Relay protection device encryption system and registration authentication method thereof

Abstract

The application belongs to the technical field of registration and authentication of relay protection devices, and particularly relates to a relay protection device encryption system and a registration and authentication method thereof. The specific steps comprise: in order to solve the problem that the relay protection devices with low security obtained through unofficial channels are mixed in the power grid, causing the power grid to be unable to operate stably, the relay protection devices obtained through official channels are registered and authenticated, the relay protection devices that have passed the registration and authentication operate normally, the security and reliability of the relay protection devices are effectively ensured, the keys and liquid crystal operations of the relay protection devices obtained through unofficial channels are locked because the devices have not been registered and authenticated, the devices cannot be normally put into use, the relay protection devices obtained through unofficial channels are effectively prevented from being put into operation, and the safe and stable operation of the power grid and the power system is ensured.

Description

Technical Field

[0001] This invention belongs to the field of relay protection device registration and authentication technology, specifically relating to a relay protection device encryption system and its registration and authentication method. Background Technology

[0002] With rapid economic development, the power system is constantly evolving, and the power grid structure is becoming more complex. Relay protection devices, acting as guardians of the power grid, have also made significant progress. Relay protection devices can act quickly when a power grid fault occurs, effectively preventing the fault from escalating and causing greater personal injury and property damage. Therefore, the safety and reliability of relay protection devices are crucial to the safe operation of the power grid and the power system.

[0003] However, for relay protection device R&D and manufacturing units, the outsourcing of their software and hardware development, as well as employee turnover, pose risks of relay protection products leaking from unofficial channels and counterfeit products appearing. These unofficial relay protection devices are difficult to update and maintain in real time, making it difficult to guarantee their safety and reliability, thus threatening the operation of the entire power grid and power system. Summary of the Invention

[0004] The purpose of this invention is to provide a relay protection device encryption system and its registration and authentication method to solve the problem of the inability to maintain low-security relay protection devices through unofficial channels in the power grid in real time, which leads to the inability of the power grid to operate safely and stably.

[0005] To address the aforementioned technical problems, this invention provides a method for registering and certifying relay protection devices, comprising the following steps:

[0006] 1) For relay protection devices with existing registration certificate files, the registration encryption server obtains the registration certificate file and the device's unique hardware identifier, calculates the device's private key using a first encryption algorithm, and then generates the device's public key using a second encryption algorithm combined with the obtained private key. The registration certificate file is obtained by encrypting the device's unique hardware identifier in the registration encryption client using the second encryption algorithm and the device's public key.

[0007] 2) Use the second encryption algorithm and the private key of the relay protection device to decrypt its registration certificate file to obtain the identification code of the relay protection device; determine whether the decrypted identification code is consistent with the obtained hardware unique identification code. If they are consistent, the relay protection device is defined as registered, and the relay protection device is allowed to operate normally and is determined to be officially produced; if they are inconsistent, the certificate file is incorrect, the relay protection device is defined as unregistered, the relay protection device cannot operate normally and is determined to be unofficially produced.

[0008] Its beneficial effects are as follows: To address the problem of unstable grid operation caused by the infiltration of low-security relay protection devices from unofficial channels into the power grid, this invention registers and certifies relay protection devices obtained through official channels, ensuring their normal operation and effectively guaranteeing their safety and reliability. For relay protection devices obtained through unofficial channels, because they are not registered and certified, their buttons and LCD operations are locked, preventing them from being put into normal use. This effectively prevents the operation of relay protection devices obtained through unofficial channels, ensuring the safe and stable operation of the power grid and power system.

[0009] Furthermore, the hash value of the hardware unique identifier of the relay protection device calculated by the first encryption algorithm is used as the private key of the relay protection device.

[0010] Furthermore, the first encryption algorithm uses the SM3 algorithm.

[0011] Its advantages are: the SM3 algorithm can meet a variety of cryptographic security requirements, and the calculation of hash values ​​is more efficient and secure.

[0012] Furthermore, the second encryption algorithm uses the SM2 algorithm.

[0013] Its beneficial effects are: using the SM2 algorithm to calculate the public key and decrypt the registration certificate file, it has the effects of high security and high efficiency.

[0014] Furthermore, the device's unique hardware identifier is composed of the processor chip's unique identifier and the memory chip's unique identifier in a predetermined order.

[0015] Its beneficial effect is that by utilizing the uniqueness of the combination of chip identifiers, the uniqueness of the hardware identifier code of the relay protection device is guaranteed.

[0016] Furthermore, if the registration encryption server receives a message from the registration encryption client querying the registration status of the relay protection device, the registration encryption server will send the latest determined registration status of the relay protection device, the unique hardware identifier, and the public key to the registration encryption server.

[0017] Furthermore, if the registration encryption server receives a registration certificate file from the registration encryption client, it updates and parses the registration certificate file, re-determines the registration status of the relay protection device, and sends it back to the registration encryption client.

[0018] Its beneficial effects are: after registering the encrypted client, the registration certificate file of the relay protection device that is determined to be unregistered is updated, which prevents some relay protection devices from not having a registration certificate file in the beginning, thus causing them to be judged as unofficial and causing the device to malfunction.

[0019] Furthermore, the registration encryption client determines whether the registration status of the relay protection device is a successful new registration based on the obtained registration status of the relay protection device. If so, it sends a message to the registration encryption server to restart the relay protection device.

[0020] Its beneficial effects are: to monitor whether the registration status of relay protection devices has changed, to restart relay protection devices that were previously unregistered but are now registered, and to facilitate quick viewing of the operating status of the devices after registration.

[0021] Furthermore, the specific method for the registered encrypted client to determine whether the registration status of the relay protection device has changed is as follows: set a relay protection device registration status update flag variable. If the hardware unique identifier in the currently received message is consistent with the hardware unique identifier in the last received message, and the device status in the currently received message is registered, while the device status in the last received message is unregistered, then the status update flag variable is marked as newly registered successfully; otherwise, the status update flag variable is marked as not newly registered successfully.

[0022] Its beneficial effects are: automatically and continuously updating the registration status of relay protection devices, making the determination of whether a relay protection device is from an official channel more accurate.

[0023] To address the aforementioned technical problems, this invention also provides a relay protection device encryption system, characterized by comprising a registration encryption server, a registration encryption client, and an application program. The registration encryption server and the application program are deployed on the relay protection device. The registration encryption server and the registration encryption client communicate over the network using the UDP protocol. The registration encryption server is used to obtain the registration certificate file and the device's unique hardware identifier of the relay protection device. It then uses a first encryption algorithm to calculate the private key of the relay protection device based on the unique hardware identifier. A second encryption algorithm is then used to generate the public key of the relay protection device based on the obtained private key. Finally, the registration certificate file is decrypted using the second encryption algorithm and the private key to obtain the identifier of the relay protection device. The registration status of the relay protection device is determined by judging whether the decrypted identifier matches the obtained unique hardware identifier.

[0024] The registration encryption client is used to encrypt the unique hardware identifier of the relay protection device using the second encryption algorithm and the public key of the relay protection device to obtain the registration certificate file;

[0025] The application is used to determine the registration status of the relay protection device based on the registration encryption server, and to control the relay protection device to operate normally or abnormally, so as to determine whether the relay protection device is officially manufactured.

[0026] Its beneficial effects are as follows: To address the problem of unstable power grid operation caused by the infiltration of relay protection devices with low security from unofficial channels, this system determines the registration status of relay protection devices through a registration encryption server. This allows for the registration and authentication of relay protection devices obtained through official channels, which are then displayed through the application. Simultaneously, the registration encryption client monitors and updates the registration status of relay protection devices, effectively preventing the commissioning of relay protection devices obtained through unofficial channels. This ensures that no relay protection device obtained through official channels is missed from being put into operation, thereby guaranteeing the safe and stable operation of the power grid and power system. Attached Figure Description

[0027] Figure 1 This is a structural diagram of the encryption system of the relay protection device of the present invention;

[0028] Figure 2 This is a flowchart of the registration encryption server workflow of the present invention;

[0029] Figure 3 This is a flowchart of the registration encryption client workflow of the present invention;

[0030] Figure 4 This is a flowchart of the application process of the present invention;

[0031] Figure 5 This is a flowchart of the process for the registration encryption server of the present invention to generate the private key and public key of the relay protection device;

[0032] Figure 6 This is a flowchart of the registration encryption server initializing the registration status of the relay protection device according to the present invention;

[0033] Figure 7 This is a flowchart of the registration encryption server updating the registration status of the relay protection device according to the present invention. Detailed Implementation

[0034] The basic concept of this invention is as follows: To address the problem of unstable power grid operation caused by the infiltration of low-security, unofficial relay protection devices into the power grid, this invention establishes a registration encryption server to obtain the registration information of relay protection devices. Based on a device registration status read message sent by a registration encryption client, the server sends the obtained registration information of the device to the registration encryption client. The registration encryption client determines whether the device has been registered based on the registration information. If so, the device registration and authentication are successful, and the application allows the device to operate normally. If the device is not registered, the application locks the device's operational functions, thus preventing the device from being properly debugged and operated. Based on this concept, a relay protection device encryption system and its registration and authentication method can be implemented according to this invention.

[0035] The present invention will now be described in detail with reference to the accompanying drawings and method embodiments.

[0036] System Implementation Example:

[0037] The present invention provides an encryption system for a relay protection device, the system structure of which is shown in the figure below. Figure 1 As shown, it includes a registration encryption server, a registration encryption client, and an application program. The registration encryption server and the application program are deployed on the relay protection device, while the registration encryption client is deployed on a PC. The registration encryption server and the registration encryption client communicate over the network using the UDP protocol. The registration encryption server is used to obtain the registration information of the relay protection device and send the corresponding registration information to the registration encryption client according to the message instructions. The registration encryption client is used to send message instructions to the registration encryption server. The application program is used to enable or disable the button and LCD operation functions according to the registration status of the relay protection device.

[0038] The registration information of the relay protection device obtained by the registration encryption server includes: the unique hardware identifier of the relay protection device, the public and private keys of the national cryptographic SM2 algorithm, the registration certificate file of the relay protection device, and the registration status of the relay protection device.

[0039] To address the problem of unstable power grid operation caused by the infiltration of low-security, unofficial relay protection devices into the power grid, a relay protection device registration and authentication method is adopted based on the aforementioned encryption system to control the decomposition of each component of the encryption system, thereby resolving the above-mentioned problem. The specific operating modes of each component of the encryption system are as follows:

[0040] The workflow diagram for registering an encryption server is as follows: Figure 2 As shown, the specific process includes:

[0041] 1) Initialize the server and obtain the unique hardware identifier of the relay protection device. The unique hardware identifier consists of the unique identifiers of the CPU chip, FPGA chip and RAM chip. The registration encryption server directly reads the hardware identifier registers of the CPU chip, FPGA chip and RAM chip to obtain the unique identifier of the corresponding chip, and concatenates the three in the order of the unique identifier of the CPU chip, the unique identifier of the FPGA chip and the unique identifier of the RAM chip to obtain the unique hardware identifier.

[0042] The hardware unique identifier is fixed at 32 bytes. When the unique identifier combination of the CPU chip, FPGA chip, and RAM chip exceeds 32 bytes, it is truncated to 32 bytes. When the unique identifier combination of the three is less than 32 bytes, the unused bytes are filled with 0. The uniqueness of the three chip identifiers ensures the uniqueness of the hardware identifier code of the relay protection device, which is the aforementioned hardware unique identifier code.

[0043] 2) Generate the public and private keys for the SM2 national cryptographic algorithm of the relay protection device, such as... Figure 5 As shown. Since the certificate content of the relay protection device does not change after registration, the private key used to decrypt the certificate file each time the relay protection device is started is fixed. Therefore, the hash value of the hardware unique identifier of the relay protection device is first calculated using the SM3 algorithm, and then this hash value is used as the private key for the SM2 algorithm. Finally, the public key is generated using the SM2 algorithm and the private key.

[0044] 3) Initialize the registration status of the relay protection device, flowchart as follows: Figure 6 As shown. First, it checks if a registration certificate file exists. If the registration certificate does not exist, the relay protection device is directly defined as unregistered. If the registration certificate exists, it is decrypted using the SM2 algorithm and private key to obtain the identification code of the decrypted relay protection device. The decrypted identification code is compared with the unique hardware identification code. If they match, the relay protection device is defined as registered. If they do not match, the certificate file is incorrect, and the relay protection device is defined as unregistered.

[0045] 4) The registration encryption server receives message instructions sent by the registration encryption client. When the received message instruction is to query the registration status of the relay protection device, the registration encryption server sends a corresponding message composed of the relay protection device's registration status, unique hardware identifier, and public key to the client. When the received message is a registration certificate, the registration encryption server updates the registration certificate, updates the registration status of the relay protection device according to the new registration certificate, and sends the new registration status of the relay protection device to the registration encryption client. The flowchart is as follows. Figure 2 When the received message is a restart message, the registration encryption server controls the relay protection device to restart.

[0046] The message format sent by the registered encryption client to the registered encryption server via the UDP protocol is shown in Table 1 below:

[0047] Table 1

[0048] Cmd command code 1 byte, command identifier Seq Frame number 1 byte, message frame sequence number Lenth Valid data length 2 bytes, number of bytes in the Content section Content Valid data n bytes, related to Cmd CRC Verification code 2 bytes, 16-bit checksum from Cmd to Content portion

[0049] The definitions of the Cmd and Content fields for the encrypted client message sent in Table 1 above are shown in Table 2 below:

[0050] Table 2

[0051] Query device registration status 1 0 bytes, no data required Send certificate file 2 The 128-byte server registration certificate content is 96 bytes longer than the device's unique hardware identifier. Restart the server 3 0 bytes, no data required

[0052] The message format sent by the registration encryption server to the registration encryption client via the UDP protocol is shown in Table 3 below:

[0053] Table 3

[0054] Cmd command code 1 byte, command identifier Lenth Valid data length 2 bytes, number of bytes in the Content section Content Valid data n bytes, related to Cmd CRC Verification code 2 bytes, 16-bit checksum from Cmd to PublicKey

[0055] The definitions of the Cmd and Content fields in the message sent by the registered encryption server in Table 3 above are shown in Table 4 below:

[0056] Table 4

[0057]

[0058] The registration encryption client queries the registration status of the relay protection device of the registration encryption server through a message with Cmd=1, sends the registration certificate file to the registration encryption server through a message with Cmd=2, and restarts the registration encryption server through a message with Cmd=3. When Cmd=2, the message needs to transmit the registration certificate content, which is filled into the Content field. For messages with Cmd=1 and Cmd=3, the Content field does not need to carry other information, so the number of bytes occupied by the Content field is 0.

[0059] When the registration encryption server receives a message with Cmd=1 from the registration encryption client, it sends the relay protection device registration status, hardware unique identifier, and public key via a message with Cmd=0x81. When the registration encryption server receives a message with Cmd=2 from the registration encryption client, it saves the certificate file. The registration encryption server performs relevant operations on messages with Cmd=2 and Cmd=3, but does not reply to the registration encryption client.

[0060] The workflow diagram for registering an encrypted client is as follows: Figure 3As shown, the registration encryption client function includes: querying the registration status of relay protection devices, registering unregistered relay protection devices, and resetting newly registered relay protection devices. The specific process includes:

[0061] 1) Initialize the client and set the time t for sending the query relay protection device registration status message to 0. If the time interval between the current time and t is greater than 5s, send the query relay protection device registration status message to the registration encryption server, update t to the current time, and re-determine whether the time interval between the current time and t is greater than 5s.

[0062] 2) After receiving the message from the registration encryption server querying the registration status of the relay protection device, the registration encryption client saves the registration status, unique hardware identifier, and public key of the relay protection device, updates the registration status change flag of the relay protection device, and determines whether the relay protection device has been registered. If not registered, the client uses the SM2 algorithm and public key to encrypt the device's unique hardware identifier and sends the encryption result to the registration encryption server (this encryption result is the registration certificate file). If registered, the client determines whether the registration status of the device has changed. If it has changed, the client issues a command to the registration encryption server to restart the device, allowing the relay protection device to operate normally.

[0063] The specific steps for determining whether a relay protection device has been registered are as follows: Referring to Table 4, when the registration encryption client receives a message with Cmd=0x81 sent by the registration encryption server, it first checks the RegFlag field. If the RegFlag field is 0, the relay protection device is not registered; if the RegFlag field is 1, the relay protection device is registered. Regardless of whether the relay protection device is registered or not, the registration status, hardware unique identifier, and public key in the current message are used to update the local data.

[0064] The specific steps for updating the registration status change flag of a relay protection device include: setting a device registration status update flag variable NewReg. When NewReg is 0, it indicates that the relay protection device has been successfully newly registered; when NewReg is 1, it indicates that the relay protection device has not been successfully newly registered. When the current frame message is the first frame message with Cmd 0x81 received by the registration encryption client, if the Digest field of the current message is consistent with the Digest field of the previously received message with Cmd 0x81, and the RegFlag field of the current message is 1, while the RegFlag field of the previous frame message with Cmd 0x81 is 0, then the variable NewReg is set to 1; otherwise, the variable NewReg is set to 0.

[0065] Application workflow diagram as follows Figure 4As shown, the application determines whether the relay protection device has completed registration based on its registration status. If the relay protection device has completed registration, the button and LCD operations are enabled, allowing the relay protection device to operate normally. If the relay protection device has not been registered, the button and LCD operations are disabled, and the LCD displays "Device not registered," thus preventing the device from being properly debugged and operated.

[0066] This invention registers and certifies relay protection devices obtained through official channels, ensuring their normal operation and effectively guaranteeing their safety and reliability. For relay protection devices obtained through unofficial channels, because they are not registered and certified, their buttons and LCD operations are locked, preventing them from being put into normal use. This effectively prevents relay protection devices obtained through unofficial channels from being put into operation, ensuring the safe and stable operation of the power grid and power system.

[0067] Method Implementation Examples:

[0068] This invention discloses a method for registering and authenticating relay protection devices. This method distinguishes whether a relay protection device was obtained through official channels or unofficial channels by comparing whether the identification code obtained by decrypting the relay protection device is consistent with the unique hardware identification code. This is indicated by opening or closing buttons and LCD operation, allowing technicians to clearly distinguish whether each relay protection device was obtained through official channels. The specific steps of this method have been described in detail in the relay protection device encryption system and will not be repeated here.

Claims

1. A method for registering and certifying relay protection devices, characterized in that, include: 1) For relay protection devices with existing registration certificate files, the registration encryption server deployed at the relay protection device end obtains the registration certificate file and the unique hardware identifier of the relay protection device, calculates the private key using the first encryption algorithm in combination with the unique hardware identifier, and then generates the public key using the second encryption algorithm in combination with the private key; wherein, the registration certificate file is obtained by the registration encryption client encrypting the unique hardware identifier using the second encryption algorithm and the public key; The registration encryption server uses the second encryption algorithm and the private key obtained above to decrypt the registration certificate file to obtain the identification code of the relay protection device. It then determines whether the decrypted identification code matches the obtained unique hardware identification code. If they match, the registration status of the relay protection device is defined as registered, and the application deployed on the relay protection device enables the registered relay protection device to operate normally and is determined to be officially manufactured. Otherwise, if the certificate file is incorrect, the registration status of the relay protection device is defined as unregistered, and the application causes the unregistered relay protection device to malfunction and is determined to be unofficially manufactured. 2) When the registration encryption server receives a query message from the registration encryption client to check the registration status of the relay protection device, it sends the latest determined registration status of the relay protection device, the unique hardware identifier, and the public key to the registration encryption client. When the registration encryption server receives the registration certificate file from the registration encryption client, it updates the registration certificate of the relay protection device, updates the registration status of the relay protection device according to the new registration certificate, and sends the new registration status of the relay protection device to the registration encryption client.

2. The method for registration and certification of relay protection devices according to claim 1, characterized in that, The hash value of the hardware unique identifier of the relay protection device calculated by the first encryption algorithm is used as the private key of the relay protection device.

3. The method for registration and certification of relay protection devices according to claim 2, characterized in that, The first encryption algorithm uses the SM3 algorithm.

4. The method for registration and certification of relay protection devices according to claim 1, characterized in that, The second encryption algorithm uses the SM2 algorithm.

5. The method for registration and certification of relay protection devices according to claim 1, characterized in that, The unique hardware identifier of a relay protection device is composed of the unique identifier of the processor chip and the unique identifier of the memory chip in a set order.

6. The method for registration and certification of relay protection devices according to claim 1, characterized in that, When the registration encryption client receives a response message from the registration encryption server querying the registration status of the relay protection device, it saves the registration status, unique hardware identifier, and public key of the relay protection device, updates the registration status change flag of the relay protection device, and determines whether the relay protection device has been registered. If not, the registration encryption client uses the SM2 algorithm and the public key to encrypt the unique hardware identifier to obtain the registration certificate file, and sends the registration certificate file to the registration encryption server.

7. The method for registration and certification of relay protection devices according to claim 1, characterized in that, For a registered encrypted client, if the time interval between the current time and the time t of sending the query relay protection device registration status message is greater than 5 seconds, the registered encrypted client sends the query relay protection device registration status message to the registered encrypted server, updates t to the current time, and then re-determines whether the time interval between the current time and t is greater than 5 seconds.

8. The method for registration and certification of relay protection devices according to claim 6, characterized in that, Based on the registration status of the relay protection device in the response message, determine whether the relay protection device has been registered. If it has been registered, determine whether the registration status of the relay protection device has changed. If it has changed, issue a command to the registration encryption server to restart the device and enable the relay protection device to operate normally.

9. The method for registration and certification of relay protection devices according to claim 8, characterized in that, The specific method for determining whether the registration status of a relay protection device has changed is as follows: Set a relay protection device registration status update flag variable. If the hardware unique identifier in the currently received message is the same as the hardware unique identifier in the last received message, and the device status in the currently received message is registered, while the device status in the last received message is unregistered, then mark the status update flag variable as newly registered successfully; otherwise, mark the status update flag variable as not newly registered successfully.

10. A relay protection device encryption system, characterized in that, This includes a registration encryption server, a registration encryption client, and an application. The registration encryption server and application are deployed at the relay protection device. The registration encryption server and the registration encryption client communicate over the network using the UDP protocol. The registration encryption server is used to cooperate with the application to implement the relay protection device registration and authentication method as described in claim 1. The registration encryption client is used to encrypt the unique hardware identifier of the relay protection device using the second encryption algorithm and the public key of the relay protection device to obtain the registration certificate file; The registration encryption client is also used to send registration certificate files to the registration encryption server and query relay protection device registration status messages to obtain the registration status, hardware unique identifier, and public key of the relay protection device; The application is used to determine the registration status of the relay protection device based on the registration encryption server, and to control the relay protection device to operate normally or abnormally, so as to determine whether the relay protection device is officially manufactured.

Images