A method for encrypted communication of power system and a secure encrypted communication system

Abstract

The present application provides an encryption communication method and a secure encryption communication system for an electric power system, the method is applied to an edge gateway in a secure encryption communication system, the method comprising: receiving first ciphertext data sent by a terminal device, the first ciphertext data being data encrypted using a session key K1, the session key K1 being a key generated by the terminal device according to a first random number R1; using a secure communication module to calculate a key factor R, generate a session key K1, and verify the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1; when the first ciphertext data is complete, using a secure communication module and the session key K1 to decrypt the first ciphertext data to obtain the first plaintext data. The method provides an edge computing gateway with a north-south secure encryption method through an autonomous and controllable end-side security chip, thereby realizing north-south communication secure encryption.

Description

Technical Field

[0001] The present application relates to the technical field of power systems and automation thereof, and in particular to an encryption communication method, a secure encryption communication system and a computer-readable storage medium for a power system. Background Art

[0002] With the construction of the digital power grid of the Southern Power Grid and the gradual promotion and application of new technologies such as the Internet of Things, big data, and intelligent sensing, comprehensive perception, precise sensing, and the interconnection of all things in the power system have become important technical development directions for the power system. In the Internet of Things, which consists of the terminal layer, edge layer, and platform layer, the number of terminals connected to the terminal layer is growing rapidly. These huge numbers of terminals are exposed to the Internet, posing serious security issues. In addition, most of the current edge computing gateways are non-encrypted, because encryption for southbound gateways has always been blank. Summary of the invention

[0003] The main purpose of this application is to provide an encrypted communication method, a secure encrypted communication system and a computer-readable storage medium for an electric power system, so as to at least solve the problem that most of the current edge computing gateways are unencrypted, especially the southbound gateway is always in an unencrypted state.

[0004] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an encryption communication method for an electric power system is provided, the method being applied to an edge gateway in a secure encryption communication system, the edge gateway comprising a secure communication module, the secure communication module being used to encrypt or decrypt data, southbound communication representing the communication between the edge gateway and a terminal device, and northbound communication representing the communication between the edge gateway and a server, the method comprising: receiving first ciphertext data sent by the terminal device, the first ciphertext data at least comprising an operating parameter of the electric power system collected by the terminal device, the first ciphertext data being data encrypted using a session key K1, the session key K1 being a key generated by the terminal device according to a first random number R1; calculating a key factor R using the secure communication module to generate the session key K1, and verifying the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1; when the first ciphertext data is complete, decrypting the first ciphertext data using the secure communication module and the session key K1 to obtain first plaintext data.

[0005] Optionally, before receiving the first ciphertext data sent by the terminal device, the method also includes: sending an instruction to obtain identity information to the terminal device; receiving the identity information sent by the terminal device according to the instruction to obtain identity information, and verifying the identity information of the terminal device, the identity information of the terminal device at least including the ID information of the terminal device; if the identity information of the terminal device is successfully verified, sending the first encrypted information to the terminal device, the first encrypted information is used for the terminal device and the edge gateway to implement key negotiation; after the first encrypted information passes the verification of the terminal device, receiving the second encrypted information sent by the terminal device, and verifying the second encrypted information, the second encrypted information is used for the terminal device and the edge gateway to implement key negotiation; if the second encrypted information is successfully verified, sending the target encrypted data to the terminal device, the target encrypted data at least including the session key K1, the broadcast key Y and the second random number R2, so that the terminal device and the edge gateway can perform encrypted communication.

[0006] Optionally, when the identity information of the terminal device is successfully verified, the first encrypted information is sent to the terminal device, including: when the identity information of the terminal device is successfully verified, generating a first random number R1; using a preset authentication protection key to encrypt the first random number R1 to obtain first encrypted data; using a gateway private key to sign the first encrypted data to obtain first signature data; determining the first encrypted data, the first signature data and the gateway certificate of the edge gateway as the first encrypted information, and sending the first encrypted information to the terminal device.

[0007] Optionally, when the identity information of the terminal device is successfully verified, after the first encrypted information is sent to the terminal device, the method further includes: when the identity information of the terminal device is successfully verified, the first encrypted information is sent to the terminal device, so that the terminal device verifies the validity of the gateway certificate and the first signature data in the first encrypted information, and when the gateway certificate and the first signature data are successfully verified, the first random number R1 is decrypted using a preset authentication protection key, and the second random number R2 is generated, the first random number R1 and the second random number R2 are encrypting using the authentication protection key to obtain second encrypted data, the second encrypted data is signed using the device private key of the terminal device to obtain second signature data, the second encrypted data, the second signature data and the device certificate of the terminal device are determined as the second encrypted information, and the second encrypted information is sent to the terminal device.

[0008] Optionally, when the second encrypted information is verified successfully, the target encrypted data is sent to the terminal device, including: when the device certificate and the second signature data of the terminal device in the second encrypted information are verified successfully, the second encrypted data in the second encrypted information is decrypted using a preset authentication protection key to obtain a first random number R1 and a second random number R2; verifying whether the first random number R1 is valid, and when the first random number R1 is valid, using the first random number R1 and the second random number R2 for calculation to generate the key factor R, and storing the key factor R, the first random number R1 and the ID information of the terminal device; using the session protection key and the key factor R to perform cryptographic operations to generate the session key K1; using the broadcast protection key and the gateway chip serial number of the edge gateway to generate the broadcast key Y; using the device public key of the terminal device to encrypt the session key K1, the broadcast key Y and the second random number R2 to obtain the target encrypted data, and sending the target encrypted data to the terminal device.

[0009] Optionally, when the second encryption information is successfully verified, after sending the target encrypted data to the terminal device, the method also includes: when the second encryption information is successfully verified, sending the target encrypted data to the terminal device, so that the terminal device uses the device private key to decrypt the target encrypted data, obtain the session key K1, the broadcast key Y and the second random number R2, and verify whether the second random number R2 is correct. When the second random number R2 is correct, the session key K1 is determined as the session key between the terminal device and the edge gateway, and the broadcast key Y is determined as the broadcast key between the terminal device and the edge gateway.

[0010] Optionally, the method also includes: using the secure communication module to receive second ciphertext data sent by the server; using the secure communication module to decrypt the second ciphertext data through the IPSec channel to obtain second plaintext data; using Ethernet to send the second plaintext data to the data center in the edge gateway for data processing.

[0011] According to another aspect of the present application, a secure encrypted communication system is provided, including: a terminal device having an encryption function; a server having an encryption function; an edge gateway including a secure communication module, wherein the edge gateway is used to execute any one of the encryption communication methods for the power system, wherein the edge gateway communicates with the server through the secure communication module, wherein the edge gateway is communicatively connected with the terminal device, and wherein the secure communication module is used to encrypt or decrypt data.

[0012] Optionally, the secure communication module includes a FUXI-EC chip having encryption and decryption functions.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the encryption communication methods for the power system.

[0014] Applying the technical solution of the present application, the above-mentioned power system encryption communication method is applied to the edge gateway in the secure encryption communication system, the edge gateway includes a secure communication module, the secure communication module is used to encrypt or decrypt data, the method first receives the first ciphertext data sent by the terminal device, the first ciphertext data at least includes the operating parameters of the power system collected by the terminal device, the first ciphertext data is encrypted using the session key K1, the session key K1 is the key generated by the terminal device according to the first random number R1; then the secure communication module is used to calculate the key factor R, generate the session key K1, and verify the integrity of the first ciphertext data, the key factor R is at least the key generated according to the first random number R1; finally, when the first ciphertext data is complete, the secure communication module and the session key K1 are used to decrypt the first ciphertext data to obtain the first plaintext data. The method provides an edge computing gateway with a north-south secure encryption method through an autonomous and controllable end-side security chip, realizes north-south communication security encryption, and solves the problem that most of the current edge computing gateways are non-encrypted, especially the southbound gateway is always in a non-encrypted state. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0016] Figure 1 A schematic diagram of a flow chart of an encrypted communication method for a power system provided according to an embodiment of the present application is shown;

[0017] Figure 2 A schematic diagram of the structure of a secure encrypted communication system provided according to an embodiment of the present application is shown;

[0018] Figure 3 A schematic diagram showing a specific process of identity authentication and key negotiation based on digital certificates provided according to an embodiment of the present application is shown;

[0019] Figure 4 A schematic diagram of the structure of another secure encrypted communication system provided according to an embodiment of the present application is shown;

[0020] Figure 5 A structural block diagram of a secure encrypted communication system provided according to an embodiment of the present application is shown;

[0021] Figure 6 A hardware structure block diagram of a secure communication module provided according to an embodiment of the present application is shown;

[0022] Figure 7 A software design schematic diagram of a secure communication module provided according to an embodiment of the present application is shown;

[0023] Figure 8 A schematic diagram of the structure of an edge gateway provided according to an embodiment of the present application is shown.

[0024] The above drawings include the following reference numerals:

[0025] 01. Server; 02. Edge gateway; 021. Secure communication module; 03. Terminal device. DETAILED DESCRIPTION

[0026] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] As introduced in the background technology, most of the current edge computing gateways are unencrypted, and some use external northbound encryption modules to achieve encryption. However, southbound encryption has always been blank. In order to solve the problem that most of the current edge computing gateways are unencrypted, especially the southbound gateway is always in an unencrypted state, the embodiments of the present application provide an encryption communication method, a secure encryption communication system and a computer-readable storage medium for a power system.

[0030] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0031] In this embodiment, an encryption communication method for an electric power system running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 1 : is a flow chart of an encrypted communication method for a power system according to an embodiment of the present application. Figure 1 As shown, the method is applied to an edge gateway in a secure encrypted communication system, the edge gateway includes a secure communication module, the secure communication module is used to encrypt or decrypt data, southbound communication represents the communication between the edge gateway and the terminal device, northbound communication represents the communication between the edge gateway and the server, and the method includes the following steps:

[0033] Step S101, receiving first ciphertext data sent by the terminal device, the first ciphertext data at least including the operating parameters of the power system collected by the terminal device, the first ciphertext data being data encrypted using a session key K1, and the session key K1 being a key generated by the terminal device according to a first random number R1;

[0034] Specifically, the edge gateway accesses various terminal layer devices to the south, and completes access authentication, data encryption and other functions of the southbound devices through the security management and control services of the secure communication module; the edge gateway also needs to access the cloud master station (server) to the north, and a northbound IPSEC function is designed. A single-module technology is proposed to implement south-to-north security service requirements, realize multiple encryption security requirements such as north-south and source channels, and propose an effective software and hardware design solution to meet the application needs of the power Internet of Things.

[0035] like Figure 2As shown, the above embodiment is based on the self-controllable series of power-specific chips to develop 2 types of edge devices, namely a lightweight edge computing control device based on FUXI-H and a high-performance edge computing control device based on FUXI-EC. The south / north encryption security module is realized through the FUXI-S2 chip in the security communication module to achieve the global IoT security protection requirements. While realizing the identity authentication of the master station and the end device, encryption by the national secret algorithm and other security functions, it has the functions of node monitoring and security management of edge-side data, and has the ability to access ≥ 8 types of end-side devices. Other functional indicators follow the same architecture of the feeder terminal, that is, the bus backplane plus 4U plug-in method, which complies with the technical specifications of the Southern Power Grid. The specific southbound and northbound security function performances are as follows:

[0036] (1) The number of concurrent tunnels supported by northbound communication is greater than or equal to 5, the tunnel establishment time is less than or equal to 1 second per tunnel, the ciphertext forwarding delay (excluding southbound data communication time) is less than or equal to 10 milliseconds, and the overall ciphertext encryption rate is greater than 2 Mbps;

[0037] (2) Southbound communication supports secure access of terminal devices through communication protocols such as Modbus and DLT645.

[0038] Among them, the server is an Internet of Things platform or a distribution master station. The digital grid edge layer equipment (distribution gateway) and the north-south security communication module are integrated into one device to form an edge gateway. Various devices on the end side (terminal devices) can be electrical quantity sensors, environmental sensors or smart circuit breakers, etc. Each terminal device is equipped with a security chip for encryption.

[0039] For south-side communication, the edge gateway and the terminal device perform identity authentication and data ciphertext transmission through protocols such as modbus and DLT645 and physical layers such as RS485, HPLC, and Bluetooth. The edge gateway receives information sent by the terminal device through a Bluetooth receiving module, etc., and transmits the southbound data to the main control chip of the distribution gateway through the serial port. The main control chip has the function of forwarding southbound data, and forwards the southbound ciphertext data to the southbound security service module in the north-south security communication module. The southbound security service module can perform identity authentication, data encryption and decryption, and status management, and transmit the plaintext data decrypted by the southbound security service module to the data center in the main control chip of the distribution gateway for data processing.

[0040] For north-side communication, the server communicates with the north-south security communication module through an encrypted tunnel (the application layer uses the MQTT protocol, the transport layer uses the TCP / IP protocol, and the physical layer uses 4G or Ethernet). The distribution gateway transmits the plaintext data through Ethernet to the northbound security service module in the north-south security communication module. The northbound security service module encrypts through IPSec, SSL (or TLS) and performs local node monitoring at the same time (including: target address identification and processing; message protocol identification and processing; other configurable local monitoring rules, etc.).

[0041] To support southbound secure communication, it is necessary to define and expand the security messages of the above modbus and DLT645 protocols, embed low-power security chips in terminal layer devices, and add security processing components to sensor layer devices to support identity authentication, data encryption and transmission, etc. After the southbound data enters the edge device, it will be forwarded to the communication module, and the southbound security service of the communication module will perform the following processing: identity authentication, data encryption and decryption processing for various southbound devices, and return the processed data to the edge device.

[0042] To support northbound secure communications, the main site will be accessed via IPSec encryption to provide secure access for northbound communications. We are also considering replacing different software versions to make them compatible with northbound encryption methods that support SSL.

[0043] The size of the security module is designed according to the requirements of the edge device, and on this basis, the hardware is designed in a way that is as small as possible. The overall architecture hardware design of the security module is shown in the figure below.

[0044] Before receiving the first ciphertext data sent by the terminal device, the method further includes the following steps:

[0045] Step S201, sending an instruction to obtain identity information to the above terminal device;

[0046] Step S202, receiving the identity information sent by the terminal device according to the instruction for obtaining identity information, and verifying the identity information of the terminal device, where the identity information of the terminal device at least includes the ID information of the terminal device;

[0047] Step S203, when the identity information of the terminal device is successfully verified, the first encrypted information is sent to the terminal device, and the first encrypted information is used for the terminal device and the edge gateway to implement key negotiation;

[0048] Wherein, when the identity information of the terminal device is successfully verified, sending the first encrypted information to the terminal device comprises the following steps:

[0049] Step S2031, when the identity information of the terminal device is successfully verified, a first random number R1 is generated;

[0050] Step S2032, using a preset authentication protection key to encrypt the first random number R1 to obtain first encrypted data;

[0051] Step S2033, using the gateway private key to sign the first encrypted data to obtain first signature data;

[0052] Step S2034: determine the first encrypted data, the first signature data and the gateway certificate of the edge gateway as the first encrypted information, and send the first encrypted information to the terminal device.

[0053] Specifically, in order to ensure the security of terminal-side device access and prevent illegal access, after the terminal-side device establishes a communication link with the edge gateway, two-way identity authentication and key negotiation are required.

[0054] Among them, when the identity information of the above-mentioned terminal device is successfully verified, after the first encrypted information is sent to the above-mentioned terminal device, the above-mentioned method also includes: when the identity information of the above-mentioned terminal device is successfully verified, the first encrypted information is sent to the above-mentioned terminal device, so that the above-mentioned terminal device verifies the validity of the gateway certificate and the first signature data in the above-mentioned first encrypted information, and when the above-mentioned gateway certificate and the above-mentioned first signature data are successfully verified, the above-mentioned first random number R1 is decrypted using the preset authentication protection key, and the above-mentioned second random number R2 is generated, the above-mentioned first random number R1 and the above-mentioned second random number R2 are encrypted using the above-mentioned authentication protection key to obtain second encrypted data, the above-mentioned second encrypted data is signed using the device private key of the above-mentioned terminal device to obtain second signature data, and the above-mentioned second encrypted data, the second signature data and the device certificate of the above-mentioned terminal device are determined as the above-mentioned second encrypted information, and the above-mentioned second encrypted information is sent to the above-mentioned terminal device.

[0055] Specifically, in order to facilitate identity authentication, the chip serial number ID, authentication protection key, and session key protection key need to be pre-set in the terminal device security chip. The authentication protection key and session key protection key of each security chip are generated by dispersing the chip serial number ID.

[0056] Step S204, after the first encrypted information is verified by the terminal device, receiving the second encrypted information sent by the terminal device, and verifying the second encrypted information, wherein the second encrypted information is used for the terminal device and the edge gateway to implement key negotiation;

[0057] Step S205, when the second encrypted information is successfully verified, the target encrypted data is sent to the terminal device, the target encrypted data at least includes the session key K1, the broadcast key Y and the second random number R2, so that the terminal device can perform encrypted communication with the edge gateway.

[0058] Specifically, the authentication protection key is mainly used to encrypt and protect the random number transmitted during the authentication process, and does not participate in other business interactions; the session protection key participates in the calculation of the session key, and the edge gateway calculates the session key factor to generate the session key in this authentication process. This ensures the security of terminal-side device access and prevents illegal access.

[0059] Wherein, when the second encrypted information is successfully verified, sending the target encrypted data to the terminal device comprises the following steps:

[0060] Step S2051, when the device certificate of the terminal device and the second signature data in the second encrypted information are successfully verified, the second encrypted data in the second encrypted information is decrypted using a preset authentication protection key to obtain a first random number R1 and the second random number R2;

[0061] Step S2052, verifying whether the first random number R1 is valid, and if the first random number R1 is valid, using the first random number R1 and the second random number R2 to perform calculations to generate the key factor R, and storing the key factor R, the first random number R1 and the ID information of the terminal device;

[0062] Step S2053, using the session protection key and the key factor R to perform cryptographic operations to generate the session key K1;

[0063] Step S2054, using the broadcast protection key and the gateway chip serial number of the edge gateway to generate the broadcast key Y;

[0064] Step S2055: Use the device public key of the terminal device to encrypt the session key K1, the broadcast key Y and the second random number R2 to obtain target encrypted data, and send the target encrypted data to the terminal device.

[0065] Specifically, this can ensure the security of terminal-side device access and prevent illegal access.

[0066] Among them, when the above-mentioned second encryption information is successfully verified, after sending the target encrypted data to the above-mentioned terminal device, the above-mentioned method also includes: when the above-mentioned second encryption information is successfully verified, sending the target encrypted data to the above-mentioned terminal device, so that the above-mentioned terminal device uses the device private key to decrypt the above-mentioned target encrypted data, obtains the above-mentioned session key K1, the above-mentioned broadcast key Y and the above-mentioned second random number R2, and verifies whether the above-mentioned second random number R2 is correct. When the above-mentioned second random number R2 is correct, the above-mentioned session key K1 is determined as the session key of the above-mentioned terminal device and the above-mentioned edge gateway, and the above-mentioned broadcast key Y is determined as the broadcast key of the above-mentioned terminal device and the above-mentioned edge gateway.

[0067] Specifically, the identity authentication is initiated by the edge gateway, and the terminal side device of the lower level access responds. After the authentication is successful, the two parties negotiate the session key. This can ensure the security of the terminal side device access and prevent illegal access.

[0068] In addition, the edge gateway must support the access of multiple terminal devices, save the device information of each terminal, the security chip serial number, the session key factor R, the gateway random number R1 and other factors. These factors can be used for subsequent key calculations and support the session reuse mechanism; during the authentication session, the session key remains unchanged. Once the authentication session ends, re-authentication is required and a new session key is recalculated; the security chip must support anti-data replay function.

[0069] The specific process of identity authentication and key negotiation based on digital certificates is as follows: Figure 3As shown, first, the edge gateway starts a two-way identity authentication process with the terminal device, and sends the terminal information acquisition instruction to the terminal device; the terminal sends information such as the chip serial number ID to the edge gateway; the edge gateway generates a random number R1, encrypts R1 with the authentication protection key (preset), signs the ciphertext with the private key, and sends the ciphertext, signature result, and gateway certificate to the terminal device; the terminal device verifies the validity of the gateway certificate and the signature result, decrypts the random number R1 with the authentication protection key (preset), generates a random number R2, encrypts "R1+R2" with the authentication protection key, signs the ciphertext with the device private key, and sends the ciphertext, signature result, and terminal device certificate to the edge gateway; the edge gateway verifies the terminal device certificate and The validity of the signature result; use the preset authentication protection key to decrypt and obtain R1+R2, verify whether R1 is valid, use random numbers R1 and R2 to calculate and generate the key factor R, and save R1, R2 and the security chip serial number ID, use the session key protection key and key factor R for cryptographic operations to generate the session key K1, use the broadcast key protection key and the gateway chip serial number to generate the broadcast key Y, use the device public key session key K1, broadcast key Y and R2 to encrypt, and then send the ciphertext to the terminal device; after the terminal device receives the data, it uses the private key to decrypt and obtain the key K1, broadcast key Y and R2, and verify whether R2 is correct. If it passes, K1 is the session key between the device and the network manager, and Y is used as the broadcast key.

[0070] Step S102, using the secure communication module to calculate the key factor R, generate the session key K1, and verify the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1;

[0071] Specifically, when data is transmitted between the edge gateway and the terminal device, the SM1 algorithm is used for encryption protection.

[0072] Step S103, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data.

[0073] Specifically, the terminal device uses the random number R1 in the authentication process as the transmission parameter, encrypts the data to be sent using the uplink session key K1 randomly generated during the authentication process, calculates the message authentication code MAC, and sends the ciphertext data + MAC to the edge gateway. After receiving the ciphertext data, the edge gateway uses the random number R to generate the session key K1, verifies the integrity of the data (verifies the correctness of the MAC), and decrypts to obtain the plaintext data.

[0074] The above method further comprises the following steps:

[0075] Step S301, using the above-mentioned secure communication module to receive second ciphertext data sent by the server;

[0076] Step S302, using the secure communication module to decrypt the second ciphertext data through the IPSec channel to obtain second plaintext data;

[0077] Step S303: Use Ethernet to send the second plaintext data to the data center in the edge gateway for data processing.

[0078] Specifically, this can achieve secure encryption of north-south communications at the same time.

[0079] like Figure 4 As shown in the figure, based on the data encryption protection of symmetric keys, the terminal device uses the random number R1 in the authentication process as the transmission parameter, encrypts the data to be uploaded with the randomly generated composite key K1 and calculates the message authentication code MAC, and sends the ciphertext data + MAC to the gateway; after the edge gateway receives the encrypted ciphertext, it uses the key factor R to calculate and generate the symmetric key K1, verifies the integrity of the data (verifies the correctness of MAC), and decrypts to obtain the plaintext data.

[0080] The above-mentioned embodiments have built a solid, safe and reliable global IoT communication environment, carried out key technology research on security chips applied to terminal layer devices, proposed an efficient, safe and reliable terminal security chip architecture, and finally formed an independent and controllable terminal security chip, mastered core technologies, and improved the digital construction level of the Southern Power Grid. It can improve the security protection level of the power Internet of Things and ensure the security of IoT terminal devices.

[0081] The encryption communication method of the above-mentioned power system of the present application is applied to the edge gateway in the secure encryption communication system. The edge gateway includes a secure communication module, which is used to encrypt or decrypt data. The method first receives the first ciphertext data sent by the terminal device. The first ciphertext data at least includes the operating parameters of the power system collected by the terminal device. The first ciphertext data is data encrypted using the session key K1, and the session key K1 is a key generated by the terminal device according to the first random number R1; then the key factor R is calculated using the secure communication module to generate the session key K1, and the integrity of the first ciphertext data is verified. The key factor R is a key generated at least according to the first random number R1; finally, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data. The method provides an edge computing gateway with a north-south secure encryption method through an autonomous and controllable end-side security chip, realizes north-south communication security encryption, and solves the problem that most of the current edge computing gateways are non-encrypted, especially the southbound gateway is always in a non-encrypted state.

[0082] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0083] The present application also provides a secure encrypted communication system. Figure 5 As shown, the system includes: a terminal device 03 having an encryption function; a server 01 having an encryption function; an edge gateway 02 including a secure communication module 021, the edge gateway 02 being used to execute any one of the above-mentioned encryption communication methods of the power system, the edge gateway 02 communicating with the server 01 through the secure communication module 021, the edge gateway 02 being communicatively connected with the terminal device 03, and the secure communication module 021 being used to encrypt or decrypt data.

[0084] The above-mentioned secure encrypted communication system of the present application includes: a terminal device with an encryption function; a server with an encryption function; an edge gateway, including a secure communication module, the edge gateway is used to execute any encryption communication method of the power system, the edge gateway communicates with the server through the secure communication module, the edge gateway is connected to the terminal device for communication, and the secure communication module is used to encrypt or decrypt data. The system provides an edge computing gateway with a north-south secure encryption method through an autonomous and controllable end-side security chip, realizes north-south communication security encryption, and solves the problem that most of the current edge computing gateways are non-encrypted, especially the southbound gateway is always in a non-encrypted state.

[0085] like Figure 2 As shown in the figure, the north-south security communication module has a southbound RJ45 interface connected to the gateway. Security-related services are divided into the following three categories:

[0086] (1) Sensor authentication: The sensor device initiates the authentication, and the peer device is a convergence unit or a north-south module. The authentication data between the sensor and the north-south module needs to be converted to a protocol and forwarded by the gateway.

[0087] (2) Terminal identity authentication: Bidirectional identity authentication between terminal devices (or aggregation units) and north-south modules. The gateway is required to convert the protocol and forward the information.

[0088] (3) Encryption and decryption services.

[0089] Northbound uplink ciphertext process: The end-side device / aggregation unit calls the security chip to encrypt the application layer data and sends it to the gateway. The gateway forwards the ciphertext data that needs to be decrypted to the north-south module through the RJ45 network port; the north-south module performs MAC verification and decryption on the ciphertext data, and then transmits the decrypted data back to the gateway through the network port.

[0090] Southbound and downlink ciphertext process: The gateway needs to encrypt the data sent to the end side. First, it encapsulates it according to a specific message format, carries information such as the end-side device ID, and forwards it to the north-south security communication module through RJ45; the north-south security communication module encrypts the data according to the end-side ID, and then sends the ciphertext back to the gateway through the RJ45 network port. The gateway forwards it to the end-side device through the local communication channel (RS485\HPLC, etc.).

[0091] Low-power security chip: Domestic security chip, supports SM2, SM3, and SM4 algorithms, and is used in various sensor terminal devices. It is generally used in battery-powered scenarios with high power consumption requirements.

[0092] General security chip: Domestic security chip, supporting SM1, SM2, SM3, SM4, and SM7 algorithms, used in devices with edge computing functions such as smart circuit breakers, reversing switches, and convergence units.

[0093] The sensors controlled by the security module of the aggregation node must be universal and not affected by the type of sensor network connected upward. The aggregation node can select the appropriate channel based on the type of network connected upward.

[0094] The edge terminal of the global Internet of Things adopts an embedded multi-operating system with an independent CPU multi-core architecture, a lightweight, highly reliable and secure container, and a multi-level and multi-task security protection strategy. The device realizes on-site intelligence of the distribution network operation based on edge computing through online measurement and offline data fusion, and edge / cloud-edge information collaboration technology. In response to the requirements of fast and high-quality application of edge-side services, it breaks through the fast reasoning and decision-making technology of artificial intelligence based on edge computing, and supports business applications such as on-site intelligent monitoring on the edge side.

[0095] The hardware and software system architecture of the edge terminal of the global Internet of Things follows the layered architecture idea and consists of five parts: physical interface layer, hardware layer (including core modules, physical interface modules, etc.), kernel layer (including operating system, file system, etc.), business support layer (including shared resource management, container technology, security technology, data center, message bus, system manager, hardware abstraction layer, etc.), application layer (including monitoring, control, metering and other business applications).

[0096] The terminal uses a real-time core and a non-real-time core to separate them at the hardware physical layer. The non-real-time core has one operating system, and the two real-time cores have one operating system each. The bottom layer of the software is the kernel layer, which is responsible for the file system, network management, process management, task scheduling, etc. In order to ensure that the application layer software of different manufacturers can be seamlessly connected, a support layer (middle layer) is set between the kernel and the application software, including container technology, security technology, data center, etc. At the same time, data exchange between different operating systems and between APP applications is realized through the middle layer. The top layer is the application APP layer, which integrates monitoring, control, metering and other services.

[0097] The device adopts a modular design concept in hardware, which is divided into main control module, power module, communication module, Beidou positioning module, AC sampling module, remote signal and remote control module, etc. Through the orderly combination of modules, functions such as load control terminal, fusion terminal, and energy controller can be realized. Container technology is used in software, and various applications are APP-based, including medium voltage topology analysis, AC sampling, fault location, fault isolation and other applications.

[0098] The resources of the core unit main control board are allocated as follows:

[0099] Ethernet: Ethernet 1-4 are connected to marketing, IoT platform and other main stations through 4G modules.

[0100] USB: USB1 for upgrading and debugging, USB2 for connecting to HUB, USB3 for uplink 4G module;

[0101] UART: UART0-1 is used for 232 / 485 multiplexing, UART2-3 is used for 232 communication, UART4-5 is used for 485 communication, UART6 is used for Bluetooth module, UART7 is used for serial maintenance, UART8 is used for Beidou module, UART9 is used for residual pressure module, UART10 is used for remote signal expansion, and UART11 is used for HPLC;

[0102] SPI: SPI1-6 connects to 6 AD acquisition chips, SPI9-10 connects to two encryption chips, and SPI11 connects to the line loss measurement chip;

[0103] ADC: collects RTC battery voltage, backup battery voltage, operating power, and hardware ID;

[0104] CAN: CAN communication;

[0105] I2C: I2C1 is connected to the real-time clock, I2C2 is connected to the local GPIO expansion module, I2C3-4 is connected to the EEPROM chip, and I2C5-6 is connected to the temperature acquisition module.

[0106] The data collected from line analog quantities is the basis for the implementation of algorithms such as power quality and metering. The accuracy of data collection directly affects the realization of business.

[0107] The signals of the power quality and low-voltage metering acquisition parts are independently configured with voltage and current transformers after passing through the external wiring terminals, and do not interfere with each other. After passing through their respective voltage transformers and current transformers, they enter the AD acquisition chip and metering chip respectively. The AD acquisition chip and metering chip exchange data through independent SPI and FUXI-EC chips respectively.

[0108] The communication interface is the system's window for external communication. Different systems are equipped with different numbers of interfaces according to their needs. Therefore, the localization of interface chips is a reliable guarantee for data exchange. The edge computing control device has a wealth of communication interfaces.

[0109] The Ethernet RJ45 connector is connected to the network transformer, and then connected to the PHY chip YT8511H / YT8512H of Yutai Microelectronics and enters the FUXI-EC chip to form a complete Ethernet interactive interface.

[0110] After the RS232 interface passes through the UM3221E chip, the standard RS232 level is converted into TTL level, and then enters the FUXI-EC chip through the NSi8242W high-speed isolation chip. At this time, the RS232 communication interface is established. The same is true for the RS485 interface, except that the interface chip is ECH485EESA.

[0111] The acquisition of external DC analog quantities allows the system to obtain the size of various external DC voltages, such as battery voltage, operating power supply voltage, etc. An important device required in DC analog quantity acquisition is an operational amplifier with isolation function. The edge computing control device uses NSI1300 as an isolation operational amplifier, which has 5000V isolation and 8 times amplification capability, and can realize the isolation and acquisition of DC analog quantities.

[0112] The power system covers a very wide range. In order to comprehensively, real-time and accurately monitor the operating status of the power system and analyze the process and causes of accidents, each device in the power system needs to use a unified time information source. The edge computing control device has Beidou, B code and master station protocol timing functions. At the same time, the RTC clock chip SD3178 is used as the timekeeping chip to achieve a 24-hour 0.5-second timekeeping function.

[0113] The terminal input voltage range is 18V-75V. The external input power is converted to 5V power through the isolated power module E4805UHBDD. First, the 5V power supply powers the DCDC conversion chip SY8386ARHC, and then it is reduced to 3.3V through SY8386ARHC to power the system. Secondly, the 5V power supply charges the supercapacitor. When the main power supply is insufficient, the supercapacitor is reduced to 3.3V through SY8386ARHC to power the system. Finally, the 5V power supply is converted into isolated 5V through the isolated power supply ZY0505FKS for use in communication interface circuits such as 485 and 232.

[0114] The FUXI-EC on the terminal runs an embedded multi-operating system with an independent CPU multi-core architecture, integrates the functions of the intelligent area TTU, adds container APP functions, metering APP, etc. The device has a rich communication interface, which can flexibly realize the access of residual current protectors, intelligent capacitors, intelligent switches, and temperature acquisition devices. Various functions are designed in a modular way, with hardware modularization and software function APP modularization, and are equipped with fully functional diagnostic and debugging tools. It can realize the analog quantity acquisition, calculation, remote signal quantity acquisition, and remote control execution of conventional distribution terminals, and can realize the collaboration of multiple businesses.

[0115] The power-specific edge computing chip (FUXI-EC multi-core architecture chip) is mainly divided into three functional cores: 2×CK810 real-time cores, 4×CK860 non-real-time cores, and CK802 security cores. The real-time core is mainly used for control services and needs to be used in conjunction with the power-specific subsystem. At the same time, it has extremely high real-time requirements, can complete fast calculations, and can make control actions in a timely manner. The non-real-time core is mainly used for non-real-time services such as communications. Due to the large number of application functions and the need for edge computing capabilities, it has strong requirements for processor computing capabilities. The security core mainly implements a series of security mechanisms coupled to the processor core, bus interface unit, and on-chip memory.

[0116] like Figure 6As shown in the figure, the edge gateway security module adopts a high-performance master MCU solution. The entire security module can be embedded in the edge device. The interface between the edge device mainly includes the power interface and the communication interface. In terms of hardware, a 2.54mm pitch standard connector or a crimped cable can be used according to the interface specification of the edge device. Inside the security module, according to the power requirements of the master MCU, storage, security chip and other hardware circuits inside the module, the power supply system is used to uniformly manage the power supply to ensure the safety of the power-on and power-off timing and the stable and reliable operation of the hardware circuits. The master MCU is configured with security chips, watchdogs, storage, memory and other circuits. Among them, the security chip is an important basis for the realization of the overall security module function, providing cryptographic computing resources for the north-south communication of the security module. The storage chip provides the system with log storage, program file storage, important event storage and other functions. The watchdog plays a role in monitoring the master MCU. Once an abnormal event occurs in the master MCU, the master MCU can be reset in time to improve the overall robustness and anti-interference of the program.

[0117] The overall hardware design follows the following design principles:

[0118] (1) Reliability: Component selection, schematic design, and PCB must strictly follow the corresponding hardware design specifications. The selected components must undergo rigorous component quality analysis and theoretical verification such as single fault failure analysis to ensure that the overall hardware MTBF meets industrial application requirements.

[0119] (2) Cost control: When designing hardware, performance and functional requirements are taken into consideration, and a certain margin is appropriately left, and irrelevant functions are cut to ensure that the overall hardware cost is controllable and to avoid ineffective waste of resources.

[0120] (3) A single module supports north-south security service functions. The hardware design takes north-south security service requirements into consideration, and fully reserves corresponding data interfaces and computing resources to ensure the feasibility of function realization and solutions.

[0121] Based on the above hardware design, the following software design scheme is adopted to meet the realization of the overall functions.

[0122] like Figure 7As shown in the figure, the overall software architecture mainly includes southbound communication processing module, northbound data communication transfer management component, and northbound communication processing module. The southbound communication processing module mainly includes terminal status management, identity management, data cache, various protocol components, etc., completes the access identity authentication, protocol processing, status management and other functions of the southbound terminal equipment, and transmits the corresponding data to the northbound communication processing module through the transfer management component; the northbound communication processing module mainly includes the identity authentication, key negotiation, ipsec protocol component, connection status maintenance, certificate management, node monitoring and other functions of the northbound master station, formats the southbound data, organizes and places it in a pre-agreed format, and then forwards the southbound data to the cloud master station through the wireless processing module on the basis of establishing the ipsec tunnel connection.

[0123] The embodiment of the present application also provides an edge gateway. It should be noted that the edge gateway of the embodiment of the present application can be used to execute the encrypted communication method for the power system provided by the embodiment of the present application. The edge gateway is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the edge gateway described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0124] The following is an introduction to the edge gateway provided in the embodiment of the present application.

[0125] Figure 8 Schematic diagram of an edge gateway according to an embodiment of the present application. Figure 8 As shown, the edge gateway includes a receiving unit 10, a generating unit 20 and a decrypting unit 30, the receiving unit 10 is used to receive the first ciphertext data sent by the above-mentioned terminal device, the above-mentioned first ciphertext data at least includes the operating parameters of the power system collected by the above-mentioned terminal device, the above-mentioned first ciphertext data is data encrypted by using a session key K1, and the above-mentioned session key K1 is a key generated by the above-mentioned terminal device according to a first random number R1; the generating unit 20 is used to calculate the key factor R by using the above-mentioned secure communication module, generate the above-mentioned session key K1, and verify the integrity of the above-mentioned first ciphertext data, and the above-mentioned key factor R is a key generated at least according to the above-mentioned first random number R1; the decrypting unit 30 is used to decrypt the above-mentioned first ciphertext data by using the above-mentioned secure communication module and the above-mentioned session key K1 to obtain the first plaintext data when the above-mentioned first ciphertext data is complete.

[0126] In some optional instances, the edge gateway further includes a first sending module, a first receiving module, a second sending module, a second receiving module and a third sending module, wherein the first sending module is used to send an instruction to obtain identity information to the terminal device; the first receiving module is used to receive the identity information sent by the terminal device according to the instruction to obtain identity information, and verify the identity information of the terminal device, wherein the identity information of the terminal device at least includes the ID information of the terminal device; the second sending module is used to send the first encrypted information to the terminal device if the identity information of the terminal device is successfully verified, and the first encrypted information is used for the terminal device and the edge gateway to implement key negotiation; the second receiving module is used to receive the second encrypted information sent by the terminal device after the first encrypted information is verified by the terminal device, and verify the second encrypted information, and the second encrypted information is used for the terminal device and the edge gateway to implement key negotiation; the third sending module is used to send the target encrypted data to the terminal device if the second encrypted information is successfully verified, and the target encrypted data at least includes the session key K1, the broadcast key Y and the second random number R2, so that the terminal device and the edge gateway can perform encrypted communication.

[0127] In some optional instances, the second sending module includes a first generation submodule, a first encryption submodule, a first signature submodule and a first determination submodule. The first generation submodule is used to generate a first random number R1 when the identity information of the above-mentioned terminal device is successfully verified; the first encryption submodule is used to encrypt the above-mentioned first random number R1 using a preset authentication protection key to obtain first encrypted data; the first signature submodule is used to sign the above-mentioned first encrypted data using a gateway private key to obtain first signature data; the first determination submodule is used to determine the above-mentioned first encrypted data, the above-mentioned first signature data and the gateway certificate of the above-mentioned edge gateway as the above-mentioned first encrypted information, and send the above-mentioned first encrypted information to the above-mentioned terminal device.

[0128] In this embodiment, the above-mentioned device also includes a third sending module. After the identity information of the above-mentioned terminal device is successfully verified, the third sending module sends the first encrypted information to the above-mentioned terminal device. When the identity information of the above-mentioned terminal device is successfully verified, the third sending module sends the first encrypted information to the above-mentioned terminal device, so that the above-mentioned terminal device verifies the validity of the gateway certificate and the first signature data in the above-mentioned first encrypted information, and when the above-mentioned gateway certificate and the above-mentioned first signature data are successfully verified, the first random number R1 is decrypted using a preset authentication protection key, and the second random number R2 is generated, the first random number R1 and the second random number R2 are encrypted using the above-mentioned authentication protection key to obtain second encrypted data, the second encrypted data is signed using the device private key of the above-mentioned terminal device to obtain second signature data, and the second encrypted data, the second signature data and the device certificate of the above-mentioned terminal device are determined as the above-mentioned second encrypted information, and the second encrypted information is sent to the above-mentioned terminal device.

[0129] In some embodiments, the third sending module includes a first decryption submodule, a first verification submodule, a second generation submodule, a third generation submodule and a second encryption submodule. The first decryption submodule is used to use a preset authentication protection key to decrypt the second encrypted data in the second encrypted information when the device certificate of the terminal device and the second signature data in the second encrypted information are successfully verified to obtain the first random number R1 and the second random number R2; the first verification submodule is used to verify whether the first random number R1 is valid, and when the first random number R1 is valid, use the first random number R1 and the second random number R2 to decrypt the second encrypted data in the second encrypted information. R2 is calculated to generate the key factor R, and the key factor R, the first random number R1 and the ID information of the terminal device are stored; the second generation submodule is used to use the session protection key and the key factor R to perform cryptographic operations to generate the session key K1; the third generation submodule is used to use the broadcast protection key and the gateway chip serial number of the edge gateway to generate the broadcast key Y; the second encryption submodule is used to use the device public key of the terminal device to encrypt the session key K1, the broadcast key Y and the second random number R2 to obtain the target encrypted data, and send the target encrypted data to the terminal device.

[0130] An optional solution, the edge gateway also includes a fourth sending module, which is used to send the target encrypted data to the terminal device after the second encryption information is verified successfully. When the second encryption information is verified successfully, the target encrypted data is sent to the terminal device, so that the terminal device uses the device private key to decrypt the target encrypted data, obtains the session key K1, the broadcast key Y and the second random number R2, and verifies whether the second random number R2 is correct. When the second random number R2 is correct, the session key K1 is determined as the session key between the terminal device and the edge gateway, and the broadcast key Y is determined as the broadcast key between the terminal device and the edge gateway.

[0131] As an optional solution, the above-mentioned edge gateway also includes a third receiving module, a decryption module and a processing module. The third receiving module is used to use the above-mentioned secure communication module to receive the second ciphertext data sent by the server; the decryption module is used to use the above-mentioned secure communication module to decrypt the above-mentioned second ciphertext data through the IPSec channel to obtain second plaintext data; the processing module is used to use Ethernet to send the above-mentioned second plaintext data to the data center in the above-mentioned edge gateway for data processing.

[0132] The above-mentioned encrypted communication device of the power system includes a processor and a memory, and the above-mentioned receiving unit and the like are stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions. The above-mentioned modules are all located in the same processor; or, the above-mentioned modules are located in different processors in any combination.

[0133] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to solve the problem that most of the current edge computing gateways are non-encrypted, especially the southbound gateway is always in a non-encrypted state.

[0134] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0135] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the encryption communication method of the power system.

[0136] Specifically, the encrypted communication method of the power system includes:

[0137] Step S101, receiving first ciphertext data sent by the terminal device, the first ciphertext data at least including the operating parameters of the power system collected by the terminal device, the first ciphertext data being data encrypted using a session key K1, and the session key K1 being a key generated by the terminal device according to a first random number R1;

[0138] Specifically, the edge gateway accesses various terminal layer devices to the south, and completes access authentication, data encryption and other functions of the southbound devices through the security management and control services of the secure communication module; the edge gateway also needs to access the cloud master station (server) to the north, and a northbound IPSEC function is designed. A single-module technology is proposed to implement south-to-north security service requirements, realize multiple encryption security requirements such as north-south and source channels, and propose an effective software and hardware design solution to meet the application needs of the power Internet of Things.

[0139] Step S102, using the secure communication module to calculate the key factor R, generate the session key K1, and verify the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1;

[0140] Specifically, when data is transmitted between the edge gateway and the terminal device, the SM1 algorithm is used for encryption protection.

[0141] Step S103, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data.

[0142] Specifically, the terminal device uses the random number R1 in the authentication process as the transmission parameter, encrypts the data to be sent using the uplink session key K1 randomly generated during the authentication process, calculates the message authentication code MAC, and sends the ciphertext data + MAC to the edge gateway. After receiving the ciphertext data, the edge gateway uses the random number R to generate the session key K1, verifies the integrity of the data (verifies the correctness of the MAC), and decrypts to obtain the plaintext data.

[0143] An embodiment of the present invention provides a processor, which is used to run a program, wherein the encryption communication method of the power system is executed when the program is running.

[0144] Specifically, the encrypted communication method of the power system includes:

[0145] Step S101, receiving first ciphertext data sent by the terminal device, the first ciphertext data at least including the operating parameters of the power system collected by the terminal device, the first ciphertext data being data encrypted using a session key K1, and the session key K1 being a key generated by the terminal device according to a first random number R1;

[0146] Specifically, the edge gateway accesses various terminal layer devices to the south, and completes access authentication, data encryption and other functions of the southbound devices through the security management and control services of the secure communication module; the edge gateway also needs to access the cloud master station (server) to the north, and a northbound IPSEC function is designed. A single-module technology is proposed to implement south-to-north security service requirements, realize multiple encryption security requirements such as north-south and source channels, and propose an effective software and hardware design solution to meet the application needs of the power Internet of Things.

[0147] Step S102, using the secure communication module to calculate the key factor R, generate the session key K1, and verify the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1;

[0148] Specifically, when data is transmitted between the edge gateway and the terminal device, the SM1 algorithm is used for encryption protection.

[0149] Step S103, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data.

[0150] Specifically, the terminal device uses the random number R1 in the authentication process as the transmission parameter, encrypts the data to be sent using the uplink session key K1 randomly generated during the authentication process, calculates the message authentication code MAC, and sends the ciphertext data + MAC to the edge gateway. After receiving the ciphertext data, the edge gateway uses the random number R to generate the session key K1, verifies the integrity of the data (verifies the correctness of the MAC), and decrypts to obtain the plaintext data.

[0151] An embodiment of the present invention provides a device, the device comprising a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, at least the following steps are implemented:

[0152] Step S101, receiving first ciphertext data sent by the terminal device, the first ciphertext data at least including the operating parameters of the power system collected by the terminal device, the first ciphertext data being data encrypted using a session key K1, and the session key K1 being a key generated by the terminal device according to a first random number R1;

[0153] Step S102, using the secure communication module to calculate the key factor R, generate the session key K1, and verify the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1;

[0154] Step S103, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data.

[0155] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0156] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0157] Step S101, receiving first ciphertext data sent by the terminal device, the first ciphertext data at least including the operating parameters of the power system collected by the terminal device, the first ciphertext data being data encrypted using a session key K1, and the session key K1 being a key generated by the terminal device according to a first random number R1;

[0158] Step S102, using the secure communication module to calculate the key factor R, generate the session key K1, and verify the integrity of the first ciphertext data, the key factor R being a key generated at least according to the first random number R1;

[0159] Step S103, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data.

[0160] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0161] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0162] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0165] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0166] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0167] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0168] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0169] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0170] 1) The encryption communication method of the power system of the present application is applied to the edge gateway in the secure encryption communication system. The edge gateway includes a secure communication module, which is used to encrypt or decrypt data. The method first receives the first ciphertext data sent by the terminal device. The first ciphertext data at least includes the operating parameters of the power system collected by the terminal device. The first ciphertext data is data encrypted using the session key K1, and the session key K1 is a key generated by the terminal device according to the first random number R1; then the key factor R is calculated by the secure communication module to generate the session key K1, and the integrity of the first ciphertext data is verified. The key factor R is a key generated at least according to the first random number R1; finally, when the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain the first plaintext data. The method provides an edge computing gateway with a north-south secure encryption method through an autonomous and controllable end-side security chip, realizes north-south communication security encryption, and solves the problem that most of the current edge computing gateways are non-encrypted, especially the southbound gateway is always in a non-encrypted state.

[0171] 2) The above-mentioned secure encrypted communication system of the present application includes: a terminal device with an encryption function; a server with an encryption function; an edge gateway including a secure communication module, the edge gateway is used to execute any encryption communication method of the power system, the edge gateway communicates with the server through the secure communication module, the edge gateway is connected to the terminal device in communication, and the secure communication module is used to encrypt or decrypt data. The system provides an edge computing gateway with a north-south secure encryption method through an autonomous and controllable end-side security chip, realizes north-south communication security encryption, and solves the problem that most of the current edge computing gateways are non-encrypted, especially the southbound gateway is always in a non-encrypted state.

[0172] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for implementing an edge computing gateway with north-south security encryption, characterized in that: The method is applied to an edge gateway in a north-south secure encrypted communication system, the edge gateway includes a secure communication module, the secure communication module is used to encrypt or decrypt data, southbound communication represents the communication between the edge gateway and the terminal device, northbound communication represents the communication between the edge gateway and the server, the method includes: Receive first ciphertext data sent by the terminal device, the first ciphertext data at least including operating parameters of the power system collected by the terminal device, the first ciphertext data is data encrypted using a session key K1, and the session key K1 is a key generated by the terminal device according to a first random number R1; Calculating a key factor R using the secure communication module to generate the session key K1 and verifying the integrity of the first ciphertext data, wherein the key factor R is a key generated at least based on the first random number R1; In the case where the first ciphertext data is complete, the first ciphertext data is decrypted using the secure communication module and the session key K1 to obtain first plaintext data; Before receiving the first ciphertext data sent by the terminal device, the method further includes: Sending an instruction to obtain identity information to the terminal device; Receiving the identity information sent by the terminal device according to the instruction for obtaining identity information, and verifying the identity information of the terminal device, wherein the identity information of the terminal device at least includes the ID information of the terminal device; When the identity information of the terminal device is successfully verified, the first encrypted information is sent to the terminal device, where the first encrypted information is used for the terminal device and the edge gateway to implement key negotiation; After the first encrypted information is verified by the terminal device, receiving second encrypted information sent by the terminal device and verifying the second encrypted information, where the second encrypted information is used for the terminal device and the edge gateway to implement key negotiation; If the second encrypted information is successfully verified, the target encrypted data is sent to the terminal device, the target encrypted data at least including the session key K1, the broadcast key Y and the second random number R2, so that the terminal device performs encrypted communication with the edge gateway; When the second encrypted information is successfully verified, sending the target encrypted data to the terminal device includes: When the device certificate of the terminal device and the second signature data in the second encrypted information are successfully verified, the second encrypted data in the second encrypted information is decrypted using a preset authentication protection key to obtain a first random number R1 and a second random number R2; Verify whether the first random number R1 is valid, and if the first random number R1 is valid, use the first random number R1 and the second random number R2 to perform calculation to generate the key factor R, and store the key factor R, the first random number R1 and the ID information of the terminal device; Perform cryptographic operations using the session protection key and the key factor R to generate the session key K1; Generate the broadcast key Y using the broadcast protection key and the gateway chip serial number of the edge gateway; The session key K1, the broadcast key Y and the second random number R2 are encrypted using the device public key of the terminal device to obtain target encrypted data, and the target encrypted data is sent to the terminal device.

2. The implementation method according to claim 1, characterized in that: When the identity information of the terminal device is successfully verified, sending the first encrypted information to the terminal device includes: If the identity information of the terminal device is successfully verified, a first random number R1 is generated; Encrypting the first random number R1 using a preset authentication protection key to obtain first encrypted data; Using a gateway private key to sign the first encrypted data to obtain first signature data; The first encrypted data, the first signature data, and the gateway certificate of the edge gateway are determined as the first encrypted information, and the first encrypted information is sent to the terminal device.

3. The implementation method according to claim 1, characterized in that: When the identity information of the terminal device is successfully verified, after sending the first encrypted information to the terminal device, the method further includes: In the case where the identity information of the terminal device is successfully verified, the first encrypted information is sent to the terminal device, so that the terminal device verifies the validity of the gateway certificate and the first signature data in the first encrypted information, and in the case where the gateway certificate and the first signature data are successfully verified, the first random number R1 is decrypted using the preset authentication protection key, and the second random number R2 is generated, the first random number R1 and the second random number R2 are encrypted using the authentication protection key to obtain second encrypted data, the second encrypted data is signed using the device private key of the terminal device to obtain second signature data, the second encrypted data, the second signature data and the device certificate of the terminal device are determined as the second encrypted information, and the second encrypted information is sent to the terminal device.

4. The implementation method according to claim 1, characterized in that: In the case where the second encrypted information is successfully verified, after sending the target encrypted data to the terminal device, the method further includes: If the second encryption information is successfully verified, the target encrypted data is sent to the terminal device, so that the terminal device uses the device private key to decrypt the target encrypted data, obtains the session key K1, the broadcast key Y and the second random number R2, and verifies whether the second random number R2 is correct. If the second random number R2 is correct, the session key K1 is determined as the session key between the terminal device and the edge gateway, and the broadcast key Y is determined as the broadcast key between the terminal device and the edge gateway.

5. The implementation method according to claim 1, characterized in that: The method further comprises: Using the secure communication module to receive second ciphertext data sent by the server; Decrypting the second ciphertext data using the secure communication module through the IPSec channel to obtain second plaintext data; The second plaintext data is sent to the data center in the edge gateway for data processing using Ethernet.

6. A north-south secure encrypted communication system, characterized in that: include: Terminal equipment, with encryption function; Server, with encryption function; An edge gateway, comprising a secure communication module, wherein the edge gateway is used to execute the implementation method of the edge computing gateway with north-south security encryption as described in any one of claims 1 to 5, wherein the edge gateway communicates with the server through the secure communication module, the edge gateway is communicatively connected with the terminal device, and the secure communication module is used to encrypt or decrypt data.

7. The north-south secure encrypted communication system according to claim 6, characterized in that: The secure communication module includes a FUXI-EC chip with encryption and decryption functions.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the implementation method of the edge computing gateway with north-south security encryption as described in any one of claims 1 to 5.

Images