Power distribution terminal internal data security sharing method and system based on lightweight attribute encryption

Abstract

The invention discloses a power distribution terminal internal data security sharing method and system based on lightweight attribute encryption, and the method comprises the steps: taking all applications in a security management and control center and a power distribution terminal as an application layer, taking a sensor or an actuator of the power distribution terminal as a physical layer, and employing a distributed database as a data layer; all applications in the power distribution terminal are divided into a plurality of function partitions according to functions, each partition is responsible for a specific function, each application distributes attributes and is encrypted according to a data acquisition rule, and the data acquisition rule stipulates the attributes which the applications capable of acquiring data of the applications should have. According to the method, data sharing among the applications in the partitions can be realized only when other applications have attributes of data acquisition rules, and when cross-partition data sharing is needed, a dynamic strategy updating technology is adopted, so that data can be safely shared among application programs in different partitions. According to the invention, data security sharing between applications can be realized.

Description

Technical Field

[0001] The present invention relates to the field of power information security technology, and in particular to a method and system for securely sharing internal data of a distribution terminal based on lightweight attribute encryption. Background Art

[0002] With the development of smart grids and the increasing demand for distribution terminal functions, the amount of applications and data in distribution terminal devices has increased dramatically. These terminal devices play a vital role in the distribution network, and undertake multiple functions such as data collection, status monitoring, fault diagnosis and remote control. However, the resource conditions of terminal devices are very limited. They usually have the characteristics of small storage space, weak computing power and limited battery capacity, which makes the security protection of their internal data face severe challenges. At the same time, the protection means of distribution terminal devices are relatively limited. Traditional security mechanisms, such as complex encryption algorithms and cumbersome authentication processes, often require high computing and storage resources, which is not realistic for resource-constrained terminal devices. As a result, the internal data of terminal devices is extremely vulnerable to theft, tampering and destruction by attackers, threatening the security and stability of the entire distribution network. There are multiple applications inside the distribution terminal. How to achieve secure data sharing between multiple applications has become an urgent problem to be solved. Summary of the invention

[0003] In view of the problems existing in the prior art, the purpose of the present invention is to provide a method and system for secure sharing of internal data of a distribution terminal based on lightweight attribute encryption, which can realize secure sharing of data between applications.

[0004] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:

[0005] A method for secure sharing of data within a distribution terminal based on lightweight attribute encryption. The method uses the security control center and all applications within the distribution terminal as the application layer and implements the following steps:

[0006] The security control center divides all applications in the power distribution terminal into several functional partitions according to their functions, and assigns attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that the application should have to obtain its data;

[0007] The security control center generates public keys and user encryption keys, and makes the public keys public to all applications;

[0008] When it is necessary to access the data of an application in the same functional partition, the accessing application sends a first access request including its own attributes to the security control center and the accessed application; when it is necessary to access the data of an application in a different functional partition, the accessing application sends a second access request including its own attributes to the security control center and the accessed application;

[0009] When the security control center receives the first access request, it parses the attributes of the access application from it, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application; when receiving the second access request, after the identity and permission authentication of the access application is passed, the attributes of the access application are dynamically updated to the data acquisition rules of the accessed application, and then the attributes of the access application are parsed from the second access request, and a user private key that matches the attributes of the access application is generated based on the user encryption key, and returns it to the access application;

[0010] When the accessed application receives the first access request or the second access request, it returns the corresponding ciphertext data to the accessing application; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key;

[0011] The access application decrypts the received ciphertext data according to the user's private key and public key to achieve secure sharing of data within a partition or across regions.

[0012] Furthermore, the method also includes: using the sensor or actuator of the distribution terminal as the physical layer, all applications inside the distribution terminal realize data collection through the physical layer, and transmit it through a wireless or wired communication network, using the transport layer security protocol and transmitting through an encrypted communication channel.

[0013] Furthermore, the method also includes: using a distributed database as a data layer, and using different encryption strategies to process data belonging to different functional partitions transmitted at the physical layer. Specifically, for functional partitions with a privacy level higher than a preset threshold, first encrypt the data using homomorphic encryption technology, and then encrypt it according to data acquisition rules and public keys; for functional partitions with a privacy level lower than a preset threshold, directly encrypt the data according to data acquisition rules and public keys.

[0014] Furthermore, the security control center divides all applications in the power distribution terminal into several functional partitions according to their functions, specifically including:

[0015] The security management and control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to perform in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

[0016] Furthermore, the method also includes: recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

[0017] A data security sharing system for distribution terminals based on lightweight attribute encryption, the system includes an application layer, the application layer includes all applications in a security control center and a distribution terminal, wherein:

[0018] The security control center includes:

[0019] A functional partitioning module is used to divide all applications in the power distribution terminal into several functional partitions according to their functions, and to assign attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that an application should have in order to acquire its data;

[0020] A key generation module, used to generate a public key and a user encryption key, and disclose the public key to all applications;

[0021] A user private key generation module is used to parse out the attributes of the access application from the first access request when it is received, generate a user private key that matches the attributes of the access application based on the user encryption key, and return it to the access application; and when receiving a second access request, after the identity and permission authentication of the access application is passed, dynamically update the attributes of the access application to the data acquisition rules of the accessed application, parse out the attributes of the access application from the second access request, generate a user private key that matches the attributes of the access application based on the user encryption key, and return it to the access application;

[0022] The applications include:

[0023] An access request sending module, configured to cause the access application to send a first access request including its own attributes to the security control center and the accessed application when data of an application in the same functional partition needs to be accessed, and to cause the access application to send a second access request including its own attributes to the security control center and the accessed application when data of an application in a different functional partition needs to be accessed;

[0024] An access data transmission module, used to return corresponding ciphertext data to the access application when receiving the first access request or the second access request; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key;

[0025] The decryption module is used to decrypt the received ciphertext data according to the user's private key and public key when receiving the ciphertext data, so as to realize the secure sharing of data within the partition or across regions.

[0026] Furthermore, the system also includes a physical layer, which includes sensors or actuators of the distribution terminal. All applications inside the distribution terminal realize data collection through the physical layer and transmit it through a wireless or wired communication network. The transmission adopts the transport layer security protocol and is transmitted through an encrypted communication channel.

[0027] Furthermore, the system also includes a data layer, which includes a distributed database, which is used to process data belonging to different functional partitions transmitted by the physical layer using different encryption strategies. Specifically, for functional partitions with a privacy level higher than a preset threshold, the data is first encrypted using homomorphic encryption technology, and then encrypted according to data acquisition rules and public keys; for functional partitions with a privacy level lower than a preset threshold, the data is directly encrypted according to data acquisition rules and public keys.

[0028] Furthermore, the security management and control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to perform in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

[0029] Furthermore, the system also includes an audit module for recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

[0030] Compared with the prior art, the present invention has the following beneficial effects: the present invention solves the problem of secure data sharing between various applications within a new power distribution system terminal, thereby enhancing the overall security and credibility of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a system block diagram of a power distribution terminal internal data security sharing system based on lightweight attribute encryption provided by an embodiment of the present invention;

[0032] Figure 2 is an example of an internal access policy for a partition;

[0033] Figure 3 is an example of a cross-partition access strategy. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0035] Embodiment 1

[0036] The embodiment of the present invention provides a method for secure sharing of data within a distribution terminal based on lightweight attribute encryption. The method uses the security control center and all applications within the distribution terminal as the application layer, the sensors or actuators of the distribution terminal as the physical layer, and a distributed database as the data layer. Figure 1 shown.

[0037] The physical layer can realize the collection and transmission of data such as the operating status of the distribution network, and the collected data of the physical layer is transmitted through a wireless or wired communication network. For example, the physical layer and the data layer support multiple communication methods, mainly including wired communication methods and wireless communication methods, to ensure that data can be transmitted efficiently. The data transmission process adopts the transport layer security protocol (TLS / SSL), and through the encrypted communication channel, it protects the security and correctness of the data during the transmission process to prevent the data from being intercepted and tampered with. Wireless communication can select different wireless communication protocols as needed, such as Wi-Fi, LoRaWAN, etc., to meet the data transmission requirements in different application scenarios and ensure the flexibility and security of data transmission.

[0038] The data layer is mainly a distributed database, which is responsible for receiving data transmitted from the physical layer and encrypting and storing it, and providing access data to the access application of the application layer. The database adopts a multi-node architecture to improve the reliability and stability of data storage, so as to meet the concurrent storage and user access requests of a large amount of data. In order to ensure the data security of different partitions, different encryption strategies need to be used. For functional partitions with a privacy level higher than the preset threshold, CKKS homomorphic encryption technology is used to encrypt the data. This encryption method can ensure that the data is always encrypted during storage and processing to prevent data leakage and unauthorized access. After the data processing is completed, the data will be decrypted and encrypted according to the data acquisition rules and public keys. For the data of functional partitions such as monitoring partitions and flow control partitions whose privacy levels are lower than the preset threshold, the data is directly encrypted according to the data acquisition rules and public keys, so as to achieve fine-grained access control to ensure data security.

[0039] The application layer mainly includes all applications within the security control center and the power distribution terminal, and is implemented in the following steps:

[0040] S101. The security control center divides all applications in the power distribution terminal into several functional partitions according to their functions, and assigns attributes and data acquisition rules to each application in the same functional partition.

[0041] The security management and control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands, such as switch operation and circuit breaker control, to ensure the normal operation of the distribution terminal. The analysis partition is used to perform in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

[0042] The security control center assigns attributes and data acquisition rules to each application in the same functional partition. The data acquisition rules specify the attributes that applications that can obtain their data should have, so that only applications with specific attributes can access the corresponding application data, thereby ensuring the security and confidentiality of data within the partition. Data acquisition rules can be implemented through the access control policy tree, such as Figure 2 As shown. The root node of the policy tree is an AND node, which means that the application must have both attribute "G" and the conditions of the "2-of-4" policy. To meet the "2-of-4" policy, the application needs to meet any two of the four conditions, including attribute "A", attribute "E", attribute "F", or comply with the "2-of-3" policy. The "2-of-3" policy further requires that the application has any two of the attributes "B", "C", and "D". Only when the application meets these combined conditions can it decrypt and access the data in the partition.

[0043] S102. The security management and control center generates a public key and a user encryption key, and publishes the public key to all applications.

[0044] S103. When it is necessary to access the data of an application in the same functional partition, the accessing application sends a first access request including its own attributes to the security control center and the accessed application. When it is necessary to access the data of an application in a different functional partition, the accessing application sends a second access request including its own attributes to the security control center and the accessed application.

[0045] S104. When the security control center receives the first access request, it parses the attributes of the access application therefrom, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application; when the second access request is received, after the identity and permission authentication of the access application is passed, the attributes of the access application are dynamically updated to the data acquisition rules of the accessed application, and then the attributes of the access application are parsed from the second access request, and a user private key that matches the attributes of the access application is generated based on the user encryption key, and returns it to the access application.

[0046] Among them, dynamically updating the attributes of the accessing application to the data acquisition rules of the accessed application can be achieved by updating the access policy tree, such as Figure 3 As shown in the figure, in the original access control policy tree of the data, the root node is an AND node, which requires the conditions of the attribute "G" and the "2-of-4" policy to be met at the same time. In order to meet the "2-of-4" policy, any two of the four conditions must be met. These four conditions include the attributes "A", "E", "F" and the "2-of-3" policy, while the "2-of-3" policy requires any two of the attributes "B", "C", and "D". In order to achieve cross-partition data sharing, the data holder can dynamically update the access policy, such as Figure 3 As shown on the right, the original attribute "G" is adjusted to a new "2-of-4" policy subtree, including attributes "G1", "G2", "G3" and "G4", so as to achieve dynamic update of access policy. When the applications in other partitions meet the AND requirements of the root node, cross-partition access to data is possible. Because the access control policy is independent of the ciphertext content, by adjusting the policy tree, the attribute combination that can decrypt data can be logically expanded, but the actual ciphertext structure has not changed, so there is no need to decrypt and re-encrypt the encrypted data. In this way, cross-partition data access can be flexibly achieved, allowing data to flow securely between multiple partitions, and realizing fine-grained access control and secure sharing of data.

[0047] S105. When the accessed application receives the first access request or the second access request, it returns corresponding ciphertext data to the accessing application, wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key.

[0048] S106. The access application decrypts the received ciphertext data according to the user's private key and public key to achieve secure sharing of data within a partition or secure sharing of data across partitions.

[0049] The encrypted data is shared and transmitted within the partition. Since the data has been encrypted, even if it is intercepted by a malicious attacker during transmission, the data content cannot be read without the correct user private key. Decryption can only be achieved by obtaining the user's private key and public key.

[0050] S107. All access requests and operations are recorded and audited, and access log records, operation log records and audit reports are generated. All data access and operations are recorded in detail to ensure that problems can be quickly tracked and located when security incidents occur. The security audit mechanism generates audit reports regularly, providing detailed access and operation records for security managers to review and analyze.

[0051] Embodiment 2

[0052] Figure 1 It is a schematic diagram of a distribution terminal internal data security sharing system based on lightweight attribute encryption provided in Embodiment 2 of the present invention, including a physical layer, a data layer and an application layer.

[0053] The physical layer can realize the collection and transmission of data such as the operating status of the distribution network, and the collected data of the physical layer is transmitted through a wireless or wired communication network. For example, the physical layer and the data layer support multiple communication methods, mainly including wired communication methods and wireless communication methods, to ensure that data can be transmitted efficiently. The data transmission process adopts the transport layer security protocol (TLS / SSL), and through the encrypted communication channel, it protects the security and correctness of the data during the transmission process to prevent the data from being intercepted and tampered with. Wireless communication can select different wireless communication protocols as needed, such as Wi-Fi, LoRaWAN, etc., to meet the data transmission requirements in different application scenarios and ensure the flexibility and security of data transmission.

[0054] The data layer is mainly a distributed database, which is responsible for receiving data transmitted from the physical layer and encrypting and storing it, and providing access data to the access application of the application layer. The database adopts a multi-node architecture to improve the reliability and stability of data storage, so as to meet the concurrent storage and user access requests of a large amount of data. In order to ensure the data security of different partitions, different encryption strategies need to be used. For functional partitions with a privacy level higher than the preset threshold, CKKS homomorphic encryption technology is used to encrypt the data. This encryption method can ensure that the data is always encrypted during storage and processing to prevent data leakage and unauthorized access. After the data processing is completed, the data will be decrypted and encrypted according to the data acquisition rules and public keys. For the data of functional partitions such as monitoring partitions and flow control partitions whose privacy levels are lower than the preset threshold, the data is directly encrypted according to the data acquisition rules and public keys, so as to achieve fine-grained access control to ensure data security.

[0055] The application layer includes all applications within the security control center and the distribution terminal, including:

[0056] The security control center includes:

[0057] A functional partitioning module is used to divide all applications in the power distribution terminal into several functional partitions according to their functions, and to assign attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that an application should have in order to acquire its data;

[0058] A key generation module, used to generate a public key and a user encryption key, and disclose the public key to all applications;

[0059] A user private key generation module is used to parse out the attributes of the access application from the first access request when it is received, generate a user private key that matches the attributes of the access application based on the user encryption key, and return it to the access application; and when receiving a second access request, after the identity and permission authentication of the access application is passed, dynamically update the attributes of the access application to the data acquisition rules of the accessed application, parse out the attributes of the access application from the second access request, generate a user private key that matches the attributes of the access application based on the user encryption key, and return it to the access application;

[0060] The applications include:

[0061] An access request sending module, configured to cause the access application to send a first access request including its own attributes to the security control center and the accessed application when data of an application in the same functional partition needs to be accessed, and to cause the access application to send a second access request including its own attributes to the security control center and the accessed application when data of an application in a different functional partition needs to be accessed;

[0062] An access data transmission module, used to return corresponding ciphertext data to the access application when receiving the first access request or the second access request; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key;

[0063] The decryption module is used to decrypt the received ciphertext data according to the user's private key and public key when receiving the ciphertext data, so as to realize the secure sharing of data within the partition or across regions.

[0064] Furthermore, the system also includes an audit module for recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

[0065] The system provided in the embodiment of the present invention can be used to execute the method provided in the first embodiment of the present invention, and has the corresponding functions and beneficial effects of the execution method.

[0066] It is worth noting that in the embodiment of the above system, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0067] The embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, or of course, it can be implemented only by hardware, as long as the function or effect can be achieved.

Claims

1. A method for securely sharing data within a power distribution terminal based on lightweight attribute encryption, characterized in that: This method uses all applications in the security control center and the power distribution terminal as the application layer and implements the following steps: The security control center divides all applications in the power distribution terminal into several functional partitions according to their functions, and assigns attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that the application should have to obtain its data; The security control center generates public keys and user encryption keys, and makes the public keys public to all applications; When it is necessary to access the data of an application in the same functional partition, the accessing application sends a first access request including its own attributes to the security control center and the accessed application; when it is necessary to access the data of an application in a different functional partition, the accessing application sends a second access request including its own attributes to the security control center and the accessed application; When the security control center receives the first access request, it parses the attributes of the access application from it, generates a user private key that matches the attributes of the access application based on the user encryption key, and returns it to the access application; when receiving the second access request, after the identity and permission authentication of the access application is passed, the attributes of the access application are dynamically updated to the data acquisition rules of the accessed application, and then the attributes of the access application are parsed from the second access request, and a user private key that matches the attributes of the access application is generated based on the user encryption key, and returns it to the access application; When the accessed application receives the first access request or the second access request, it returns the corresponding ciphertext data to the accessing application; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key; The access application decrypts the received ciphertext data according to the user's private key and public key to achieve secure sharing of data within a partition or across regions.

2. The method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption according to claim 1 is characterized in that: The method further includes: The sensors or actuators of the distribution terminal are used as the physical layer. All applications inside the distribution terminal collect data through the physical layer and transmit the data through a wireless or wired communication network. The transmission adopts the transport layer security protocol and is transmitted through an encrypted communication channel.

3. The method for securely sharing data within a power distribution terminal based on lightweight attribute encryption according to claim 2 is characterized in that: The method further includes: A distributed database is used as the data layer, and different encryption strategies are adopted to process the data belonging to different functional partitions transmitted at the physical layer. Specifically: for functional partitions with privacy levels higher than the preset threshold, the data is first encrypted using homomorphic encryption technology, and then encrypted according to data acquisition rules and public keys; for functional partitions with privacy levels lower than the preset threshold, the data is directly encrypted according to data acquisition rules and public keys.

4. The method for securely sharing data within a power distribution terminal based on lightweight attribute encryption according to claim 1 is characterized in that: The safety control center divides all applications in the power distribution terminal into several functional partitions according to their functions, including: The security management and control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to perform in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

5. The method for securely sharing internal data of a power distribution terminal based on lightweight attribute encryption according to claim 1 is characterized in that: The method further includes: All access requests and operations are recorded and audited, and access log records, operation log records and audit reports are generated.

6. A distribution terminal internal data security sharing system based on lightweight attribute encryption, characterized in that: The system includes an application layer, which includes all applications within the security control center and the distribution terminal, including: The security control center includes: A functional partitioning module is used to divide all applications in the power distribution terminal into several functional partitions according to their functions, and to assign attributes and data acquisition rules to each application in the same functional partition, wherein the data acquisition rules specify the attributes that an application should have in order to acquire its data; A key generation module, used to generate a public key and a user encryption key, and disclose the public key to all applications; A user private key generation module is used to parse out the attributes of the access application from the first access request when it is received, generate a user private key that matches the attributes of the access application based on the user encryption key, and return it to the access application; and when receiving a second access request, after the identity and permission authentication of the access application is passed, dynamically update the attributes of the access application to the data acquisition rules of the accessed application, parse out the attributes of the access application from the second access request, generate a user private key that matches the attributes of the access application based on the user encryption key, and return it to the access application; The applications include: An access request sending module, configured to cause the access application to send a first access request including its own attributes to the security control center and the accessed application when data of an application in the same functional partition needs to be accessed, and to cause the access application to send a second access request including its own attributes to the security control center and the accessed application when data of an application in a different functional partition needs to be accessed; An access data transmission module, used to return corresponding ciphertext data to the access application when receiving the first access request or the second access request; wherein the ciphertext data is data encrypted according to the data acquisition rule and the public key; The decryption module is used to decrypt the received ciphertext data according to the user's private key and public key when receiving the ciphertext data, so as to realize the secure sharing of data within the partition or across regions.

7. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 6 is characterized in that: The system also includes a physical layer, which includes sensors or actuators of the distribution terminal. All applications inside the distribution terminal collect data through the physical layer and transmit it through a wireless or wired communication network. The transmission adopts the transport layer security protocol and is transmitted through an encrypted communication channel.

8. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 7 is characterized in that: The system also includes a data layer, which includes a distributed database for processing data belonging to different functional partitions transmitted by the physical layer using different encryption strategies. Specifically, for functional partitions with a privacy level higher than a preset threshold, the data is first encrypted using homomorphic encryption technology, and then encrypted according to data acquisition rules and public keys; for functional partitions with a privacy level lower than a preset threshold, the data is directly encrypted according to data acquisition rules and public keys.

9. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 6 is characterized in that: The security management and control center divides all applications inside the distribution terminal into monitoring partitions, control partitions and analysis partitions according to their functions. The monitoring partition is used to collect and monitor the operating status and environmental information of the distribution terminal in real time. The control partition is used to receive and execute control commands to ensure the normal operation of the distribution terminal. The analysis partition is used to perform in-depth analysis and modeling of the collected data to provide decision support and optimization suggestions.

10. The power distribution terminal internal data security sharing system based on lightweight attribute encryption according to claim 6 is characterized in that: The system also includes an audit module for recording and auditing all access requests and operations, and generating access log records, operation log records and audit reports.

Images