whether the current session cycle between the power secondary service master station and the edge device is the first session cycle;

[0043] The current session cycle between the power secondary business master station and the edge device is the first session cycle, the symmetric key generated by the cryptographic infrastructure is used as the initial master station protection key, and the initial master station protection key is used to encrypt the first quantum session key;

[0044] If the current session cycle between the power secondary business master station and the edge device is not the first session cycle, the first quantum session key of the previous session cycle between the power secondary business master station and the edge device is used as the master station protection key, and the first quantum session key is encrypted using the master station protection key.

[0045] The power secondary system service security protection method also includes:

[0046] The first security chip has an optical quantum random number generator, which generates a quantum random number. The first security chip of the edge device generates a second quantum session key based on the quantum random number, and encrypts the second quantum session key through the end device protection key to obtain a third encryption key. The edge device transmits the third encryption key to the end device.

[0047] The second security chip of the end device uses the end device protection key to decrypt the third encryption key to obtain the second quantum session key.

[0048] Before the optical quantum random number generator generates quantum random numbers, the digital certificate two-way authentication step specifically includes:

[0049] When the end device accesses the edge device, the end device digital certificate is sent to the edge device;

[0050] The edge device verifies the digital certificate of the end device, generates a third random number after the verification is passed, and sends the third random number to the end device;

[0051] The end device generates a fourth random number, combines the third random number with the fourth random number, signs the combination result to obtain a third signature result, and packages the third signature result and the fourth random number and sends them to the edge device;

[0052] The edge device verifies the third signature result using the end device digital certificate, and returns authentication confirmation information after the verification is successful.

[0053] The first security chip of the edge device encrypts the second quantum session key by using the end device protection key, specifically including:

[0054] Determine whether the current session cycle between the edge device and the end device is the first session cycle;

[0055] The current session cycle between the edge device and the end device is the first session cycle, the symmetric key generated by the cryptographic infrastructure is used as the initial end device protection key, and the initial end device protection key is used to encrypt the second quantum session key;

[0056] If the current session cycle between the edge device and the end device is not the first session cycle, the second quantum session key during the previous session cycle between the edge device and the end device is used as the end device protection key, and the end device protection key is used to encrypt the second quantum session key.

[0057] The initial master station protection key is pre-issued in the encryption authentication device and is dispersed according to preset rules to obtain the initial edge device protection key; the initial edge device protection key is pre-issued in the first security chip and is dispersed according to preset rules to obtain the initial end device protection key.

[0058] Beneficial Effects

[0059] Due to the adoption of the above-mentioned technical scheme, compared with the prior art, the present invention has the following advantages and positive effects: Based on the existing power secondary system security protection system architecture, the present invention performs quantum replacement of symmetric keys for encryption of business data such as collection, remote control, and remote adjustment for master stations, terminals, or cloud, edge, and terminal interaction processes, and improves the security level of business data protection from the perspective of quantum attacks through a quantum key short-cycle update mechanism of "replacing a session key once for each business interaction" or "replacing a session key once for each data transmission". At the same time, it avoids the communication traffic overhead and huge economic investment brought about by traditional quantum encryption schemes based on IPsec or SSL encryption (which require the deployment of quantum key generation and distribution platforms, quantum key mobile storage devices, and other devices at the master station, channel, and terminal side, respectively). BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a diagram of the security protection architecture of the distribution automation system that integrates quantum keys;

[0061] Figure 2 This is a diagram of the security protection architecture of the power distribution Internet of Things that integrates quantum keys;

[0062] Figure 3 This is the first schematic diagram of cloud-edge quantum session key generation and transmission;

[0063] Figure 4 This is the second schematic diagram of cloud-edge quantum session key generation and transmission;

[0064] Figure 5 This is a schematic diagram of cloud-edge business data transmission protection;

[0065] Figure 6 This is a schematic diagram of edge-to-end quantum session key generation and transmission. DETAILED DESCRIPTION

[0066] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0067] The embodiment of the present invention relates to a power secondary system business security protection system, which integrates quantum key generation and distribution technology on the basis of the existing authentication and encryption architecture of the power secondary system, realizes quantum substitution of session keys, and improves the confidentiality and integrity protection level of interactive data. This embodiment can be applied to power secondary systems such as distribution automation systems, distribution Internet of Things, dispatching automation systems, power consumption information collection systems, and load management systems. The following takes the distribution automation system and the distribution Internet of Things as examples to explain this embodiment in detail.

[0068] Since 2017, the distribution automation system has built a "master station-gateway (channel)-terminal" layered authentication and hierarchical encryption protection system based on domestic commercial cryptographic algorithms and digital certificate technology, and has been widely used in more than 300 distribution automation systems of State Grid Corporation. Since 2019, the distribution automation system deployed in the management information area has begun to develop towards the Internet of Things, evolving into a "cloud-pipe-edge-end" distribution Internet of Things architecture, and the authentication and encryption system has been further expanded to cover a lightweight authentication and encryption system that covers the secure interaction of edge and end devices. The power secondary system business security protection system of this implementation method can be set up based on the above two architectures.

[0069] For the distribution automation system, this implementation method deploys a quantum key generation and distribution system and a quantum key transfer service module at the master station, integrates a security chip in the terminal, and builds a quantum secure encryption channel between the master station, communication, and terminal (see Figure 1 ).

[0070] The distribution automation system in this embodiment includes a master station and a terminal, wherein the master station includes: a power secondary business master station, an encryption authentication device, a quantum key generation and distribution system, and a quantum key transfer service module; the power secondary business master station includes a distribution master station application and a master station front-end; a quantum key generation and distribution system for generating a first quantum session key; a quantum key transfer service module for transferring the first quantum session key to the master station and the encryption authentication device; the encryption authentication device is used to encrypt the first quantum session key; the master station is used to transfer the encrypted first quantum session key to the terminal. The terminal is provided with a first security chip, and the first security chip is used to decrypt the encrypted first quantum session key to obtain the first quantum session key.

[0071] For the power distribution IoT architecture, this implementation deploys a quantum key generation and distribution system and a quantum key transfer service module on the cloud side, integrates a security chip in the edge device, and also integrates a security chip in the end devices such as smart circuit breakers, photovoltaic grid-connected circuit breakers, and LTUs, thus building a cloud-pipe-edge-end quantum security encryption channel (see Figure 2 ).

[0072] The power distribution Internet of Things architecture in this embodiment includes a cloud side, an edge side and an end side. The cloud side and the edge side communicate and interact through an information security channel, and the edge side and the end side communicate and interact. Among them, the cloud side includes: a power secondary business master station and an encryption authentication device; the power secondary business master station includes a power distribution master station application and a security access server, a quantum key generation and distribution system, which is used to generate a first quantum session key; a quantum key transfer service module, which is used to transfer the first quantum session key to the master station and the encryption authentication device; the encryption authentication device is used to encrypt the first quantum session key, and the master station is used to transfer the encrypted first quantum session key to the edge side. The edge side includes an edge device, which is provided with a first security chip, and the first security chip is used to decrypt the encrypted first quantum session key to obtain the first quantum session key. The first security chip has an optical quantum random number generator; the optical quantum random number generator is used to generate quantum random numbers; the edge device is also used to generate a second quantum session key based on the quantum random number, and encrypt the second quantum session key through the first security chip and transmit it to the end side; the end side includes an end device, which is provided with a second security chip, and the second security chip is used to decrypt the encrypted second quantum session key to obtain the second quantum session key.

[0073] It can be seen that this implementation method combines quantum keys with the cryptographic application systems (including PKI public key infrastructure and symmetric key management infrastructure) of existing mature power professional applications, and builds a quantum security encryption channel based on the authentication encryption architecture of the interaction process between the cloud, edge, and end (or master station and terminal) of the power secondary system such as dispatching automation, distribution automation, power consumption information collection system, and load management system. This implementation method also performs quantum upgrades on the existing security chips of power terminal equipment to form a security chip with an optical quantum random number generator, avoiding the economic investment caused by the additional configuration of quantum key mobile storage devices.

[0074] The secure interaction process of the "master-terminal" ("cloud-edge") business integrating quantum keys is as follows:

[0075] (1) Bidirectional identity authentication based on PKI digital certificates

[0076] After the link is established between the master station (cloud) and the terminal (edge), two-way authentication is required before business data is transmitted. The authentication is initiated by the master station, and the terminal responds passively. Both parties complete the two-way authentication by signing and verifying the other party's random number. If one party fails to authenticate the other party, the authentication failure message is returned and the other party's data is not responded.

[0077] The two-way identity authentication process based on PKI digital certificates is as follows:

[0078] 1) The master station generates a random number R1 and sends the random number R1 to the distribution terminal (or edge device);

[0079] 2) The power distribution terminal (or edge device) generates a random number R2, adds the random number R1 and the random number R2 together, and signs them to obtain a first signature result. Then, the random number R2, the first signature result, and the PKI digital certificate of the power distribution terminal (or edge device) are packaged and sent to the master station. It is worth mentioning that the combined signature method of adding the random number R1 and the random number R2 can also use other combined signature methods with the same effect, such as multiplying the random number R1 and the random number R2.

[0080] 3) The master station verifies the first signature result with the PKI digital certificate of the power distribution terminal (or edge device). The master station completes the identity authentication of the power distribution terminal (or edge device) after verification. Then the master station signs the random number R2 of the power distribution terminal (or edge device) to obtain the second signature result, and sends the second signature result and the master station PKI digital certificate to the power distribution terminal (or edge device).

[0081] 4) The distribution terminal (or edge device) uses the master station PKI digital certificate to verify the second signature result. The verification completes the identity authentication of the distribution terminal (or edge device) to the master station and returns the authentication confirmation information.

[0082] (2) Quantum session key generation and transmission

[0083] The session keys between the master station and the terminal (cloud-edge) are uniformly generated and issued by the quantum key generation and distribution system. The application for the session key is carried out by the initiator of the interactive service. For example, the master station initiates a "general call" request to the terminal. Before the "general call", the master station first initiates a quantum session key application to the quantum key transfer service. The process is as follows: Figure 3 As shown, specifically including:

[0084] 1) The power distribution encryption authentication device at the power distribution master station sends a quantum session key application request to the quantum key transfer service module;

[0085] 2) After receiving the quantum session key application request, the quantum key transfer service module requests the quantum session key from the quantum key generation and distribution system. The quantum key generation and distribution system generates a quantum session key Ks and transmits it to the quantum key transfer service module. The quantum key transfer service module encrypts the quantum session key Ks through the master station protection key Kp to obtain a first encryption key Kp (Ks), and sends the first encryption key Kp (Ks) to the power distribution encryption authentication device via the master station. In this step, when the sub-key transfer service module encrypts the quantum session key Ks through the master station protection key Kp, it first determines when Whether the session cycle between the previous master station and the power distribution terminal (or edge device) is the first session cycle. If the session cycle between the current master station and the power distribution terminal (or edge device) is the first session cycle, the symmetric key generated by the cryptographic infrastructure used by the current power distribution system is used as the initial master station protection key, and the initial master station protection key is used to encrypt the first quantum session key. If the session cycle between the current master station and the edge device is not the first session cycle, the first quantum session key of the previous session cycle between the master station and the edge device is used as the master station protection key, and the master station protection key is used to encrypt the first quantum session key. The initial master station protection key is issued to the power distribution encryption authentication device and the quantum key transfer service module in an offline manner;

[0086] 3) The power distribution encryption authentication device uses the master station protection key Kp to decrypt the first encryption key Kp (Ks) to obtain the quantum session key Ks, and then uses the protection key Kp' of the power distribution terminal (or edge device) to encrypt the quantum session key Ks to obtain the second encryption key Kp' (Ks), and forwards the second encryption key Kp' (Ks) to the power distribution terminal (or edge device);

[0087] 4) The security chip of the power distribution terminal (or edge device) uses the protection key Kp' to decrypt the second encryption key Kp' (Ks) to obtain the quantum session key Ks.

[0088] (3) Business data transmission protection based on quantum session keys, such as Figure 5 As shown, including:

[0089] 1) The power distribution encryption authentication device uses the quantum session key Ks to encrypt the data DATA and sends the encrypted data Ks (DATA) to the power distribution terminal (or edge device);

[0090] 2) The distribution terminal (or edge device) uses the quantum session key Ks to decrypt and obtain the data DATA.

[0091] In addition, when the terminal needs to actively send data to the master station due to events such as telesignal change, current / voltage dead zone exceeding the limit, etc., the terminal first initiates a quantum session key application to the master station, and the master station then initiates a session key application to the quantum key generation and distribution system through the quantum key transfer service. The subsequent process is the same. The specific process is as follows Figure 4 shown.

[0092] In this implementation, the update cycle of the quantum session key can be bound to the service interaction cycle, that is, before each service interaction, the service interaction initiator needs to reapply for a quantum session key; the update cycle of the quantum session key can also be bound to each service data transmission, that is, each data transmission requires a new session key. The update cycle of the quantum session key can also be regularly updated depending on the usage time, system security status, etc.

[0093] It is not difficult to find that this implementation method uses the existing power secondary system master station and terminal two-way identity authentication results as the characteristic information for activating the initial protection key of the quantum key, realizes the encrypted transmission of the quantum key between the master station and the terminal with a trusted identity, and through the protection key iterative use mechanism, it ensures that the quantum session key protection key is different each time at a low cost, and solves the key security and economic problems at the same time. At the same time, this method binds the update cycle of the quantum session key to the business interaction cycle, that is, before each business interaction, the initiator of the business interaction needs to reapply for a quantum session key, and through the quantum substitution of the session key in the business interaction process, the business data security interaction of "one business interaction replaces one session key" is realized, avoiding the high traffic overhead caused by the "nested" encryption method.

[0094] The secure interaction process of "edge-to-end" services integrating quantum keys is as follows:

[0095] (1) Bidirectional identity authentication based on PKI digital certificates

[0096] Because the connection relationship between edge and end devices cannot be determined before they are officially put into operation, when the end device accesses the edge computing terminal, it should first send its digital certificate to the edge device. After the edge device verifies the legitimacy of the certificate, the identity registration is completed. The subsequent two-way identity authentication process is the same as the two-way identity authentication process in the "master station-terminal" ("cloud-edge") business security interaction process, which includes:

[0097] 1) When the end device accesses the edge device, it sends the end device digital certificate to the edge device;

[0098] 2) The edge device verifies the digital certificate of the end device, generates a random number R3 after the verification is successful, and sends the random number R3 to the end device;

[0099] 3) The end device generates a random number R4, adds the random number R3 and the random number R4 together, and signs them to obtain a third signature result. The third signature result and the random number R4 are combined and sent to the edge device;

[0100] 4) The edge device uses the end device digital certificate to verify the third signature result, and returns authentication confirmation information after the verification is successful.

[0101] (2) Quantum session key generation and transmission

[0102] After identity authentication, the session key between the edge and the end is generated by the quantum random number built into the edge security chip and sent to the end device. The edge device is responsible for the maintenance and management of the session key of the end device. Figure 6 As shown, specifically including:

[0103] 1) The first security chip of the edge device generates a quantum random number through an optical quantum random number generator, generates a quantum session key Ks' using the quantum random number and the end device security module ID, encrypts the quantum session key Ks' using the protection key Kpn, obtains the third encryption key Es', and sends the third encryption key Es' to the end device. In this step, when the quantum session key Ks' is encrypted using the protection key Kpn, first determine whether the current session cycle between the edge device and the end device is the first session cycle. If the current session cycle between the edge device and the end device is the first session cycle, the symmetric key generated by the cryptographic infrastructure is used as the initial end device protection key, and the initial end device protection key is used to encrypt the second quantum session key; if the current session cycle between the edge device and the end device is not the first session cycle, the second quantum session key during the previous session cycle between the edge device and the end device is used as the end device protection key, and the end device protection key is used to encrypt the second quantum session key;

[0104] 2) After receiving the third encryption key Es', the end device uses the protection key Kpn to decrypt the third encryption key Es' to obtain the quantum session key Ks'.

[0105] (3) Business data transmission protection based on quantum session keys

[0106] The edge and end devices use the quantum session key Ks' to encrypt and transmit business data. This method is the same as the business data transmission protection based on quantum session keys in the "master station-terminal" ("cloud-edge") business security interaction process, and will not be repeated here.

[0107] It is worth mentioning that in this embodiment, the initial master station protection key is pre-issued in the encryption authentication device and is dispersed through preset rules (such as the security chip serial number based on the terminal / edge device), and the initial edge device protection key is obtained after the dispersion processing; the initial edge device protection key is pre-issued in the first security chip and is dispersed through preset rules (such as the security chip serial number based on the end device), and the initial end device protection key is obtained after the dispersion processing.

[0108] In addition, this implementation also sets up two versions, test and formal, for testing the quantum key initial protection key. The test key is preset in the power distribution encryption authentication device on the master station side and the terminal side security dedicated chip. At the same time, the formal key is also preset in the power distribution encryption authentication device on the master station side. After the terminal goes online and passes the identity authentication with the master station, the master station updates the terminal side test key to the formal key according to predetermined rules.

[0109] It is not difficult to find that the present invention greatly improves the security of the business data encryption key of the power secondary system master station-terminal (cloud-edge) and edge-end, and the security of the business data encryption transmission process through the cross-iterative application of the symmetric key and quantum session key generated by the existing cryptographic infrastructure, and the quantum initial protection key activation mechanism based on the two-way identity authentication result of the PKI digital certificate. At the same time, it avoids the high economic investment and large-scale traffic overhead caused by the conventional use of quantum keys for SSL, IPsec and other protocol encryption at the communication layer on the basis of business data encryption: SSL, IPsec identity authentication and key negotiation process require the transmission of certificate chains, long interaction delays, and large communication traffic consumption (where the IPsec message length increases by 150%~200%). The present invention adopts application layer encryption, and when encrypting 200 bytes of data, the length increases by about 15~20%.

Claims

1. A power secondary system business security protection system, characterized in that: It includes a cloud side, an edge side and a terminal side, wherein the cloud side and the edge side communicate and interact through an information security channel, and the terminal side and the edge side communicate and interact; wherein, The cloud side includes: Power secondary business master station and encryption authentication device; A quantum key generation and distribution system for generating a first quantum session key; A quantum key transfer service module, used to transfer the first quantum session key to the power secondary business master station and the encryption authentication device; The encryption authentication device is used to encrypt the first quantum session key using the edge device protection key, and the power secondary business master station is used to transmit the encrypted first quantum session key to the edge side; The side includes: The edge device is provided with a first security chip, and the first security chip is used to decrypt the encrypted first quantum session key to obtain the first quantum session key; The power secondary business master station on the cloud side and the edge device on the edge side transmit business data based on the first quantum session key; The first security chip has an optical quantum random number generator; the optical quantum random number generator is used to generate quantum random numbers; the edge device is also used to generate a second quantum session key based on the quantum random number, and encrypt the second quantum session key through the first security chip and transmit it to the end side; The end side includes: The terminal device is provided with a second security chip, and the second security chip is used to decrypt the encrypted second quantum session key to obtain the second quantum session key; The end device on the end side and the edge device on the edge side transmit service data based on the second quantum session key; The initial master station protection key is pre-issued in the encryption authentication device and is dispersed through the security chip serial number based on the edge device, and the initial edge device protection key is obtained after the dispersion processing; the initial edge device protection key is pre-issued in the first security chip and is dispersed through the security chip serial number based on the end device, and the initial end device protection key is obtained after the dispersion processing.

2. The power secondary system service security protection system according to claim 1 is characterized in that: When transmitting the first quantum session key, the quantum key transfer service module uses the master station protection key to encrypt the first quantum session key.

3. The power secondary system business security protection system according to claim 2 is characterized in that: The quantum key transfer service module includes: The first judgment unit is used to judge whether the current session cycle between the power secondary service master station and the edge device is the first session cycle; A first encryption unit is used to use the symmetric key generated by the cryptographic infrastructure as an initial master station protection key when the current session cycle between the power secondary business master station and the edge device is the first session cycle, and to encrypt the first quantum session key using the initial master station protection key; The second encryption unit is used to use the first quantum session key of the previous session cycle between the power secondary business master station and the edge device as the master station protection key when the current session cycle between the power secondary business master station and the edge device is not the first session cycle, and use the master station protection key to encrypt the first quantum session key.

4. The power secondary system service security protection system according to claim 1 is characterized in that: When the first security chip encrypts the second quantum session key, the end device protection key is used to encrypt the second quantum session key.

5. The power secondary system service safety protection system according to claim 4 is characterized in that: The first security chip comprises: The second judgment unit is used to judge whether the current session period between the edge device and the end device is the first session period; A third encryption unit is used to use the symmetric key generated by the cryptographic infrastructure as the initial end device protection key when the session cycle between the current edge device and the end device is the first session cycle, and to encrypt the second quantum session key with the initial end device protection key; The fourth encryption unit is used to use the second quantum session key in the previous session cycle between the edge device and the end device as the end device protection key when the current session cycle between the edge device and the end device is not the first session cycle, and use the end device protection key to encrypt the second quantum session key.

6. A power secondary system service security protection method, characterized in that: The power secondary system service security protection system as claimed in any one of claims 1 to 5 comprises the following steps: The power secondary business master station or the encryption authentication device sends a quantum session key application request to the quantum key transfer service module; After receiving the quantum session key application request, the quantum key transfer service module requests the first quantum session key from the quantum key generation and distribution system; The quantum key generation and distribution system generates a first quantum session key and transmits it to the quantum key transfer service module; The quantum key transfer service module encrypts the first quantum session key using the master station protection key to obtain a first encryption key, and sends the first encryption key to the encryption authentication device through the master station; The encryption authentication device uses the master station protection key to decrypt the first encryption key to obtain the first quantum session key, and uses the edge device protection key to encrypt the first quantum session key to obtain a second encryption key, and transmits the second encryption key to the edge device; The first security chip of the edge device uses the edge device protection key to decrypt the second encryption key to obtain the first quantum session key.

7. The power secondary system service security protection method according to claim 6 is characterized in that: Before the power secondary business master station or the encryption authentication device sends a quantum session key application request to the quantum key transfer service module, a digital certificate two-way authentication step is also included, specifically including: The power secondary service master station generates a first random number and sends the first random number to the edge device; The edge device generates a second random number, combines the first random number with the second random number, signs the combination result to obtain a first signature result, and packages the first signature result, the second random number and the edge device digital certificate and sends them to the main station; The power secondary business master station verifies the first signature result using the edge device digital certificate, and signs the second random number after the verification is passed to obtain a second signature result, and packages the second signature result and the master station digital certificate and sends them to the edge device; The edge device verifies the second signature result using the master station digital certificate, and returns authentication confirmation information after the verification is successful.

8. The power secondary system service security protection method according to claim 6 is characterized in that: The quantum key transfer service module encrypts the first quantum session key using the master station protection key, specifically including: Determine whether the current session cycle between the power secondary service master station and the edge device is the first session cycle; The current session cycle between the power secondary business master station and the edge device is the first session cycle, the symmetric key generated by the cryptographic infrastructure is used as the initial master station protection key, and the initial master station protection key is used to encrypt the first quantum session key; If the current session cycle between the power secondary business master station and the edge device is not the first session cycle, the first quantum session key of the previous session cycle between the power secondary business master station and the edge device is used as the master station protection key, and the first quantum session key is encrypted using the master station protection key.

9. The power secondary system service security protection method according to claim 8, characterized in that: Also includes: The first security chip has an optical quantum random number generator, which generates a quantum random number. The first security chip of the edge device generates a second quantum session key based on the quantum random number, and encrypts the second quantum session key through the end device protection key to obtain a third encryption key. The edge device transmits the third encryption key to the end device. The second security chip of the end device uses the end device protection key to decrypt the third encryption key to obtain the second quantum session key.

10. The power secondary system service security protection method according to claim 9, characterized in that: Before the optical quantum random number generator generates quantum random numbers, the digital certificate two-way authentication step specifically includes: When the end device accesses the edge device, the end device digital certificate is sent to the edge device; The edge device verifies the digital certificate of the end device, generates a third random number after the verification is passed, and sends the third random number to the end device; The end device generates a fourth random number, combines the third random number with the fourth random number, signs the combination result to obtain a third signature result, and packages the third signature result and the fourth random number and sends them to the edge device; The edge device verifies the third signature result using the end device digital certificate, and returns authentication confirmation information after the verification is successful.

11. The power secondary system service security protection method according to claim 9, characterized in that: The first security chip of the edge device encrypts the second quantum session key by using the end device protection key, specifically including: Determine whether the current session cycle between the edge device and the end device is the first session cycle; The current session cycle between the edge device and the end device is the first session cycle, the symmetric key generated by the cryptographic infrastructure is used as the initial end device protection key, and the initial end device protection key is used to encrypt the second quantum session key; If the current session cycle between the edge device and the end device is not the first session cycle, the second quantum session key during the previous session cycle between the edge device and the end device is used as the end device protection key, and the end device protection key is used to encrypt the second quantum session key.

12. The power secondary system service security protection method according to claim 11, characterized in that: The initial master station protection key is pre-issued in the encryption authentication device and is dispersed according to preset rules to obtain the initial edge device protection key; the initial edge device protection key is pre-issued in the first security chip and is dispersed according to preset rules to obtain the initial end device protection key.

Images