Encryption method and device based on power distribution terminal security chip, computer equipment and storage medium

Abstract

The invention relates to an encryption method based on a security chip of a power distribution terminal, which comprises the following steps: acquiring storage information of storage equipment of the power distribution terminal, and dividing the storage equipment into a plurality of storage units according to the storage information; the first dispersed key is stored in the security chip, and the multiple second dispersed keys are sequentially stored in the storage units; obtaining a performance index of the security chip, and determining a combination mode of the first disperse key and the second disperse key according to the performance index; and combining the first dispersed key and the second dispersed key according to the combination mode to obtain a target key. The matched encryption modes are adopted for the security chips with different performances, so that the security of the files of the power distribution switch monitoring terminal is improved, and the situation that the memory occupancy rate of the power distribution terminal is high due to the fact that the encryption modes are too complex is avoided.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an encryption method, device, computer equipment and storage medium based on a power distribution terminal security chip. Background Art

[0002] With the rapid development of the power industry, the construction and transformation of smart grids have also expanded rapidly. In smart grids, the distribution switch monitoring terminal (FTU) is an indispensable part, which can realize remote monitoring and control, thereby improving the efficiency and quality of the power system. FTU deployment is often deployed externally, so it is particularly important for FTU to strengthen the security of internally stored files.

[0003] In order to improve the security of files, encryption is currently used. However, due to the limited performance of the chip used by FTU, there are problems such as how to process and store the encryption key when encrypting files, and the storage speed becomes slower after encryption. If full software encryption is used, security will be reduced, and full software encryption will lead to reduced performance. For existing FTU equipment, how to use it directly without modifying the hardware? Summary of the invention

[0004] The purpose of the present invention is to provide an encryption method based on a power distribution terminal security chip to solve the problems raised in the above background technology.

[0005] A first aspect of the present invention provides an encryption method based on a power distribution terminal security chip, comprising:

[0006] S1. Obtain storage information of a storage device of a power distribution terminal, and divide the storage device into a plurality of storage units according to the storage information;

[0007] S2, storing the distributed key 1 in the security chip, and storing the plurality of distributed keys 2 in each of the storage units in sequence;

[0008] S3, obtaining a performance indicator of the security chip, and determining a combination method of the distributed key 1 and the distributed key 2 according to the performance indicator;

[0009] S4. Combine the distributed key 1 and the distributed key 2 according to the combination method to obtain a target key.

[0010] In a possible implementation, step S2 includes:

[0011] The storage unit is divided into an encryption area and a non-encryption area, and the distributed key 2 is stored in the encryption area.

[0012] In a possible implementation, step S3 includes:

[0013] A preset encryption mode table is obtained, and a combination mode of the security chip is determined according to a position of a performance parameter of the security chip in the encryption mode table.

[0014] In a possible implementation, it is determined whether the performance index of the security chip reaches a preset threshold value. If the preset threshold value is reached, the distributed key 1 and the distributed key 2 are combined to obtain an intermediate key, and a hash algorithm is applied to convert the intermediate key to obtain the target key.

[0015] Otherwise, the distributed key 1 and the distributed key 2 are combined to obtain the target key.

[0016] In a possible implementation, combining the distributed key 1 and the distributed key 2 to obtain the target key includes:

[0017] The same part of the distributed key 1 and the distributed key 2 is extracted, a combination mode of the distributed key 1 and the distributed key 2 is determined according to the same part, and the target key is obtained after combining them according to the combination mode.

[0018] In a possible implementation, combining the distributed key 1 and the distributed key 2 to obtain the target key includes:

[0019] Determine the numbering system used by the distributed key 1 and the distributed key 2, and if the numbering system is decimal, add the distributed key 1 and the distributed key 2 to obtain the target key;

[0020] If the number system is binary, the target key is obtained by removing the same parts of the distributed key 1 and the distributed key 2.

[0021] A second aspect of the present invention provides an encryption device based on a power distribution terminal security chip, comprising:

[0022] A security chip for storing a distributed key;

[0023] A storage device, used for storing a second distributed key;

[0024] A processing device, used to collect the performance of the security chip, and determine the combination of the distributed key 1 and the distributed key 2 according to the performance index of the security chip, and obtain the target key according to the combination;

[0025] The security chip, the storage device and the processing device are electrically connected.

[0026] The third aspect of the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the encryption method based on the power distribution terminal security chip as described in the first aspect of the present invention is implemented.

[0027] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the encryption method based on the power distribution terminal security chip as described in the first aspect of the present invention.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. By using matching encryption methods for security chips with different performance, the security of the distribution switch monitoring terminal files is improved, and the memory usage of the distribution terminal will not be high due to the overly complex encryption method;

[0030] 2. The asymmetric key of the security chip on the distribution switch monitoring terminal can be directly used for hardware encryption without modifying the hardware, which can reduce costs and directly upgrade the original equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a flow chart of the encryption method based on the power distribution terminal security chip of the present invention;

[0032] Figure 2 It is a structural schematic diagram of an encryption device based on a power distribution terminal security chip of the present invention;

[0033] Figure 3 FIG. 4 is a schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] It should be noted that the serial numbers assigned to the components in the embodiments of the present invention, such as "first" and "second", are only used to distinguish the objects being described and do not have any order or technical meaning.

[0036] For the distribution terminal, encryption needs to be implemented in the process of ensuring normal operation. Traditionally, a single key is used for encryption, but this encryption method has low security and cannot guarantee the security of each storage unit of the distribution terminal. Once the key is decrypted, the overall security of the distribution terminal is threatened. However, if a collaborative key is used for encryption, it will be limited by the performance of the security chip and the storage device of the distribution terminal, which will affect the normal operation of the distribution terminal. Therefore, the existing encryption method must be improved to meet the needs of the distribution terminal.

[0037] Combine the following Figure 1 An encryption method based on a power distribution terminal security chip of the present invention is described.

[0038] An encryption method based on a power distribution terminal security chip, comprising:

[0039] S1. Obtain storage information of a storage device of a power distribution terminal, and divide the storage device into a plurality of storage units according to the storage information;

[0040] Specifically, in the present invention, the storage device of the power distribution terminal can be a low-priced, small-sized memory such as nandflash, norflash or sd card. This is because the configuration of the power distribution terminal is relatively low, and it is impossible and unnecessary to use a high-performance memory.

[0041] S2, storing the distributed key 1 in the security chip, and storing the plurality of distributed keys 2 in each of the storage units in sequence;

[0042] Specifically, the storage device is divided into different storage units according to the type of stored information. Each storage unit stores data codes that implement a certain function. In order to ensure the security of each storage unit, each storage unit needs to be encrypted. Therefore, each storage unit is divided into an encryption area and a non-encryption area. The encryption area is used to store distributed key 2, and the non-encryption area is used to store data for normal operation.

[0043] Taking nandflash as an example, each storage unit contains (2K+64bytes), 2K is used to store normal working data, and 64bytes is used to store distributed key 2.

[0044] S3, obtaining a performance indicator of the security chip, and determining a combination method of the distributed key 1 and the distributed key 2 according to the performance indicator;

[0045] Among them, the performance of the chip varies greatly due to different manufacturing processes, and the equipment needs to consider the layout and heat dissipation of other devices when using the chip. Therefore, for the distribution terminal, only a security chip with lower performance can be used for encryption, so that the encryption process occupies the low performance of the entire distribution terminal and does not affect the normal operation of the distribution terminal. In the present invention, the SM2 security chip on the FTU is preferentially used for encryption, and the original equipment can be directly upgraded without modifying the hardware, reducing costs. Distributed key one can be stored in the security chip as a master key, and there are multiple distributed keys two, each of which is different and stored in each storage unit. When reading data, first read the distributed key one, and then call the distributed key two of the storage unit according to the position of the storage unit to be retrieved, and finally combine the distributed key one and the distributed key two for decryption to read the data stored in the storage unit.

[0046] S4. Combine the distributed key 1 and the distributed key 2 according to the combination method to obtain a target key.

[0047] Among them, the combination method of the distributed keys is related to the performance of the security chip and the storage device of the distribution terminal. If the performance is high, a complex combination method is used to increase security, and if the performance is low, a simple combination method is used so as not to affect the normal operation of the distribution terminal.

[0048] In one embodiment, when selecting the combination of the distributed key 1 and the distributed key 2 according to the performance index, the following method can be used:

[0049] A preset encryption mode table is obtained, and a combination mode of the security chip is determined according to a position of a performance parameter of the security chip in the encryption mode table.

[0050] The performance of the security chip is listed according to the performance parameters, and then the performance of different security chips is matched with the performance indicators in the encryption method table. If a performance interval is met, the distributed key 1 and the distributed key 2 are combined using the combination method corresponding to the performance interval.

[0051] In one embodiment, the combination of the distributed key 1 and the distributed key 2 can be divided in the following manner: First, determine whether the performance index of the security chip reaches a preset threshold, if it reaches the preset threshold, combine the distributed key 1 and the distributed key 2 to obtain an intermediate key, and apply a hash algorithm to convert the intermediate key to obtain the target key;

[0052] Otherwise, the distributed key 1 and the distributed key 2 are combined to obtain the target key.

[0053] In this embodiment, in the case where the performance of the security chip does not reach the preset threshold, the following method can be used for combination: extract the same part of the distributed key 1 and the distributed key 2, determine the combination method of the distributed key 1 and the distributed key 2 according to the same part, and obtain the target key after combining according to the combination method. For example, the distributed key 1 is: 21213541, and the distributed key 2 is: 21521521. The target key can be obtained by removing the repeated parts of the distributed key 1 and the distributed key 2, and the target key is: 21345212.

[0054] For the specific combination of the distributed keys of the high-performance security chip, the following keys can be used as an example for combination: Distributed Key 1: 1020301010101010, Distributed Key 2: 1020401010101010, first interleave to obtain the intermediate key: 110022003400110011001100, and then use the MD5 algorithm to convert the intermediate key into a 16-bit string target key, the target key is: 0C499C3C7A8F526CEFC9A1BB10EC14D1. For this embodiment, other hash algorithms can also be used to convert the intermediate keys.

[0055] Different combination methods may also be adopted for different key systems, specifically, the system adopted by the distributed key 1 and the distributed key 2 is determined. If the system is decimal, the distributed key 1 and the distributed key 2 are added together to obtain the target key.

[0056] If the number system is binary, the target key is obtained by removing the same parts of the distributed key 1 and the distributed key 2.

[0057] For example: (1) Distributed key 1 is: 1111222233334444, distributed key 2 is: 2222333344445555, and the target key is obtained by direct addition of the decimal key. The target key is: 3333555577779999;

[0058] (2) Distributed key one: 1111000011110000, distributed key two: 11111111100001111. For the binary key, the target key is obtained by adding the last digit and taking the last digit. The target key is: 00001111111111111.

[0059] like Figure 2 As shown, the present invention also provides an encryption device based on a power distribution terminal security chip, comprising:

[0060] The security chip 10 is used to store a distributed key 1;

[0061] Storage device 20, used for storing distributed key 2;

[0062] The processing device 30 is used to collect the performance of the security chip, and determine the combination of the distributed key 1 and the distributed key 2 according to the performance index of the security chip, and obtain the target key according to the combination;

[0063] The security chip 10 , the storage device 20 and the processing device 30 are electrically connected.

[0064] In one embodiment, Figure 3 As shown, a computer device 40 is provided, including a memory 42, a processor 41, and a computer program 43 stored in the memory 42 and executable on the processor 41. When the processor 41 executes the computer program 43, the steps in the data processing method of the above embodiment are implemented. To avoid repetition, they are not described here. Alternatively, when the processor 41 executes the computer program 43, the functions of each module in the above embodiment of the encryption device based on the power distribution terminal security chip are implemented. To avoid repetition, they are not described here.

[0065] In one embodiment, a readable storage medium is provided, wherein the readable storage medium stores a computer program 43. When the computer program 43 is executed by the processor 41, the steps in the data processing method in the above embodiment are implemented. To avoid repetition, it is not described here. Alternatively, when the processor 41 executes the computer program 43, the functions of each module in the above data processing device embodiment are implemented. To avoid repetition, it is not described here.

[0066] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0067] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules, sub-modules and units as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0068] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An encryption method based on a power distribution terminal security chip, characterized in that: include: S1. Obtain storage information of a storage device of a power distribution terminal, and divide the storage device into a plurality of storage units according to the storage information; S2, storing the distributed key 1 in the security chip, and storing the plurality of distributed keys 2 in each of the storage units in sequence; S3, obtaining a performance indicator of the security chip, and determining a combination method of the distributed key 1 and the distributed key 2 according to the performance indicator; S4. Combine the distributed key 1 and the distributed key 2 according to the combination method to obtain a target key.

2. The encryption method based on the power distribution terminal security chip according to claim 1 is characterized in that: The step S2 comprises: The storage unit is divided into an encryption area and a non-encryption area, and the distributed key 2 is stored in the encryption area.

3. The encryption method based on the power distribution terminal security chip according to claim 1 is characterized in that: The step S3 comprises: A preset encryption mode table is obtained, and a combination mode of the security chip is determined according to a position of a performance parameter of the security chip in the encryption mode table.

4. The encryption method based on the power distribution terminal security chip according to claim 1 is characterized in that: The step S3 comprises: Determine whether the performance index of the security chip reaches a preset threshold value. If so, combine the distributed key 1 and the distributed key 2 to obtain an intermediate key, and apply a hash algorithm to convert the intermediate key to obtain the target key; Otherwise, the distributed key 1 and the distributed key 2 are combined to obtain the target key.

5. The encryption method based on the power distribution terminal security chip according to claim 4 is characterized in that: The step of combining the distributed key 1 and the distributed key 2 to obtain the target key includes: The same part of the distributed key 1 and the distributed key 2 is extracted, a combination mode of the distributed key 1 and the distributed key 2 is determined according to the same part, and the target key is obtained after combining them according to the combination mode.

6. The encryption method based on the power distribution terminal security chip according to claim 4 is characterized in that: The step of combining the distributed key 1 and the distributed key 2 to obtain the target key includes: Determine the numbering system used by the distributed key 1 and the distributed key 2, and if the numbering system is decimal, add the distributed key 1 and the distributed key 2 to obtain the target key; If the number system is binary, the target key is obtained by removing the same parts of the distributed key 1 and the distributed key 2.

7. An encryption device based on a power distribution terminal security chip, comprising: A security chip for storing a distributed key; A storage device, used for storing a second distributed key; A processing device, used to collect the performance of the security chip, and determine the combination of the distributed key 1 and the distributed key 2 according to the performance index of the security chip, and obtain the target key according to the combination; The security chip, the storage device and the processing device are electrically connected.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the encryption method based on the power distribution terminal security chip as described in any one of claims 1-6 is implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the encryption method based on the power distribution terminal security chip as described in any one of claims 1 to 6 is implemented.

Images