Key distribution and identity authentication method for power distribution network protection multicast message system

Abstract

The invention discloses a key distribution and identity authentication method for a power distribution network protection multicast message system. The method comprises a key initialization process, an initial key distribution process and an identity authentication process. Wherein the key initialization process comprises three steps of generating and distributing a master key pair, generating a key based on an identifier, and transmitting a user key pair. The initial key distribution process comprises two steps of initial key generation and initial key distribution. The identity authentication process comprises two steps of signature based on accurate time and verification based on accurate time difference. According to the invention, rapid key distribution and identity authentication in the multicast environment can be realized, the network interaction flow for key distribution and identity authentication is reduced, and the method is suitable for the multicast environment of the power distribution protection device. By implementing the method, safety protection can be performed on the multicast message, so that the safety of the multicast information of the power distribution protection device is ensured, and the requirement of low time delay of information transmission is met.

Description

Technical Field

[0001] The present invention relates to a method for transmitting digital information, and in particular to a method for securely transmitting digital information. Background Art

[0002] The multicast communication system is a communication mechanism that allows information to be transmitted from one or more senders to multiple receivers in the network at the same time. It is used for the communication of horizontal GOOSE messages in the distribution network protection system. In the traditional distribution network protection system, the communication of horizontal GOOSE messages is carried out through wired media such as optical fiber. With the development of 5G technology and the gradual improvement of 5G networks, 5G networks can perform intelligent analysis and respond to abnormal information in real time. Therefore, 5G technology is used in the distribution network protection system to achieve faster and more accurate power grid control.

[0003] However, information transmission through the 5G network of wireless communication will face more severe security threats, so it is necessary to ensure that only authorized users can join specific multicast groups or receive multicast data. Therefore, for the multicast environment, it is necessary to introduce an authentication mechanism to verify the identity of the user and decide whether the user is allowed to join the multicast network based on predefined policies. Secondly, it is also necessary to protect the multicast data from tampering and eavesdropping during transmission, such as using encryption technology to prevent unauthorized users from reading the content. Therefore, in the multicast environment, it is necessary to design key distribution and authentication methods for the multicast network to ensure the security of information transmission in the multicast environment. Summary of the invention

[0004] Purpose of the invention: In view of the above-mentioned prior art, a key distribution and identity authentication method for a distribution network protection multicast message system is proposed, which can realize rapid key distribution and identity authentication in a decentralized multicast communication network.

[0005] Technical solution: A key distribution and identity authentication method for a distribution network protection multicast message system, wherein each network node communicates in a group manner, including a group security node and a plurality of sub-nodes; the method comprises:

[0006] Step 1: The group security node obtains the identification information of its device, generates a master public key and a master private key, and securely transmits the master public key to each child node;

[0007] Step 2: Each child node generates its own public key and private key based on the identification information in its own device;

[0008] Step 3: Each child node encrypts its own public key and the identification information of its own device based on the master public key distributed by the group security node, and transmits the encrypted information to the group security node. The group security node then receives the encrypted information and decrypts it using the master private key.

[0009] Step 4: The group security node generates the initial session key of each node through a hash algorithm based on the identification information of all node devices it obtains, the current timestamp information and the random amount;

[0010] Step 5: The group security node distributes the initial session keys of all nodes to each child node based on the public key information of each node, and then each child node decrypts based on its own private key to obtain the initial session keys of all nodes;

[0011] Step 6: When the sub-nodes in the network reach the point where identity authentication is required, each sub-node uses its own private key to sign the identification information of its own device and the time information of the authentication moment, and then passes the signed information to the group security node;

[0012] Step 7: After receiving the signature information sent by the child node, the group security node uses the public key of the child node for verification, and then compares the time information at the authentication moment and the difference between the timestamp information. When the absolute value of the difference between the two is less than the threshold and the identification information of the device is accurate, the group security node completes the identity authentication of the child node.

[0013] Furthermore, in step 1, the secure transmission is based on wired transmission or manual copying.

[0014] Furthermore, in step 1, the identification information of the device is obtained based on the MAC address, IP address, and motherboard number of the device.

[0015] Furthermore, in step 4 and step 7, the timestamp information is standard clock information obtained by the satellite positioning navigation module through the satellite navigation signal.

[0016] Furthermore, in step 6 and step 7, the signing and verification is to sign the transmitted information using the private key of the asymmetric encryption algorithm, and to verify the received information using the public key of the asymmetric encryption algorithm.

[0017] Furthermore, in step 7: the threshold is the maximum transmission delay tolerated by the multicast network.

[0018] Furthermore, in step 1, the identification information of the device is based on the MAC address of the power distribution protection device to which it is connected and its own MAC address for connecting to the power distribution protection device. After the two sets of MAC addresses are converted into binary bits, they are spliced ​​to obtain the identification information of the device.

[0019] Furthermore, in step 1, the identification information of the device is based on the MAC address of the power distribution protection device to which it is connected and its own MAC address used to connect to the power distribution protection device. After the two groups of MAC addresses are converted into binary bits, XOR processing is performed to obtain the identification information of the device.

[0020] Furthermore, in step 1, the master public key and the master private key are generated by an asymmetric encryption and decryption algorithm, or by an asymmetric encryption algorithm.

[0021] Furthermore, in step 4, the hash algorithm is an algorithm that generates a fixed-length result based on an input sequence of arbitrary length.

[0022] Beneficial effects: The method of the present invention includes a key initialization process, an initial key distribution process and an identity authentication process. The key initialization process includes three steps: generating and distributing a master key pair, generating keys based on identifiers, and transferring user key pairs. The initial key distribution process includes two steps: initial key generation and initial key distribution. The identity authentication process includes two steps: signature based on accurate time and verification based on accurate time difference. This method can realize fast key distribution and identity authentication in a multicast environment, reduce network interaction traffic for key distribution and identity authentication, and is suitable for the multicast environment of distribution protection devices. By implementing this method, multicast messages can be securely protected to ensure the security of multicast information of distribution protection devices and meet the requirements of low latency in information transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 is a general flow chart of the method of the present invention;

[0024] Figure 2 A flowchart of generating and distributing a master key pair during the key initialization process in the method of the present invention;

[0025] Figure 3 A schematic diagram of a method for obtaining a device identifier based on a MAC address;

[0026] Figure 4 A schematic diagram of the process of generating a key based on an identifier and transmitting a user key pair during the key initialization process in the method of the present invention;

[0027] Figure 5 Schematic diagram of the process of initial key distribution in the method of the present invention;

[0028] Figure 6 Schematic diagram of the identity authentication process in the method of the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0030] The distribution protection device needs to send multicast messages during operation. With the development of 5G technology, the distribution protection device will be able to send multicast messages based on wireless communication. However, eavesdropping attacks and counterfeit attacks often occur in wireless environments. Therefore, it is necessary to perform security protection on multicast messages to ensure the security of the multicast information of the distribution protection device. In addition, since the information sent by the distribution protection device has high requirements for latency, the security protection of the distribution protection device needs to ensure that its processing latency is low.

[0031] In this embodiment, it is assumed that there are 4 distribution protection devices in the network, and each distribution protection device is equipped with a communication node device, which are respectively recorded as nodes A, B, C, and D. These 4 distribution protection devices are in the same group and need to transmit information to each other through multicast. Among these 4 distribution protection devices, node A is the group security node of the group, which is responsible for coordinating the security of the entire group. The 4 distribution protection devices can obtain accurate system time based on the timing module.

[0032] like Figure 1 As shown, this method includes a key initialization process, an initial key distribution process, and an identity authentication process. The key initialization process includes three steps: generating and distributing a master key pair, generating a key based on an identifier, and delivering a user key pair. The initial key distribution process includes two steps: initial key generation and initial key distribution. The identity authentication process includes two steps: signing based on accurate time and verifying based on accurate time difference.

[0033] First, each node in the group performs a key initialization process. Figure 2 The process of generating and distributing the master key pair in the key initialization process of the present invention is shown as follows:

[0034] During the key initialization process, group security node A can obtain the identification information ID of its device A , generate the master public key and the master private key like Figure 3 As shown, the device identification information ID A The acquisition can be based on the MAC address of the power distribution protection device to which it is connected and the MAC address of itself used to connect to the power distribution protection device. After converting the two sets of MAC addresses into binary bits, they are spliced ​​to obtain the device identification information ID A ; or convert the two sets of MAC addresses into binary bits and perform XOR processing to obtain the device identification information ID A The master public key and the master private key can be generated by an asymmetric encryption and decryption algorithm, such as SM2, SM9 and other national secret algorithms, or by an asymmetric encryption algorithm such as RSA. In addition, the device identification information can also be replaced by an IP address other than the MAC address, a motherboard number, etc.

[0035] The master public key and master private key are trusted by the entire group and can be used safely by the entire group. Node A transmits the identification information ID A , Generate a master public key and the master private key All or part of the information is transmitted to nodes B, C, and D.

[0036] like Figure 2 As shown, node A will identify the information ID A , Generate a master public key and the master private key To nodes B, C, and D. Considering that different encryption algorithms require different information, node A can also only generate the master public key Delivered to nodes B, C, and D. Among them, the secure delivery method includes a method based on wired transmission or a method based on manual copying.

[0037] After completing the generation and distribution of the master key pair during the key initialization process, it is necessary to implement identity-based key generation and user key pair delivery. Figure 4 As shown, each node in the group except node A (node ​​B, C, D) is based on its device identification information ID B 、ID C 、ID D Generate respective public keys and private key The generation method can also use the above-mentioned asymmetric encryption and decryption algorithm or asymmetric encryption algorithm. Then, nodes B, C, and D use the master public key distributed by group security node A to generate the key. The public key generated for it And the device's identification information ID B 、ID C 、ID D After encryption, it is transmitted to node A. The specific processing process is as follows:

[0038] Node B,

[0039] Node C,

[0040] Node D, in, It represents the encrypted information of nodes B, C, and D, E() represents the encryption algorithm, and | | represents concatenation. Here, it means that the public key and identification information are concatenated and encrypted and sent.

[0041] Node A uses its master private key Decrypt and obtain the transmitted information. The specific processing process is as follows:

[0042] Node B information,

[0043] Node C information,

[0044] Information of node D, Where D() represents the decryption algorithm. The encryption and decryption algorithms are asymmetric encryption and decryption algorithms, such as SM2, SM9 and other national secret algorithms or asymmetric encryption algorithms such as RSA.

[0045] After the processing is completed, group security node A obtains the identification information ID of all other nodes in the group B 、ID C , IDD and public key information

[0046] After completing the key initialization process, the group will distribute the initial key. The implementation process is as follows: Figure 5 As shown. Group security node A obtains the ID information of all nodes based on the ID B 、ID C 、ID D , select the accurate timestamp information transmitted by the current timing module The initial session key of each node is generated by the hash algorithm H() and the random amount X generated by itself. The specific process is as follows:

[0047] Node B,

[0048] Node C,

[0049] Node D, in, They are the initial session keys of nodes B, C, and D respectively. The hash algorithm is an algorithm that generates a fixed-length result based on an input sequence of any length, such as the SM3 national encryption algorithm. Accurate timestamp information It can be standard clock information obtained by Beidou module or other satellite positioning and navigation modules through satellite navigation signals. The random quantity X is a random number generated based on an existing random algorithm, and there are no other requirements for the random number.

[0050] Node A uses the identification information ID A , timestamp information and the random amount X generated by itself, and the initial session key The initial session key K in the group Ses1 Contains the initial session key for each node in the group generated by node A:

[0051]

[0052] Group security node A obtains the public key information of all nodes Distribute the initial session key within the group to each node. The specific process is as follows:

[0053] Node B,

[0054] Node C,

[0055] Node D, in, They represent the encrypted ciphertext of nodes B, C, and D respectively.

[0056] Each node in the group is based on its own private key Decryption obtains the initial session key of all nodes, that is, the initial session key within the group. The specific processing process is as follows:

[0057] Node B,

[0058] Node C,

[0059] Node D,

[0060] Through the above processing flow, all nodes in the group obtain the initial session key of each node in the group.

[0061] When it is necessary to authenticate the devices in the group, the implementation process is as follows: Figure 6 When nodes B, C, and D in the network reach the point where they need to authenticate themselves, they use their private keys based on the exact time. Its identification information ID B 、ID C 、ID D and time information Signing, the specific implementation process is as follows:

[0062] Node B,

[0063] Node C,

[0064] Node D, Among them, S B , S C , S D Respectively represent the information signed by nodes B, C, and D.

[0065] Nodes B, C, and D pass the signed information to group security node A. After receiving the signed information sent by nodes B, C, and D, group security node A authenticates the information. Use the public keys of nodes B, C, and D Verify, the specific process is as follows:

[0066] Node B information,

[0067] Node C information,

[0068] Information of node D,

[0069] Node A is based on accurate timestamp information Compare the time information transmitted by nodes B, C, and D and When time information and the exact time of node A Error Less than the threshold T Thres And the device identification information ID B 、ID C 、ID D When everything is correct, node A completes the identity authentication of nodes B, C, and D. Among them, the threshold T Thres It can be the maximum transmission delay that the multicast network can tolerate.

[0070] The above description is only a preferred embodiment of the present invention and cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A key distribution and identity authentication method for a distribution network protection multicast message system, characterized in that: Each node in the network communicates in a group manner, including a group security node and a plurality of sub-nodes; the method includes: Step 1: The group security node obtains the identification information of its device, generates a master public key and a master private key, and securely transmits the master public key to each child node; Step 2: Each child node generates its own public key and private key based on the identification information in its own device; Step 3: Each child node encrypts its own public key and the identification information of its own device based on the master public key distributed by the group security node, and transmits the encrypted information to the group security node. The group security node then receives the encrypted information and decrypts it using the master private key. Step 4: The group security node generates the initial session key of each node through a hash algorithm based on the identification information of all node devices it obtains, the current timestamp information and the random amount; Step 5: The group security node distributes the initial session keys of all nodes to each child node based on the public key information of each node, and then each child node decrypts based on its own private key to obtain the initial session keys of all nodes; Step 6: When the sub-nodes in the network reach the point where identity authentication is required, each sub-node uses its own private key to sign the identification information of its own device and the time information of the authentication moment, and then passes the signed information to the group security node; Step 7: After receiving the signature information sent by the child node, the group security node uses the public key of the child node for verification, and then compares the time information at the authentication moment and the difference between the timestamp information. When the absolute value of the difference between the two is less than the threshold and the identification information of the device is accurate, the group security node completes the identity authentication of the child node.

2. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 1, characterized in that: In the step 1, the secure transmission is based on wired transmission or manual copying.

3. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 1, characterized in that: In step 1, the identification information of the device is obtained based on the MAC address, IP address, and motherboard number of the device.

4. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 1, characterized in that: In step 4 and step 7, the timestamp information is standard clock information obtained by the satellite positioning navigation module through the satellite navigation signal.

5. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 1, characterized in that: In step 6 and step 7, the signing and verification are to sign the transmitted information using the private key of the asymmetric encryption algorithm, and to verify the received information using the public key of the asymmetric encryption algorithm.

6. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 1, characterized in that: In step 7: the threshold is the maximum transmission delay tolerated by the multicast network.

7. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 3, characterized in that: In step 1, the identification information of the device is based on the MAC address of the power distribution protection device to which it is connected and its own MAC address for connecting to the power distribution protection device. After the two groups of MAC addresses are converted into binary bits, they are spliced ​​to obtain the identification information of the device.

8. The key distribution and identity authentication method for the distribution network protection multicast message system according to claim 3, characterized in that: In step 1, the identification information of the device is based on the MAC address of the power distribution protection device to which it is connected and its own MAC address for connecting to the power distribution protection device. After the two groups of MAC addresses are converted into binary bits, an XOR process is performed to obtain the identification information of the device.

9. The key distribution and identity authentication method for a distribution network protection multicast message system according to any one of claims 1 to 8, characterized in that: In step 1, the master public key and the master private key are generated by an asymmetric encryption and decryption algorithm, or by an asymmetric encryption algorithm.

10. The key distribution and identity authentication method for a distribution network protection multicast message system according to claim 1 or 4, characterized in that: In step 4, the hash algorithm is an algorithm that generates a fixed-length result based on an input sequence of any length.

Images