Power business data security encryption method based on Internet of Things

Abstract

The present invention provides a method for secure encryption of electric power business data based on the Internet of Things, which extracts multiple candidate data nodes from the associated encrypted data nodes of the target security encryption unit, and determines the candidate privacy-sensitive features in each candidate data node according to a predefined multiple reference privacy-sensitive feature encryption strategy, and makes encryption path decisions based on this, which not only improves the pertinence of the encryption process, but also ensures that the encryption process is closely related to the privacy-sensitive features of the data. In addition, by comparing the errors between the encryption path decision results of each candidate data node under different encryption strategies and the default encryption path, the present invention can quantify the encryption cost of each encryption strategy, thereby optimizing the target privacy-sensitive feature encryption strategy that is most suitable for the current target security encryption unit, effectively improving the security and encryption efficiency of electric power business data in the Internet of Things environment, and ensuring the safe transmission and storage of electric power business data.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method for securely encrypting power business data based on the Internet of Things. Background Art

[0002] With the rapid development of Internet of Things technology, power business data faces increasingly severe security threats during transmission and storage. Power business data in the Internet of Things environment usually contains a large amount of sensitive information, such as user power consumption data, power grid operation status, equipment monitoring data, etc. The security and privacy protection of this data are crucial. However, traditional encryption methods often use fixed encryption strategies, which are difficult to adapt to the diversity and dynamic characteristics of data in the Internet of Things environment, resulting in unsatisfactory encryption effects and a high risk of data leakage.

[0003] In response to the above problems, the existing technology has proposed some improved encryption methods, attempting to improve data security by introducing dynamic encryption strategies, strengthening key management, and other means. However, these methods still have many shortcomings in practical applications. For example, although some methods take into account the privacy-sensitive characteristics of data, they lack flexibility and pertinence in the selection of encryption strategies, resulting in a large gap between the encryption effect and expectations. In addition, although some methods can dynamically adjust the encryption strategy, they fail to effectively quantify the advantages and disadvantages of each encryption strategy, making the encryption process lack of scientific basis and difficult to achieve the best encryption effect.

[0004] Therefore, there is an urgent need for a data security encryption method that can flexibly select and optimize encryption strategies based on the characteristics of power business data in the Internet of Things environment. Summary of the invention

[0005] In view of the above-mentioned problems, in combination with the first aspect of the present invention, an embodiment of the present invention provides a method for secure encryption of power business data based on the Internet of Things, the method comprising:

[0006] For a target security encryption unit in a power business data block in an Internet of Things environment, extract multiple candidate data nodes from the associated encrypted data nodes of the target security encryption unit;

[0007] For each of the predefined multiple reference privacy-sensitive feature encryption strategies, determine candidate privacy-sensitive features from the multiple candidate data nodes according to the traversed reference privacy-sensitive feature encryption strategies;

[0008] Performing encryption path decision on the target security encryption unit based on the candidate privacy-sensitive features respectively determined in the multiple candidate data nodes, and determining encryption path decision results respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy;

[0009] Determine a default encryption path of the target security encryption unit, and determine encryption costs corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy based on errors between encryption path decision results corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy and the default encryption path;

[0010] Based on the encryption cost of each of the multiple candidate data nodes under each reference privacy-sensitive feature encryption strategy, a target privacy-sensitive feature encryption strategy is determined from the multiple reference privacy-sensitive feature encryption strategies; the target privacy-sensitive feature encryption strategy is used to perform encryption processing on the target security encryption unit.

[0011] On the other hand, an embodiment of the present invention also provides an Internet of Things-based power business data security encryption system, including a processor and a machine-readable storage medium, the machine-readable storage medium is connected to the processor, the machine-readable storage medium is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the machine-readable storage medium to implement the above method.

[0012] Based on the above aspects, the embodiment of the present application extracts multiple candidate data nodes from the associated encrypted data nodes of the target security encryption unit, and determines the candidate privacy-sensitive features in each candidate data node according to multiple pre-defined reference privacy-sensitive feature encryption strategies, and makes encryption path decisions based on this, which not only improves the pertinence of the encryption processing, but also ensures that the encryption process is closely related to the privacy-sensitive features of the data. In addition, the present invention can quantify the encryption cost of each encryption strategy by comparing the encryption path decision results of each candidate data node under different encryption strategies with the error between the default encryption path, thereby selecting the target privacy-sensitive feature encryption strategy that is most suitable for the current target security encryption unit, effectively improving the security and encryption efficiency of power business data in the Internet of Things environment, and ensuring the safe transmission and storage of power business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a schematic diagram of the execution flow of the method for secure encryption of power business data based on the Internet of Things provided in an embodiment of the present invention.

[0014] Figure 2 It is a schematic diagram of the hardware architecture of the power business data security encryption system based on the Internet of Things provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The present invention will be described in detail below with reference to the accompanying drawings. Figure 1It is a flow chart of a method for secure encryption of power business data based on the Internet of Things provided by an embodiment of the present invention. The method for secure encryption of power business data based on the Internet of Things is introduced in detail below.

[0016] Step S110, for a target security encryption unit in a power business data block in an Internet of Things environment, extract multiple candidate data nodes from the associated encrypted data nodes of the target security encryption unit.

[0017] In this embodiment, for the power enterprise IoT environment, there are a large number of power business data blocks. Assume that there is a power business data block specifically used to store real-time monitoring data of substations in a certain area. This power business data block contains a target security encryption unit. The target security encryption unit may cover data on key power parameters such as voltage, current, and power factor.

[0018] For this target security encryption unit, its associated encrypted data nodes are distributed in different related data blocks. For example, under the linkage encryption strategy, the server will extract multiple candidate data nodes from multiple data nodes of the predecessor data block and the side chain data block of the target security encryption unit. The predecessor data block may contain the power parameter data of the substation at the previous moment, which has been encrypted, and the side chain data block may store data nodes of other equipment associated with the substation (such as line switch status monitoring equipment). The server extracts multiple candidate data nodes from the data nodes in these predecessor data blocks and side chain data blocks according to specific rules. For example, the server will screen out data nodes that are close in time or logically closely associated with the power parameter data in the current target security encryption unit as candidate data nodes.

[0019] Under the core encryption strategy, multiple candidate data nodes can be extracted from multiple data nodes of the precursor data block of the target security encryption unit. Taking the aforementioned substation as an example, the data nodes in the precursor data block contain the historical data of power parameters in the previous short period of time. The server will extract those data nodes that have important reference value for the encryption of the current target security encryption unit from the data nodes of these historical data as candidate data nodes. These data nodes may include data nodes such as the fluctuation range, peak value, and valley value of power parameters in the past period of time. These data nodes can provide basic data references for encryption operations under the core encryption strategy.

[0020] Under the auxiliary encryption strategy, the server extracts multiple candidate data nodes from multiple data nodes of the side chain data block of the target security encryption unit. For example, the data nodes in the side chain data block include data nodes such as the ambient temperature and humidity of the substation (because environmental factors may affect the operating parameters of power equipment). The server will extract these data nodes related to the substation operating environment as multiple candidate data nodes associated with the auxiliary encryption strategy.

[0021] Step S120: for each reference privacy-sensitive feature encryption strategy among the pre-defined multiple reference privacy-sensitive feature encryption strategies, determine candidate privacy-sensitive features from the multiple candidate data nodes respectively according to the traversed reference privacy-sensitive feature encryption strategy.

[0022] In this embodiment, multiple reference privacy-sensitive feature encryption strategies, such as a linkage encryption strategy, a core encryption strategy, and an auxiliary encryption strategy, are predefined.

[0023] For the linkage encryption strategy, take the previously mentioned substation power business data as an example. In each of the multiple candidate data nodes extracted from different data blocks, the server determines the features to be encrypted in the core encryption area and the auxiliary encryption area respectively as candidate privacy-sensitive features associated with the linkage encryption strategy. Suppose that a candidate data node contains the voltage, current and ambient temperature data of the substation at a certain moment. In the core encryption area, the server determines the voltage and current data as features to be encrypted, because these are the core data of the power business, involving important privacy information such as the stability and security of the power supply; in the auxiliary encryption area, the server determines the ambient temperature data as a feature to be encrypted, because although the ambient temperature is not the core data of the power business, it has a certain relationship with the operating status of the power equipment and is also part of the privacy information that needs to be protected.

[0024] For the core encryption strategy, in each of the multiple candidate data nodes, the server determines the to-be-encrypted features in the core encryption zone as candidate privacy-sensitive features associated with the core encryption strategy. For example, for a data node containing the fluctuation range of the historical power parameters of a substation, the server determines that this fluctuation range data is the to-be-encrypted feature in the core encryption zone, because it reflects the stability of the power operation of the substation and is the core privacy-sensitive information of the power business.

[0025] For the auxiliary encryption strategy, in each of the multiple candidate data nodes, the server determines the features to be encrypted in the auxiliary encryption area as candidate privacy-sensitive features associated with the core encryption strategy. For example, in the data node containing the ambient humidity around the substation, the server determines that the ambient humidity data is the feature to be encrypted in the auxiliary encryption area, because although the ambient humidity is auxiliary data, it is of certain significance for a comprehensive understanding of the operating environment of the substation and ensuring the normal operation of the power equipment, and is privacy information that needs to be protected.

[0026] Step S130, performing encryption path decision on the target security encryption unit based on the candidate privacy-sensitive features respectively determined in the multiple candidate data nodes, and determining the encryption path decision results respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy.

[0027] In this embodiment, the server determines the encryption attention factors corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy based on the candidate privacy-sensitive features determined in the multiple candidate data nodes. Taking the power business data of the substation as an example, for any one of the multiple candidate data nodes, it is assumed that this candidate data node contains the voltage, current and ambient temperature data of the substation at a certain moment, and in the previous step, the voltage and current have been determined as candidate privacy-sensitive features of the core encryption area, and the ambient temperature has been determined as the candidate privacy-sensitive features of the auxiliary encryption area. Based on these determined candidate privacy-sensitive features, the server determines the feature importance weights and encryption requirement levels corresponding to these features. For example, since voltage and current data are the core data of the power business, the server assigns them higher feature importance weights, such as the feature importance weight of voltage data is 0.8, and the feature importance weight of current data is 0.7; at the same time, since they are crucial to the safety and stability of power supply, the encryption requirement level is also high, set to level 3 (assuming that the encryption requirement level is divided into 1-3 levels, and level 3 is the highest requirement level). For ambient temperature data, its feature importance weight is relatively low, set to 0.3, and the encryption requirement level is level 1.

[0028] Based on the feature importance weights and encryption requirement levels corresponding to these candidate privacy-sensitive features, the server determines the encryption attention factor of the candidate data nodes traversed under the reference privacy-sensitive feature encryption strategy. Specifically, from the feature importance weights corresponding to these candidate privacy-sensitive features, the server determines the average importance weight, such as (0.8 + 0.7 + 0.3) / 3 = 0.6; from the encryption requirement levels corresponding to these candidate privacy-sensitive features, the server determines the average encryption requirement level, such as (3 + 3 + 1) / 3 = 2.33 (for the convenience of calculation here, the average value is only an example, and the actual situation may be based on more complex algorithms). Based on this average importance weight and average encryption requirement level, the encryption attention factor of this candidate data node is determined by a specific calculation function (such as a weighted calculation function).

[0029] According to the encryption attention factors corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, the server constructs the encryption path selection model corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy. Based on these encryption attention factors, the server extracts key feature data related to encryption path selection, such as the change trend of the encryption attention factor in different dimensions (such as the change trend of the encryption attention factor on the power parameter data over time), and the relative relationship between the encryption attention factors of different candidate data nodes (such as the size relationship between the encryption attention factors of the candidate data nodes corresponding to the power parameter data at different times).

[0030] The server determines the basic architecture of the encryption path selection model, which adopts a hierarchical structure. The upper layer is the decision layer, which is used to make encryption path selection decisions based on the information provided by the lower layer, and the lower layer is the feature analysis layer, which is used to analyze the input key feature data and provide decision-making basis to the upper layer. At the same time, the main modules involved in the encryption path selection model and the interaction between the modules are determined. For example, the data processing module in the feature analysis layer will perform data cleaning and feature conversion on the input encryption attention factor data, and then pass the processed data to the encryption path evaluation module. The encryption path evaluation module evaluates different encryption paths based on the processed encryption attention factor data and the model parameters in the encryption path selection model (such as weight parameters related to the encryption attention factor, threshold parameters for judging encryption path selection, etc.), and finally passes the evaluation results to the encryption path decision module, which makes the final encryption path selection decision.

[0031] According to the encryption path selection model corresponding to multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, the server makes encryption path decisions for the target security encryption unit, and determines the encryption path decision results corresponding to multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy. For example, for the target security encryption unit containing substation power parameter data, according to the constructed encryption path selection model, the server may decide to use an encryption path based on a symmetric encryption algorithm for some candidate data nodes, because the power parameter data in these candidate data nodes are judged to have extremely high security requirements and relatively small data volume under the influence of the encryption attention factor, which is suitable for efficient encryption of symmetric encryption algorithms; while for some other candidate data nodes containing environmental data, an encryption path of an asymmetric encryption algorithm may be used, because the encryption requirements of environmental data are relatively low, but better key management is required, and asymmetric encryption algorithms have advantages in this regard.

[0032] Step S140, determine the default encryption path of the target security encryption unit, and determine the encryption costs corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy based on the errors between the encryption path decision results corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy and the default encryption path.

[0033] In this embodiment, the server extracts features based on the business requirements, data type information, security level requirements, and historical encryption data statistics related to the target security encryption unit in the power business data block to generate basic feature data. For example, for the target security encryption unit in the power business data block of the substation, the business requirements may be to ensure the real-time, accuracy, and security of the power data; the data type information includes numerical data such as voltage and current, and discrete data such as equipment status; the security level requirements may be set to a higher level according to the importance of power supply; the historical encryption data statistics include the encryption algorithm, encryption time, encryption resource consumption, and other information used in the past to encrypt similar power data. Through comprehensive analysis of this information, the server generates basic feature data, which includes various basic elements related to the encryption of the target security encryption unit.

[0034] Based on these basic feature data, the server determines the candidate default encryption path that matches the target security encryption unit. For example, for the power parameter data of the substation, considering the high real-time and security requirements of the data and the relatively small amount of data, the server may preliminarily determine the symmetric encryption algorithm (such as the AES algorithm) as the candidate default encryption path. Then, a comprehensive evaluation is conducted on this candidate default encryption path, and the evaluation basis includes the complexity of the encryption algorithm, the occupation of power business system resources by the encryption process, the performance stability of the encryption, and the compatibility with the IoT environment. For the AES algorithm, the server will analyze its computational complexity (such as the number of rounds in the encryption and decryption process, the complexity of the key expansion algorithm, etc.). In terms of the occupation of power business system resources, the CPU, memory and other resources occupied when it runs on the server will be considered. In terms of performance stability, it will check whether there are decryption failures or large fluctuations in encryption time in past encryption operations. In terms of compatibility with the IoT environment, it will check whether it is compatible with the communication protocol and data format adopted by IoT devices (such as sensors, smart meters, etc.) in the substation. The final default encryption path is determined based on the comprehensive evaluation results. Assuming that the AES algorithm performs well in all aspects after evaluation, it is determined as the final default encryption path.

[0035] For the encryption path decision result corresponding to each candidate data node, the server calculates the error between the encryption path decision result and the default encryption path, and generates an error value set. For example, for the encryption path decision result corresponding to a candidate data node using an asymmetric encryption algorithm (such as the RSA algorithm), the error between it and the default AES algorithm encryption path is calculated. In terms of the encryption algorithm step error of the encryption path, the AES algorithm is a symmetric encryption algorithm based on block encryption, with relatively simple and fixed steps, while the RSA algorithm is an asymmetric encryption algorithm based on number theory, with complex steps and large amount of calculation. The difference between the two in the algorithm steps is calculated as the encryption algorithm step error; in terms of the data conversion error during the encryption process, the AES algorithm directly encrypts the data block, while the RSA algorithm may need to perform some preprocessing on the data (such as digital signature operations), and the difference between the two operations in data conversion is calculated as the data conversion error; in terms of the format error of the encrypted data, the data format encrypted by the AES algorithm is relatively fixed, and the data format encrypted by the RSA algorithm may be different due to the mathematical operations in the encryption process. The difference between the two in data format is calculated as the data format error, and these errors are combined into an error value set.

[0036] The server collects basic data related to encryption costs, such as resource consumption weight information of different encryption operations in the power business system (such as the weight of symmetric encryption algorithms on CPU resource consumption, the weight of asymmetric encryption algorithms on memory resource consumption, etc.), and weight information of the impact of different error values ​​on the security of power business (such as the weight of encryption algorithm step errors on the risk of power data tampering, the weight of data conversion errors on the accuracy of power data transmission, etc.).

[0037] According to the error value set, the resource consumption weight information of different encryption operations in the power business system, and the weight information of the impact of different encryption errors on the security of the power business, the server calculates the encryption cost corresponding to each candidate data node. Specifically, for each candidate data node, the error value between the corresponding encryption path decision result and the default encryption path is multiplied by the corresponding resource consumption weight and security impact weight to obtain the encryption cost of each candidate data node under the reference privacy-sensitive feature encryption strategy. For example, for the candidate data node that previously adopted the RSA algorithm, assuming that the encryption algorithm step error is 0.3 (here is a relative value), the corresponding resource consumption weight is 0.2 (indicating the weight in terms of CPU resource consumption), and the security impact weight on the risk of power data tampering is 0.5; the data conversion error is 0.2, the corresponding resource consumption weight is 0.1 (indicating the weight in terms of memory resource consumption), and the security impact weight on the accuracy of power data transmission is 0.3; the data format error is 0.1, the corresponding resource consumption weight is 0.1 (indicating the resource consumption weight in terms of data storage), and the security impact weight on the accuracy of power data reading is 0.2. Then the encryption cost of the candidate data node is: (0.3×0.2×0.5 + 0.2×0.1×0.3+0.1×0.1×0.2) = 0.032.

[0038] Step S150, based on the encryption cost of each of the multiple candidate data nodes under each reference privacy-sensitive feature encryption strategy, determine a target privacy-sensitive feature encryption strategy from the multiple reference privacy-sensitive feature encryption strategies. The target privacy-sensitive feature encryption strategy is used to perform encryption processing on the target security encryption unit.

[0039] In this embodiment, the server determines the minimum encryption cost based on the encryption cost of each of the multiple candidate data nodes under each reference privacy-sensitive feature encryption strategy. For example, assuming that under the linkage encryption strategy, the encryption costs of each candidate data node are calculated to be 0.05, 0.04, and 0.06 respectively; under the core encryption strategy, the encryption costs of each candidate data node are calculated to be 0.07, 0.08, and 0.09 respectively; under the auxiliary encryption strategy, the encryption costs of each candidate data node are calculated to be 0.03, 0.04, and 0.05 respectively. By comparing these encryption costs, the server determines that the minimum encryption cost is 0.03, and this minimum encryption cost is obtained under the auxiliary encryption strategy.

[0040] The server uses the reference privacy-sensitive feature encryption strategy represented by the minimum encryption cost, namely the auxiliary encryption strategy, as the target privacy-sensitive feature encryption strategy for encrypting the target security encryption unit, and uses the candidate data node represented by the minimum encryption cost (in this example, the candidate data node with an encryption cost of 0.03 under the auxiliary encryption strategy) as the target candidate data node based on which the target privacy-sensitive feature encryption strategy is used for encryption processing.

[0041] In addition, the server determines the target policy index information corresponding to the target privacy-sensitive feature encryption policy (e.g., the index number of the auxiliary encryption policy in the encryption policy library stored on the server), and the target candidate data node index information corresponding to the target candidate data node (e.g., the index position of this candidate data node in the data structure storing all candidate data nodes). Under the target privacy-sensitive feature encryption policy, the server encrypts the target security encryption unit according to the target candidate data node, and loads the target policy index information and the target candidate data node index information into the encrypted information. In this way, in subsequent encrypted data management, decryption operations, or security audits, relevant information of the encryption process can be easily found and verified based on these index information.

[0042] Based on the above steps, the embodiment of the present application extracts multiple candidate data nodes from the associated encrypted data nodes of the target security encryption unit, and determines the candidate privacy-sensitive features in each candidate data node according to multiple pre-defined reference privacy-sensitive feature encryption strategies, and makes encryption path decisions based on this, which not only improves the pertinence of the encryption processing, but also ensures that the encryption process is closely related to the privacy-sensitive features of the data. In addition, the present invention can quantify the encryption cost of each encryption strategy by comparing the encryption path decision results of each candidate data node under different encryption strategies with the error between the default encryption path, thereby selecting the target privacy-sensitive feature encryption strategy that is most suitable for the current target security encryption unit, effectively improving the security and encryption efficiency of power business data in the Internet of Things environment, and ensuring the safe transmission and storage of power business data.

[0043] In a possible implementation, the multiple reference privacy-sensitive feature encryption strategies include at least one of a linkage encryption strategy, a core encryption strategy, or an auxiliary encryption strategy.

[0044] Step S110 includes:

[0045] Step S111, for the target security encryption unit in the power business data block, under the linkage encryption strategy, multiple candidate data nodes are extracted from multiple data nodes of the predecessor data block and the side chain data block of the target security encryption unit as multiple candidate data nodes associated with the linkage encryption strategy.

[0046] Step S112, under the core encryption strategy, extract multiple candidate data nodes from multiple data nodes of the predecessor data block of the target security encryption unit as multiple candidate data nodes associated with the core encryption strategy.

[0047] Step S113, under the auxiliary encryption strategy, extract multiple candidate data nodes from multiple data nodes of the side chain data block of the target security encryption unit as multiple candidate data nodes associated with the auxiliary encryption strategy.

[0048] In a possible implementation, the multiple reference privacy-sensitive feature encryption strategies include at least one of a linkage encryption strategy, a core encryption strategy, or an auxiliary encryption strategy.

[0049] Step S120 includes:

[0050] Step S121, for the linkage encryption strategy, in each of the multiple candidate data nodes, the features to be encrypted in the core encryption area and the auxiliary encryption area are respectively determined as candidate privacy-sensitive features associated with the linkage encryption strategy.

[0051] Step S122: For the core encryption strategy, in each of the multiple candidate data nodes, a feature to be encrypted in the core encryption area is determined as a candidate privacy-sensitive feature associated with the core encryption strategy.

[0052] Step S123: For the auxiliary encryption strategy, in each of the multiple candidate data nodes, a feature to be encrypted in the auxiliary encryption area is determined as a candidate privacy-sensitive feature associated with the core encryption strategy.

[0053] In this embodiment, under the linkage encryption strategy, the server operates on the target security encryption unit in the power business data block. Taking the power business data of the substation as an example, the target security encryption unit contains the real-time power operation parameters of the substation, such as voltage, current, power factor and other key data. The server extracts multiple candidate data nodes from the multiple data nodes of the precursor data block and the side chain data block of the target security encryption unit as multiple candidate data nodes associated with the linkage encryption strategy. The precursor data block stores the power operation data of the substation at the previous moment, and these data nodes are of great significance for analyzing the power operation trend. The side chain data block contains other equipment or environmental data related to the substation, such as real-time temperature and humidity data of the transmission line connected to the substation, and status data of the intelligent monitoring equipment on the line. The server selects the data nodes associated with the target security encryption unit from the data nodes of these precursor data blocks and side chain data blocks according to pre-set rules as candidate data nodes. These candidate data nodes may contain the voltage fluctuation data at the previous moment in the predecessor data block and the current line temperature data in the side chain data block, etc. They can provide comprehensive data references for encryption operations under the linkage encryption strategy.

[0054] Under the core encryption strategy, also taking the substation data as an example, the server extracts multiple candidate data nodes from multiple data nodes in the precursor data block of the target security encryption unit as multiple candidate data nodes associated with the core encryption strategy. The data nodes in the precursor data block contain detailed power operation data of the substation in the past period of time, and the server extracts those data nodes that are of great value to the core data encryption of the target security encryption unit. For example, for the real-time voltage data in the target security encryption unit, the server extracts data nodes such as the peak value, valley value, and fluctuation frequency of the voltage in the past few hours from the precursor data block. These data nodes reflect the stability characteristics of the power supply of the substation and are an important reference for encryption operations under the core encryption strategy.

[0055] Under the auxiliary encryption strategy, the server extracts multiple candidate data nodes from multiple data nodes of the side chain data block of the target security encryption unit as multiple candidate data nodes associated with the auxiliary encryption strategy. Continuing with the substation as an example, the data nodes in the side chain data block may contain meteorological data of the substation's surrounding environment, such as wind speed, wind direction, etc., as well as operating status data of the substation's ancillary equipment, such as the temperature of the cooling system, fan speed, etc. The server extracts these data nodes related to the substation's operating environment and ancillary equipment as candidate data nodes under the auxiliary encryption strategy. Although these data nodes are not the core data of the power business, they play an auxiliary role in fully understanding the substation's operating status and ensuring the stability of power supply.

[0056] For each of the predefined multiple reference privacy-sensitive feature encryption strategies, the server determines candidate privacy-sensitive features from multiple candidate data nodes based on the traversed reference privacy-sensitive feature encryption strategies.

[0057] For the linkage encryption strategy, in each of the multiple candidate data nodes, the server determines the features to be encrypted in the core encryption area and the auxiliary encryption area respectively as candidate privacy-sensitive features associated with the linkage encryption strategy. Taking the candidate data node containing the substation voltage, current data and ambient temperature data as an example, in the core encryption area, the server determines the voltage and current data as features to be encrypted. Because voltage and current data are core indicators of substation power supply and are directly related to the efficiency and safety of power transmission, the privacy of these data is crucial to power companies. In the auxiliary encryption area, the server determines the ambient temperature data as a feature to be encrypted. Although ambient temperature data is not the core data of the power business, it affects the operating efficiency and life of substation equipment, and has a certain correlation with the stability of power supply, so it also belongs to privacy information that needs to be protected.

[0058] For the core encryption strategy, in each of the multiple candidate data nodes, the server determines the features to be encrypted in the core encryption area as candidate privacy-sensitive features associated with the core encryption strategy. For example, for a data node containing the voltage fluctuation range and fluctuation frequency of the substation over the past period of time, the server determines that the voltage fluctuation range and fluctuation frequency data are the features to be encrypted in the core encryption area. Because these data reflect the stability of the power supply of the substation and are the core privacy-sensitive information of the power business, any improper access or tampering with these data may affect the normal operation of the power system.

[0059] For the auxiliary encryption strategy, in each of the multiple candidate data nodes, the server determines the features to be encrypted in the auxiliary encryption area as candidate privacy-sensitive features associated with the core encryption strategy. For example, in the data node containing the ambient wind speed and wind direction around the substation, the server determines that the ambient wind speed and wind direction data are the features to be encrypted in the auxiliary encryption area. Although the ambient wind speed and wind direction are auxiliary data, they are of certain significance for a comprehensive understanding of the operating environment of the substation and ensuring the normal operation of power equipment, and are privacy information that needs to be protected. The privacy protection of these data helps power companies better manage and maintain the operation of substations and improve the reliability of power supply.

[0060] In a possible implementation, step S130 includes:

[0061] Step S131, based on the candidate privacy-sensitive features respectively determined in the multiple candidate data nodes, determine the encryption attention factors respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy.

[0062] Step S132: construct an encryption path selection model corresponding to each of the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy based on the encryption attention factors corresponding to each of the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy.

[0063] Step S133, based on the encryption path selection models respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, encryption path decisions are made on the target security encryption unit respectively, and encryption path decision results respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy are determined.

[0064] In this embodiment, for each candidate data node, the server can determine the relevant feature importance weight and encryption requirement level based on the candidate privacy-sensitive features therein, and then derive the encryption attention factor. For example, there is a candidate data node that contains the voltage, current and ambient temperature data of the substation at a certain moment. Among the previously determined candidate privacy-sensitive features, voltage and current are important features of the core encryption area, and ambient temperature belongs to the auxiliary encryption area feature. Since voltage and current are core data of the power business, the server assigns a higher feature importance weight to voltage, such as 0.8, and a feature importance weight of 0.7 to current. Their encryption requirement level is level 3 (assuming that the encryption requirement level is divided into levels 1-3, and level 3 is the highest requirement level); the feature importance weight of ambient temperature is relatively low and is set to 0.3, and the encryption requirement level is level 1. The server then determines the average importance weight from these feature importance weights, such as (0.8 + 0.7 + 0.3) / 3 = 0.6, and determines the average encryption requirement level from the encryption requirement levels, such as (3 + 3 + 1) / 3 = 2.33. Based on the average importance weight and the average encryption requirement level, the server determines the encryption attention factor of this candidate data node through a specific calculation function.

[0065] Next, based on these encrypted attention factors, key feature data related to encrypted path selection can be extracted, such as the changing trend of encrypted attention factors in different dimensions, such as the changes in encrypted attention factors corresponding to different power parameters over time, and the relative relationship between encrypted attention factors of different candidate data nodes, such as the comparison of encrypted attention factors between candidate data nodes corresponding to power parameter data at different times. Then determine the basic architecture of the encrypted path selection model, which adopts a hierarchical structure. The upper layer is the decision layer for making encrypted path selection decisions based on the information provided by the lower layer, and the lower layer is the feature analysis layer for analyzing the input key feature data and providing decision basis to the upper layer. At the same time, determine the main modules in the model and the interaction between the modules. For example, the data processing module in the feature analysis layer will clean and transform the input encrypted attention factor data, and then pass it to the encrypted path evaluation module. The encrypted path evaluation module evaluates different encrypted paths based on the processed data and parameters in the model, such as weight parameters related to the encrypted attention factor, threshold parameters for judging the selection of encrypted paths, etc., and finally passes the results to the encrypted path decision module for final decision.

[0066] Finally, taking the power parameter data of the substation as an example, for candidate data nodes containing different power data, according to the constructed encryption path selection model, the server may decide to adopt an encryption path based on a symmetric encryption algorithm for some candidate data nodes. For example, for candidate data nodes containing core power parameters and whose encryption attention factor indicates extremely high security requirements and relatively small data volume, the high efficiency of the symmetric encryption algorithm is suitable for this situation; while for candidate data nodes containing auxiliary data such as environmental data, an encryption path using an asymmetric encryption algorithm may be adopted, because the encryption requirements for environmental data are relatively low but require better key management, and the asymmetric encryption algorithm has advantages in this regard, thereby determining the encryption path decision result corresponding to each candidate data node.

[0067] In a possible implementation, each of the plurality of candidate data nodes has a plurality of candidate privacy-sensitive features selected. Step S131 includes:

[0068] Step S1311: For any one of the multiple candidate data nodes, based on the multiple candidate privacy-sensitive features determined by the traversed candidate data nodes, determine the feature importance weights and encryption requirement levels respectively corresponding to the multiple candidate privacy-sensitive features.

[0069] Step S1312: Determine the encryption attention factor of the candidate data nodes traversed under the reference privacy-sensitive feature encryption strategy according to the feature importance weights and encryption requirement levels respectively corresponding to the multiple candidate privacy-sensitive features.

[0070] In a possible implementation, step S1312 includes:

[0071] Step S1312-1: Determine an average importance weight from the feature importance weights corresponding to the multiple candidate privacy-sensitive features.

[0072] Step S1312-2: Determine an average encryption requirement level from the encryption requirement levels corresponding to the multiple candidate privacy-sensitive features.

[0073] Step S1312-3, based on the average importance weight and the average encryption requirement level, determine the encryption attention factor of the candidate data nodes traversed under the traversed reference privacy-sensitive feature encryption strategy.

[0074] In a possible implementation, step S132 includes:

[0075] Step S1321, based on the encrypted attention factors corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, extract key feature data related to encryption path selection, the key feature data including the changing trend of the encrypted attention factor in different dimensions and the relative relationship between the encrypted attention factors of different candidate data nodes.

[0076] Step S1322, determine the basic architecture of the encryption path selection model, the basic architecture includes the hierarchical structure of the encryption path selection model, the connection method between each layer and the main modules involved in the encryption path selection model, wherein the hierarchical structure adopts a layered structure, the upper layer is a decision-making layer, which is used to make encryption path selection decisions based on information provided by the lower layer, and the lower layer is a feature analysis layer, which is used to analyze the input key feature data and provide decision-making basis to the upper layer, and at the same time determine the interaction method between each module in the encryption path selection model.

[0077] Step S1323, initializing the model parameters in the encryption path selection model after the basic architecture is determined, and the model parameters include weight parameters related to the encryption attention factor and threshold parameters for determining the encryption path selection.

[0078] Step S1324, constructing various functional modules according to the basic framework of the encrypted path selection model, wherein a data processing module is constructed for performing data cleaning and feature conversion on the input encrypted attention factor data, an encrypted path evaluation module is constructed for evaluating different encryption paths according to the processed encrypted attention factor data and the model parameters in the encrypted path selection model, and an encrypted path decision module is constructed for making a final encryption path selection decision according to the result of the encrypted path evaluation module.

[0079] In this embodiment, taking the power business data of the substation as an example, for any candidate data node among the multiple candidate data nodes, the server determines the feature importance weights and encryption requirement levels corresponding to the multiple candidate privacy-sensitive features based on the multiple candidate privacy-sensitive features determined by the traversed candidate data nodes. Assume that this candidate data node contains data such as voltage, current, ambient temperature, and equipment operating status of the substation at a certain moment, and these data are all determined as candidate privacy-sensitive features. Since voltage and current are core indicators of power supply, they are directly related to the efficiency and safety of power transmission, so the server assigns a higher feature importance weight to voltage, such as 0.8, and its encryption requirement level is level 3 (assuming that the encryption requirement level is divided into levels 1-3, and level 3 is the highest requirement level); the feature importance weight of current is set to 0.7, and the encryption requirement level is also level 3. Although ambient temperature has a certain impact on the operation of power equipment, its importance is slightly lower than that of voltage and current, so its feature importance weight is 0.3 and the encryption requirement level is 1; equipment operation status data is helpful for a comprehensive understanding of the operation of the substation, and its feature importance weight is 0.4 and the encryption requirement level is 2.

[0080] According to the feature importance weights and encryption requirement levels corresponding to multiple candidate privacy-sensitive features, the server determines the encryption attention factor of the candidate data nodes traversed under the traversed reference privacy-sensitive feature encryption strategy. First, the average importance weight is determined from the feature importance weights corresponding to multiple candidate privacy-sensitive features. In the above example, the average importance weight is (0.8 + 0.7 + 0.3 + 0.4) / 4 = 0.55. Then, the average encryption requirement level is determined from the encryption requirement levels corresponding to multiple candidate privacy-sensitive features, that is, (3 + 3 + 1 + 2) / 4 = 2.25. Then, based on the average importance weight and the average encryption requirement level, the encryption attention factor of the candidate data nodes traversed under the traversed reference privacy-sensitive feature encryption strategy is determined by a specific calculation function. This calculation function may be pre-set according to the security policy of the power business and the relevant algorithm of data encryption. For example, it may be a weighted sum function, which calculates the average importance weight and the average encryption requirement level according to a certain ratio to obtain the encryption attention factor.

[0081] According to the encryption attention factors respectively corresponding to multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, the server constructs an encryption path selection model respectively corresponding to multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy.

[0082] First, based on the encryption attention factors corresponding to multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, key feature data related to encryption path selection are extracted. These key feature data include the changing trend of encryption attention factors in different dimensions and the relative relationship between encryption attention factors of different candidate data nodes. For example, from the perspective of time dimension, the encryption attention factors corresponding to power data at different times may change with the passage of time. For the voltage data of the substation, its encryption attention factor may increase during the peak period of power consumption, because the stability of voltage is crucial to power supply at this time; while during the trough period of power consumption, the encryption attention factor may be relatively reduced. The relative relationship between the encryption attention factors of different candidate data nodes is also very important. For example, between the candidate data nodes containing voltage and current data and the candidate data nodes containing ambient temperature and equipment operation status data, their encryption attention factors are relatively large due to the higher importance of voltage and current data. This relative relationship reflects the priority of different data in encryption decisions.

[0083] Then determine the basic architecture of the encryption path selection model. This basic architecture includes the hierarchical structure of the encryption path selection model, the connection mode between each layer, and the main modules involved in the encryption path selection model. Among them, the hierarchical structure adopts a hierarchical structure, the upper layer is the decision layer, which is used to make encryption path selection decisions based on the information provided by the lower layer; the lower layer is the feature analysis layer, which is used to analyze the input key feature data and provide decision-making basis to the upper layer. At the same time, determine the interaction mode between each module in the encryption path selection model. For example, the data processing module in the feature analysis layer will perform data cleaning and feature conversion on the encrypted attention factor data obtained from different candidate data nodes, remove the noise data and irrelevant information, and convert the data into a format suitable for processing by the encryption path evaluation module. Then, the encryption path evaluation module evaluates different encryption paths based on the processed encryption attention factor data and the model parameters in the encryption path selection model. The model parameters include weight parameters related to the encryption attention factor, threshold parameters for judging the selection of the encryption path, etc. For example, the weight parameters related to the encryption attention factor may be adjusted according to the importance of different power data, and the threshold parameters for judging the selection of the encryption path may be set according to the security level of the power business.

[0084] After that, the model parameters in the encryption path selection model after the basic architecture is determined are initialized. For the weight parameters related to the encryption attention factor, they are initialized according to the importance weights of different candidate privacy-sensitive features previously determined. For example, the weight parameters related to the encryption attention factor corresponding to the voltage data may be set to a higher value because the voltage data is more important. The threshold parameters used to determine the encryption path selection are initialized according to the security requirements of the power business and the characteristics of the encryption algorithm. For example, if a symmetric encryption algorithm is used, the threshold parameters may be set according to the requirements of the symmetric encryption algorithm for data volume and security.

[0085] Finally, according to the basic framework of the encryption path selection model, various functional modules are constructed. A data processing module is constructed to perform data cleaning and feature conversion on the input encrypted attention factor data. The data cleaning process may include operations such as removing duplicate data and correcting erroneous data. Feature conversion may convert the original encrypted attention factor data into a standardized data format for processing by subsequent modules. An encryption path evaluation module is constructed to evaluate different encryption paths based on the processed encrypted attention factor data and the model parameters in the encryption path selection model. For example, for two different encryption paths, symmetric encryption algorithm and asymmetric encryption algorithm, the encryption path evaluation module will calculate the score of each encryption path based on the encryption attention factor data and model parameters to evaluate its applicability to power business data. An encryption path decision module is constructed to make the final encryption path selection decision based on the results of the encryption path evaluation module. If the encryption path evaluation module concludes that the symmetric encryption algorithm is more suitable for the current candidate data node in terms of security, efficiency, etc., the encryption path decision module will select the symmetric encryption algorithm as the final encryption path.

[0086] In a possible implementation, step S150 includes:

[0087] Step S151 : determining a minimum encryption cost based on the encryption costs of each of the multiple candidate data nodes under each reference privacy-sensitive feature encryption strategy.

[0088] Step S152, using the reference privacy-sensitive feature encryption strategy represented by the minimum encryption cost as the target privacy-sensitive feature encryption strategy for encrypting the target security encryption unit, and using the candidate data node represented by the minimum encryption cost as the target candidate data node based on which the target privacy-sensitive feature encryption strategy is used for encryption processing.

[0089] In this embodiment, taking the power business data of the substation as an example, it is assumed that there are three reference privacy-sensitive feature encryption strategies, namely, linkage encryption strategy, core encryption strategy and auxiliary encryption strategy. For multiple candidate data nodes under each strategy, the server will calculate their respective encryption costs. Under the linkage encryption strategy, the encryption cost calculation of each candidate data node involves multiple factors, such as data processing complexity, resource occupancy, and the associated encryption cost with other related data. For example, one of the candidate data nodes contains the real-time voltage, current data and related environmental data of the substation. Encrypting these data requires considering the high sensitivity of voltage and current data and the correlation of environmental data. When calculating the encryption cost, the processing time of the encryption algorithm for these data, the occupancy of server computing resources (such as CPU and memory), and the coordination encryption cost of the associated data during the encryption process should be considered. After detailed calculation, it is obtained that the encryption cost of this candidate data node under the linkage encryption strategy is a specific value, such as 0.05. Similarly, for each candidate data node under the core encryption strategy and the auxiliary encryption strategy, the respective encryption costs are obtained in a similar complex calculation method. Then the server compares the encryption costs of each candidate data node under these different strategies and determines the minimum encryption cost.

[0090] Once the minimum encryption cost is determined, the server uses the reference privacy-sensitive feature encryption strategy represented by the minimum encryption cost as the target privacy-sensitive feature encryption strategy for encrypting the target security encryption unit, and uses the candidate data node represented by the minimum encryption cost as the target candidate data node based on which the target privacy-sensitive feature encryption strategy performs encryption processing. For example, after the above calculation, it is found that the encryption cost of a candidate data node containing specific environmental data and part of the power equipment status data under the auxiliary encryption strategy is the smallest, then the auxiliary encryption strategy is determined as the target privacy-sensitive feature encryption strategy, and this specific candidate data node becomes the target candidate data node.

[0091] In a possible implementation, the method further includes:

[0092] Step A110, determining target policy index information corresponding to the target privacy-sensitive feature encryption policy, and target candidate data node index information corresponding to the target candidate data node.

[0093] Step A120, under the target privacy-sensitive feature encryption strategy, encrypt the target security encryption unit according to the target candidate data node, and load the target policy index information and the target candidate data node index information into the encrypted information.

[0094] Based on the above embodiments, in the encryption policy repository of the server, each encryption policy has a unique index number, and the index number corresponding to the auxiliary encryption policy is the target policy index information. For the target candidate data node, in the data structure storing all candidate data nodes, it also has a specific index position, and this position number is the target candidate data node index information.

[0095] Finally, under the target privacy-sensitive feature encryption strategy, the server encrypts the target security encryption unit according to the target candidate data node, and loads the target policy index information and the target candidate data node index information into the encrypted information. Under the auxiliary encryption strategy, the server performs encryption operations on the target security encryption unit according to the data content in the target candidate data node. The encryption process will strictly follow the encryption algorithm, encryption parameters and other requirements specified by the auxiliary encryption strategy. At the same time, the target policy index information and the target candidate data node index information are loaded into the encrypted information together. The advantage of this is that in the subsequent encrypted data management process, whether it is data decryption, data auditing or data update operations, the strategy and data node used in encryption can be quickly and accurately located according to these index information, thereby ensuring the accuracy, integrity and traceability of the entire power business data encryption management. For example, when decrypting data, the corresponding decryption algorithm can be found according to the target policy index information in the encrypted information, and the data range and association relationship to be decrypted can be determined according to the target candidate data node index information, so as to efficiently and accurately complete the decryption operation and ensure the safe use and management of power business data.

[0096] In a possible implementation, step S130 includes:

[0097] Step S131, based on the business requirements, data type information, security level requirements and historical encryption data statistical information related to the target security encryption unit in the power business data block, feature extraction is performed to generate basic feature data, and the basic feature data includes various basic elements related to the encryption of the target security encryption unit.

[0098] In this embodiment, taking the power business data of the substation as an example, the target security encryption unit includes the real-time operation data of the substation, such as voltage, current, power factor, etc. From the perspective of business requirements, the power supply needs to ensure real-time, accuracy and stability, so the encryption of these data cannot affect the normal transmission and monitoring of power data, which requires the encryption algorithm to be efficient and cannot produce too much delay. In terms of data type information, voltage and current are numerical data, and such data may require special processing during the encryption process to ensure the accuracy of the values. The security level requirements are high, because these data involve the core operating parameters of the power system, and once leaked or tampered with, they may have a serious impact on the entire power supply network. The historical encrypted data statistical information includes the encryption algorithm, encryption time, encryption resource consumption, etc. used in the past to encrypt similar power data. For example, when the symmetric encryption algorithm was used to encrypt the voltage data, the average encryption time was 0.5 seconds, occupying 20% ​​of the server CPU resources, etc. Through a comprehensive analysis of these business requirements, data type information, security level requirements, and historical encrypted data statistical information, the server extracts basic feature data such as the degree of real-time demand for data, data value range, security risk factor, and average performance of historical encryption algorithms.

[0099] Step S132, based on the basic feature data, determine the candidate default encryption path that matches the target security encryption unit, conduct a comprehensive evaluation on the candidate default encryption path, and determine the final default encryption path based on the comprehensive evaluation result. The evaluation is based on the complexity of the encryption algorithm, the occupation of power business system resources by the encryption process, the encryption performance stability, and compatibility with the Internet of Things environment.

[0100] For the power data of the substation, the symmetric encryption algorithm is first considered as a candidate default encryption path, such as the AES algorithm. In terms of evaluating the complexity of the encryption algorithm, the number of rounds of the AES algorithm, the key expansion algorithm, etc. will affect its complexity. For example, the 10-round encryption process of AES-128 is relatively moderate in complexity. For the occupation of power business system resources by the encryption process, the server will monitor the proportion of the AES algorithm to the server CPU, memory, network bandwidth and other resources in the actual encryption process. In terms of performance stability, check whether there is a situation of encryption failure or large fluctuation in encryption time when the AES algorithm is used to encrypt power data in the past. If the encryption time of the AES algorithm is basically stable at about 0.5 seconds in a large number of encryption operations, and the encryption success rate is close to 100%, it means that its performance stability is good. In terms of compatibility with the Internet of Things environment, since the Internet of Things devices (such as smart meters, sensors, etc.) in the substation need to interact with the encrypted data, the data format and transmission method encrypted by the AES algorithm need to be compatible with these devices. For example, the smart meter can correctly read and process the power data encrypted by the AES algorithm. After a comprehensive evaluation of these aspects, if the AES algorithm meets the requirements in all aspects, the server will determine it as the final default encryption path.

[0101] Step S133, for each candidate data node corresponding to the encryption path decision result, calculate the error between the encryption path decision result and the default encryption path, and generate an error value set, wherein the error value set includes the encryption algorithm step error of the encryption path, the data conversion error during the encryption process, and the format error of the encrypted data.

[0102] For example, the encryption path decision result corresponding to a candidate data node is to use the RSA algorithm for encryption, while the default encryption path is the AES algorithm. In terms of encryption algorithm step errors, the AES algorithm is a symmetric encryption algorithm based on block encryption, and its encryption steps are relatively fixed, while the RSA algorithm is an asymmetric encryption algorithm based on number theory, and its encryption steps involve more mathematical operations, such as large number decomposition, etc. There are obvious differences between the two in algorithm steps. The server calculates this difference value as the encryption algorithm step error through a specific algorithm complexity analysis method. In terms of data conversion errors during the encryption process, the AES algorithm directly encrypts the data block, while the RSA algorithm may need to preprocess the data, such as digital signatures, which will lead to differences in the data conversion process. The server calculates the data conversion error by comparing the data structure and content changes of the two algorithms before and after the data conversion. In terms of the format error of the encrypted data, the data format encrypted by the AES algorithm is relatively fixed, while the data format encrypted by the RSA algorithm may be different due to the mathematical operations in the encryption process. The server calculates the data format error by analyzing the difference between the two encrypted data formats and combines these errors into an error value set.

[0103] Step S134, collecting basic data related to encryption cost, wherein the basic data includes resource consumption weight information of different encryption operations in the power business system, and weight information of the impact of different error values ​​on the security of the power business.

[0104] In the power business system, different encryption operations consume different resources. For example, symmetric encryption algorithms may consume a larger proportion of CPU resources, while asymmetric encryption algorithms may consume a larger proportion of memory resources. The server will collect statistics on the weight information of these different encryption operations in terms of resource consumption. For the weight information of the impact of different error values ​​on the security of the power business, for example, the error in the encryption algorithm steps may have a greater impact on the risk of tampering with power data, and the data conversion error may have a greater impact on the transmission accuracy of power data. The server determines the weight information of the impact of these different error values ​​on the security of the power business based on the security requirements and risk assessment of the power business.

[0105] Step S135, calculates the encryption cost corresponding to each candidate data node based on the error value set, the resource consumption weight information of different encryption operations in the power business system, and the weight information of the impact of different encryption errors on the security of the power business. Specifically, for each candidate data node, multiply the error value between the corresponding encryption path decision result and the default encryption path by the corresponding resource consumption weight and security impact weight to obtain the encryption cost of each candidate data node under the reference privacy-sensitive feature encryption strategy.

[0106] For example, for the candidate data node using the RSA algorithm, the encryption algorithm step error is 0.3 (here is a relative value), the corresponding resource consumption weight is 0.2 (indicating the weight in terms of CPU resource consumption), and the security impact weight on the risk of power data tampering is 0.5; the data conversion error is 0.2, the corresponding resource consumption weight is 0.1 (indicating the weight in terms of memory resource consumption), and the security impact weight on the accuracy of power data transmission is 0.3; the data format error is 0.1, the corresponding resource consumption weight is 0.1 (indicating the resource consumption weight in terms of data storage), and the security impact weight on the accuracy of power data reading is 0.2. Then the encryption cost of the candidate data node is: (0.3×0.2×0.5 + 0.2×0.1×0.3 + 0.1×0.1×0.2) = 0.032. Through this calculation method, the server can accurately evaluate the encryption cost of each candidate data node under different reference privacy-sensitive feature encryption strategies, providing a basis for the subsequent selection of the optimal encryption strategy and data node.

[0107] Figure 2 The hardware structure of the power business data security encryption system 100 based on the Internet of Things for implementing the above-mentioned power business data security encryption method based on the Internet of Things provided by the embodiment of the present invention is shown as follows: Figure 2 As shown, the power business data security encryption system 100 based on the Internet of Things may include a processor 110 , a machine-readable storage medium 120 , a bus 130 , and a communication unit 140 .

[0108] The machine-readable storage medium 120 may store data and / or instructions. In some embodiments, the machine-readable storage medium 120 may store data obtained from an external terminal. In some embodiments, the machine-readable storage medium 120 may store data and / or instructions that the power business data security encryption system 100 based on the Internet of Things uses to execute or use to complete the exemplary method described in the present invention.

[0109] During the specific implementation process, one or more processors 110 execute computer executable instructions stored in the machine-readable storage medium 120, so that the processor 110 can execute the power business data security encryption method based on the Internet of Things as described in the above method embodiment. The processor 110, the machine-readable storage medium 120 and the communication unit 140 are connected through the bus 130, and the processor 110 can be used to control the sending and receiving actions of the communication unit 140.

[0110] The specific implementation process of the processor 110 can refer to the various method embodiments executed by the above-mentioned power business data security encryption system 100 based on the Internet of Things. The implementation principles and technical effects are similar, and this embodiment will not be repeated here.

[0111] In addition, an embodiment of the present invention further provides a readable storage medium, in which computer executable instructions are preset. When a processor executes the computer executable instructions, the above-mentioned method for secure encryption of power business data based on the Internet of Things is implemented.

[0112] It should be noted that in order to simplify the description of the present invention and thus help understand one or more embodiments of the invention, in the foregoing description of the embodiments of the present invention, various features are sometimes combined into one embodiment, drawing or description thereof.

Claims

1. A method for secure encryption of power business data based on the Internet of Things, characterized in that: The method comprises: For a target security encryption unit in a power business data block in an Internet of Things environment, extract multiple candidate data nodes from the associated encrypted data nodes of the target security encryption unit; For each of the predefined multiple reference privacy-sensitive feature encryption strategies, determine candidate privacy-sensitive features from the multiple candidate data nodes according to the traversed reference privacy-sensitive feature encryption strategies; Performing encryption path decision on the target security encryption unit based on the candidate privacy-sensitive features respectively determined in the multiple candidate data nodes, and determining encryption path decision results respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy; Determine a default encryption path of the target security encryption unit, and determine encryption costs corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy based on errors between encryption path decision results corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy and the default encryption path; Based on the encryption costs of each of the multiple candidate data nodes under each reference privacy-sensitive feature encryption strategy, determine a target privacy-sensitive feature encryption strategy from the multiple reference privacy-sensitive feature encryption strategies; the target privacy-sensitive feature encryption strategy is used to perform encryption processing on the target security encryption unit; The multiple reference privacy-sensitive feature encryption strategies include at least one of a linkage encryption strategy, a core encryption strategy, or an auxiliary encryption strategy; For each of the predefined multiple reference privacy-sensitive feature encryption strategies, determining candidate privacy-sensitive features from the multiple candidate data nodes according to the traversed reference privacy-sensitive feature encryption strategies, includes: For the linkage encryption strategy, in each of the plurality of candidate data nodes, features to be encrypted in a core encryption area and an auxiliary encryption area are respectively determined as candidate privacy-sensitive features associated with the linkage encryption strategy; For the core encryption strategy, in each of the plurality of candidate data nodes, a feature to be encrypted in the core encryption area is respectively determined as a candidate privacy-sensitive feature associated with the core encryption strategy; For the auxiliary encryption strategy, in each of the plurality of candidate data nodes, a feature to be encrypted in the auxiliary encryption area is respectively determined as a candidate privacy-sensitive feature associated with the core encryption strategy; The step of performing encryption path decision on the target security encryption unit based on the candidate privacy-sensitive features respectively determined in the multiple candidate data nodes, and determining encryption path decision results respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, includes: Based on the candidate privacy-sensitive features respectively determined in the multiple candidate data nodes, determining the encryption attention factors respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy; Constructing encryption path selection models corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy according to the encryption attention factors corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy; According to the encryption path selection models respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, encryption path decisions are made for the target security encryption unit respectively, and encryption path decision results respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy are determined.

2. The method for secure encryption of power business data based on the Internet of Things according to claim 1 is characterized in that: The multiple reference privacy-sensitive feature encryption strategies include at least one of a linkage encryption strategy, a core encryption strategy, or an auxiliary encryption strategy; The method for extracting a plurality of candidate data nodes from the associated encrypted data nodes of the target security encryption unit in the power business data block under the Internet of Things environment includes: For a target security encryption unit in the power business data block, under the linkage encryption strategy, multiple candidate data nodes are extracted from multiple data nodes of the predecessor data block and the side chain data block of the target security encryption unit as multiple candidate data nodes associated with the linkage encryption strategy; Under the core encryption strategy, extracting a plurality of candidate data nodes from a plurality of data nodes of a predecessor data block of a target security encryption unit as a plurality of candidate data nodes associated with the core encryption strategy; Under the auxiliary encryption strategy, multiple candidate data nodes are extracted from multiple data nodes of the side chain data block of the target security encryption unit as multiple candidate data nodes associated with the auxiliary encryption strategy.

3. The method for secure encryption of power business data based on the Internet of Things according to claim 1 is characterized in that: Each of the multiple candidate data nodes has multiple candidate privacy-sensitive features selected; the step of determining the encryption attention factors corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy based on the candidate privacy-sensitive features respectively determined from the multiple candidate data nodes includes: For any one of the plurality of candidate data nodes, determining, based on the plurality of candidate privacy-sensitive features determined by the traversed candidate data nodes, feature importance weights and encryption requirement levels respectively corresponding to the plurality of candidate privacy-sensitive features; According to the feature importance weights and encryption requirement levels respectively corresponding to the multiple candidate privacy-sensitive features, the encryption attention factors of the candidate data nodes traversed under the traversed reference privacy-sensitive feature encryption strategy are determined.

4. The method for secure encryption of power business data based on the Internet of Things according to claim 3 is characterized in that: Determining the encryption attention factors of the candidate data nodes traversed under the traversed reference privacy-sensitive feature encryption strategy according to the feature importance weights and encryption requirement levels respectively corresponding to the multiple candidate privacy-sensitive features, including: Determining an average importance weight from the feature importance weights respectively corresponding to the multiple candidate privacy-sensitive features; Determining an average encryption requirement level from the encryption requirement levels respectively corresponding to the plurality of candidate privacy-sensitive features; Based on the average importance weight and the average encryption requirement level, an encryption attention factor of the traversed candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy is determined.

5. The method for secure encryption of power business data based on the Internet of Things according to claim 3 is characterized in that: The step of constructing the encryption path selection model corresponding to each of the plurality of candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy according to the encryption attention factors corresponding to each of the plurality of candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy comprises: Based on the encrypted attention factors respectively corresponding to the multiple candidate data nodes under the traversed reference privacy-sensitive feature encryption strategy, extract key feature data related to encryption path selection, wherein the key feature data includes a change trend of the encrypted attention factor in different dimensions and a relative relationship between the encrypted attention factors of different candidate data nodes; Determine the basic architecture of the encryption path selection model, which includes the hierarchical structure of the encryption path selection model, the connection mode between each layer, and the main modules involved in the encryption path selection model, wherein the hierarchical structure adopts a hierarchical structure, the upper layer is a decision layer, which is used to make encryption path selection decisions based on information provided by the lower layer, and the lower layer is a feature analysis layer, which is used to analyze the input key feature data and provide decision-making basis to the upper layer, and at the same time determine the interaction mode between each module in the encryption path selection model; Initializing model parameters in the encryption path selection model after determining the basic architecture, wherein the model parameters include weight parameters related to the encryption attention factor and threshold parameters for determining encryption path selection; According to the basic framework of the encryption path selection model, various functional modules are constructed, wherein a data processing module is constructed for performing data cleaning and feature conversion on the input encrypted attention factor data, an encryption path evaluation module is constructed for evaluating different encryption paths based on the processed encrypted attention factor data and the model parameters in the encryption path selection model, and an encryption path decision module is constructed for making a final encryption path selection decision based on the result of the encryption path evaluation module.

6. The method for secure encryption of power business data based on the Internet of Things according to claim 1 is characterized in that: The step of determining a target privacy-sensitive feature encryption strategy from the multiple reference privacy-sensitive feature encryption strategies based on the encryption costs of each of the multiple candidate data nodes under each reference privacy-sensitive feature encryption strategy includes: Determining a minimum encryption cost based on the encryption costs of each of the plurality of candidate data nodes under each reference privacy-sensitive feature encryption strategy; The reference privacy-sensitive feature encryption strategy represented by the minimum encryption cost is used as the target privacy-sensitive feature encryption strategy for encrypting the target security encryption unit, and the candidate data node represented by the minimum encryption cost is used as the target candidate data node based on which the target privacy-sensitive feature encryption strategy is used for encryption processing.

7. The method for secure encryption of power business data based on the Internet of Things according to claim 6 is characterized in that: The method further comprises: Determine target policy index information corresponding to the target privacy-sensitive feature encryption policy, and target candidate data node index information corresponding to the target candidate data node; Under the target privacy-sensitive feature encryption strategy, the target security encryption unit is encrypted according to the target candidate data node, and the target policy index information and the target candidate data node index information are loaded into the encrypted information.

8. The method for secure encryption of power business data based on the Internet of Things according to claim 1 is characterized in that: The step of determining the default encryption path of the target security encryption unit, and determining the encryption costs corresponding to the multiple candidate data nodes respectively under the traversed reference privacy-sensitive feature encryption strategy based on the errors between the encryption path decision results corresponding to the multiple candidate data nodes respectively under the traversed reference privacy-sensitive feature encryption strategy and the default encryption path, comprises: Based on the business requirements, data type information, security level requirements and historical encryption data statistics of the target security encryption unit in the power business data block, feature extraction is performed to generate basic feature data, wherein the basic feature data includes various basic elements related to the encryption of the target security encryption unit; According to the basic feature data, determine the candidate default encryption path that matches the target security encryption unit, conduct a comprehensive evaluation on the candidate default encryption path, and determine the final default encryption path according to the comprehensive evaluation result, wherein the evaluation is based on the complexity of the encryption algorithm, the occupation of power business system resources by the encryption process, the performance stability of the encryption, and the compatibility with the Internet of Things environment; For each candidate data node, the error between the encryption path decision result and the default encryption path is calculated to generate an error value set, where the error value set includes an encryption algorithm step error of the encryption path, a data conversion error during the encryption process, and a format error of the encrypted data; Collect basic data related to encryption cost, including resource consumption weight information of different encryption operations in the power business system and weight information of the impact of different error values ​​on the security of the power business; According to the error value set, the resource consumption weight information of different encryption operations in the power business system, and the weight information of the impact of different encryption errors on the security of the power business, the encryption cost corresponding to each candidate data node is calculated. Specifically, for each candidate data node, the error value between the corresponding encryption path decision result and the default encryption path is multiplied by the corresponding resource consumption weight and the security impact weight to obtain the encryption cost of each candidate data node under the reference privacy-sensitive feature encryption strategy.

Images