Power distribution terminal operation and maintenance safety protection method, system and equipment based on physical characteristics

Abstract

The invention discloses a power distribution terminal operation and maintenance safety protection method, system and equipment based on physical characteristics, and the method comprises the steps: enabling an operation and maintenance handheld device and a power distribution terminal to achieve the near-field protection based on the physical characteristics and a Z algorithm, and enabling the power distribution terminal and a master station to achieve the remote safety protection based on the physical characteristics through load flow calculation and operation and maintenance instructions. Wherein the operation and maintenance handheld device carries out bidirectional identity authentication on the handheld device and the power distribution terminal by combining a handheld device identifier ID, a user password P and a registration region with a random parameter X and utilizing an algorithm instance Z. According to the method, the operation and maintenance handheld device performs encryption and decryption authentication by using the algorithm instance Z, so that data security and identity security are ensured, and partition and domain division use of the operation and maintenance handheld device is realized; the power distribution terminal and the master station perform remote safety protection by adopting load flow calculation and operation and maintenance instructions based on physical characteristics, so that instruction misjudgment and judgment omission can be effectively reduced, dynamic and efficient encryption is realized, the operation and maintenance stability of the power distribution terminal is improved, and the operation and maintenance data safety is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of information security protection technology for power distribution terminal operation and maintenance, and in particular to a power distribution terminal operation and maintenance security protection method, system and equipment based on physical characteristics. Background Art

[0002] With the development of digitalization, traditional industrial systems have become more complex, the linkage between the information side and the physical side has become increasingly close, and the coupling between the two has increased. The separate protection system is no longer suitable for the development needs of the existing distribution network. At the same time, in recent years, the distribution terminal has been continuously updated and upgraded, with more types and functions. It is an important secondary equipment in the distribution network and an important object of distribution network security protection. In the process of deep integration of power information, it is necessary to improve the perception, monitoring and defense capabilities of the operation and maintenance of the distribution terminal.

[0003] The distribution terminal is mainly responsible for collecting real-time data information and fault information during the operation of the distribution equipment, receiving control commands from the master station, and adjusting the corresponding equipment. With the development of power distribution Internet of Things technology, the distribution terminal has gradually shown the characteristics of Internet of Things, with the function of edge computing, which can process local data more efficiently and realize the coordination of perception, collection and edge computing.

[0004] In recent years, the Internet of Things for power distribution has developed rapidly. In order to realize online status perception, local autonomous computing, and data fusion applications, terminal devices including smart terminals such as station terminals (TTU), station terminals (DTU), and feeder terminals (FTU) are connected to the power grid. However, with the promotion of smart distribution network construction and the increase in the number of distribution terminals, its operation and maintenance security faces challenges. Since the terminals are deployed in a scattered manner and directly contact users, the physical environment and network environment are complex and changeable, which is an important link that is difficult to implement effective management and a new weak point in security protection. The distribution terminal is connected to the main station at the top and the power physical equipment at the bottom. It is the key security protection target of the cloud-edge-end collaborative system. Once it is breached, the main station and physical equipment connected to it will be affected. Therefore, the security protection method applied to the operation and maintenance of intelligent terminals in the distribution network is an issue that needs to be studied urgently.

[0005] The operation and maintenance of distribution terminals can include near-field operation and maintenance and remote operation and maintenance. Among them, the online operation and maintenance problems of the terminal can be checked and solved through the remote monitoring system of the master station. When the terminal is offline or cannot be maintained remotely through the master station, the operation and maintenance personnel need to communicate at close range and perform on-site maintenance. In order to ensure the safety of the operation and maintenance of the distribution terminal, based on the principle of network-specific and vertical authentication, a protection architecture of distribution master station-dedicated network communication-distribution terminal is built, such as Figure 1 shown.

[0006] In the remote operation and maintenance of terminals, digital certificates and encryption chip technologies are often used. Among them, the power distribution master station is a multifunctional integrated system integrating management, scheduling, computing, monitoring and other functions, and is also the main deployment area of ​​the remote operation and maintenance system. The master station collects operation and maintenance information such as parameter configuration and terminal data from the terminal through the gateway and communication network, and monitors the normal operation of the terminal and equipment. The remote operation and maintenance information interaction between the master station and the terminal generally adopts the method of vertical encryption authentication to realize information encryption and two-way identity authentication to ensure the confidentiality and integrity of the data and the security of the remote operation and maintenance of the terminal. The power distribution terminal mainly uses power optical fiber communication. For the terminal distribution terminals that do not have the conditions for optical fiber communication, wireless private network / public network communication is adopted; both are based on asymmetric national secret algorithm security chips and digital certificates to realize the two-way head operation and maintenance communication security with the master station and gateway. At the same time, when subjected to external attacks, the terminal attack is identified and monitored by deploying intrusion detection devices to reduce the occurrence of security risks.

[0007] During terminal near-field operation and maintenance, Figure 2 As shown, the access of operation and maintenance tools is required, which is usually achieved by on-site personnel operating the operation and maintenance handheld device through a serial port or a short-range wireless communication method (such as Bluetooth communication) and using a simple user password authentication protection measure to achieve security authentication.

[0008] The on-site operation and maintenance of the power distribution terminal adopts traditional protection methods. The operation and maintenance handheld game console is connected to the power distribution terminal via Bluetooth, and a simple static user password is used to achieve user authentication. In this identity authentication system based on simple passwords, users often choose simple and easy-to-remember weak passwords for the sake of ease of memory, and always reuse them. It is very vulnerable to risks such as guessing attacks, offline dictionary attacks, and brute force attacks, making it difficult to ensure data security and identity security. Secondly, since the password is determined by the user, the handheld game console and the power distribution terminal can be randomly paired, and the operation and maintenance handheld game consoles in different regions can be interconnected to the power distribution terminal, and it is impossible to use them in different areas. Not only is management confusing, but it may also cause theft risks.

[0009] During the remote operation and maintenance of the terminal, the master station monitors the operation of the terminal and collects information, and issues operation and maintenance instructions such as restarting the terminal, collecting data, and modifying parameters. In general, when a terminal is attacked, encryption chips and intrusion detection devices are used to protect the terminal's operation and maintenance communications and detect network attacks. However, with the risk interaction and integration of the physical side and the information space and the limitations of the terminal's own computing power, encryption chips based on static algorithms and intrusion detection devices that mainly monitor network-side information are difficult to cover the operation and maintenance security of a large number of terminals economically and comprehensively. Most of the existing master station monitoring and protection measures are aimed at attacks on the information side, and do not take into account the operating laws and constraints of the physical system. For example, the execution of irregular instructions, erroneous instructions, and repeated instructions will also cause certain security risks. Therefore, for similar problems, it is difficult for existing remote defense methods to prevent such phenomena.

[0010] Due to the complex on-site environment of the operation and maintenance of distribution terminals, there are problems such as inconvenient operation and maintenance channel connection, unfriendly methods, non-standardized processes, easy misoperation, and untraceable maintenance process. The existing protection methods are relatively simple and cannot meet the safety protection needs of the operation and maintenance of a large number of distribution terminals.

[0011] In summary, the existing on-site operation and maintenance of power distribution terminals uses simple static user passwords to achieve user authentication, which is very vulnerable to guessing attacks, offline dictionary attacks, and brute force attacks, making it difficult to ensure data security and identity security. In addition, since the password is determined by the user, the handheld device and the power distribution terminal can be randomly paired, and it is impossible to use them in different areas, resulting in chaotic management and the risk of theft. In addition, the existing protection methods are relatively simple and cannot meet the security protection needs of the operation and maintenance of a large number of power distribution terminals. Summary of the invention

[0012] In order to solve the problem that the existing on-site operation and maintenance of power distribution terminals uses simple static user passwords to achieve user authentication, which is very vulnerable to guessing attacks, offline dictionary attacks, and brute force attacks, making it difficult to ensure data security and identity security, and because the password is determined by the user, the handheld device and the power distribution terminal can be randomly paired, and it is impossible to use them in different areas, resulting in chaotic management and the risk of theft. In addition, the existing protection means are relatively simple and cannot meet the security protection needs of a large number of power distribution terminal operations and maintenance. The present invention proposes a terminal operation and maintenance security protection method based on the physical characteristics of the equipment, including:

[0013] Send the handheld device ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identifier R returned by the power distribution terminal;

[0014] Send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal;

[0015] Encryption and decryption authentication is performed using algorithm instance Z through the handheld device identification ID, user password P and registration area, and the operation and maintenance handheld device is authenticated in combination with the random parameter X;

[0016] The encrypted information Y2 sent by the power distribution terminal is received, and the power distribution terminal is authenticated based on the handheld device identification ID, the authentication time T, the user password P, the authentication region identification R and the encrypted information Y2.

[0017] Optionally, the encryption and decryption authentication is performed using the handheld device identification ID, the user password P and the registration area using the algorithm instance Z, and the operation and maintenance handheld device is authenticated in combination with the random parameter X, including:

[0018] The authentication information and the authentication region identifier R are encrypted by using the handheld device identifier ID, the user password P and the registration region using the algorithm instance Z to obtain the identity authentication identifier Y1;

[0019] The algorithm instance Z is used again to reversely decrypt the identity authentication identifier Y1 to obtain a random number X0;

[0020] The random number X0 is compared with the random parameter X. If they are equal, the operation and maintenance handheld device passes the authentication and generates a session key. Otherwise, the operation and maintenance handheld device fails the authentication.

[0021] Optionally, the authentication of the power distribution terminal based on the handheld device ID, the authentication time T, the user password P, the authentication region ID R and the encrypted information Y2 includes:

[0022] Calculate the authentication identifier Y3 generated by the operation and maintenance handheld device based on the handheld device identifier ID, authentication time T, user password P and authentication region identifier R;

[0023] The authentication mark Y3 generated by the operation and maintenance handheld device is compared with the encrypted information Y2. If they are the same, the power distribution terminal passes the authentication, otherwise the power distribution terminal fails the authentication.

[0024] On the other hand, the present application further provides an operation and maintenance handheld device, wherein the operation and maintenance handheld device is used for:

[0025] Send the handheld device ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identifier R returned by the power distribution terminal;

[0026] Send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal;

[0027] Encryption and decryption authentication is performed using algorithm instance Z through the handheld device identification ID, user password P and registration area, and the operation and maintenance handheld device is authenticated in combination with the random parameter X;

[0028] The encrypted information Y2 sent by the power distribution terminal is received, and the power distribution terminal is authenticated based on the handheld device identification ID, the authentication time T, the user password P, the authentication region identification R and the encrypted information Y2.

[0029] On the other hand, the present application also provides a power distribution terminal operation and maintenance safety protection method based on physical characteristics, including:

[0030] Based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device, the algorithm generator generates an encryption algorithm instance Z and an authentication area identification R, and returns them to the operation and maintenance handheld device after storage;

[0031] Receive the handheld device identification ID and authentication time T sent again by the operation and maintenance handheld device, and send a random parameter X to the operation and maintenance handheld device;

[0032] Calculate the encrypted information Y2 using the encryption algorithm instance Z based on the handheld device ID, authentication time T, user password P and authentication region ID R, and send the encrypted information Y2 to the operation and maintenance handheld device;

[0033] Receive remote operation and maintenance start-up instructions from the master station and collect information and physical data at time t;

[0034] The information and physical data are divided into upload data and storage data, the upload data is encrypted based on the key CEK at time t-1 in the local key library, and the encrypted upload data is transmitted to the master station;

[0035] Receive the encrypted operation and maintenance instruction issued by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK to obtain the operation and maintenance instruction;

[0036] Determining whether to issue a warning based on the operation and maintenance instructions and the information and physical data;

[0037] The key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm.

[0038] Optionally, the determining whether to issue a warning based on the operation and maintenance instruction and the information and physical data includes:

[0039] Based on the operation and maintenance reason and the operation and maintenance operation instruction, combined with the information and physical data, determine whether the operation and maintenance reason is consistent with the current environment, and whether the operation and maintenance operation instruction is consistent with the operation and maintenance reason;

[0040] When the operation and maintenance reason is consistent with the current environment and the operation and maintenance operation instruction is consistent with the operation and maintenance reason, it is determined whether the decrypted operation and maintenance instruction is the same as the remote operation and maintenance start instruction issued by the master station. If they are not the same, a deviation is calculated or a warning is issued. Otherwise, normal operation is performed without issuing a warning.

[0041] The operation and maintenance instructions include operation and maintenance reasons and operation and maintenance operation instructions.

[0042] Optionally, the method of generating an encryption algorithm instance Z and an authentication region identifier R based on the handheld device identifier ID, user password P and registration region combined with an algorithm generator sent by the operation and maintenance handheld device includes:

[0043] Generate a user key K based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device;

[0044] Based on the user key K and the algorithm generator, an encryption algorithm instance Z and an authentication region identifier R are generated.

[0045] On the other hand, the present application also provides a power distribution terminal, which is used for:

[0046] Based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device, the algorithm generator generates an encryption algorithm instance Z and an authentication area identification R, and returns them to the operation and maintenance handheld device after storage;

[0047] Receive the handheld device identification ID and authentication time T sent again by the operation and maintenance handheld device, and send a random parameter X to the operation and maintenance handheld device;

[0048] Calculate the encrypted information Y2 using the encryption algorithm instance Z based on the handheld device ID, authentication time T, user password P and authentication region ID R, and send the encrypted information Y2 to the operation and maintenance handheld device;

[0049] Receive the remote operation and maintenance start-up command issued by the master station, collect information and physical data; divide the information and physical data into upload data and storage data, encrypt the upload data based on the key CEK at time t-1 in the local key library, and transmit the encrypted upload data to the master station;

[0050] Receive the encrypted operation and maintenance instruction sent by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK at the time t-1 to obtain the operation and maintenance instruction;

[0051] Determining whether to issue a warning based on the operation and maintenance instructions and the information and physical data;

[0052] The key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm.

[0053] On the other hand, the present application also provides a power distribution terminal operation and maintenance safety protection method based on physical characteristics, including:

[0054] Issue remote operation and maintenance start instructions to the power distribution terminal;

[0055] Receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption;

[0056] Based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal;

[0057] The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

[0058] Optionally, the master station communication key CEK at time t-1 stored in the dynamic key library *The formation includes:

[0059] Reconstructing the voltage and amplitude at time t-1 based on the decrypted uploaded data at time t-1 combined with power flow calculation;

[0060] The master station communication key CEK at time t-1 is formed by a hash algorithm based on the voltage and amplitude at time t-1 * ;

[0061] The uploaded data includes the active power and reactive power at time t-1.

[0062] On the other hand, the present application also provides a master station, which is used for:

[0063] Issue remote operation and maintenance start instructions to the power distribution terminal;

[0064] Receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption;

[0065] Based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal;

[0066] The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

[0067] On the other hand, the present application also provides a power distribution terminal operation and maintenance safety protection system based on physical characteristics, including:

[0068] The operation and maintenance handheld device is used to send the handheld device identification ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identification R returned by the power distribution terminal; send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal; perform encryption and decryption authentication using the algorithm instance Z through the handheld device identification ID, user password P and registration area, and authenticate the operation and maintenance handheld device in combination with the random parameter X; receive the encrypted information Y2 sent by the power distribution terminal, and authenticate the power distribution terminal based on the handheld device identification ID, authentication time T, user password P, authentication area identification R and encrypted information Y2;

[0069] The power distribution terminal is used to generate an encryption algorithm instance Z and an authentication region identifier R based on the handheld identification ID, user password P and registration region sent by the operation and maintenance handheld in combination with an algorithm generator, and return the encryption algorithm instance Z and the authentication region identifier R to the operation and maintenance handheld after storage; receive the handheld identification ID and authentication time T sent again by the operation and maintenance handheld, and send a random parameter X to the operation and maintenance handheld; calculate the encryption information Y2 using the encryption algorithm instance Z based on the handheld identification ID, authentication time T, user password P and authentication region identifier R, and send the encrypted information Y2 to the operation and maintenance handheld; receive the remote operation and maintenance start instruction issued by the master station, collect information and physical data; and divide the information and physical data into upload data and storage data, encrypt the upload data based on the key CEK at time t-1 in the local key library, and transmit the encrypted upload data to the master station; receive the encrypted operation and maintenance instruction issued by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK at time t-1 to obtain the operation and maintenance instruction; determine whether to issue a warning based on the operation and maintenance instruction and the information and physical data;

[0070] The master station is used to issue remote operation and maintenance start instructions to the distribution terminal; receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption; based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal;

[0071] Among them, the key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm;

[0072] The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

[0073] In another aspect, the present application further provides a computing device, comprising: one or more processors;

[0074] a processor for executing one or more programs;

[0075] When the one or more programs are executed by the one or more processors, a power distribution terminal operation and maintenance safety protection method based on physical characteristics as described above is implemented.

[0076] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed, it implements a distribution terminal operation and maintenance safety protection method based on physical characteristics as described above.

[0077] Compared with the prior art, the present invention has the following beneficial effects:

[0078] The present invention provides a terminal operation and maintenance security protection method based on the physical characteristic attributes of the equipment, including sending a handheld identification ID, a user password P and a registration area to a power distribution terminal, and receiving an encryption algorithm instance Z and an authentication area identifier R returned by the power distribution terminal; sending the handheld identification ID and the authentication time T to the power distribution terminal again, and receiving a random parameter X sent by the power distribution terminal; performing encryption and decryption authentication using the algorithm instance Z through the handheld identification ID, the user password P and the registration area, and authenticating the operation and maintenance handheld itself in combination with the random parameter X; receiving the encrypted information Y2 sent by the power distribution terminal, and authenticating the power distribution terminal based on the handheld identification ID, the authentication time T, the user password P, the authentication area identifier R and the encrypted information Y2. The present invention uses the operation and maintenance handheld to perform encryption and decryption authentication using the algorithm instance Z, which can ensure data security and identity security; the present invention not only uses the user password, but also combines the handheld identification and the registration area for pairing, which can realize the use of partitions and domains; and the present invention not only authenticates the operation and maintenance handheld, but also authenticates the power distribution terminal, and finally meets the security protection requirements of the power distribution terminal operation and maintenance through two-way authentication.

[0079] The present invention not only realizes near-field operation and maintenance by the operation and maintenance handheld device and the power distribution terminal, but also realizes remote operation and maintenance composed of the master station and the power distribution terminal. The master station issues a remote operation and maintenance start instruction to the power distribution terminal, and the master station communication key CEK at time t-1 in the dynamic key library is used to start the remote operation and maintenance. * The operation and maintenance instructions are encrypted and sent to the distribution terminal, which decrypts the key CEK at time t-1 in the local key library to determine whether the information has been leaked and issue a warning. The present invention is based on the operation and maintenance instructions formed by the operation and maintenance reasons and operations, and takes into account the operating laws and environmental constraints of the physical system to avoid the execution of repeated instructions, erroneous instructions and non-standard instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 It is the protection architecture of power distribution master station-private network communication-power distribution terminal in the prior art;

[0081] Figure 2 This is a near-field operation and maintenance access diagram in the prior art;

[0082] Figure 3 This is a flow chart of the power distribution terminal operation and maintenance safety protection method based on physical characteristics of the present invention;

[0083] Figure 4 This is a design diagram of the power distribution terminal operation and maintenance safety solution of the present invention;

[0084] Figure 5 This is the near field operation and maintenance access communication authentication process of the present invention;

[0085] Figure 6 It is the remote operation and maintenance solution based on physical features of the present invention;

[0086] Figure 7 This is a flow chart of determining illegal operation and maintenance instructions of the present invention. DETAILED DESCRIPTION

[0087] According to the existing operation and maintenance safety measures of the power distribution terminal, the present invention combines the characteristics of remote operation and maintenance and near-field operation and maintenance of the power distribution terminal, and proposes a power distribution terminal operation and maintenance safety protection method based on physical characteristics, which mainly solves the following safety problems existing in the remote and on-site operation and maintenance of the power distribution terminal:

[0088] (1) Security issues of simple static user passwords during the process of accessing the operation and maintenance handheld device to the terminal in near-field operation and maintenance;

[0089] (2) The distribution terminals and the operation and maintenance handheld devices are randomly allocated and paired, and there is no way to manage the operation and maintenance security in different areas;

[0090] (3) Failure to consider the operating rules of the physical system and environmental constraints, such as the execution of irregular instructions, erroneous instructions, and repeated instructions, which may cause certain safety risks;

[0091] The operation and maintenance security solution is designed to improve the operation and maintenance protection system of the master station-distribution terminal-operation and maintenance handheld device, and to ensure the security protection of communication authentication, monitoring and other links during the remote operation and maintenance of the distribution terminal and the near-field operation and maintenance.

[0092] Embodiment 1:

[0093] A distribution terminal operation and maintenance security protection method based on physical characteristics, which is applied to operation and maintenance handheld devices, such as Figure 3 As shown, including:

[0094] Step 1: Send the handheld device ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identifier R returned by the power distribution terminal;

[0095] Step 2: Send the handheld device ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal;

[0096] Step 3: Encrypt and decrypt the handheld device using the algorithm instance Z through the handheld device identification ID, user password P and registration area, and authenticate the operation and maintenance handheld device in combination with the random parameter X;

[0097] Step 4: Receive the encrypted information Y2 sent by the power distribution terminal, and authenticate the power distribution terminal based on the handheld device identification ID, authentication time T, user password P, authentication area identification R and the encrypted information Y2.

[0098] Among them, in step 3, the encryption and decryption authentication is performed by using the handheld device identification ID, the user password P and the registration area using the algorithm instance Z, and the operation and maintenance handheld device is authenticated in combination with the random parameter X, including:

[0099] The authentication information and the authentication region identifier R are encrypted by using the handheld device identifier ID, the user password P and the registration region using the algorithm instance Z to obtain the identity authentication identifier Y1;

[0100] The algorithm instance Z is used again to reversely decrypt the identity authentication identifier Y1 to obtain a random number X0;

[0101] The random number X0 is compared with the random parameter X. If they are equal, the operation and maintenance handheld device passes the authentication and generates a session key. Otherwise, the operation and maintenance handheld device fails the authentication.

[0102] In step 4, the encrypted information Y2 sent by the power distribution terminal is received, and the power distribution terminal is authenticated based on the handheld device ID, the authentication time T, the user password P, the authentication area identifier R and the encrypted information Y2, including:

[0103] Calculate the authentication identifier Y3 generated by the operation and maintenance handheld device based on the handheld device identifier ID, authentication time T, user password P and authentication region identifier R;

[0104] The authentication mark Y3 generated by the operation and maintenance handheld device is compared with the encrypted information Y2. If they are the same, the power distribution terminal passes the authentication, otherwise the power distribution terminal fails the authentication.

[0105] The Z algorithm involved in the present invention is a lightweight cryptographic algorithm that integrates user keys and algorithms. The formed key generates an algorithm instance through a nonlinear algorithm generator and can realize dynamic algorithm updates within a period of time, so that different users have different algorithm instances for each authentication, reducing the risk of user key leakage.

[0106] The Z algorithm is applied to the near-field operation and maintenance scenario of the power distribution terminal. The idea is that after the operation and maintenance handheld device is connected, an independent algorithm instance Z is first formed through the device parameters of the power distribution terminal (area ID, device serial number ID, user ID), and then the algorithm is used to encrypt the authentication information layer by layer during the authentication process. Finally, the session key is generated for near-field operation and maintenance after successful authentication.

[0107] Example 2

[0108] In another aspect, the present invention further provides an operation and maintenance handheld device, wherein the operation and maintenance handheld device is used for:

[0109] Send the handheld device ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identifier R returned by the power distribution terminal;

[0110] Send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal;

[0111] Encryption and decryption authentication is performed using algorithm instance Z through the handheld device identification ID, user password P and registration area, and the operation and maintenance handheld device is authenticated in combination with the random parameter X;

[0112] The encrypted information Y2 sent by the power distribution terminal is received, and the power distribution terminal is authenticated based on the handheld device identification ID, the authentication time T, the user password P, the authentication region identification R and the encrypted information Y2.

[0113] Furthermore, the specific steps for the operation and maintenance console to authenticate itself include:

[0114] The authentication information and the authentication region identifier R are encrypted by using the handheld device identifier ID, the user password P and the registration region using the algorithm instance Z to obtain the identity authentication identifier Y1;

[0115] The algorithm instance Z is used again to reversely decrypt the identity authentication identifier Y1 to obtain a random number X0;

[0116] The random number X0 is compared with the random parameter X. If they are equal, the operation and maintenance handheld device passes the authentication and generates a session key. Otherwise, the operation and maintenance handheld device fails the authentication.

[0117] Furthermore, the operation and maintenance handheld device's authentication of the power distribution terminal specifically includes:

[0118] Calculate the authentication identifier Y3 generated by the operation and maintenance handheld device based on the handheld device identifier ID, authentication time T, user password P and authentication region identifier R;

[0119] The authentication mark Y3 generated by the operation and maintenance handheld device is compared with the encrypted information Y2. If they are the same, the power distribution terminal passes the authentication, otherwise the power distribution terminal fails the authentication.

[0120] Embodiment 3:

[0121] On the other hand, the present invention also provides a distribution terminal operation and maintenance safety protection method based on physical characteristics, which is applied to the distribution terminal and includes:

[0122] Based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device, the algorithm generator generates an encryption algorithm instance Z and an authentication area identification R, and returns them to the operation and maintenance handheld device after storage;

[0123] Receive the handheld device identification ID and authentication time T sent again by the operation and maintenance handheld device, and send a random parameter X to the operation and maintenance handheld device;

[0124] Calculate the encrypted information Y2 using the encryption algorithm instance Z based on the handheld device ID, authentication time T, user password P and authentication region ID R, and send the encrypted information Y2 to the operation and maintenance handheld device;

[0125] Receive remote operation and maintenance start-up instructions from the master station and collect information and physical data at time t;

[0126] The information and physical data are divided into upload data and storage data, the upload data is encrypted based on the key CEK at time t-1 in the local key library, and the encrypted upload data is transmitted to the master station;

[0127] Receive the encrypted operation and maintenance instruction issued by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK to obtain the operation and maintenance instruction;

[0128] Determining whether to issue a warning based on the operation and maintenance instructions and the information and physical data;

[0129] The key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm.

[0130] Further, the determining whether to issue a warning based on the operation and maintenance instruction and the information and physical data includes:

[0131] Based on the operation and maintenance reason and the operation and maintenance operation instruction, combined with the information and physical data, determine whether the operation and maintenance reason is consistent with the current environment, and whether the operation and maintenance operation instruction is consistent with the operation and maintenance reason;

[0132] When the operation and maintenance reason is consistent with the current environment and the operation and maintenance operation instruction is consistent with the operation and maintenance reason, it is determined whether the decrypted operation and maintenance instruction is the same as the remote operation and maintenance start instruction issued by the master station. If they are not the same, a deviation is calculated or a warning is issued. Otherwise, normal operation is performed without issuing a warning.

[0133] The operation and maintenance instructions include operation and maintenance reasons and operation and maintenance operation instructions.

[0134] Furthermore, the handheld device identification ID, user password P and registration area combined with the algorithm generator sent by the operation and maintenance handheld device to generate the encryption algorithm instance Z and the authentication area identification R include:

[0135] Generate a user key K based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device;

[0136] Based on the user key K and the algorithm generator, an encryption algorithm instance Z and an authentication region identifier R are generated.

[0137] Embodiment 4:

[0138] In another aspect, the present invention further provides a power distribution terminal, the power distribution terminal being used for:

[0139] Based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device, the algorithm generator generates an encryption algorithm instance Z and an authentication area identification R, and returns them to the operation and maintenance handheld device after storage;

[0140] Receive the handheld device identification ID and authentication time T sent again by the operation and maintenance handheld device, and send a random parameter X to the operation and maintenance handheld device;

[0141] Calculate the encrypted information Y2 using the encryption algorithm instance Z based on the handheld device ID, authentication time T, user password P and authentication region ID R, and send the encrypted information Y2 to the operation and maintenance handheld device;

[0142] Receive the remote operation and maintenance start-up command issued by the master station, collect information and physical data; divide the information and physical data into upload data and storage data, encrypt the upload data based on the key CEK at time t-1 in the local key library, and transmit the encrypted upload data to the master station;

[0143] Receive the encrypted operation and maintenance instruction sent by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK at the time t-1 to obtain the operation and maintenance instruction;

[0144] Determining whether to issue a warning based on the operation and maintenance instructions and the information and physical data;

[0145] The key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm.

[0146] Furthermore, the power distribution terminal generates the encryption algorithm instance Z and the authentication region identifier R specifically including:

[0147] Generate a user key K based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device;

[0148] Based on the user key K and the algorithm generator, an encryption algorithm instance Z and an authentication region identifier R are generated.

[0149] Further, the power distribution terminal determines whether to issue a warning based on the operation and maintenance instruction and the information and physical data, specifically including:

[0150] Based on the operation and maintenance reason and the operation and maintenance operation instruction, combined with the information and physical data, determine whether the operation and maintenance reason is consistent with the current environment, and whether the operation and maintenance operation instruction is consistent with the operation and maintenance reason;

[0151] When the operation and maintenance reason is consistent with the current environment and the operation and maintenance operation instruction is consistent with the operation and maintenance reason, it is determined whether the decrypted operation and maintenance instruction is the same as the remote operation and maintenance start instruction issued by the master station. If they are not the same, a deviation is calculated or a warning is issued. Otherwise, normal operation is performed without issuing a warning.

[0152] The operation and maintenance instructions include operation and maintenance reasons and operation and maintenance operation instructions.

[0153] Embodiment 5:

[0154] On the other hand, the present invention also provides a distribution terminal operation and maintenance safety protection method based on physical characteristics, which is applied to a master station and includes:

[0155] Issue remote operation and maintenance start instructions to the power distribution terminal;

[0156] Receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption;

[0157] Based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal;

[0158] The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

[0159] Furthermore, the master station communication key CEK at time t-1 stored in the dynamic key library * The formation includes:

[0160] Reconstructing the voltage and amplitude at time t-1 based on the decrypted uploaded data at time t-1 combined with power flow calculation;

[0161] The key CEK at time t-1 is formed by a hash algorithm based on the voltage and amplitude at time t-1. * ;

[0162] The uploaded data includes the active power and reactive power at time t-1.

[0163] Embodiment 6:

[0164] In another aspect, the present invention further provides a master station, the master station being used for:

[0165] Issue remote operation and maintenance start instructions to the power distribution terminal;

[0166] Receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption;

[0167] Based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal;

[0168] The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

[0169] Furthermore, the master station forms the master station communication key CEK stored in the dynamic key library at time t-1 * The specific steps include:

[0170] Reconstructing the voltage and amplitude at time t-1 based on the decrypted uploaded data at time t-1 combined with power flow calculation;

[0171] The master station communication key CEK at time t-1 is formed by a hash algorithm based on the voltage and amplitude at time t-1 * ;

[0172] The uploaded data includes the active power and reactive power at time t-1.

[0173] Embodiment 7:

[0174] On the other hand, the present invention also provides a power distribution terminal operation and maintenance safety protection system based on physical characteristics, including:

[0175] The operation and maintenance handheld device is used to send the handheld device identification ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identification R returned by the power distribution terminal; send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal; perform encryption and decryption authentication using the algorithm instance Z through the handheld device identification ID, user password P and registration area, and authenticate the operation and maintenance handheld device in combination with the random parameter X; receive the encrypted information Y2 sent by the power distribution terminal, and authenticate the power distribution terminal based on the handheld device identification ID, authentication time T, user password P, authentication area identification R and encrypted information Y2;

[0176] The power distribution terminal is used to generate an encryption algorithm instance Z and an authentication region identifier R based on the handheld identification ID, user password P and registration region sent by the operation and maintenance handheld in combination with an algorithm generator, and return the encryption algorithm instance Z and the authentication region identifier R to the operation and maintenance handheld after storage; receive the handheld identification ID and authentication time T sent again by the operation and maintenance handheld, and send a random parameter X to the operation and maintenance handheld; calculate the encryption information Y2 using the encryption algorithm instance Z based on the handheld identification ID, authentication time T, user password P and authentication region identifier R, and send the encrypted information Y2 to the operation and maintenance handheld; receive the remote operation and maintenance start instruction issued by the master station, collect information and physical data; and divide the information and physical data into upload data and storage data, encrypt the upload data based on the key CEK at time t-1 in the local key library, and transmit the encrypted upload data to the master station; receive the encrypted operation and maintenance instruction issued by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK at time t-1 to obtain the operation and maintenance instruction; determine whether to issue a warning based on the operation and maintenance instruction and the information and physical data;

[0177] The master station is used to issue remote operation and maintenance start instructions to the distribution terminal; receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption; based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal;

[0178] Among them, the key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm;

[0179] The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

[0180] Furthermore, the specific steps for the operation and maintenance console to authenticate itself include:

[0181] The authentication information and the authentication region identifier R are encrypted by using the handheld device identifier ID, the user password P and the registration region using the algorithm instance Z to obtain the identity authentication identifier Y1;

[0182] The algorithm instance Z is used again to reversely decrypt the identity authentication identifier Y1 to obtain a random number X0;

[0183] The random number X0 is compared with the random parameter X. If they are equal, the operation and maintenance handheld device passes the authentication and generates a session key. Otherwise, the operation and maintenance handheld device fails the authentication.

[0184] Furthermore, the operation and maintenance handheld device's authentication of the power distribution terminal specifically includes:

[0185] Calculate the authentication identifier Y3 generated by the operation and maintenance handheld device based on the handheld device identifier ID, authentication time T, user password P and authentication region identifier R;

[0186] The authentication mark Y3 generated by the operation and maintenance handheld device is compared with the encrypted information Y2. If they are the same, the power distribution terminal passes the authentication, otherwise the power distribution terminal fails the authentication.

[0187] Furthermore, the power distribution terminal generates the encryption algorithm instance Z and the authentication region identifier R specifically including:

[0188] Generate a user key K based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device;

[0189] Based on the user key K and the algorithm generator, an encryption algorithm instance Z and an authentication region identifier R are generated.

[0190] Further, the power distribution terminal determines whether to issue a warning based on the operation and maintenance instruction and the information and physical data, specifically including:

[0191] Based on the operation and maintenance reason and the operation and maintenance operation instruction, combined with the information and physical data, determine whether the operation and maintenance reason is consistent with the current environment, and whether the operation and maintenance operation instruction is consistent with the operation and maintenance reason;

[0192] When the operation and maintenance reason is consistent with the current environment and the operation and maintenance operation instruction is consistent with the operation and maintenance reason, it is determined whether the decrypted operation and maintenance instruction is the same as the remote operation and maintenance start instruction issued by the master station. If they are not the same, a deviation is calculated or a warning is issued. Otherwise, normal operation is performed without issuing a warning.

[0193] The operation and maintenance instructions include operation and maintenance reasons and operation and maintenance operation instructions.

[0194] Furthermore, the master station forms the master station communication key CEK stored in the dynamic key library at time t-1 * The specific steps include:

[0195] Reconstructing the voltage and amplitude at time t-1 based on the decrypted uploaded data at time t-1 combined with power flow calculation;

[0196] The master station communication key CEK at time t-1 is formed by a hash algorithm based on the voltage and amplitude at time t-1 * ;

[0197] The uploaded data includes the active power and reactive power at time t-1.

[0198] Embodiment 8:

[0199] The present invention focuses on two main aspects: near-field operation and maintenance and remote operation and maintenance, involving security strategies such as operation and maintenance communication security, remote status monitoring, and illegal behavior restriction. Figure 4 The solution of the present invention is introduced in detail.

[0200] (1) Near-field operation and maintenance

[0201] The near-field operation and maintenance security issues of distribution terminals mainly focus on the authentication and communication security level between the distribution terminals and the operation and maintenance handheld devices. The static operation and maintenance security strategy is mainly based on existing encryption chips and digital certificates, while the dynamic operation and maintenance security strategy adopts a dynamic authentication mechanism based on the lightweight Z algorithm instead of a simple password method.

[0202] The present invention applies the Z algorithm to the near-field operation and maintenance scenario of the power distribution terminal. The idea is that after the operation and maintenance handheld device is connected, an independent algorithm instance Z is first formed through the device parameters (region ID, device serial number ID, user ID) of the power distribution terminal, and then the algorithm instance Z is used to encrypt the authentication information layer by layer during the authentication process. Finally, the session key is generated for near-field operation and maintenance after the authentication is successful. The specific access communication authentication process is described as follows: Figure 5 As shown:

[0203] 1) Algorithm generation stage

[0204] The operation and maintenance handheld device sends the handheld device identification ID (including user ID, hardware serial number H), user password P, and registration area to the distribution terminal; the distribution terminal generates a user key K based on the above parameters, and injects the key into the algorithm generator to generate an encryption algorithm instance Z and an authentication area identification R, which are stored and returned to the handheld device.

[0205] 2) Handheld device certification stage

[0206] The operation and maintenance handheld device sends the identification ID and authentication time T again; the power distribution terminal responds and sends a random parameter X; the handheld device uses the existing parameters and the algorithm instance Z to encrypt the authentication information to obtain Y1=Z(Z(Z(X)+P)+ID+R) and send it to the power distribution terminal, and uses the Z algorithm to reversely decrypt Y1 again to obtain the random X0, which is compared with the sent X value. If they are equal, the handheld device authentication is passed and a session key is generated; the power distribution terminal side calculates Y2=Z(Z(Z(T)+P)+ID+R) and sends it to the handheld device. After receiving it, the handheld device calculates the authentication identifier Y3=Z(Z(Z(T)+P)+ID+R) generated by the operation and maintenance handheld device using the known storage parameters and compares it with Y2. If they are equal, the power distribution terminal also passes the authentication.

[0207] The communication authentication process uses the Z algorithm to achieve two-way authentication security of the equipment during the near-field operation and maintenance process, and the communication uses the generated Y2 as the session key to further ensure the communication security of the operation and maintenance. At the same time, the algorithm Z that integrates the user ID, area ID and device ID not only meets the requirements of device zoning and domaining, reduces equipment management risks, but also ensures the uniqueness of user authentication and improves the near-field operation and maintenance security system of the distribution terminal.

[0208] (2) Remote Operation and Maintenance

[0209] In the remote operation and maintenance link, the present invention designs a dynamic power flow calculation encryption method based on physical characteristics and an illegal instruction judgment program, which are mainly deployed on the master station and distribution terminal side. The main functions are:

[0210] 1) Monitor the operation and maintenance process of distribution terminals, collect and analyze information and physical characteristics, and detect external attacks and risks;

[0211] 2) Encrypt the collected operation and maintenance information to ensure the security of information data;

[0212] 3) For illegal operation and maintenance instructions, set up basic judgment procedures to reduce the probability of executing erroneous instructions.

[0213] The above three functions can realize all-round and multi-level real-time terminal operation and maintenance detection, cooperate with the operation and maintenance platform and basic safety protection measures of the distribution network, and improve the remote operation and maintenance system of the distribution terminal. The specific implementation process is as follows Figure 6 :

[0214] During the operation and maintenance of the power distribution terminal, the terminal operation and maintenance monitoring module will remain turned on for routine testing.

[0215] The master station issues a remote operation and maintenance start command to the distribution terminal;

[0216] The distribution terminal receives instructions and collects the equipment model, operating data (such as voltage, current, power, load, etc.) and IP, flow and other information and physical data of the distribution terminal at time t.

[0217] The distribution terminal divides the collected data into two parts: upload data and storage data, which are uploaded to the main station as the basis for analyzing the security environment and retained in the local data of the terminal for generating keys.

[0218] The key is mainly formed by the power flow data collected by the system. Taking the PQ node as an example, the uploaded data includes the active power P at time t. t , reactive power Q t , other operation and information, physical monitoring data, etc., the stored data includes voltage amplitude V t , phase angle θ t wait.

[0219] The stored data is transformed through a hash algorithm to form the key CEK and stored in the local key library.

[0220] It is worth noting that in order to prevent data redundancy and key theft in the key library, only the keys formed at time t and time t-1 are stored in the key library. The key library here includes the local key library and the dynamic key library. The key at time t-1 is used to encrypt the uploaded data at time t. t 、Reactive power Q t It is mainly used to form a key at the master station. According to the basic principles of power flow calculation and operation and maintenance instructions, it can be t , Q t The value calculation reconstructs V t * ,θ t * , after reconstruction, V t * ,θ t * Form the master station communication key CEK * , and the master station communication key CEK * Add to the dynamic key library. Use the master station communication key CEK at time t-1 in the dynamic key library. * Encrypt the instruction at time t.

[0221] Using the master station communication key CEK * Decrypt data encrypted by the local CEK. Both can be used to encrypt and decrypt operation and maintenance instructions sent by the master station. If they are different, it proves that the calculation is biased or the data has been modified by an attack. A warning should be issued and the key generation process should be repeated. If the set limit is exceeded, the system needs to be blocked.

[0222] The information and physical data contained in the uploaded data, such as IP and traffic data, are often used to monitor whether external virus attacks are received, such as DOS attacks. This type of attack continuously sends access requests to the server, which will cause the traffic to increase to more than the normal value in an instant. Similarly, replay attacks and other types of attacks that use external computers to replace servers to steal information will cause IP addresses to change, which will cause the risk of changes in normal values. Monitoring these abnormal phenomena can effectively prevent some external attacks.

[0223] Similarly, the physical characteristics of some equipment have corresponding unique identification functions, such as equipment code, physical address, model, capacity, etc. When accessing the system, these information models can be compared to see if they meet the information requirements entered in the database to prevent the current equipment from being impersonated. Collecting some data with physical characteristics of the distribution terminal, such as physical path, equipment parameters and other physical attribute information can better prevent illegal identity access; similarly, whether some operating signals with physical characteristics, such as voltage, current, power, etc., are within the parameter limit of the equipment is also one of the criteria for judgment. The process of analyzing the current and voltage flow is not only a means of generating keys, but also an important indicator to ensure the smooth operation and maintenance process.

[0224] In order to reduce the execution rate of illegal operation and maintenance instructions, a simple judgment procedure needs to be set up on the distribution terminal side. Its main concept is as follows: Figure 7 :

[0225] The operation and maintenance instructions here are also called causal instructions. The judgment of causal instructions tends to be real-time judgment and has certain logical judgment functions. The master station sends an operation and maintenance instruction C, which contains the detailed operation and maintenance reason R and the operation command O. It is encrypted and transmitted to the distribution terminal side through the above-mentioned key CEK. The distribution terminal decrypts R and O, and makes a reasonable judgment on the operation and maintenance reason through the judgment program to determine whether it is consistent with the actual situation or whether the operation is currently high-risk.

[0226] The causal instruction can judge whether the operation reason + operation entered by the operation personnel is in line with the current environment. The current environment is determined based on the uploaded data. When the operation reason is in line with the current environment, it is also necessary to judge whether the operation instruction is in line with the operation reason. For example, if the operation personnel send an instruction because the equipment is damaged and the switch needs to be turned on, the program first determines whether the equipment is damaged. If not, the instruction will not be executed; if the current switch is already turned on, it will not be executed, and the situation and reason will be recorded and returned to the main station for further inspection; if it is consistent with the actual situation, the operation instruction will be executed through judgment and uploaded to the main station in real time. This method can effectively reduce the execution rate of illegal instructions such as repeated instructions and wrong instructions.

[0227] The present invention comprehensively improves the operation and maintenance safety of distribution terminals: This operation and maintenance safety strategy is divided into near-field operation and maintenance and remote operation and maintenance, which respectively take into account the current situation of lack of high-level security measures for short-range Bluetooth operation and maintenance of distribution terminals and the single security measures for remote operation and maintenance, and use advanced encryption algorithms and technologies to improve the operation and maintenance safety system of distribution terminals.

[0228] in:

[0229] (1) In terms of near-field operation and maintenance security: By replacing the insecure simple password encryption with a partition key based on the Z algorithm, the communication security of the handheld power distribution terminal is better guaranteed; at the same time, this method further considers the use of partitions and domains of the power distribution terminal, which helps to improve the management level of the equipment.

[0230] (2) In terms of remote operation and maintenance security: The present invention considers the dynamic encryption method of the operation and maintenance instructions of the master station and the distribution terminal, the comprehensive security analysis method based on information and physical attributes, and the causal instruction judgment strategy. This combined strategy, in conjunction with the existing encryption chip and intrusion detection device, can effectively reduce the misjudgment and missed judgment of instructions, and the simple and secure transmission encryption mechanism reduces the requirements for computing resources and complexity, realizes dynamic and efficient encryption, and at the same time increases the stability of the distribution terminal operation and maintenance and enhances the security of the operation and maintenance data.

[0231] Embodiment 9:

[0232] Based on the same inventive concept, the present invention also provides a computer device, which includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of a distribution terminal operation and maintenance safety protection method based on physical characteristics in the above embodiment.

[0233] Embodiment 10:

[0234] Based on the same inventive concept, the present invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It can be understood that the computer-readable storage medium here can include both built-in storage media in a computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the steps of a distribution terminal operation and maintenance safety protection method based on physical characteristics in the above embodiment.

[0235] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0236] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0237] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0238] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0239] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A power distribution terminal operation and maintenance safety protection method based on physical characteristics, characterized in that: include: Send the handheld device ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identifier R returned by the power distribution terminal; Send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal; Encryption and decryption authentication is performed using algorithm instance Z through the handheld device identification ID, user password P and registration area, and the operation and maintenance handheld device is authenticated in combination with the random parameter X; The encrypted information Y2 sent by the power distribution terminal is received, and the power distribution terminal is authenticated based on the handheld device identification ID, the authentication time T, the user password P, the authentication region identification R and the encrypted information Y2.

2. The method according to claim 1, characterized in that The method of encrypting and decrypting the handheld device using the handheld device identification ID, the user password P and the registered area using the algorithm instance Z, and authenticating the operation and maintenance handheld device in combination with the random parameter X, includes: The authentication information and the authentication region identifier R are encrypted by using the handheld device identifier ID, the user password P and the registration region using the algorithm instance Z to obtain the identity authentication identifier Y1; The algorithm instance Z is used again to reversely decrypt the identity authentication identifier Y1 to obtain a random number X0; The random number X0 is compared with the random parameter X. If they are equal, the operation and maintenance handheld device passes the authentication and generates a session key. Otherwise, the operation and maintenance handheld device fails the authentication.

3. The method according to claim 1, characterized in that The method of authenticating the power distribution terminal based on the handheld device ID, authentication time T, user password P, authentication area ID R and encrypted information Y2 includes: Calculate the authentication identifier Y3 generated by the operation and maintenance handheld device based on the handheld device identifier ID, authentication time T, user password P and authentication region identifier R; The authentication mark Y3 generated by the operation and maintenance handheld device is compared with the encrypted information Y2. If they are the same, the power distribution terminal passes the authentication, otherwise the power distribution terminal fails the authentication.

4. A handheld operation and maintenance console, characterized in that: The operation and maintenance handheld device is used for: Send the handheld device ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identifier R returned by the power distribution terminal; Send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal; Encryption and decryption authentication is performed using algorithm instance Z through the handheld device identification ID, user password P and registration area, and the operation and maintenance handheld device is authenticated in combination with the random parameter X; The encrypted information Y2 sent by the power distribution terminal is received, and the power distribution terminal is authenticated based on the handheld device identification ID, the authentication time T, the user password P, the authentication region identification R and the encrypted information Y2.

5. A power distribution terminal operation and maintenance safety protection method based on physical characteristics, characterized in that: include: Based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device, the algorithm generator generates an encryption algorithm instance Z and an authentication area identification R, and returns them to the operation and maintenance handheld device after storage; Receive the handheld device identification ID and authentication time T sent again by the operation and maintenance handheld device, and send a random parameter X to the operation and maintenance handheld device; Calculate the encrypted information Y2 using the encryption algorithm instance Z based on the handheld device ID, authentication time T, user password P and authentication region ID R, and send the encrypted information Y2 to the operation and maintenance handheld device; Receive remote operation and maintenance start-up instructions from the master station and collect information and physical data at time t; The information and physical data are divided into upload data and storage data, the upload data is encrypted based on the key CEK at time t-1 in the local key library, and the encrypted upload data is transmitted to the master station; Receive the encrypted operation and maintenance instruction issued by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK to obtain the operation and maintenance instruction; Determining whether to issue a warning based on the operation and maintenance instructions and the information and physical data; The key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm.

6. The method according to claim 5, characterized in that The determining whether to issue a warning based on the operation and maintenance instruction and the information and physical data includes: Based on the operation and maintenance reason and the operation and maintenance operation instruction, combined with the information and physical data, determine whether the operation and maintenance reason is consistent with the current environment, and whether the operation and maintenance operation instruction is consistent with the operation and maintenance reason; When the operation and maintenance reason is consistent with the current environment and the operation and maintenance operation instruction is consistent with the operation and maintenance reason, it is determined whether the decrypted operation and maintenance instruction is the same as the remote operation and maintenance start instruction issued by the master station. If they are not the same, a deviation is calculated or a warning is issued. Otherwise, normal operation is performed without issuing a warning. The operation and maintenance instructions include operation and maintenance reasons and operation and maintenance operation instructions.

7. The method according to claim 5, characterized in that The method of generating an encryption algorithm instance Z and an authentication region identifier R based on the handheld device identification ID, user password P and registration region combined algorithm generator sent by the operation and maintenance handheld device includes: Generate a user key K based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device; Based on the user key K and the algorithm generator, an encryption algorithm instance Z and an authentication region identifier R are generated.

8. A power distribution terminal, characterized in that: The power distribution terminal is used for: Based on the handheld device identification ID, user password P and registration area sent by the operation and maintenance handheld device, the algorithm generator generates an encryption algorithm instance Z and an authentication area identification R, and returns them to the operation and maintenance handheld device after storage; Receive the handheld device identification ID and authentication time T sent again by the operation and maintenance handheld device, and send a random parameter X to the operation and maintenance handheld device; Calculate the encrypted information Y2 using the encryption algorithm instance Z based on the handheld device ID, authentication time T, user password P and authentication region ID R, and send the encrypted information Y2 to the operation and maintenance handheld device; Receive the remote operation and maintenance start-up command issued by the master station, collect information and physical data; divide the information and physical data into upload data and storage data, encrypt the upload data based on the key CEK at time t-1 in the local key library, and transmit the encrypted upload data to the master station; Receive the encrypted operation and maintenance instruction sent by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK at the time t-1 to obtain the operation and maintenance instruction; Determining whether to issue a warning based on the operation and maintenance instructions and the information and physical data; The key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm.

9. A power distribution terminal operation and maintenance safety protection method based on physical characteristics, characterized in that: include: Issue remote operation and maintenance start instructions to the power distribution terminal; Receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption; Based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal; The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

10. The method according to claim 9, characterized in that The master station communication key CEK at time t-1 stored in the dynamic key library * The formation includes: Reconstructing the voltage and amplitude at time t-1 based on the decrypted uploaded data at time t-1 combined with power flow calculation; The master station communication key CEK at time t-1 is formed by a hash algorithm based on the voltage and amplitude at time t-1 * ; The uploaded data includes the active power and reactive power at time t-1.

11. A master station, characterized in that: The master station is used for: Issue remote operation and maintenance start instructions to the power distribution terminal; Receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption; Based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal; The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

12. A power distribution terminal operation and maintenance safety protection system based on physical characteristics, characterized in that: include: The operation and maintenance handheld device is used to send the handheld device identification ID, user password P and registration area to the power distribution terminal, and receive the encryption algorithm instance Z and authentication area identification R returned by the power distribution terminal; send the handheld device identification ID and authentication time T to the power distribution terminal again, and receive the random parameter X sent by the power distribution terminal; perform encryption and decryption authentication using the algorithm instance Z through the handheld device identification ID, user password P and registration area, and authenticate the operation and maintenance handheld device in combination with the random parameter X; Receive the encrypted information Y2 sent by the power distribution terminal, and authenticate the power distribution terminal based on the handheld device ID, authentication time T, user password P, authentication area ID R and the encrypted information Y2; The power distribution terminal is used to generate an encryption algorithm instance Z and an authentication region identifier R based on the handheld identification ID, user password P and registration region sent by the operation and maintenance handheld in combination with an algorithm generator, and return the encryption algorithm instance Z and the authentication region identifier R to the operation and maintenance handheld after storage; receive the handheld identification ID and authentication time T sent again by the operation and maintenance handheld, and send a random parameter X to the operation and maintenance handheld; calculate the encryption information Y2 using the encryption algorithm instance Z based on the handheld identification ID, authentication time T, user password P and authentication region identifier R, and send the encrypted information Y2 to the operation and maintenance handheld; receive the remote operation and maintenance start instruction issued by the master station, collect information and physical data; and divide the information and physical data into upload data and storage data, encrypt the upload data based on the key CEK at time t-1 in the local key library, and transmit the encrypted upload data to the master station; receive the encrypted operation and maintenance instruction issued by the master station, and decrypt the encrypted operation and maintenance instruction based on the key CEK at time t-1 to obtain the operation and maintenance instruction; determine whether to issue a warning based on the operation and maintenance instruction and the information and physical data; The master station is used to issue remote operation and maintenance start instructions to the distribution terminal; receive the encrypted upload data sent by the distribution terminal, and based on the master station communication key CEK stored in the dynamic key library at time t-1 * Decryption; based on the master station communication key CEK at time t-1 stored in the dynamic key library * Encrypting the operation and maintenance instructions at time t, and transmitting the encrypted operation and maintenance instructions at time t to the power distribution terminal; Among them, the key CEK at time t-1 in the local key library is formed by transforming the stored data at time t-1 through a hash algorithm; The master station communication key CEK at time t-1 stored in the dynamic key library * It is formed based on the decrypted uploaded data at time t-1 combined with power flow calculation.

13. A computer device, characterized in that: include: one or more processors; The processor is used to store one or more programs; When the one or more programs are executed by the one or more processors, the distribution terminal operation and maintenance safety protection method based on physical characteristics as described in any one of claims 1 to 3, 5 to 7, and 9 to 10 is implemented.

14. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, it implements the distribution terminal operation and maintenance safety protection method based on physical characteristics as described in any one of claims 1 to 3, 5 to 7, and 9 to 10.

Images