Power grid real asset data protection method and system based on G-AES algorithm

Abstract

A kind of power grid real asset data protection method and system based on G-AES algorithm, method includes the following steps: different types of interactive operation business in power grid real asset business system containerization, obtain multiple different types of business container pool;G-AES data exchange pool is constructed based on G-AES algorithm, multiple different data encryption modes in G-AES data exchange pool are associated with multiple business container pool matching;User operation instruction is obtained by power grid real asset business system;According to user operation instruction, generate calling instruction, and respond to calling instruction and call the target business container pool of corresponding type and associated target data encryption mode;Based on target business container pool, respond to user operation instruction and execute the interactive operation business of corresponding type, and according to target data encryption mode, the data security protection of target business container pool in interactive operation business execution process is carried out.The present application has the effect of safe isolation business system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital information, in particular to a power grid real asset data protection method and system based on a G-AES algorithm. BACKGROUND

[0002] With the increasing scale of digital construction in China, while supporting the rapid development of society, more and more security challenges are also faced. Among them, data security is the core issue of digital construction. First, data attack means is more and more diversified, virus intrusion, Trojan implantation, network extortion, web phishing and other data attack means occur from time to time, causing data loss, tampering and other serious consequences. Second, security vulnerabilities of original systems exist widely, and current digital construction relies on componentized modules. These components are often exposed to security vulnerabilities because of their wide use, especially open source components which are more vulnerable to hacker vulnerabilities, posing a serious threat to system data security. Third, social engineering attacks caused by human factors are difficult to prevent. Commonly seen are violent password cracking to penetrate the system for data tampering, internal personnel data leakage, and data storage device theft, which directly threaten the core data security.

[0003] Data security of the power grid is a crucial task because the power system is one of the key infrastructures related to national economy, national defense and public life, and data security risks such as data leakage, hacker attacks and data misuse exist widely, and enterprises need to further improve data security protection measures. Currently, the data of the power grid real asset business system is saved in the form of plaintext on the file system, database and cloud container, and each business system is isolated by system security partition, making it difficult to effectively protect the data. SUMMARY

[0004] The purpose of the present application is to overcome the defects in the prior art that the data of the power grid real asset business system is saved in the form of plaintext on the file system, database and cloud container, and each business system is isolated by system security partition, and the data security isolation measures are not perfect. A power grid real asset data protection method and system based on a G-AES algorithm are provided.

[0005] In a first aspect, the present application provides a power grid real asset data protection method based on a G-AES algorithm, comprising:

[0006] Containerizing different types of interactive operation business in the power grid real asset business system to obtain a plurality of different types of business container pools;

[0007] constructing a G-AES data exchange pool based on the G-AES algorithm, associating and matching a plurality of different data encryption modes in the G-AES data exchange pool with a plurality of the service container pools, and each of the service container pools is associated and matched with at least one of the data encryption modes;

[0008] obtaining a user operation instruction through the power grid physical asset service system;

[0009] generating a calling instruction according to the user operation instruction, and calling a target service container pool of a corresponding type and an associated target data encryption mode in response to the calling instruction;

[0010] performing the interactive operation service of the corresponding type based on the target service container pool in response to the user operation instruction, and performing data security protection on the target service container pool during the interactive operation service according to the target data encryption mode.

[0011] In some embodiments, the power grid physical asset service system includes an ERP management system, a PMS management system, a TMS management system, a SCADA transaction system, and an ENS analysis system.

[0012] In some embodiments, the interactive operation service includes a database operation service, a file system operation service, a device sensing data interaction service, and a cloud resource data interaction service.

[0013] The containerization of different types of interactive operation services in the power grid physical asset service system to obtain a plurality of different types of service container pools includes the following steps:

[0014] packing the operation software and software configuration in the database operation service into an independent container image to form a database container pool;

[0015] packing the storage service and access service in the file system operation service into an independent container image to form a file system container pool;

[0016] packing the driver program and driver service in the device sensing data interaction service into an independent container image and integrating it into a preset container running environment to form a device sensing container pool;

[0017] packing the application program interface and development tool kit in the cloud resource data interaction service into an independent container image to form a cloud resource container pool.

[0018] In some embodiments, the construction of the G-AES data exchange pool based on the G-AES algorithm, and the association and matching of a plurality of different data encryption modes in the G-AES data exchange pool with a plurality of the service container pools include the following steps:

[0019] constructing a G-AES data exchange pool based on the G-AES algorithm, the G-AES data exchange pool comprising a plurality of different data encryption modes, the data encryption modes comprising an AES-GCM data encryption mode, an AES-CBC data encryption mode, and an AES-CTR data encryption mode;

[0020] associating and matching the database container pool with the AES-GCM data encryption mode;

[0021] associating and matching the file system container pool with the AES-CBC data encryption mode;

[0022] associating and matching both the device awareness container pool and the cloud resource container pool with the AES-CTR data encryption mode.

[0023] In some embodiments, the executing, by the target service container pool, of the corresponding type of the interactive operation service in response to the user operation instruction and the data security protection of the target service container pool during the execution of the interactive operation service according to the target data encryption mode comprises the following steps:

[0024] when the target service container pool is the database container pool, executing, by the database container pool, the database operation service in response to the user operation instruction;

[0025] generating a first encryption request during the execution of the database operation service;

[0026] extracting, from the database operation service, to-be-encrypted database data in response to the first encryption request;

[0027] generating a first initial counter value in combination with a database number of a database to which the to-be-encrypted database data belongs and a request generation time of the first encryption request;

[0028] executing, based on the first initial counter value and by using the AES-GCM data encryption mode, a first data encryption step on the to-be-encrypted database data, to obtain encrypted database data;

[0029] writing the encrypted database data into the database container pool;

[0030] the first data encryption step comprises the following steps:

[0031] Splitting the database data to be encrypted into N database data blocks according to the numerical length of the first initial counter value; generating N-1 first counter values by increasing the first initial counter value by a preset numerical increment; encrypting the first initial counter value and the N-1 first counter values by using the AES algorithm to generate N first key blocks; performing XOR encryption operation on the N database data blocks and the N first key blocks to obtain N database ciphertext data blocks, and merging all the database ciphertext data blocks.

[0032] In some embodiments, the target service container pool performs the corresponding type of interactive operation service in response to the user operation instruction, and performs data security protection on the target service container pool during the execution of the interactive operation service according to the target data encryption mode, including the following steps:

[0033] When the target service container pool is the file system container pool, the database container pool performs the file system operation service in response to the user operation instruction;

[0034] Generating a second encryption request during the execution of the file system operation service;

[0035] Extracting file data to be encrypted from the file system operation service in response to the second encryption request;

[0036] Generating a second initial counter value in combination with the folder number of the folder to which the file data to be encrypted belongs and the request generation time of the second encryption request;

[0037] Performing a second data encryption step on the file data to be encrypted based on the second initial counter value and using the AES-CBC data encryption mode to obtain encrypted file data;

[0038] Writing the encrypted file data into the file system container pool;

[0039] The second data encryption step includes the following steps:

[0040] According to the numerical length of the second initial counter value, the file data to be encrypted is split into M file data blocks; the M file data blocks are sorted according to the generation time, and the first file data block is selected as a target file data block according to the sorting result; the target file data block is subjected to an XOR encryption operation with the second initial counter value to generate a file ciphertext data block; the next file data block is selected as the target file data block according to the sorting result, and the target file data block is subjected to the XOR encryption operation with the newly generated file ciphertext data block, until all the file data blocks are subjected to the XOR encryption operation once, to obtain M file ciphertext data blocks, and all the file ciphertext data blocks are combined.

[0041] In some embodiments, the target service container pool performs the corresponding type of interactive operation service based on the target service container pool in response to the user operation instruction, and performs data security protection on the target service container pool during the execution of the interactive operation service according to the target data encryption mode, including the following steps:

[0042] When the target service container pool is the device-aware container pool or the cloud resource container pool, the device-aware data interaction service or the cloud resource data interaction service is executed based on the device-aware container pool or the cloud resource container pool and in response to the user operation instruction;

[0043] A third encryption request is generated during the execution of the device-aware data interaction service or the cloud resource data interaction service;

[0044] In response to the third encryption request, encrypted device interaction data is extracted from the device-aware data interaction service, or encrypted cloud resource data is extracted from the cloud resource data interaction service;

[0045] If the encrypted device interaction data is extracted, a third initial counter value is generated in combination with the device number of the device to which the encrypted device interaction data belongs and the request generation time of the third encryption request;

[0046] A third data encryption step is performed on the encrypted device interaction data based on the third initial counter value and using the AES-CTR data encryption mode, to obtain encrypted device interaction data, which is written into the device-aware container pool;

[0047] If the encrypted cloud resource data is extracted, a third initial counter value is generated in combination with the server number of the cloud server to which the encrypted cloud resource data belongs and the request generation time of the third encryption request;

[0048] performing the third data encryption step on the to-be-encrypted cloud resource data based on the third initial counter value and using the AES-CTR data encryption mode, to obtain encrypted cloud resource interaction data, and writing the encrypted cloud resource interaction data into the cloud resource container pool;

[0049] The third data encryption step comprises the following steps:

[0050] According to the numerical length of the third initial counter value, the to-be-encrypted device interaction data or the to-be-encrypted cloud resource data is split into L to-be-encrypted data blocks; the third initial counter value is encrypted by using the AES algorithm to generate a key stream block; the key stream block is sequentially subjected to an exclusive or encryption operation with the L to-be-encrypted data blocks to obtain L encrypted data blocks, and all the encrypted data blocks are combined.

[0051] In a second aspect, an embodiment of the present application provides a power grid physical asset data protection system based on a G-AES algorithm, comprising:

[0052] A containerization module is configured to containerize different types of interactive operation businesses in a power grid physical asset business system to obtain a plurality of different types of business container pools.

[0053] An encryption mode construction module is configured to construct a plurality of different data encryption modes based on a G-AES algorithm, associate and match the plurality of data encryption modes with the plurality of business container pools, and associate and match at least one data encryption mode with any one business container pool.

[0054] An instruction acquisition module is configured to acquire a user operation instruction through the power grid physical asset business system.

[0055] A calling module is configured to generate a calling instruction according to the user operation instruction, and call a target business container pool of a corresponding type and an associated target data encryption mode in response to the calling instruction.

[0056] An interactive operation module is configured to execute the interactive operation business of a corresponding type based on the target business container pool in response to the user operation instruction, and perform data security protection on the target business container pool in the process of the interactive operation business according to the target data encryption mode.

[0057] In a third aspect, an embodiment of the present application provides a power grid physical asset data protection device based on a G-AES algorithm, comprising a memory and a processor, wherein the memory is configured to store computer program code and transmit the computer program code to the processor; and the processor is configured to execute any of the above-mentioned power grid physical asset data protection methods based on a G-AES algorithm according to instructions in the computer program code.

[0058] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above power grid physical asset data protection methods based on the G-AES algorithm.

[0059] Compared with the prior art, the present application has the following beneficial effects:

[0060] In the power grid physical asset data protection method based on the G-AES algorithm, the database software and configuration, the storage and access service of the file system, the device perception driver and service, and the cloud resource are packaged into independent container images respectively, and are deployed and managed through the container orchestration technology to obtain the corresponding database container pool, the file system container pool, the device perception container pool, and the cloud resource container pool. Different data encryption modes are constructed based on the G-AES algorithm. The power grid physical asset business system executes the database operation, the file read-write operation, the device perception data interaction, and the cloud resource data interaction according to the user instruction and the corresponding encryption mode. In the interaction operation execution process, the G-AES encryption algorithm is used to customize the personalized encryption mode for different businesses to ensure that the data interaction process of each business can be effectively protected. At the same time, the power grid physical asset business system includes five subsystems, i.e., the ERP management system, the PMS management system, the TMS management system, the SCADA transaction system, and the ENS analysis system. The power grid physical asset business system spans the power grid asset management, the device management, and the operation and maintenance plan management. The database software and configuration of the above multiple subsystems, the file storage and access service, the device perception driver and service, and the cloud resource are packaged into the four independent container pools, i.e., the database access container pool, the file system container pool, the device perception container pool, and the cloud resource container pool, thereby simplifying and optimizing the resource management, deployment, and maintenance, and the data will not be lost due to the shutdown of part of the subsystems. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 is a flowchart of the power grid physical asset data protection method based on the G-AES algorithm provided by the embodiments of the present application.

[0062] Figure 2 is a flowchart of the containerization of the database, the file system, the device perception, and the cloud resource of the power grid physical asset business system respectively provided by the embodiments of the present application.

[0063] Figure 3 is a structural diagram of the power grid physical asset business system, the G-AES data exchange pool, and the container pool provided by the embodiments of the present application.

[0064] Figure 4It is a structural schematic diagram of data security governance provided by an embodiment of the application.

[0065] Figure 5 It is a schematic diagram of a method for bidirectional encryption, decryption and file authorization using G-AES technology provided by an embodiment of the application.

[0066] Figure 6 It is a schematic diagram of a method for encryption using G-AES technology provided by an embodiment of the application.

[0067] Figure 7 It is a structural schematic diagram of a power grid physical asset data protection system based on G-AES algorithm provided by an embodiment of the application.

[0068] Figure 8 It is a structural schematic diagram of a power grid physical asset data protection device based on G-AES algorithm provided by an embodiment of the application. Specific embodiments

[0069] The technical solutions in the embodiments of the application will be clearly described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only some of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by a person of ordinary skill in the art belong to the scope of protection of the application.

[0070] As shown in Figure 1 The power grid physical asset data protection method based on G-AES algorithm disclosed by the application specifically comprises the following steps:

[0071] S101, containerize different types of interactive operation services in a power grid physical asset business system to obtain a plurality of different types of service container pools.

[0072] S102, construct a G-AES data exchange pool based on a G-AES algorithm, and associate and match a plurality of different data encryption modes in the G-AES data exchange pool with a plurality of the service container pools. Any one of the service container pools is associated and matched with at least one of the data encryption modes.

[0073] S103, acquire a user operation instruction through the power grid physical asset business system. The user operation instruction is acquired through a preset user interface (such as a Web interface, an API interface, etc.).

[0074] S104, generate a call instruction according to the user operation instruction, and call the target business container pool of the corresponding type and the associated target data encryption mode in response to the call instruction. Wherein, the user's operation instruction is received through the user interface (such as Web interface, API interface, mobile application, etc.), and the user operation instruction is parsed. This step needs a parser to identify the type of user instruction, such as database operation, file operation, device interaction or cloud resource interaction, etc. Then generate standardized call instruction according to the parsing result, these call instructions are used inside the system, usually predefined string or identifier. The call instruction should be clear, unique, and can be directly mapped to specific business container pool and encryption mode.

[0075] According to the call instruction, the corresponding business container pool is selected, and the business scheduling mechanism (such as routing table, service registry center, etc.) is used to manage and select the appropriate business container pool. At the same time, according to the type of business container pool, select the encryption mode matched with the business container pool from the G-AES data exchange pool, each business container pool is associated with at least one data encryption mode. The selection of encryption mode should be based on the security requirements of business type. For example, database operation may need high security AES-GCM mode, and file operation may use AES-CBC mode.

[0076] Through the above steps, the call instruction can be generated according to the user operation instruction, and the target business container pool of the corresponding type and the associated target data encryption mode are called in response to the call instruction. The whole process needs a complete system architecture, including user interface layer, instruction parsing layer, business scheduling layer, encryption service layer and business container pool, each layer cooperates closely to ensure the efficiency and security of the system.

[0077] S105, based on the target business container pool, execute the corresponding type of interactive operation business in response to the user operation instruction, and perform data security protection on the target business container pool during the execution of the interactive operation business according to the corresponding target data encryption mode.

[0078] Through the above steps, first, identify different types of interactive operation business in power grid physical asset business system, including database operation, file read and write, device data interaction and cloud resource interaction, etc. Use containerization technology (such as Docker) to encapsulate each type of business into independent container, these containers contain business logic, dependent library and running environment. Organize the same type of business container into a business container pool, each business container pool can contain multiple instances to improve the availability and scalability of the system. Through the way of containerization, each business system can be effectively isolated to prevent data loss due to the shutdown of part of the subsystem.

[0079] Secondly, by using the G-AES data exchange pool, the real asset business system can be isolated from external systems, and based on the G-AES encryption algorithm, the data is stored in ciphertext form, so even if the external system is attacked, the data security of the real asset is not affected.

[0080] Finally, when accessing the content of the power grid real asset business system, the power grid real asset business system establishes a connection with the container pool through the G-AES data exchange pool and carries out data interaction, so that in the process of system operation, the calling instruction can be generated according to the user operation instruction, and the corresponding type of target business container pool and the associated target data encryption mode can be called in response to the calling instruction. This design ensures the flexibility and security of the system, and can effectively handle various interactive operation businesses in the power grid real asset business system, thereby protecting the security of data in real time, preventing unauthorized access and data leakage, tampering, loss, etc.

[0081] Therefore, the power grid real asset business system provided by the embodiment can solve the problem in the related art that it is difficult to protect data without closing the system, and ensure the data security of the system in each stage of the data life cycle.

[0082] In some embodiments, the power grid real asset business system can include an ERP management system, a PMS management system, a TMS management system, a SCADA transaction system, an EMS analysis system, and the like. Among them, the ERP management system refers to the power enterprise resource planning system, which integrates advanced information technology to comprehensively integrate and optimize the management of various resources of the power enterprise, including but not limited to material resources (such as equipment, materials, energy, etc.), human resources, financial resources, and information resources; the PMS management system refers to the power asset and production management system, which is mainly used for the management and maintenance of equipment and facilities in the power industry to ensure the safe and stable operation of the power grid; the TMS management system refers to the system for managing and monitoring the power communication network, which is mainly used for managing and maintaining the communication infrastructure of the power system to ensure the reliable transmission of power business data and the stable operation of communication services; the SCADA transaction system refers to an automatic system for remote monitoring and data acquisition, which is mainly used for real-time acquisition and control of various parameters and device states in the operation of the power grid; and the EMS analysis system refers to the energy management and analysis system, which is used to realize energy management and data analysis of the power system to improve the energy efficiency and operation efficiency of the power system.

[0083] In the embodiment, the names, system types, data production methods, and data maintenance units of the subsystems of the power grid real asset business system are as shown in the following table:

[0084]

[0085]

[0086] It should be noted that the power grid physical asset business system provided in the embodiment is not limited to only including the ERP management system, the PMS management system, the TMS management system, the SCADA transaction system, and the ENS analysis system subsystem mentioned in the above embodiment, but can also include other systems related to the operation and maintenance of a power enterprise, such as a power distribution management system, a metering and billing system, and the like, which are not specifically limited here.

[0087] A power grid enterprise is an asset-intensive and technology-intensive enterprise, and the proportion of physical assets represented by power grid equipment is more than 80%, the equipment scale is huge and the types are various, and the construction and operation and maintenance management are complex. At present, the power grid enterprise has established multiple information systems to assist in equipment asset management, including the above-mentioned ERP management system, PMS management system, TMS management system, SCADA transaction system, and ENS analysis system subsystem, and has saved a large amount of basic data of equipment assets, including:

[0088] (1) Equipment account, including data protection and application of equipment registration, asset classification, asset coding, asset attribute, asset state information. Record the basic information of each physical asset, including name, model, manufacturer, purchase date, purchase price, etc. Classify assets for better organization and management. Assign a unique identifier or code for easy identification and retrieval of assets. Record the attributes of assets, such as size, weight, capacity, etc. Track the current state of assets, including in stock, on loan, maintenance, etc.

[0089] (2) Geographic information, including data protection and application of geographic location records, geographic analysis, and geographic visualization data. Associate physical assets with geographic locations, use geographic information systems (GIS) or GPS to record the precise location of assets. Use geographic information for spatial analysis, such as determining the best asset layout, route planning, etc. Visualize assets on a map to better understand and manage their distribution and relationships.

[0090] (3) Operation and maintenance, including maintenance planning, fault reporting, maintenance history, and data protection and application of materials and spare parts management. Develop and manage maintenance plans, including regular maintenance, emergency repairs, and preventive maintenance. Record asset failures and issues and track repair progress. Maintenance history records include information such as repair date, repair personnel, repair cost, etc. Manage inventory of spare parts, materials, and spare parts required for maintenance.

[0091] (4) Identification information, including physical ID, RFID tag, identification information association, data protection and application of identification scanning. Add a unique identification to each asset using technologies such as tags, QR codes or RFID. Associate asset identification information with equipment inventory and geographic information to enhance the accuracy and traceability of asset management. Use mobile devices or scanning devices to scan asset identification to obtain detailed information about the asset.

[0092] (5) Operation and maintenance work, including data protection and application of work order management, task tracking, operation and maintenance plan, resource allocation. Create and distribute operation and maintenance work orders, specify tasks, responsible persons and deadlines. Track the progress of operation and maintenance work and record task completion. Develop planned operation and maintenance work to ensure the reliability and performance of equipment. Allocate the required manpower, equipment and materials to perform operation and maintenance work.

[0093] (6) Analysis and evaluation, performance analysis, cost analysis, decision support, risk assessment, data protection and application. Analyze the performance indicators of assets, such as utilization rate, efficiency and availability. Calculate the total cost of ownership of assets, including purchase, maintenance and operation costs. Provide data and reports to help management make decisions on maintenance, upgrade, replacement or disposal of assets.

[0094] In related technologies, the main data security risks of power grid physical asset business systems are as follows:

[0095] (1) Data theft: Data theft refers to unauthorized or malicious access, copying, transmission or use of sensitive data. Data theft can lead to issues such as enterprise privacy leaks, confidential information exposure, economic losses and reputation damage. Physical asset data is related to the most core asset information of the power grid, especially the technical specifications and geographic location of power transmission and transformation equipment. Once the data is stolen, the entire power grid will be exposed to security risks, threatening the physical security of the power grid.

[0096] (2) Data tampering: Data tampering refers to malicious, unauthorized modification or tampering of data to gain undue advantage, deceive others or harm the system. Data tampering can occur in various contexts, including computer security, database management, network communication and information transmission. Physical asset data tampering can cause power system instability and disrupt reliable power supply. Tampering will cause important asset information to be lost, posing a serious threat to the life and safety of power equipment.

[0097] (3) Information leakage: Information leakage refers to the disclosure of sensitive, private, or confidential information to unauthorized individuals, organizations, or the public without authorization or consent. Information leakage of physical assets may include operation and maintenance guidelines, emergency plans, and operating procedures. If these information falls into the hands of malicious people, they can use these information to interfere with the normal operation of the power system, or even cause accidents.

[0098] In order to adapt to the requirements of modern power grid physical asset data security, the present application is based on the governance concepts of classification and grading, role authorization, scene security, and operation optimization, and provides a complete data security solution for structured data and unstructured data application scenarios for physical asset business systems. The core of this solution is the G-AES algorithm, which can meet the needs of data security protection, sensitive data management, data security flow, and legal use. At the same time, by introducing the design of data exchange pool and container pool, the data security problem of the system in each stage of the data life cycle is solved.

[0099] In order to effectively isolate each business system and prevent data from being lost due to system shutdown, containerization technology can be used. Specifically, the interactive operation business includes database operation business, file system operation business, device perception data interaction business, and cloud resource data interaction business. Step S101 containerizes different types of interactive operation businesses in the power grid physical asset business system to obtain multiple different types of business container pools, which specifically include the following steps:

[0100] S201, packing the operation software and software configuration in the database operation business into an independent container image to form a database container pool.

[0101] In this embodiment, container technology such as Docker can be used to pack the operation software and software configuration in the database operation business into an independent container image. This way, the database can be quickly deployed, upgraded, and migrated, and different databases are isolated from each other, improving the flexibility and scalability of the system.

[0102] Docker is an open-source containerization platform that helps developers package applications and their dependencies into independent containers, enabling fast deployment and portability. The core components of Docker include Docker Engine, Docker Image, Docker Container, and Docker Repository. Docker provides a convenient and efficient application packaging and deployment method through containerization technology, allowing developers to more easily develop, test, and deploy applications.

[0103] S202, packing the storage service and access service in the file system operation business into an independent container image to form a file system container pool.

[0104] In this embodiment, by packaging the storage service and access service in the file system operation business into independent container images, flexible management and isolation of the file system can be achieved, and the security and availability of file data can be improved. At the same time, the file data can be stored persistently through the container volume technology, realizing the persistence of data.

[0105] S203, packaging the driver and driver service in the device perception data interaction business into an independent container image, and integrating it into a preset container running environment to form a device perception container pool.

[0106] In this embodiment, by packaging the driver and driver service in the device perception data interaction business into an independent container image, flexible management and isolation of the file system can be achieved, and the security and availability of file data can be improved. At the same time, the file data can be stored persistently through the container volume technology, realizing the persistence of data.

[0107] S204, packaging the application program interface and development toolkit in the cloud resource data interaction business into an independent container image to form a cloud resource container pool.

[0108] In this embodiment, a container management platform such as Kubernetes can be used to package cloud resources such as virtual machines, container instances, etc. into container images, and deploy and manage them through container orchestration technology. In this way, flexible allocation and management of cloud resources can be achieved, improving the flexibility and availability of the system.

[0109] Kubernetes (often referred to as K8s) is an open source container orchestration platform that is used to automatically deploy, schedule and manage containerized applications. The goal of Kubernetes is to simplify the deployment and management of containerized applications, providing high availability, elastic expansion, automatic scaling and other functions. Kubernetes provides a rich command line tool and management interface for managing and monitoring resources in the cluster. It can run in public clouds, private clouds and hybrid cloud environments, providing a highly scalable architecture suitable for large-scale application deployment. By using Kubernetes, developers can more easily manage and run containerized applications, improving the reliability, scalability and maintainability of the application.

[0110] In summary, by containerizing the interactive operation services including database operation services, file system operation services, device awareness data interaction services, and cloud resource data interaction services, the corresponding container pool is obtained. Through the containerization method, the isolation and management of resources are realized, the various business systems are effectively isolated, and the data loss due to the shutdown of part of the subsystems is prevented. At the same time, the containerization technology can provide a lightweight, portable, and scalable resource environment, simplify deployment and management operations, and improve the efficiency and security of the system. Moreover, the container pool can also realize the elastic scheduling, automatic expansion, and fault recovery of resources, and improve the reliability and availability of the real asset business system.

[0111] In some embodiments, a G-AES data exchange pool is established, which can isolate the real asset business system from external systems, including data encryption, decryption, and file authorization.

[0112] Specifically, the G-AES data exchange pool can encrypt, decrypt, and authorize files for sensitive data in the real asset business system, wherein the sensitive data at least includes one of the following: data in the database, content in the file. The G-AES data exchange pool can use different encryption modes of the G-AES algorithm for bidirectional encryption, decryption, and file authorization.

[0113] The G-AES data exchange pool can also realize the following functions:

[0114] Access control, through the access control mechanism to protect the access rights of data, so that the external system needs to pass through the identity authentication and authorization to access the data of the real asset business system. For example, identity authentication mechanisms such as username and password, API key, etc. can be used to verify the identity of the external system; at the same time, access strategies can be set to control the read and write permissions of the external system to the data.

[0115] Secure communication, in the process of realizing the data exchange between the real asset business system and the external system, a secure communication protocol is adopted. For example, the secure communication protocol can be HTTPS, RPC, etc. Through the encrypted communication protocol, the confidentiality and integrity of the data in the transmission process are ensured, and the data is prevented from being tampered with or stolen.

[0116] Data isolation, using containerization technology to isolate the operation of different components and services of the real asset business system and the external system. For example, the real asset business system and the external system can be deployed in different network environments to ensure their physical and logical isolation to improve security and stability.

[0117] Monitoring and auditing: monitoring the data exchange process between the real asset business system and the external system, recording the access logs and behavior data of the users to audit the data exchange behavior.

[0118] In summary, based on the G-AES data exchange pool, through data encryption, decryption, file authorization, access control, secure communication, data isolation, and monitoring and auditing, the isolation of the physical asset business system and the external system is realized. These measures can protect the confidentiality, integrity and availability of data, and ensure the security of data exchange.

[0119] In some embodiments, the G-AES data exchange pool includes a database link unit, a file system access unit, a device awareness unit, and a cloud resource unit. As shown in Figure 3 Figure 3 is a structural schematic diagram of the power grid physical asset business system, the G-AES data exchange pool, and the container pool provided by the embodiments of the present application. When the target business container pool is the database container pool, step S105 specifically includes the following steps:

[0120] Performing the database operation business in response to the user operation instruction based on the database container pool;

[0121] Generating a first encryption request during the execution of the database operation business;

[0122] Extracting encrypted database data from the database operation business in response to the first encryption request;

[0123] Generating a first initial counter value based on the database number of the database to which the encrypted database data belongs and the request generation time of the first encryption request;

[0124] Performing a first data encryption step on the encrypted database data based on the first initial counter value and using the AES-GCM data encryption mode, to obtain encrypted database data;

[0125] Writing the encrypted database data to the database container pool;

[0126] The first data encryption step includes the following steps:

[0127] According to the numerical length of the first initial counter value, the encrypted database data is split into N database data blocks; N-1 first counter values are generated based on the first initial counter value and according to a preset numerical increment; the first initial counter value and N-1 first counter values are encrypted by the AES algorithm to generate N first key blocks; N database data blocks and N first key blocks are subjected to XOR encryption operation to obtain N database ciphertext data blocks, and all database ciphertext data blocks are combined.

[0128] ​In this embodiment, the power grid physical asset business system establishes a connection with the database container pool through the database link unit and performs data interaction. The power grid physical asset business system establishes a connection with the database container pool through the database link unit and performs data interaction, including the following steps:

[0129] Configure the database link unit: In the power grid physical asset business system, configure the parameters of the database link unit, including the connection address of the database, the username, the password, etc. These parameters are used to establish a connection with the database container pool.

[0130] Establish a connection: Use the interface or method provided by the database link unit to establish a connection with the database container pool by specifying the parameters. This can be a common connection, or multiple connections can be created as needed.

[0131] Perform data operations: After establishing a connection with the database container pool, the power grid physical asset business system can use the interface or method provided by the database link unit to perform database operations, such as querying, inserting, modifying, deleting, etc.

[0132] For example: The power grid physical asset business system needs to query the relevant information of a certain device, which can be set up according to the following steps:

[0133] Configure the database link unit: Add the configuration parameters of the database link unit in the configuration file of the power grid physical asset business system, such as the database connection address "local host:3306", the username "user", and the password "password".

[0134] Establish a connection: In the code of the power grid physical asset business system, use the method provided by the database link unit to establish a connection with the database container pool. For example, call the function connect(database_address, username, password) to establish a connection.

[0135] Perform a query operation: After establishing a connection with the database container pool, the power grid physical asset business system can use the interface provided by the database link unit to perform a query operation. For example, call the function: query("SELECT*FROMdevices WHEREid='123'") to query the device information of the device with the device number "123".

[0136] Through the above settings, the power grid physical asset business system can establish a connection with the database container pool through the database link unit and perform data query operations.

[0137] In this embodiment, the first data encryption step corresponds to the data decryption process as follows:

[0138] Read encrypted data: The grid physical asset business system calls the database link unit to read encrypted data from the database container pool.

[0139] Decrypt request: The grid physical asset business system sends a decryption request to the database link unit.

[0140] Key acquisition: The database link unit acquires the key required for decryption from the key management service.

[0141] Data decryption: The encrypted data is decrypted using the G-AES algorithm and the acquired key to restore the original data.

[0142] Data processing: The grid physical asset business system processes the decrypted data as needed. For example, the decrypted data is queried, inserted, modified, deleted, etc., to serve as data that needs to be encrypted again.

[0143] In this embodiment, the database operation interface is set as follows:

[0144] Interface design: In response to preset parameters, a database operation interface is established, which provides encryption and decryption functions, as well as traditional database operations (such as query, insertion, modification, deletion, etc.).

[0145] Parameter verification: Before performing database operations, the interface verifies the legality of the incoming data and requests.

[0146] Call encryption / decryption: According to the operation type (write or read), the interface calls the corresponding encryption or decryption service.

[0147] In some embodiments, when the target business container pool is the file system container pool, step S105 specifically includes the following steps:

[0148] Performing the file system operation business based on the database container pool in response to the user operation instruction;

[0149] Generating a second encryption request during the execution of the file system operation business;

[0150] Extracting encrypted file data from the file system operation business in response to the second encryption request;

[0151] Generating a second initial counter value in combination with the folder number of the folder to which the encrypted file data belongs and the request generation time of the second encryption request;

[0152] performing a second data encryption step on the to-be-encrypted file data based on the second initial counter value and using the AES-CBC data encryption mode, to obtain encrypted file data;

[0153] writing the encrypted file data into the file system container pool;

[0154] The second data encryption step comprises the following steps:

[0155] According to the numerical length of the second initial counter value, the to-be-encrypted file data is split into M file data blocks; the M file data blocks are sorted according to the generation time, and the first file data block is selected as a target file data block according to the sorting result; the target file data block is subjected to an exclusive or encryption operation with the second initial counter value, to generate a file ciphertext data block; the next file data block is selected as the target file data block according to the sorting result, and the target file data block is subjected to the exclusive or encryption operation with the newly generated file ciphertext data block, until all the file data blocks have been subjected to the exclusive or encryption operation once, to obtain M file ciphertext data blocks, and all the file ciphertext data blocks are combined.

[0156] In the embodiment, the power grid physical asset business system is connected with the file system container pool through the file system access unit, and data interaction is performed. The power grid physical asset business system is connected with the file system container pool through the file system access unit, and data interaction is performed, comprising the following steps:

[0157] Configuring the file system access unit: in response to the input parameters, the file system access parameters are configured in the power grid physical asset business system, including the type, path, access permission, creation of file, writing of data, reading of file content, and the like of the file system. These parameters are used to establish the connection with the file system container pool.

[0158] Configuring the file system access parameters: in response to the input parameters, the file system access parameters are configured in the power grid physical asset business system.

[0159] Establishing the connection: based on the configured file system access parameters, the connection between the power grid physical asset business system and the file system container pool is established. This can be a common connection, or multiple connections can be created as needed. For example, the file system access unit is used as a medium, and the interface provided by the file system access unit is used as a bridge, and through the interface, the data transmission between the power grid physical asset business system and the file system container pool is realized.

[0160] Perform data read / write operations: After establishing a connection with the file system container pool, the power grid physical asset business system can use the interfaces or methods provided by the file system access unit to perform file read / write operations, such as creating files, writing data, reading file contents, etc.

[0161] For example: The power grid physical asset business system needs to store the relevant information of the device into the file system and then perform read operations. The following steps can be followed to set up:

[0162] Configure the file system access unit: Add configuration parameters of the file system access unit in the configuration file of the power grid physical asset business system, such as file system type "local", file path " / path / to / files", and access permissions read / write.

[0163] Establish a connection: In the code of the power grid physical asset business system, use the methods provided by the file system access unit to establish a connection with the file system container pool. For example, call the function: connect(file_system_type, file_path, access_permissions) to establish a connection.

[0164] Perform data read / write operations: After establishing a connection with the file system container pool, the power grid physical asset business system can use the interfaces provided by the file system access unit to perform data read / write operations. For example, call the function: write_file("device_info.txt", "Device information") to write device information into the file, and call the function read_file("device_info.txt") to read the contents of the file.

[0165] Through the above settings, the power grid physical asset business system can establish a connection with the file system container pool through the file system access unit and perform data storage and read operations.

[0166] In this embodiment, the data decryption process corresponding to the second data encryption step is as follows:

[0167] Read encrypted file: Through the file system access unit based on the power grid physical asset business system, read the encrypted file data from the file system container pool.

[0168] Decryption request: The power grid physical asset business system sends a decryption request to the file system access unit.

[0169] Key acquisition: The file system access unit obtains the required key for decryption from the key management service.

[0170] Data decryption: decrypt the encrypted file data using the G-AES algorithm and the obtained key, restoring the original data.

[0171] Data processing: subsequent processing of the decrypted data by the power grid physical asset business system based on pre-set parameters. For example, for the decrypted original data, the power grid physical asset business system redefines the type, path, access rights, creation of the file system, writing of data, reading of file content, etc., so as to redefine the data again as data to be encrypted.

[0172] In this embodiment, the design of the file system access unit interface is as follows:

[0173] Interface definition: define the interface of the file system access unit in response to the input parameters, including encryption, decryption, and file creation, writing, reading, etc.

[0174] Parameter verification: use the interface to verify the incoming parameters before performing the operation to ensure security and data accuracy.

[0175] Log recording: record the logs of all file operations, including encryption and decryption operations, for auditing and monitoring.

[0176] In some embodiments, when the target business container pool is the device-aware container pool or the cloud resource container pool, step S105 specifically includes the following steps:

[0177] Performing the device-aware data interaction business or the cloud resource data interaction business based on the device-aware container pool or the cloud resource container pool and in response to the user operation instruction;

[0178] Generating a third encryption request during the execution of the device-aware data interaction business or the cloud resource data interaction business;

[0179] Extracting encrypted device interaction data from the device-aware data interaction business or encrypted cloud resource data from the cloud resource data interaction business in response to the third encryption request;

[0180] If the encrypted device interaction data is extracted, a third initial counter value is generated in combination with the device number of the device to which the encrypted device interaction data belongs and the request generation time of the third encryption request;

[0181] Performing a third data encryption step on the encrypted device interaction data based on the third initial counter value and using the AES-CTR data encryption mode to obtain encrypted device interaction data, and writing the encrypted device interaction data to the device-aware container pool;

[0182] If the to-be-encrypted cloud resource data is extracted, a third initial counter value is generated in combination with a server number of a cloud server to which the to-be-encrypted cloud resource data belongs and a request generation time of the third encryption request;

[0183] The third data encryption step is performed on the to-be-encrypted cloud resource data based on the third initial counter value and by using the AES-CTR data encryption mode, to obtain encrypted cloud resource interaction data, and the encrypted cloud resource interaction data is written into the cloud resource container pool;

[0184] The third data encryption step includes the following steps:

[0185] The to-be-encrypted device interaction data or the to-be-encrypted cloud resource data is split into L to-be-encrypted data blocks according to a numerical length of the third initial counter value; the third initial counter value is encrypted by using the AES algorithm to generate a key stream block; the key stream block is sequentially subjected to an exclusive or encryption operation with the L to-be-encrypted data blocks to obtain L encrypted data blocks, and all the encrypted data blocks are combined.

[0186] Traditional initial counter value generation methods usually rely on global counters or simple increment patterns, which may be effective in single systems but can easily lead to conflicts, performance bottlenecks, and management difficulties in complex multi-service environments. In this embodiment, by combining specific service-related numbers (such as database numbers, folder numbers, device numbers, server numbers) to generate initial counter values, it is more suitable for systems that require high reliability and high performance. First, generating initial counter values in combination with service numbers can ensure uniqueness and avoid conflicts, as each service operation has its unique number, which means that the generated counter values are unique between different service operations, avoiding the problem of duplication and overlap. This uniqueness greatly reduces the risk of counter conflicts and improves the stability of the system. Second, this method provides good service isolation, as each service operation has its own independent counter value generation method, ensuring that counter values from different service operations do not interfere with each other. This isolation not only improves the stability and reliability of the system, but also simplifies management and maintenance, for example, if a service operation fails, it can be quickly located to the specific service number and operation type, facilitating troubleshooting and system maintenance. Third, generating counter values in combination with service numbers also has strong traceability, through service numbers, it is easy to track and manage the source of counter values, if a counter value is abnormal, it can be quickly located to the specific service number and operation type, facilitating troubleshooting and system maintenance, which is particularly important for complex system management and maintenance. In summary, this counter value generation method is particularly suitable for complex multi-service operation scenarios, and generating initial counter values in combination with specific service-related numbers enhances uniqueness, isolation, traceability, scalability, and distributed support, significantly improving the stability, reliability, and performance of the system.

[0187] In this embodiment, if the target service container pool is a device-aware container pool, the power grid physical asset business system establishes a connection with the device-aware container pool through the device-aware unit and performs data interaction. The power grid physical asset business system establishes a connection with the device-aware container pool through the device-aware unit and performs data interaction, including the following steps:

[0188] Configure the device-aware unit: In the power grid physical asset business system, configure the parameters of the device-aware unit, including device type, communication protocol, connection method, etc. These parameters are used to establish a connection with the device-aware container pool.

[0189] Establish a connection: Use the functions or interfaces provided by the device-aware unit to establish a connection with the device-aware container pool according to the configured parameters. This may involve using device ID or network address to identify the device. The connection method can be direct connection (such as through a physical interface) or indirect connection (such as through a network protocol).

[0190] Data interaction operation: After establishing a connection with the device perception container pool, the grid physical asset business system can use the interface or method provided by the device perception unit to perform data interaction operations, such as sending instructions, receiving sensor data, etc.

[0191] For example: The grid physical asset business system needs to interact with the temperature sensor device and obtain real-time temperature data. The following steps can be taken to set up:

[0192] Configure the device perception unit: Add configuration parameters of the device perception unit in the configuration file of the grid physical asset business system, such as device type "Temperature Sensor", communication protocol "Modbus TCP", and connection method Ethernet. In addition, you can also specify the IP address and port of the device, etc.

[0193] Establish a connection: In the code of the grid physical asset business system, use the functions or interfaces provided by the device perception unit to establish a connection with the device perception container pool according to the configured parameters. For example, call the function: connect(device_type, communication_protocol, connection_params) to perform the connection operation.

[0194] Data interaction operation: After establishing a connection with the device perception container pool, the grid physical asset business system can use the interface provided by the device perception unit to perform data interaction operations. For example, call the function: send_command("ReadTemperature", device_id) to send the instruction to read the temperature to the device, and call the function: get_sensor_data(device_id, "Temperature") to obtain the real-time data of the temperature sensor.

[0195] Through the above settings, the grid physical asset business system can establish a connection with the device perception container pool through the device perception unit and perform data interaction operations.

[0196] In this embodiment, in order to realize the connection between the grid physical asset business system and the device perception container pool through the device perception unit, and the data interaction, the following methods can be used:

[0197] Parameter configuration: In response to the input parameters, configure the device perception parameters in the grid physical asset business system, including device type, communication protocol, connection method, etc., to obtain the encryption request.

[0198] Connection establishment: Based on device perception parameters, establish a connection between the power grid physical asset business system and the device perception container pool. For example, use the device perception unit as a medium, use the interface provided by the device perception unit as a bridge, and transmit device perception parameters between the power grid physical asset business system and the device perception container pool through the interface.

[0199] Data reception: Through the power grid physical asset business system, receive monitoring data from sensors based on device perception units.

[0200] Data preprocessing: Perform necessary preprocessing on the received raw data, such as formatting, denoising, etc.

[0201] In this embodiment, the third data encryption step corresponds to the following data decryption process:

[0202] Decryption request: The power grid physical asset business system sends a decryption request to the device perception unit.

[0203] Key acquisition: Through the device perception unit, acquire the required key for decryption from the key management service.

[0204] Data decryption: Use the G-AES algorithm and the acquired key to decrypt the encrypted data and restore the original device perception data. Alternatively, for the decrypted original device perception data, modify the device type, communication protocol, connection method, etc. of the decrypted original device perception data through the power grid physical asset business system to re-use the modified device perception data as encrypted data.

[0205] In this embodiment, the device perception unit interface design is as follows:

[0206] Interface definition: Based on preset parameters, define the interface of the device perception unit, including data encryption, decryption, and device perception data reception, transmission, etc.

[0207] Parameter verification: Through the interface, verify the incoming parameters before performing operations to ensure security and data correctness.

[0208] In this embodiment, if the target business container pool is a cloud resource container pool, the power grid physical asset business system establishes a connection with the cloud resource container pool through the cloud resource unit and performs data interaction. The power grid physical asset business system establishes a connection with the cloud resource container pool through the cloud resource unit and performs data interaction, including the following steps:

[0209] Configure the cloud resource unit: In the power grid physical asset business system, configure the parameters of the cloud resource unit, including cloud platform information, authorization credentials, network settings, etc. These parameters are used to establish a connection with the cloud resource container pool.

[0210] Connection establishment: Use the functions or interfaces provided by the cloud resource unit to establish a connection with the cloud resource container pool according to the configured parameters. This may involve using authentication information such as access tokens, authentication keys, etc. The connection can be made through API calls based on the cloud platform, message queues, WebSockets, etc.

[0211] Data interaction operation: After establishing a connection with the cloud resource container pool, the power grid physical asset business system can use the interfaces or methods provided by the cloud resource unit to perform data interaction operations, such as uploading data, downloading data, calling cloud services, etc.

[0212] For example: The power grid physical asset business system needs to upload sensor data to the database on the cloud platform and can extract data from the database on the cloud platform. The following steps can be followed to set up:

[0213] Configure the cloud resource unit: Add configuration parameters of the cloud resource unit in the configuration file of the power grid physical asset business system, such as the cloud platform being "AWS", the authorization credentials being access keys and passwords, and the network configuration being to use the HTTPS protocol. In addition, you can also specify the database name and table name on the cloud platform, etc.

[0214] Connection establishment: In the code of the power grid physical asset business system, use the functions or interfaces provided by the cloud resource unit to establish a connection with the cloud resource container pool according to the configured parameters. For example, call the function: connect(cloud_platform, access_key, secret_key, endpoint) to perform the connection operation.

[0215] Data interaction operation: After establishing a connection with the cloud resource container pool, the power grid physical asset business system can use the interfaces provided by the cloud resource unit to perform data interaction operations. For example, call the function: upload_data(sensor_data, database, table) to upload sensor data to the specified database and data table on the cloud platform, and call the function: query_data(database, table, query_condition) to extract data from the database on the cloud platform according to the condition.

[0216] Through the above settings, the power grid physical asset business system can establish a connection with the cloud resource container pool through the cloud resource unit and perform data interaction operations.

[0217] In this embodiment, in order to realize the connection between the power grid physical asset business system and the cloud resource container pool through the cloud resource unit, the following methods can be used:

[0218] Parameter configuration: In response to input parameters, configure cloud resource parameters in the power grid physical asset business system, including cloud platform information, authorization credentials, network settings, etc.

[0219] Connection establishment: According to the configured cloud resource parameters, establish the connection between the power grid physical asset business system and the cloud resource container pool. For example, use the cloud resource unit as a medium, use the interface provided by the cloud resource unit as a bridge, and transmit the cloud resource parameters between the power grid physical asset business system and the cloud resource container pool through the interface.

[0220] Data preparation: In response to input parameters, confirm the data that needs to be uploaded to the cloud or downloaded from the cloud or call cloud services to obtain encryption requests.

[0221] Upload data: Use the interface provided by the cloud resource unit to upload data to the cloud platform.

[0222] Download data: Use the interface provided by the cloud resource unit to download data from the cloud platform.

[0223] Call cloud services: Call various services on the cloud platform through the cloud resource unit.

[0224] In this embodiment, the third data encryption step corresponds to the data decryption process as follows:

[0225] Decryption request: After downloading the data, the power grid physical resource business system sends a decryption request to the cloud resource unit.

[0226] Data decryption: Use the G-AES algorithm and the obtained key to decrypt the encrypted data to restore the original data. Alternatively, for the original data, modify the cloud platform information, authorization credentials, network settings, uploaded data, downloaded data, and called cloud services of the original data through the power grid physical resource business system, and use the modified data as the data to be encrypted again.

[0227] In this embodiment, the cloud resource unit can reconstruct the API and SDK as follows:

[0228] API reconstruction: Reconstruct the API provided by the cloud resource unit to support encryption and decryption operations, ensuring that all data transmitted through the API is encrypted.

[0229] SDK reconstruction: Reconstruct the SDK provided by the cloud resource unit, integrate encryption and decryption functions, and enable developers to easily encrypt and decrypt data when using the SDK.

[0230] In some embodiments, the G-AES data exchange pool is a system for securely exchanging data in a network. It is based on the G-AES encryption algorithm, which is a variant of the Advanced Encryption Standard (AES). The G-AES algorithm combines data encryption and data signature algorithms organically, and can simultaneously realize data encryption and data compression functions. The data signature process ensures data integrity and reduces the workload of the data encryption process. Therefore, the algorithm includes data encryption and signature parts. The data encryption part is used to realize the conversion process from plaintext to ciphertext, and the signature part is before the data encryption part, which hashes the plaintext data. Both parts have their inverse algorithms, which can restore the ciphertext to plaintext.

[0231] The G-AES data exchange pool encrypts and decrypts data using keys and uses secure communication protocols to protect the confidentiality, integrity, and availability of data during transmission. It can be used to protect sensitive information such as personal identity information and financial transaction data, and encrypt these information during data exchange to prevent unauthorized access or tampering.

[0232] As shown in Figure 4 , Figure 4 is a structure diagram of data security governance provided by an embodiment of the application. The G-AES data exchange pool plays a key protection role in network communication and ensures the secure transmission of data. It can be applied to various scenarios, including enterprise internal communication, e-commerce transactions, and cloud computing data transmission. By using the G-AES data exchange pool, users can exchange sensitive data with confidence while protecting the confidentiality and integrity of the data.

[0233] Specifically, to ensure data security, for containerized databases and containerized file systems: when storing data, the G-AES algorithm is applied to the containerized database and file system to encrypt sensitive data. When data is accessed, the G-AES algorithm is used to decrypt the data for business processing in the real asset business system.

[0234] For containerized device perception and containerized cloud resources: the G-AES algorithm performs encryption and decryption calculations on device perception and cloud resources in the container to ensure the security of data during interaction with device perception and cloud resources.

[0235] Based on the G-AES algorithm, the G-AES data exchange pool securely isolates the business system from external systems by containerizing databases, files, device perception, and cloud resources for access. In this scheme, all data is saved in ciphertext in the system.

[0236] In another embodiment, the G-AES data exchange pool is based on G-AES technology for bidirectional encryption, decryption, file authorization, Figure 5 is a schematic diagram of the method for bidirectional encryption, decryption, file authorization provided by the embodiment of the application using G-AES technology, Figure 6 is a schematic diagram of the method for encryption provided by the embodiment of the application using G-AES technology, as shown in Figure 5 、 Figure 6 G-AES uses the DES structure and the Rijndael algorithm as the core, DES is a block cipher algorithm, which uses a 56-bit key to encrypt and decrypt data blocks in units of 64 bits, and the length of the ciphertext and the plaintext is the same, both of which are 64 bits. DES is a symmetric cipher system, and the same key is used for encryption and decryption. At the same time, DES also uses the same algorithm for encryption and decryption. The security of DES depends on the key. Each different transformation in G-AES operates on an intermediate result called a state. The state is an intermediate cryptographic result. It can be represented by a matrix of bytes, which has 4 rows and a column number of Nb. Nb is equal to the block length divided by 32. The block length specified in the G-AES specification is 128 bits, and the Rijndael algorithm supported by G-AES supports blocks of lengths of 128 bits, 192 bits, and 256 bits. Therefore, according to the different block lengths, the column number of the matrix will be Nb=4, Nb=6, Nb=8 respectively. G-AES also uses the Feistel structure, unlike many cryptographic algorithms: with different key lengths, the number of rounds of G-AES varies, denoted as Nr.

[0237] G-AES is a key iteration block cipher, which includes the repeated action of the round transformation on the state. Denote the number of rounds as Nr, which depends on the block length and the key length. Its encryption process includes an initial key addition, denoted as AddRoundkey, followed by Nr-1 round transformations Round, and finally using a round transformation FinalRound. The initial key addition and each round transformation take the state State and a round key as input. The key of the i-th round is denoted as ExpandedKey[i], the input of the initial key addition is denoted as Expandedkey[0], and the process of deriving ExpandedKey from CipherKey is denoted as KeyExpansion.

[0238] Step SubBytes is the only nonlinear transformation in the G-AES cipher. It is a bricklayer permutation, which includes an S-Box acting on the state bytes, and the specific S-Box used in G-AES is denoted as SRD. The design criteria for SRD require that when designing SRD, the criteria followed are in the order of importance as follows:

[0239] (1) Nonlinearity: The maximum correlation amplitude between input and output must be as small as possible, and the maximum value of differential propagation probability must be as small as possible.

[0240] (2) Numerical complexity: There should be a complex algebraic expression in GF(28).

[0241] In the embodiment, the G-AES data exchange pool is packaged in a Jar package, and can be applied in various business systems through an adapter mode to replace the traditional database JDBC connection. The system adopts a B / S architecture design of lightweight Java EE (Java Platform, Enterprise Edition), and the bottom layer is supported by a JDAP (Java Data Application Platform) framework. Specifically, the G-AES data exchange pool can realize easy deployment, client installation-free, and convenient upgrade and maintenance, the above-mentioned scheme has low requirements for software and hardware environment, and high development efficiency.

[0242] To sum up, the embodiment of the application provides a power grid real asset data protection method based on a G-AES algorithm, which uses containerization technology, so that database, file, cloud resource and device management can be simplified and optimized through containerization technology. At the same time, the method is based on a G-AES data exchange pool, and reconstructs a power grid real asset management business comprehensive platform. The platform provides high security protection data, and crosses power grid asset management, device management, operation and maintenance plan management and other businesses, and realizes the following technical effects:

[0243] (1) Database management: Containers can be used to deploy and manage various database systems, such as MySQL, PostgreSQL, MongoDB, etc. The configuration parameters of the database in the container are set, including username, password, database name, etc. The database is stored by using G-AES encryption, so that the data will not be lost after the container restarts.

[0244] (2) File management: File management can be realized through containers, such as using NFS, GlusterFS or Ceph distributed file system, or uploading files to cloud storage services. G-AES is used for bidirectional encryption and decryption and file authentication at the transport layer and file layer, to avoid file tampering.

[0245] (3) Cloud resource management: Management of cloud resources (such as virtual machines, storage buckets, database services, etc.) requires API and SDK of cloud providers. G-AES will be used to reconstruct API and SDK to realize bidirectional encryption and decryption.

[0246] (4) Device management: Device management can use containers to monitor, control and manage various devices, including Internet of Things (IoT) devices, network devices, etc., in the same way as cloud resources.

[0247] According to the method described in the above embodiment, this embodiment will be further described from the perspective of a power grid physical asset data protection system based on the G-AES algorithm, specifically, as shown in Figure 7 The power grid physical asset data protection system based on the G-AES algorithm provided by the embodiment of the application has the advantages that

[0248] The containerization module is configured to containerize different types of interactive operation services in the power grid physical asset business system to obtain a plurality of different types of service container pools. The power grid physical asset business system includes an ERP management system, a PMS management system, a TMS management system, a SCADA transaction system, and an EMS analysis system. The interactive operation services include database operation services, file system operation services, device sensing data interaction services, and cloud resource data interaction services.

[0249] The containerization module is specifically configured to package operation software and software configurations in the database operation services into independent container images to form a database container pool, package storage services and access services in the file system operation services into independent container images to form a file system container pool, package drivers and driver services in the device sensing data interaction services into independent container images and integrate them into a preset container running environment to form a device sensing container pool, and package application program interfaces and development tool kits in the cloud resource data interaction services into independent container images to form a cloud resource container pool.

[0250] The encryption mode construction module is configured to construct a plurality of different data encryption modes based on the G-AES algorithm, associate and match the plurality of data encryption modes with the plurality of service container pools, and associate and match at least one data encryption mode with any one service container pool.

[0251] The encryption mode construction module is specifically configured to construct a G-AES data exchange pool including an AES-GCM data encryption mode, an AES-CBC data encryption mode, and an AES-CTR data encryption mode based on the G-AES algorithm, associate and match the database container pool with the AES-GCM data encryption mode, associate and match the file system container pool with the AES-CBC data encryption mode, and associate and match the device sensing container pool and the cloud resource container pool with the AES-CTR data encryption mode.

[0252] The instruction acquisition module is configured to acquire user operation instructions through the power grid physical asset business system.

[0253] The calling module is configured to generate a calling instruction according to the user operation instruction, and to call a target service container pool of a corresponding type and an associated target data encryption mode in response to the calling instruction.

[0254] The interactive operation module is configured to execute the interactive operation service of the corresponding type based on the target service container pool in response to the user operation instruction, and to perform data security protection on the target service container pool during execution of the interactive operation service according to the target data encryption mode.

[0255] When the target service container pool is the database container pool, the interactive operation module is configured to:

[0256] execute the database operation service in response to the user operation instruction based on the database container pool;

[0257] generate a first encryption request during execution of the database operation service, extract to-be-encrypted database data from the database operation service in response to the first encryption request, generate a first initial counter value based on a database number of a database to which the to-be-encrypted database data belongs and a request generation time of the first encryption request, perform a first data encryption step on the to-be-encrypted database data based on the first initial counter value and using the AES-GCM data encryption mode, to obtain encrypted database data, and write the encrypted database data to the database container pool.

[0258] The first data encryption step includes the following steps: splitting the to-be-encrypted database data into N database data blocks according to a numerical length of the first initial counter value; generating N-1 first counter values based on the first initial counter value and according to a preset numerical increment; performing AES algorithm encryption on the first initial counter value and the N-1 first counter values to generate N first key blocks; performing XOR encryption operation on the N database data blocks and the N first key blocks to obtain N database ciphertext data blocks, and combining all the database ciphertext data blocks.

[0259] When the target service container pool is the file system container pool, the interactive operation module is configured to:

[0260] performing the file system operation service in response to the user operation instruction based on the database container pool; generating a second encryption request during the execution of the file system operation service; extracting file data to be encrypted from the file system operation service in response to the second encryption request; generating a second initial counter value in combination with a folder number of a folder to which the file data to be encrypted belongs and a request generation time of the second encryption request; performing a second data encryption step on the file data to be encrypted based on the second initial counter value and using the AES-CBC data encryption mode, to obtain encrypted file data; and writing the encrypted file data to the file system container pool.

[0261] The second data encryption step includes the following steps: splitting the file data to be encrypted into M file data blocks according to the numerical length of the second initial counter value; sorting the M file data blocks according to the generation time, and selecting the first file data block as a target file data block according to the sorting result; performing an exclusive or encryption operation on the target file data block and the second initial counter value to generate a file ciphertext data block; selecting the next file data block as the target file data block according to the sorting result, and performing the exclusive or encryption operation on the target file data block and the newly generated file ciphertext data block, until all the file data blocks have been subjected to the exclusive or encryption operation once, to obtain M file ciphertext data blocks, and combining all the file ciphertext data blocks.

[0262] When the target service container pool is the device-aware container pool or the cloud resource container pool, the interactive operation module is configured to:

[0263] based on the device-aware data interaction service or the cloud resource data interaction service, generating a third encryption request during execution of the device-aware data interaction service or the cloud resource data interaction service; extracting encrypted device interaction data from the device-aware data interaction service or encrypted cloud resource data from the cloud resource data interaction service in response to the third encryption request; if the encrypted device interaction data is extracted, generating a third initial counter value in combination with a device number of a device to which the encrypted device interaction data belongs and a request generation time of the third encryption request; performing a third data encryption step on the encrypted device interaction data based on the third initial counter value and using the AES-CTR data encryption mode to obtain encrypted device interaction data, and writing the encrypted device interaction data to the device-aware container pool; if the encrypted cloud resource data is extracted, generating a third initial counter value in combination with a server number of a cloud server to which the encrypted cloud resource data belongs and a request generation time of the third encryption request; performing the third data encryption step on the encrypted cloud resource data based on the third initial counter value and using the AES-CTR data encryption mode to obtain encrypted cloud resource interaction data, and writing the encrypted cloud resource interaction data to the cloud resource container pool.

[0264] The third data encryption step includes the following steps: splitting the encrypted device interaction data or the encrypted cloud resource data into L encrypted data blocks according to a numerical length of the third initial counter value; performing AES algorithm encryption on the third initial counter value to generate a key stream block; performing XOR encryption operation on the key stream block and L encrypted data blocks in sequence to obtain L encrypted data blocks, and combining all the encrypted data blocks.

[0265] In specific implementation, each of the above modules and / or units can be implemented as an independent entity, or can be combined as the same or several entities, and the specific implementation of each of the above modules and / or units can refer to the method embodiments above, and the beneficial effects that can be achieved can also refer to the beneficial effects in the method embodiments above, which will not be described here.

[0266] In addition, Figure 8 is a structural schematic diagram of a power grid physical asset data protection device based on a G-AES algorithm provided by an embodiment of the present application. As Figure 8 shown, the embodiment of the present application further provides a power grid physical asset data protection device based on a G-AES algorithm, and the protection device 400 includes a processor 401 and a memory 402, the memory 402 stores a computer program, and the processor 401 is configured to run the computer program to execute the steps in any one of the method embodiments above.

[0267] In some embodiments, the electronic device described above can further include a transmission device connected to the processor and an input and output device connected to the processor.

[0268] The embodiment of the present application provides a storage medium, wherein a plurality of instructions are stored in the storage medium, and the instructions can be executed by a processor to implement any step of the power grid physical asset data protection method based on the G-AES algorithm.

[0269] In the embodiment, the computer readable storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk and various computer program storage media.

Claims

1. A method for protecting physical asset data of a power grid based on a G-AES algorithm, characterized in that, The method comprises the following steps: Containerizing different types of interactive operation services in the power grid physical asset business system to obtain a plurality of different types of service container pools, including a database container pool, a file system container pool, a device awareness container pool, and a cloud resource container pool; Based on the G-AES9 algorithm, a G-AES data exchange pool is constructed, and a plurality of different data encryption modes in the G-AES data exchange pool are associated and matched with a plurality of service container pools, and any one of the service container pools is associated and matched with at least one data encryption mode; Obtaining a user operation instruction through the power grid physical asset business system; Generating a calling instruction according to the user operation instruction, and calling a target service container pool of a corresponding type and an associated target data encryption mode in response to the calling instruction; Based on the target service container pool, the interactive operation service of the corresponding type is executed in response to the user operation instruction, and the target service container pool is data-protected during the execution of the interactive operation service according to the target data encryption mode, including the following steps: When the target service container pool is the database container pool, the database operation service is executed based on the database container pool in response to the user operation instruction; Generating a first encryption request during the execution of the database operation service; Extracting encrypted database data from the database operation service in response to the first encryption request; Generating a first initial counter value based on the database number of the database to which the encrypted database data belongs and the request generation time of the first encryption request; Performing a first data encryption step on the encrypted database data based on the first initial counter value and using the AES-GCM data encryption mode to obtain encrypted database data; Writing the encrypted database data into the database container pool; The first data encryption step comprises the following steps: Splitting the encrypted database data into N database data blocks according to the numerical length of the first initial counter value; Generating N-1 first counter values based on the first initial counter value and according to a preset numerical increment; Encrypting the first initial counter value and N-1 first counter values using the AES algorithm to generate N first key blocks; Performing an exclusive or encryption operation on N database data blocks and N first key blocks to obtain N database ciphertext data blocks, and merging all database ciphertext data blocks.

2. The power grid physical asset data protection method based on the G-AES algorithm according to claim 1, wherein: The power grid physical asset business system comprises an ERP management system, a PMS management system, a TMS management system, a SCADA transaction system, and an EMS analysis system.

3. The power grid physical asset data protection method based on the G-AES algorithm according to claim 1, wherein: The interactive operation service comprises a database operation service, a file system operation service, a device awareness data interaction service, and a cloud resource data interaction service. The different types of interactive operation business containers in the power grid physical asset business system are containerized to obtain a plurality of different types of business container pools, including the following steps: The operation software and software configuration in the database operation business are packaged into independent container images to form a database container pool; The storage service and access service in the file system operation business are packaged into independent container images to form a file system container pool; The driver program and driver service in the device perception data interaction business are packaged into independent container images and integrated into a preset container running environment to form a device perception container pool; The application program interface and development kit in the cloud resource data interaction business are packaged into independent container images to form a cloud resource container pool.

4. The power grid physical asset data protection method based on the G-AES algorithm according to claim 3, characterized in that: The G-AES data exchange pool is constructed based on the G-AES algorithm, and the plurality of different data encryption modes in the G-AES data exchange pool are associated and matched with the plurality of business container pools, including the following steps: The G-AES data exchange pool is constructed based on the G-AES algorithm, and the G-AES data exchange pool includes a plurality of different data encryption modes, including an AES-GCM data encryption mode, an AES-CBC data encryption mode, and an AES-CTR data encryption mode; The database container pool is associated and matched with the AES-GCM data encryption mode; The file system container pool is associated and matched with the AES-CBC data encryption mode; Both the device perception container pool and the cloud resource container pool are associated and matched with the AES-CTR data encryption mode.

5. The power grid physical asset data protection method based on the G-AES algorithm according to claim 4, characterized in that: The target business container pool performs the corresponding type of interactive operation business in response to the user operation instruction, and the target business container pool in the interactive operation business execution process is protected based on the target data encryption mode, including the following steps: When the target business container pool is the file system container pool, the database container pool performs the file system operation business in response to the user operation instruction; A second encryption request is generated during the file system operation business execution process; Encrypted file data is extracted from the file system operation business in response to the second encryption request; A second initial counter value is generated in combination with the folder number of the folder to which the encrypted file data belongs and the request generation time of the second encryption request; A second data encryption step is performed on the encrypted file data based on the second initial counter value and using the AES-CBC data encryption mode to obtain encrypted file data; The encrypted file data is written into the file system container pool; The second data encryption step includes the following steps: The encrypted file data is split into M file data blocks according to the numerical length of the second initial counter value; Sort M file data blocks according to generation time, and select the first file data block as a target file data block according to the sorting result; XOR encryption operation is performed between the target file data block and the second initial counter value to generate a file ciphertext data block; According to the sorting result, the next file data block is selected as the target file data block, and the XOR encryption operation is performed between the target file data block and the newly generated file ciphertext data block, until all the file data blocks have been subjected to the XOR encryption operation once, and M file ciphertext data blocks are obtained.

6. The power grid physical asset data protection method based on the G-AES algorithm according to claim 4, characterized in that: The target business container pool performs the corresponding type of interactive operation business in response to the user operation instruction, and performs data security protection on the target business container pool during the interactive operation business according to the target data encryption mode, including the following steps: When the target business container pool is the device awareness container pool or the cloud resource container pool, the device awareness data interaction business or the cloud resource data interaction business is performed based on the device awareness container pool or the cloud resource container pool and in response to the user operation instruction; A third encryption request is generated during the execution of the device awareness data interaction business or the cloud resource data interaction business; In response to the third encryption request, encrypted device interaction data is extracted from the device awareness data interaction business, or encrypted cloud resource data is extracted from the cloud resource data interaction business; If the encrypted device interaction data is extracted, a third initial counter value is generated in combination with the device number of the device to which the encrypted device interaction data belongs and the request generation time of the third encryption request; A third data encryption step is performed on the encrypted device interaction data based on the third initial counter value and using the AES-CTR data encryption mode, and the encrypted device interaction data is written into the device awareness container pool; If the encrypted cloud resource data is extracted, a third initial counter value is generated in combination with the server number of the cloud server to which the encrypted cloud resource data belongs and the request generation time of the third encryption request; The third data encryption step is performed on the encrypted cloud resource data based on the third initial counter value and using the AES-CTR data encryption mode, and the encrypted cloud resource interaction data is written into the cloud resource container pool; The third data encryption step includes the following steps: The encrypted device interaction data or the encrypted cloud resource data is split into L encrypted data blocks according to the numerical length of the third initial counter value; The third initial counter value is encrypted by the AES algorithm to generate a key stream block; The key stream block is sequentially XOR encrypted with L encrypted data blocks to obtain L encrypted data blocks, and all the encrypted data blocks are combined.

7. A power grid physical asset data protection system based on G-AES algorithm, characterized by, including: A containerization module is configured to containerize different types of interactive operation services in a power grid physical asset business system to obtain a plurality of different types of service container pools, including a database container pool, a file system container pool, a device awareness container pool, and a cloud resource container pool. An encryption mode construction module is configured to construct a plurality of different data encryption modes based on a G-AES algorithm, and associate and match the plurality of data encryption modes with the plurality of service container pools, wherein any one of the service container pools is associated and matched with at least one of the data encryption modes. An instruction acquisition module is configured to acquire a user operation instruction through the power grid physical asset business system. A calling module is configured to generate a calling instruction according to the user operation instruction, and call a target service container pool of a corresponding type and a target data encryption mode associated therewith in response to the calling instruction. An interactive operation module is configured to execute the interactive operation service of the corresponding type based on the target service container pool in response to the user operation instruction, and perform data security protection on the target service container pool during the execution of the interactive operation service according to the target data encryption mode, including the following steps: When the target service container pool is the database container pool, executing the database operation service based on the database container pool in response to the user operation instruction. Generating a first encryption request during the execution of the database operation service. Extracting encrypted database data from the database operation service in response to the first encryption request. Generating a first initial counter value in combination with a database number of a database to which the encrypted database data belongs and a request generation time of the first encryption request. Performing a first data encryption step on the encrypted database data based on the first initial counter value and using an AES-GCM data encryption mode to obtain encrypted database data. Writing the encrypted database data into the database container pool. The first data encryption step includes the following steps: Splitting the encrypted database data into N database data blocks according to a numerical length of the first initial counter value. Generating N-1 first counter values based on the first initial counter value and according to a preset numerical increment. Encrypting the first initial counter value and the N-1 first counter values using an AES algorithm to generate N first key blocks. Performing an exclusive or encryption operation on N database data blocks and N first key blocks to obtain N database ciphertext data blocks, and merging all the database ciphertext data blocks.

8. A power grid physical asset data protection device based on G-AES algorithm, characterized in that, A memory and a processor are included: The memory is configured to store computer program code and transmit the computer program code to the processor. The processor is configured to execute the power grid physical asset data protection method based on the G-AES algorithm according to the instructions in the computer program code, as claimed in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the power grid physical asset data protection method based on the G-AES algorithm, as claimed in any one of claims 1 to 6.

Images