Relay protection device encryption system and registration authentication method thereof

Abstract

The invention belongs to the technical field of relay protection device registration authentication, and particularly relates to a relay protection device encryption system and a registration authentication method thereof. The method comprises the following specific steps: in order to solve the problem that a power grid cannot run stably due to the fact that an unofficial-channel relay protection device with low safety is mixed in the power grid, registration authentication is carried out on the relay protection device obtained through an official channel, so that the relay protection device subjected to registration authentication works normally; the safety and reliability of the relay protection device are effectively ensured, and for the relay protection device obtained from an unofficial channel, the device cannot be normally put into use because the device is not registered and authenticated and the key and liquid crystal operations of the relay protection device are locked, so that the relay protection device obtained from the unofficial channel is effectively prevented from being put into operation, and the safety of the relay protection device is ensured. Safe and stable operation of a power grid and a power system is ensured.

Description

Technical Field

[0001] The invention belongs to the technical field of registration and authentication of relay protection devices, and in particular relates to a relay protection device encryption system and a registration and authentication method thereof. Background Art

[0002] With the rapid development of economy, the power system is developing continuously, the grid structure is becoming more complex, and the relay protection device as the guardian of the grid has also made great progress. The relay protection device can act quickly when a grid fault occurs, effectively preventing the expansion of the grid fault and causing greater personal and social property losses. Therefore, the safety and reliability of the relay protection device is crucial to the safe operation of the grid and power system.

[0003] However, for the R&D and production units of relay protection devices, the outsourcing of software and hardware development, as well as the turnover of employees, there is a risk of relay protection products leaking from unofficial channels and counterfeit products appearing. These unofficial relay protection devices are difficult to update and maintain in real time, making it difficult to ensure their safety and reliability, which in turn threatens the operation of the entire power grid and power system. Summary of the invention

[0004] The purpose of the present invention is to provide a relay protection device encryption system and a registration and authentication method thereof, so as to solve the problem that the relay protection devices of unofficial channels with low security cannot be maintained in real time in the power grid, resulting in the power grid being unable to operate safely and stably.

[0005] In order to solve the above technical problems, the present invention provides a registration and authentication method for a relay protection device, comprising the following steps:

[0006] 1) For a relay protection device with a registration certificate file, the registration encryption server obtains the registration certificate file of the relay protection device and the hardware unique identification code of the device, uses the first encryption algorithm in combination with the hardware unique identification code of the relay protection device to calculate the private key of the relay protection device, and then uses the second encryption algorithm in combination with the obtained private key of the relay protection device to generate the public key of the relay protection device; wherein the registration certificate file is obtained by encrypting the hardware unique identification code of the relay protection device in the registration encryption client using the second encryption algorithm and the public key of the relay protection device;

[0007] 2) Use the second encryption algorithm and combine with the private key of the relay protection device to decrypt its registration certificate file to obtain the identification code of the relay protection device; determine whether the decrypted identification code is consistent with the obtained hardware unique identification code. If they are consistent, the relay protection device is defined as registered, so that the relay protection device can operate normally and is determined to be officially produced; if they are inconsistent, the certificate file is incorrect, then the relay protection device is defined as unregistered, the relay protection device cannot operate normally and is determined to be unofficially produced.

[0008] Its beneficial effects are: in order to solve the problem that relay protection devices with low security from unofficial channels are mixed into the power grid, resulting in the instability of the power grid operation, the present invention registers and authenticates the relay protection devices obtained from official channels, so that the registered and authenticated relay protection devices can work normally, and the safety and reliability of the relay protection devices are effectively guaranteed. As for the relay protection devices obtained from unofficial channels, because the devices are not registered and authenticated, the buttons and LCD operations of the relay protection devices are locked, making the devices unable to be put into use normally, effectively preventing the relay protection devices obtained from unofficial channels from being put into operation, and ensuring the safe and stable operation of the power grid and the power system.

[0009] Furthermore, the hash value of the hardware unique identification code of the relay protection device calculated by the first encryption algorithm is used as the private key of the relay protection device.

[0010] Furthermore, the first encryption algorithm adopts SM3 algorithm.

[0011] The beneficial effects are: the use of the SM3 algorithm can meet a variety of cryptographic security requirements, and the calculation of hash values ​​is more efficient and secure.

[0012] Furthermore, the second encryption algorithm adopts SM2 algorithm.

[0013] The beneficial effect is that the SM2 algorithm is used to calculate the public key and decrypt the registration certificate file, which has the effects of high security and high efficiency.

[0014] Furthermore, the hardware unique identification code of the device is composed of the processor chip unique identification and the memory chip unique identification in a set order.

[0015] The beneficial effect is that the uniqueness of the combination of chip identifiers is utilized to ensure the uniqueness of the hardware identification code of the relay protection device.

[0016] Furthermore, if the message received by the registration encryption server from the registration encryption client is to query the registration status of the relay protection device, the registration encryption server will send the most recently determined registration status, hardware unique identification code and public key of the relay protection device to the registration encryption server.

[0017] Furthermore, if the message received by the registration encryption server from the registration encryption client is a registration certificate file, the registration certificate file is updated and parsed, and the registration status of the relay protection device is re-determined and sent to the registration encryption client.

[0018] The beneficial effect is that after registering the encrypted client, the registration certificate file of the relay protection device judged as unregistered is updated to prevent the relay protection device of some official channels from initially not having a registration certificate file, resulting in being judged as an unofficial channel, causing the device to fail to work normally.

[0019] Furthermore, the registration encryption client determines whether the registration status of the relay protection device is a new successful registration based on the obtained registration status of the relay protection device. If so, a message for restarting the relay protection device is sent to the registration encryption server.

[0020] Its beneficial effects are: monitoring whether the registration status of the relay protection device has changed, restarting the relay protection device that was previously unregistered and is currently registered, so as to quickly check the operating status of the device after registration.

[0021] Furthermore, the specific means by which the registered encryption client determines whether the registration status of the relay protection device has changed is: setting the relay protection device registration status update flag variable; if the hardware unique identification code in the currently received message is consistent with the hardware unique identification code in the last received message, and the device status in the currently received message is registered, and the device status in the last received message was unregistered, then the status update flag variable is marked as a new registration success; otherwise, the status update flag variable is marked as a non-new registration success.

[0022] The beneficial effect is that the registration status of the relay protection device is automatically and continuously updated, making the result of judging whether the relay protection device is an official channel more accurate.

[0023] In order to solve the above technical problems, the present invention also provides a relay protection device encryption system, characterized in that it includes a registration encryption server, a registration encryption client and an application program, the registration encryption server end and the application program are deployed on the relay protection device end, and the registration encryption server and the registration encryption client use the UDP protocol for network communication; the registration encryption server is used to obtain the registration certificate file of the relay protection device and the hardware unique identification code of the device, and use the first encryption algorithm in combination with the hardware unique identification code of the relay protection device to calculate the private key of the relay protection device, and then use the second encryption algorithm in combination with the obtained private key of the relay protection device to generate the public key of the relay protection device, and use the second encryption algorithm in combination with the private key of the relay protection device to decrypt its registration certificate file to obtain the identification code of the relay protection device, and determine whether the identification code obtained by decryption is consistent with the obtained hardware unique identification code to obtain the registration status of the relay protection device;

[0024] The registration encryption client is used to encrypt the hardware unique identification code of the relay protection device according to the second encryption algorithm and the public key of the relay protection device to obtain a registration certificate file;

[0025] The application is used to control the normal or abnormal operation of the relay protection device according to the registration status of the relay protection device determined by the registration encryption server, so as to determine whether the relay protection device is officially produced.

[0026] Its beneficial effects are: in order to solve the problem that relay protection devices from unofficial channels with low security are mixed into the power grid, resulting in the instability of the power grid operation, this system determines the registration status of the relay protection device through the registration encryption server, registers and authenticates the relay protection devices obtained through official channels, and displays them through the application. At the same time, the registration status of the relay protection device is monitored and updated through the registration encryption client, which effectively prevents the relay protection devices obtained through unofficial channels from being put into operation, ensures that no relay protection devices obtained through official channels are missed and put into operation, and ensures the safe and stable operation of the power grid and power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a structural diagram of the encryption system of the relay protection device of the present invention;

[0028] Figure 2 It is a workflow diagram of the registration encryption server of the present invention;

[0029] Figure 3 It is a workflow diagram of the registered encrypted client of the present invention;

[0030] Figure 4 is an application workflow diagram of the present invention;

[0031] Figure 5 It is a flow chart of the registered encryption server of the present invention generating the private key and the public key of the relay protection device;

[0032] Figure 6 It is a flow chart of the registration encryption server of the present invention initializing the registration status of the relay protection device;

[0033] Figure 7 It is a flow chart of updating the registration status of a relay protection device by a registration encryption server of the present invention. DETAILED DESCRIPTION

[0034] The basic concept of the present invention is: in order to solve the problem that relay protection devices from unofficial channels with low security are mixed into the power grid, resulting in the instability of the power grid operation, the registration encryption server of the present invention obtains the registration information of the relay protection device, and sends the above-obtained registration information of the device to the registration encryption client according to the device registration status message sent by the registration encryption client. The registration encryption client determines whether the device has been registered according to the registration information. If so, the device registration authentication is successful, and the application allows the device to operate normally; if the device is not registered, the application locks the operating function of the device, so that the device cannot be debugged and operated normally. Based on this concept, a relay protection device encryption system and a registration authentication method thereof of the present invention can be realized.

[0035] The present invention will be described in detail below with reference to the accompanying drawings and method embodiments.

[0036] System Example:

[0037] The present invention provides a relay protection device encryption system, the system structure diagram is as follows Figure 1 As shown, it includes a registration encryption server, a registration encryption client and an application, wherein the registration encryption server and the application are deployed on the relay protection device, and the registration encryption client is deployed on the PC; the registration encryption server and the registration encryption client use the UDP protocol for network communication; the registration encryption server is used to obtain the registration information of the relay protection device and send the corresponding registration information to the registration encryption client according to the message instruction; the registration encryption client is used to send the message instruction to the registration encryption server; the application is used to open or lock the button and LCD operation function according to the registration status of the relay protection device.

[0038] Among them, the registration information of the relay protection device obtained by the registration encryption server includes: the unique hardware identification code of the relay protection device, the public key and private key of the national secret SM2 algorithm, the registration certificate file of the relay protection device, and the registration status of the relay protection device.

[0039] In order to solve the problem that the power grid cannot operate stably due to the presence of unofficial relay protection devices with low security in the power grid, a relay protection device registration and authentication method is used on the basis of the above encryption system to control the decryption of each part of the encryption system to solve the above problem. The working methods of each part of the encryption system are as follows:

[0040] The workflow diagram for registering an encryption server is as follows: Figure 2 As shown, the specific process includes:

[0041] 1) Initialize the server and obtain the unique hardware identification code of the relay protection device. The unique hardware identification code consists of the unique identifications of the CPU chip, FPGA chip and RAM chip. The registration encryption server directly reads the hardware identification code registers of the CPU chip, FPGA chip and RAM chip to obtain the unique identification of the corresponding chip, and splices the three in the order of the unique identification of the CPU chip, the unique identification of the FPGA chip and the unique identification of the RAM chip to obtain the unique hardware identification code;

[0042] Among them, the hardware unique identification code is fixed to 32 bytes of data. When the unique identification combination of the CPU chip, FPGA chip and RAM chip exceeds 32 bytes, it is truncated according to 32 bytes; when the unique identification combination of the three is less than 32 bytes, the unused bytes are filled with 0 values; the uniqueness of the three chip identifications ensures the uniqueness of the hardware identification code of the relay protection device, that is, the hardware unique identification code.

[0043] 2) Generate the public key and private key of the national secret SM2 algorithm for the relay protection device, such as Figure 4 As shown. After the relay protection device is registered, its certificate content will not change, so the private key used to decrypt the certificate file each time the relay protection device is started is fixed. Therefore, the SM3 algorithm is first used to calculate the hash value of the hardware unique identification code of the relay protection device, and then this hash value is used as the private key of the SM2 algorithm, and then the SM2 algorithm and the private key are used to generate the public key.

[0044] 3) Initialize the registration status of the relay protection device, the flow chart is as follows Figure 5 As shown. First, determine whether there is a registration certificate file. If the registration certificate does not exist, directly define the relay protection device as unregistered; if the registration certificate exists, use the SM2 algorithm and private key to decrypt the registration certificate to obtain the identification code of the decrypted relay protection device, and compare the decrypted identification code with the hardware unique identification code. If the two are consistent, it is defined that the relay protection device is registered. If they are inconsistent, the certificate file is incorrect and the relay protection device is defined as unregistered.

[0045] 4) The registration encryption server receives the message instruction sent by the registration encryption client. When the received message instruction is to query the registration status of the relay protection device, the registration encryption server sends the corresponding message consisting of the registration status of the relay protection device, the hardware unique identification code and the public key to the client; when the received message is a registration certificate, the registration encryption server updates the registration certificate, updates the registration status of the relay protection device according to the new registration certificate, and sends the new registration status of the relay protection device to the registration encryption client. The flow chart is as follows: Figure 6 ; When the received message instruction is a restart message, the registered encryption server controls the relay protection device to restart.

[0046] The format of the message sent by the registration encryption client to the registration encryption server via the UDP protocol is shown in Table 1 below:

[0047] Table 1

[0048] Field Name Field meaning Remark Cmd Command code 1 byte, command identifier Seq Frame number 1 byte, message frame number Lenth Valid data length 2 bytes, number of bytes in the Content part Content Valid data n bytes, related to Cmd CRC Check code 2 bytes, 16-bit checksum from Cmd to Content

[0049] The Cmd and Content fields of the message sent by the registered encrypted client in Table 1 above are defined as shown in Table 2 below:

[0050] Table 2

[0051]

[0052]

[0053] The format of the message sent by the registration encryption server to the registration encryption client via the UDP protocol is shown in Table 3 below:

[0054] Table 3

[0055] Field Name Field meaning Remark Cmd Command code 1 byte, command identifier Lenth Valid data length 2 bytes, number of bytes in the Content part Content Valid data n bytes, related to Cmd CRC Check code 2 bytes, 16-bit checksum from Cmd to PublicKey

[0056] The Cmd and Content fields of the message sent by the registration encryption server in Table 3 above are defined as shown in Table 4 below:

[0057] Table 4

[0058]

[0059] The registration encryption client queries the registration status of the relay protection device of the registration encryption server through a message with Cmd being 1, sends the registration certificate file to the registration encryption server through a message with Cmd being 2, and restarts the registration encryption server through a message with Cmd being 3; when Cmd is 2, the message needs to transmit the registration certificate content, which is filled into the Content field. For messages with Cmd being 1 and 3, the Content field does not need to carry other information, so the number of bytes occupied by the Content field is 0.

[0060] When the registration encryption server receives a message with Cmd of 1 sent by the registration encryption client, it sends the registration status, hardware unique identification code and public key of the relay protection device through a message with Cmd of 0x81; when the registration encryption server receives a message with Cmd of 2 sent by the registration encryption client, it saves the certificate file; the registration encryption server performs related operations on the messages with Cmd of 2 and Cmd of 3, but does not reply to the registration encryption client.

[0061] The workflow diagram for registering an encryption client is as follows: Figure 7As shown, the registration encryption client function includes: querying the device registration status of the relay protection device, registering the unregistered relay protection device, and resetting the newly registered relay protection device. The specific process includes:

[0062] 1) Initialize the client and set the time t for sending a message to query the registration status of the relay protection device to 0. If the time interval between the current time and t is greater than 5s, send a message to query the registration status of the relay protection device to the registration encryption server, and update t to the current time, and re-judge whether the time interval between the current time and t is greater than 5s;

[0063] 2) After the registration encryption client receives the message from the registration encryption server in response to the message querying the registration status of the relay protection device, it saves the registration status, hardware unique identification code and public key of the relay protection device, updates the registration status change flag of the relay protection device, and determines whether the relay protection device has been registered. If not, the client uses the SM2 algorithm and the public key to encrypt the device hardware unique identification code, and sends the encryption result to the registration encryption server (the encryption result is the registration certificate file); if it has been registered, it determines whether the registration status of the device has changed. If it has changed, it sends a command to restart the device to the registration encryption server to allow the relay protection device to operate normally.

[0064] Among them, the specific steps for judging whether the relay protection device has been registered are as follows: combined with Table 4, when the registration encryption client receives a message with Cmd of 0x81 sent by the registration encryption server, the RegFlag field is first judged. If the RegFlag field is 0, the relay protection device is not registered; if the RegFlag field is 1, the relay protection device is registered; regardless of whether the relay protection device is registered or not, the registration status, hardware unique identification code and public key in the current message are used to update local data.

[0065] The specific steps of updating the registration status change flag of the relay protection device include: setting a device registration status update flag variable NewReg, when NewReg is 0, it indicates that the relay protection device is newly registered successfully, and when NewReg is 1, it indicates that the relay protection device is not newly registered successfully; when the current frame message is the first frame Cmd received by the registration encryption client with a message of 0x81, if the Digest field of the current message is consistent with the Digest field of the previously received message with Cmd of 0x81, and the RegFlag field of the current message is 1, and the RegFlag field of the previous frame Cmd field is 0x81 The message is 0, then the variable NewReg is set to 1; otherwise, the variable NewReg is set to 0.

[0066] The application workflow diagram is as follows Figure 3As shown, the application determines whether the relay protection device has been registered based on the registration status of the relay protection device. If the relay protection device has been registered, the buttons and LCD operations are opened to allow the relay protection device to operate normally. If the relay protection device has not been registered, the buttons and LCD operations are locked, and the LCD displays "Device not registered", making it impossible for the device to be debugged and operated normally.

[0067] The present invention registers and authenticates the relay protection devices obtained through official channels, so that the registered and authenticated relay protection devices can work normally, effectively ensuring the safety and reliability of the relay protection devices. As for the relay protection devices obtained through unofficial channels, since the devices are not registered and authenticated, the buttons and LCD operations of the relay protection devices are locked, making it impossible for the devices to be put into use normally, effectively preventing the relay protection devices obtained through unofficial channels from being put into operation, and ensuring the safe and stable operation of the power grid and the power system.

[0068] Method Example:

[0069] A registration and authentication method for a relay protection device of the present invention distinguishes whether the relay protection device is obtained through official channels or unofficial channels by comparing whether the identification code obtained by decrypting the relay protection device is consistent with the hardware unique identification code, thereby indicating by opening or locking buttons and liquid crystal operations, so that technicians can clearly distinguish whether each relay protection device is obtained through official channels. The specific steps of this method have been described in detail in the relay protection device encryption system and will not be repeated here.

Claims

1. A method for registration and authentication of a relay protection device, characterized in that: The steps include: 1) For a relay protection device with a registration certificate file, the registration encryption server obtains the registration certificate file of the relay protection device and the hardware unique identification code of the device, uses the first encryption algorithm in combination with the hardware unique identification code of the relay protection device to calculate the private key of the relay protection device, and then uses the second encryption algorithm in combination with the obtained private key of the relay protection device to generate the public key of the relay protection device; wherein the registration certificate file is obtained by encrypting the hardware unique identification code of the relay protection device in the registration encryption client using the second encryption algorithm and the public key of the relay protection device; 2) Use the second encryption algorithm and combine with the private key of the relay protection device to decrypt its registration certificate file to obtain the identification code of the relay protection device; determine whether the decrypted identification code is consistent with the obtained hardware unique identification code. If they are consistent, the relay protection device is defined as registered, so that the relay protection device can operate normally and is determined to be officially produced; if they are inconsistent, the certificate file is incorrect, then the relay protection device is defined as unregistered, the relay protection device cannot operate normally and is determined to be unofficially produced.

2. The registration and authentication method for relay protection device according to claim 1, characterized in that: The hash value of the hardware unique identification code of the relay protection device calculated by the first encryption algorithm is used as the private key of the relay protection device.

3. The registration and authentication method for relay protection device according to claim 2, characterized in that: The first encryption algorithm adopts the SM3 algorithm.

4. The registration and authentication method for relay protection device according to claim 1, characterized in that: The second encryption algorithm adopts the SM2 algorithm.

5. The registration and authentication method for relay protection device according to claim 1, characterized in that: The hardware unique identification code of the device is composed of the processor chip unique identification and the memory chip unique identification in a set order.

6. The registration and authentication method for relay protection device according to claim 1, characterized in that: If the message received by the registration encryption server from the registration encryption client is to query the registration status of the relay protection device, the registration encryption server will send the latest determined registration status, hardware unique identification code and public key of the relay protection device to the registration encryption server.

7. The registration and authentication method for relay protection device according to claim 1, characterized in that: If the message received by the registration encryption server from the registration encryption client is a registration certificate file, the registration certificate file is updated and parsed, and the registration status of the relay protection device is re-determined and sent to the registration encryption client.

8. The registration and authentication method for relay protection device according to claim 6 or 7, characterized in that: The registration encryption client determines whether the registration status of the relay protection device is a new successful registration according to the obtained registration status of the relay protection device. If so, a message for restarting the relay protection device is sent to the registration encryption server.

9. The registration and authentication method for relay protection device according to claim 8, characterized in that: The specific means to determine whether the registration status of the relay protection device has changed is: setting the registration status update flag variable of the relay protection device. If the hardware unique identification code in the currently received message is consistent with the hardware unique identification code in the last received message, and the device status in the currently received message is registered, and the device status in the last received message was unregistered, then the status update flag variable is marked as a new registration success, otherwise the status update flag variable is marked as a non-new registration success.

10. A relay protection device encryption system, characterized in that: It includes a registration encryption server, a registration encryption client and an application program. The registration encryption server and the application program are deployed on the relay protection device. The registration encryption server and the registration encryption client use the UDP protocol for network communication. The registration encryption server is used to obtain the registration certificate file of the relay protection device and the hardware unique identification code of the device, and use the first encryption algorithm to calculate the private key of the relay protection device in combination with the hardware unique identification code of the relay protection device, and then use the second encryption algorithm in combination with the obtained private key of the relay protection device to generate the public key of the relay protection device, and use the second encryption algorithm in combination with the private key of the relay protection device to decrypt its registration certificate file to obtain the identification code of the relay protection device, and determine whether the identification code obtained by decryption is consistent with the obtained hardware unique identification code to obtain the registration status of the relay protection device; The registration encryption client is used to encrypt the hardware unique identification code of the relay protection device according to the second encryption algorithm and the public key of the relay protection device to obtain a registration certificate file; The application is used to control the normal or abnormal operation of the relay protection device according to the registration status of the relay protection device determined by the registration encryption server, so as to determine whether the relay protection device is officially produced.

Images