Protection method and device for communication between micro-grid master station and power distribution terminal, medium and equipment
By combining the identity authentication method of device unique identification and digital certificate, and negotiating temporary session keys during the communication between the micronet main site and the power distribution terminal, the security issues of the micronet system in network attacks are solved, and higher network and system security is achieved.
Patent Information
- Application Number
- CN202411601715.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-11
- Publication Date
- 2025-03-11
AI Technical Summary
The prior art is difficult to effectively protect the micronet system from network attacks, which leads to threatening the system security, especially during the communication between the micronet main site and the power distribution terminal.
Identity authentication is performed using a combination of device unique identification and digital certificates, and temporary session keys are negotiated during the identity authentication process to meet the plug-and-play needs of end devices. At the same time, in the design of communication protocols, the system and network status are improved, and a secure execution environment is built into the design of communication protocols, and the system and network status can be realized in a virtual heterogeneous way.
It enhances the network and system inherent security of the micronet system, effectively prevents network attacks, ensures the confidentiality and integrity of data transmission, and reduces the risk of the system being maliciously manipulated.
Smart Images
Figure CN119602936A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of communication technology, and in particular to a protection method and device, medium and equipment for communication between a microgrid master station and a distribution terminal. Background Art
[0002] With the integration of informatization and industrialization, the security issues of microgrid systems have become increasingly prominent. The types of network attacks are increasing, the attacks are becoming more and more hidden, and various automatic attack tools have emerged. Obviously, firewalls can no longer meet the security needs of users. Firewalls can block unidentified intruders to a large extent, but intruders can bypass the firewall. Scanning tools can find loopholes, but the actual harm of loopholes still requires manual judgment of false positives and false negatives. Once a security loophole occurs in the microgrid system, the possibility of the microgrid system being attacked by viruses, Trojans and other threats increases, which in turn makes the industrial generation control process face security threats. At present, the security protection measures taken in the microgrid system are generally to deploy firewalls between the enterprise management layer of the microgrid system and the external network. Due to the lack of protection measures, once the firewall between the enterprise management layer and the external network is breached by the attacker, the internal network of the microgrid system can be easily controlled, so that the production data and other data in the microgrid system are stolen, or the field equipment is maliciously manipulated, affecting the normal industrial control.
[0003] In addition, the microgrid system deploys a large number of intelligent integrated terminals, which are monitored and controlled by the microgrid energy controller and communicate with the large power grid. It has the characteristics of large data transmission volume, diverse data acquisition methods, and high real-time data interaction. It is urgent to improve the network security protection of the microgrid system.
[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention
[0005] The purpose of the present disclosure is to provide a protection method and device, medium and equipment for communication between a microgrid master station and a distribution terminal, which at least to a certain extent overcomes the problems existing in the prior art, uses a combination of a unique device identifier and a digital certificate to complete identity authentication, and negotiates a temporary session key during the identity authentication process to meet the plug-and-play requirements of the terminal device. Strengthen the inherent security of the network and the system itself, consider improving the security mechanism in the design of the communication protocol, embedding access control based on behavior judgment, realizing the variable state of the system and network in a virtual heterogeneous manner, and building a secure execution environment.
[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.
[0007] According to one aspect of the present application, a protection method for communication between a microgrid master station and a distribution terminal is provided, comprising: receiving digital certificate information, distribution terminal unique identification information, distribution terminal random number and distribution terminal key-share information sent by the distribution terminal; authenticating the distribution terminal unique identification information based on preset processing rules to generate an authentication result; if the authentication result is that the distribution terminal has access rights, obtaining the microgrid EMS master station random number and the microgrid EMS master station key-share information; generating a pre-master key based on the distribution terminal key-share information and the microgrid EMS master station key-share information; generating a temporary session key based on the distribution terminal random number, the microgrid EMS master station random number and the pre-master key, wherein the temporary session key is a symmetric cipher; processing the digital certificate information and the distribution terminal unique identification information based on preset pairing rules to generate a processing result; obtaining configuration information based on the processing result; encrypting the configuration information based on the temporary session key to generate encrypted configuration information; and sending the encrypted configuration information to the distribution terminal to complete the connection establishment process.
[0008] In one embodiment of the present application, after sending the encrypted configuration information to the distribution terminal to complete the connection establishment process, it also includes: receiving an encryption request message sent by the distribution terminal, the encryption request message including the first national secret information; selecting the second national secret information from the first national secret information, and sending an encryption confirmation message to the distribution terminal, the encryption confirmation message including the second national secret information; determining the national secret certificate based on preset encryption rules, and signing the national secret certificate through the signature algorithm in the second national secret information to generate encryption verification information; sending the encryption verification information to the distribution terminal; and when interacting data with the terminal, encrypting / decrypting through the SM4 algorithm in the second national secret information.
[0009] In one embodiment of the present application, the selecting of the second national secret information from the first national secret information includes: extracting all national secret algorithm suites in the first national secret information, screening them according to a preset screening strategy, and using the screened national secret algorithm suites as the second national secret information.
[0010] In one embodiment of the present application, obtaining configuration information based on the processing result includes: sending a certificate loading request to a certificate center, wherein the certificate loading request includes identification information, and the identification information is used to identify the processing priority of the certificate loading request in the certificate center; receiving a digital certificate returned by the certificate center; and replacing an expired digital certificate with a new digital certificate received from the certificate center.
[0011] In one embodiment of the present application, after sending the encrypted configuration information to the distribution terminal to complete the connection establishment process, it also includes: when the microgrid EMS master station completes the first handshake request, storing all domain name information, cross-domain name multiplexing information and handshake multiplexing information associated with the digital certificate supported by the digital certificate in the first handshake request in a mapping table; sending the handshake multiplexing information to the distribution terminal; when the distribution terminal is disconnected from the microgrid EMS master station and needs to be connected again, completing the handshake request with the distribution terminal based on the handshake multiplexing information.
[0012] In one embodiment of the present application, completing the handshake request with the distribution terminal based on the handshake multiplexing information includes: when the cross-domain name multiplexing information is the cross-domain name multiplexing extension information carried by the terminal interaction message sent by the distribution terminal; receiving the terminal interaction message sent by the distribution terminal, the terminal interaction message includes the Session ID information; determining the session key according to the session information associated with the Session ID information, and completing the handshake request with the distribution terminal.
[0013] In one embodiment of the present application, the completing the handshake request with the distribution terminal based on the handshake multiplexing information also includes: when the cross-domain name multiplexing information is the cross-domain name multiplexing flag carried by the New session ticket message sent by the distribution terminal; receiving the terminal interaction message sent by the distribution terminal, the terminal interaction message includes Session ticket information; sending verification information to the distribution terminal, wherein the verification information is the information returned after the Sessionticket information is successfully verified; determining the session key according to the session information associated with the Session ID information, and completing the handshake request with the distribution terminal, wherein the session key is an asymmetric password.
[0014] Another aspect of the present application is a protection device for communication between a microgrid master station and a distribution terminal, characterized in that it includes: an acquisition module for receiving digital certificate information, unique identification information of the distribution terminal, random number of the distribution terminal and key-share information of the distribution terminal sent by the distribution terminal; obtaining configuration information based on the processing result; a processing module for performing authentication processing on the unique identification information of the distribution terminal based on a preset processing rule to generate an authentication result; if the authentication result is that the distribution terminal has access rights, obtaining the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station; according to The key-share information of the distribution terminal and the key-share information of the microgrid EMS master station generate a pre-master key; a temporary session key is generated according to the random number of the distribution terminal, the random number of the microgrid EMS master station and the pre-master key, wherein the temporary session key is a symmetric cipher; the digital certificate information and the unique identification information of the distribution terminal are processed based on a preset pairing rule to generate a processing result; the configuration information is encrypted based on the temporary session key to generate encrypted configuration information; the encrypted configuration information is sent to the distribution terminal to complete the connection establishment process.
[0015] According to another aspect of the present application, an electronic device is characterized in that it includes: a first processor; and a memory for storing executable instructions of the first processor; wherein the first processor is configured to execute the above-mentioned protection method for communication between the microgrid master station and the distribution terminal by executing the executable instructions.
[0016] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a second processor, the above-mentioned protection method for communication between a microgrid master station and a distribution terminal is implemented.
[0017] According to another aspect of the present application, a computer program product is provided, including a computer program, characterized in that when the computer program is executed by a third processor, the above-mentioned protection method for communication between the microgrid master station and the distribution terminal is implemented.
[0018] The present application provides a protection method and device, medium and equipment for communication between a microgrid master station and a distribution terminal, wherein the microgrid EMS master station receives digital certificate information, distribution terminal unique identification information, distribution terminal random number and distribution terminal key-share information sent by the distribution terminal; the distribution terminal unique identification information is authenticated based on a preset processing rule to generate an authentication result; if the authentication result is that the distribution terminal has access rights, the microgrid EMS master station random number and the microgrid EMS master station key-share information are obtained; a pre-master key is generated based on the distribution terminal key-share information and the microgrid EMS master station key-share information; a temporary session key is generated based on the distribution terminal random number, the microgrid EMS master station random number and the pre-master key, wherein the temporary session key is a symmetric cipher; the digital certificate information and the distribution terminal unique identification information are processed based on a preset pairing rule to generate a processing result; configuration information is obtained based on the processing result; the configuration information is encrypted based on the temporary session key to generate encrypted configuration information; the encrypted configuration information is sent to the distribution terminal to complete the connection establishment process. The unique device identifier and digital certificate are used to complete identity authentication, and temporary session key negotiation is performed during the identity authentication process to meet the plug-and-play requirements of the end device. The inherent security of the network and system itself is strengthened, and the improvement of security mechanisms, embedded access control based on behavior judgment, and the implementation of system and network state changes in a virtual heterogeneous manner are considered in the design of communication protocols, and a secure execution environment is constructed.
[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.
[0021] Figure 1 A flow chart showing a protection method for communication between a microgrid master station and a power distribution terminal provided by an embodiment of the present application;
[0022] Figure 2 A schematic diagram of the structure of a protection device for communication between a microgrid master station and a power distribution terminal provided in an embodiment of the present application is shown;
[0023] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application is shown;
[0024] Figure 4 A schematic diagram of a storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0025] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.
[0026] Combine the following Figure 1 To describe the protection method for the communication between the microgrid master station and the distribution terminal according to the exemplary embodiment of the present application. It should be noted that the following application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this regard. On the contrary, the implementation of the present application can be applied to any applicable scenario.
[0027] It should be noted that the communication between the distribution terminal and the microgrid EMS master station can be established through physical ports, etc. One or more distribution terminals can be deployed in the network system architecture, and the same distribution terminal can be connected to multiple microgrid EMS master stations, and the same microgrid EMS master station can also be connected to multiple distribution terminals.
[0028] Among them, the distribution terminal and the microgrid EMS master station are not fixed hardware products for the entire network system architecture. The same hardware, such as a computer, a microgrid EMS master station, etc., may be used as a distribution terminal in one situation and as a microgrid EMS master station in another situation.
[0029] The division of distribution terminals and microgrid EMS master stations in this application can represent the corresponding relationship in communication mode, for example, one microgrid EMS master station can correspond to multiple distribution terminals; it can also represent different usage functions, such as the distribution terminal is used for users. In order to facilitate more accurate judgment, in this application, the functions and roles of the distribution terminal and the microgrid EMS master station are not limited. Only the one that sends the connection request in the communication connection is regarded as the distribution terminal, and the one that receives the connection request is regarded as the microgrid EMS master station.
[0030] In one implementation, the present application also proposes a protection method, device, medium and equipment for communication between a microgrid master station and a distribution terminal. Figure 1 The flowchart of a protection method for communication between a microgrid master station and a distribution terminal according to an embodiment of the present application is schematically shown. Figure 1 As shown, the method is applied to the microgrid EMS master station, including:
[0031] S101, receiving digital certificate information, unique identification information of the power distribution terminal, random number of the power distribution terminal and key-share information of the power distribution terminal sent by the power distribution terminal.
[0032] In one implementation, the random number of the distribution terminal may be 32 bytes generated by a secure random number generator, the unique identification information of the distribution terminal may be the MAC address of the distribution terminal, key_share is the public key corresponding to the elliptic curve type, and the specific presentation form of the key_share information will not be repeated here.
[0033] S102: Authenticate the unique identification information of the power distribution terminal based on a preset processing rule to generate an authentication result.
[0034] In one implementation, for example, authentication is performed on anti-hotlink parameters such as timestamp, UA, IP blacklist and whitelist, cookie, referer, etc. The microgrid EMS master station authenticates the connection request of the distribution terminal, and directly rejects it if the authentication fails.
[0035] S103: If the authentication result shows that the power distribution terminal has access rights, obtain the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station.
[0036] In one implementation, the microgrid EMS master station has an identity authentication function for access distribution terminals, thereby implementing legality control of access to production control area distribution terminals.
[0037] S104, generating a pre-master key according to the key-share information of the power distribution terminal and the key-share information of the microgrid EMS master station.
[0038] In one embodiment, the key-share information includes but is not limited to preset parameters for calculating the pre-master key; for example: the distribution terminal sends a request (terminal interaction), the extended part carries the supported elliptic curve type, and calculates the distribution terminal public key (POINT) for each elliptic curve type supported by itself, and the distribution terminal public key is placed in the key-share information in the extended information; after the microgrid EMS master station selects the elliptic curve parameters, it multiplies the base point of the elliptic curve to obtain the microgrid EMS master station public key (POINT); then extracts the corresponding distribution terminal public key in the key_share information in the terminal interaction, and calculates the pre-master key; the distribution terminal calculates the pre-master key after receiving the microgrid EMS master station public key (POINT) of the microgrid EMS master station.
[0039] S105, generating a temporary session key according to the distribution terminal random number, the microgrid EMS master station random number and the pre-master key.
[0040] In one implementation, the random number of the distribution terminal and the key-share information of the distribution terminal are generated by the distribution terminal; the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station are generated by the microgrid EMS master station, and the specific generation method is not limited here. By using the pre-information of the session key in the message transmission between the distribution terminal and the microgrid EMS master station during the handshake process (connection establishment process), the session key can be quickly determined without affecting the handshake process (connection establishment process), greatly shortening the time for communication between the two ends after the handshake (connection establishment). In addition, the temporary session key in this implementation is a symmetric cipher. In order to prevent the business data from being stolen and tampered with, the telemetry, telesignaling and other business messages uploaded by the terminal are verified for confidentiality and integrity protection using a domestically produced commercial symmetric encryption algorithm, which effectively reduces the occurrence of batch tampering of business data, which in turn causes the master station to issue batch erroneous instructions.
[0041] S106: Process the digital certificate information and the unique identification information of the power distribution terminal based on a preset pairing rule to generate a processing result.
[0042] In one implementation, identity authentication is completed by combining the unique identification of the power distribution terminal with a digital certificate, and a temporary session key negotiation is performed during the identity authentication process to meet the plug-and-play requirements of the terminal device. During registration, the sensor device identification, digital certificate and other information need to be uniquely bound; after registration is completed, when the session link is reestablished, two-way identity authentication is performed based on the digital certificate and SM2 algorithm.
[0043] In another embodiment, if the processing result is to allow the microgrid EMS master station to pair and connect with the distribution terminal, the configuration information is obtained, and the configuration information includes the digital certificate and other microgrid EMS master station parameters required to complete the connection establishment process with the distribution terminal. The microgrid EMS master station detects whether the digital certificate in the local storage area is in a valid state; if not, a certificate loading request is sent to the certificate center; the digital certificate in an invalid state is replaced with the new digital certificate received from the certificate center. The microgrid EMS master station detects whether the digital certificate in the local storage area is in a valid state. If not, the microgrid EMS master station sends a certificate loading request to the certificate center and replaces the digital certificate in an invalid state with the new digital certificate received from the certificate center. In this way, the invalid digital certificate is replaced before the handshake starts, so that the required digital certificate is directly loaded during the handshake process, reducing the handshake time. A certificate list is set in the microgrid EMS master station, and the digital certificate in the local storage area is recorded in the certificate list, and the digital certificate is detected through the certificate list. Whether it is in a valid state. The local storage area may include a disk storage area and a memory storage area. Files stored in the disk storage area require I / O performance to read and write, while files stored in the memory storage area can be read directly.
[0044] In another implementation, a certificate loading request is sent to a certificate center, wherein the certificate loading request includes identification information, and the identification information is used to identify the processing priority of the certificate loading request in the certificate center; and a digital certificate returned by the certificate center is received. The microgrid EMS master station sends a certificate loading request to the certificate center, and the request can be made through a python script or other methods. In this application, there is no restriction on the specific request method. The specific form of the identification information can be selected according to the actual situation, and there is no restriction on this in this application. The example is as follows, setting the processing priority to a weight value of 1-25, and the larger the weight value, the higher the priority.
[0045] S107: Acquire configuration information based on the processing result.
[0046] In one implementation, the configuration information includes the domain name certificate and other target server parameters required to complete the connection establishment process with the terminal device. A certificate list is set in the microgrid EMS master station, and the domain name certificate in the local storage area is recorded in the certificate list. The domain name certificate is detected to be valid through the certificate list. Among them, the local storage area may include a disk storage area and a memory storage area. Files stored in the disk storage area require I / O performance to read and write, and files stored in the memory storage area can be read directly.
[0047] S108: Encrypt the configuration information based on the temporary session key to generate encrypted configuration information.
[0048] In one implementation, configuration information is encrypted / decrypted using a temporary session key, specifically: when a distribution terminal sends data, the data is first encrypted using an SM4 algorithm based on a temporary session key and then sent to a microgrid EMS master station; when the microgrid EMS master station receives the encrypted data, the data is first decrypted using an SM4 algorithm based on a temporary session key to obtain corresponding data; similarly, when a microgrid EMS master station sends data, the data is first encrypted using an SM4 algorithm based on a temporary session key and then sent to a distribution terminal; when the distribution terminal receives the encrypted data, the data is first decrypted using an SM4 algorithm based on a temporary session key to obtain corresponding data.
[0049] S109, sending the encrypted configuration information to the power distribution terminal to complete the connection establishment process.
[0050] In one implementation, after receiving the CHLO message (initial packet), the microgrid EMS master station replies with a rejection (REJ) message, which includes the configuration information of the microgrid EMS master station, and the configuration information includes the corresponding digital certificate; the distribution terminal receives the REJ message, extracts and stores the configuration information, and sends a full terminal interaction message to the microgrid EMS master station to start a formal handshake. The message includes the public number selected by the distribution terminal; at this time, the distribution terminal can calculate the initial key based on the obtained configuration information and the public number selected by itself; the microgrid EMS master station receives the full terminal interaction message, and if it agrees to connect, it calculates the initial key based on the public number of the distribution terminal and replies to the server hello (SHLO) message, the SHLO message is encrypted with the initial key and contains a temporary public number selected by the microgrid EMS master station; the distribution terminal receives the reply from the microgrid EMS master station, if it is a SHLO message, it attempts to decrypt with the initial key and extract the temporary public number; the distribution terminal and the microgrid EMS master station derive the session key based on the SHA-256 algorithm according to the temporary public number and the initial key; the two parties switch to using the session key to communicate, the initial key is no longer useful at this time, and the handshake process is completed. The specific handshake process can also be other methods after partial improvement, and this embodiment will not repeat this process. The session key adopts a domestically produced commercial asymmetric encryption algorithm, and the domestically produced commercial asymmetric encryption algorithm is used to sign important downlink messages (such as remote control, parameter setting, remote upgrade, etc.) to achieve behavior non-repudiation and message integrity protection.
[0051] In this application, the microgrid EMS master station receives the digital certificate information, the unique identification information of the distribution terminal, the random number of the distribution terminal and the key-share information of the distribution terminal sent by the distribution terminal; the unique identification information of the distribution terminal is authenticated based on the preset processing rules to generate an authentication result; if the authentication result is that the distribution terminal has access rights, the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station are obtained; the pre-master key is generated according to the key-share information of the distribution terminal and the key-share information of the microgrid EMS master station; a temporary session key is generated according to the random number of the distribution terminal, the random number of the microgrid EMS master station and the pre-master key, wherein the temporary session key is a symmetric cipher; the digital certificate information and the unique identification information of the distribution terminal are processed based on the preset pairing rules to generate a processing result; the configuration information is obtained based on the processing result; the configuration information is encrypted based on the temporary session key to generate the encrypted configuration information; the encrypted configuration information is sent to the distribution terminal to complete the connection establishment process. Identity authentication is completed by combining the device unique identification and the digital certificate, and a temporary session key negotiation is performed during the identity authentication process to meet the plug-and-play requirements of the terminal device. Strengthen the inherent security of the network and the system itself, consider improving the security mechanism in the design of the communication protocol, embedding access control based on behavior judgment, realizing the variability of the system and network status in a virtual heterogeneous manner, and building a secure execution environment.
[0052] Optionally, in another embodiment of the above method of the present application, after sending the encrypted configuration information to the power distribution terminal to complete the connection establishment process, the method further includes:
[0053] Receiving an encryption request message sent by a power distribution terminal, wherein the encryption request message includes first national secret information;
[0054] Selecting second national secret information from the first national secret information, and sending an encrypted confirmation message to the power distribution terminal, wherein the encrypted confirmation message includes the second national secret information;
[0055] Determine the national secret certificate based on the preset encryption rule, and sign the national secret certificate using the signature algorithm in the second national secret information to generate encrypted verification information;
[0056] sending the encrypted verification information to the power distribution terminal;
[0057] When data is interacted with the terminal, encryption / decryption is performed using the SM4 algorithm in the second national secret information.
[0058] In one implementation, if it is determined that the terminal interaction message carries SNI extension information, the domain name information in the SNI extension information is extracted, and the national secret certificate corresponding to the domain name information is used as the national secret certificate, and / or if it is determined that the terminal interaction message does not carry SNI extension information, the default national secret certificate is used as the national secret certificate. When the distribution terminal sends data, the data is encrypted using the SM4 algorithm based on the second national secret information and then sent to the microgrid EMS master station. When the microgrid EMS master station receives the encrypted data, the data is first decrypted using the SM4 algorithm based on the second national secret information to obtain the corresponding data; similarly, when the microgrid EMS master station sends data, the data is first encrypted using the SM4 algorithm based on the second national secret information and then sent to the distribution terminal. When the distribution terminal receives the encrypted data, the data is first decrypted using the SM4 algorithm based on the second national secret information to obtain the corresponding data.
[0059] In another implementation, all national secret algorithm suites in the first national secret information are extracted, screened according to a preset screening strategy, and the screened national secret algorithm suites are used as the second national secret information.
[0060] The preset screening strategy can be: according to the arrangement order of all the national secret algorithm suites in the first national secret information, starting from the first one, determine whether the microgrid EMS master station supports the national secret algorithm suite. If supported, the first national secret algorithm suite is the screened national secret algorithm suite and the screening is ended; if not supported, the microgrid EMS master station determines whether it supports the second national secret algorithm suite until all national secret algorithm suites in the first national secret information are judged (if all national secret algorithm suites in the first national secret information are not supported by the server, the microgrid EMS master station determines whether the first national secret information contains a standard algorithm suite. If not, an error message is returned).
[0061] In this embodiment, the preset screening strategy may also be: comprehensively determine the screened national secret algorithm suite according to the arrangement order of all national secret algorithm suites in the first national secret information and the arrangement order of all national secret algorithm suites supported by the microgrid EMS master station.
[0062] It should be noted that the above screening strategy only screens out one national secret algorithm suite from multiple national secret algorithm suites of the first national secret information (even if the microgrid EMS master station supports multiple national secret algorithm suites).
[0063] Optionally, in another embodiment of the above method of the present application, after sending the encrypted configuration information to the power distribution terminal to complete the connection establishment process, the method further includes:
[0064] When the microgrid EMS master station completes the first handshake request, all domain name information supported by the digital certificate in the first handshake request, cross-domain name multiplexing information, and handshake multiplexing information associated with the digital certificate are stored in the mapping table;
[0065] Sending handshake multiplexing information to the power distribution terminal;
[0066] When the power distribution terminal is disconnected from the microgrid EMS master station and needs to be reconnected, a handshake request is completed with the power distribution terminal based on the handshake multiplexing information.
[0067] In one implementation, the microgrid EMS master station extracts all domain name information supported by the certificate; obtains SESSION ID information, or receives SESSION ticket encrypted information sent by the edge node; associates all domain name information with SESSION ID information, or associates all domain name information with SESSION ticket encrypted information.
[0068] In another implementation, when the cross-domain name multiplexing information is the cross-domain name multiplexing extension information carried by the terminal interaction message sent by the distribution terminal; the terminal interaction message sent by the distribution terminal is received, and the terminal interaction message includes SessionID information; according to the session information associated with the Session ID information, the session key is determined, and the handshake request with the distribution terminal is completed. For example, a normal user requests the original request https: / / a.example.com / url1, the distribution terminal DNS resolves a.example.com to obtain the corresponding IP, performs a TLS handshake, and the microgrid EMS master station returns the handshake information, and the handshake information contains a flag or extended information for cross-domain name handshake multiplexing, and the microgrid EMS master station saves the relevant handshake session information. The distribution terminal parses the handshake information, obtains the cross-domain name multiplexing identifier, extracts all the domain name information of the certificate, caches the relevant handshake information, and the extracted domain names can share this handshake information. (For example, the certificate supports *.example.com) After the handshake is successful, a request is initiated to obtain a content completion request. Normal users also request https: / / b.example.com / url2. The distribution terminal DNS resolves b.example.com to obtain the corresponding IP. The distribution terminal searches the handshake cache and finds that this domain name can share the previous handshake information of a.example.com. This handshake information is used to complete the multiplexing handshake with the new microgrid EMS master station.
[0069] In another implementation, when the cross-domain name multiplexing information is the cross-domain name multiplexing flag carried by the New session ticket message sent by the distribution terminal; the terminal interaction message sent by the distribution terminal is received, and the terminal interaction message includes the Session ticket information; verification information is sent to the distribution terminal, wherein the verification information is the information returned after the Session ticket information is successfully verified; the session key is determined based on the session information associated with the Session ID information, and the handshake request with the distribution terminal is completed.
[0070] The unique device identifier and digital certificate are combined to complete identity authentication, and temporary session key negotiation is performed during the identity authentication process to meet the plug-and-play requirements of the end device. Strengthen the inherent security of the network and system itself, and consider improving the security mechanism, embedding access control based on behavior judgment, realizing system and network state changes in a virtual heterogeneous manner, and building a secure execution environment in the design of the communication protocol. Build an integrated security architecture in which "external protection + native security" interact and complement each other. On the one hand, relying on the existing external security protection technology, targeted isolation, filtering, detection and other defense measures are implemented for the risk points that may exist in the system architecture of smart fusion terminals, microgrid energy controllers, etc., to resist potential network attack security threats; on the other hand, strengthen the inherent security of the network and system itself, such as considering improving the security mechanism, embedding access control based on behavior judgment, realizing system and network state changes in a virtual heterogeneous manner, and building a secure execution environment in the design of the communication protocol.
[0071] In one embodiment, if Figure 2 As shown, the present application also provides a protection device for communication between a microgrid master station and a distribution terminal, including:
[0072] The acquisition module 201 is used to receive the digital certificate information, the unique identification information of the distribution terminal, the random number of the distribution terminal and the key-share information of the distribution terminal sent by the distribution terminal; and acquire the configuration information based on the processing result;
[0073] The processing module 202 is used to authenticate the unique identification information of the distribution terminal based on preset processing rules to generate an authentication result; if the authentication result is that the distribution terminal has access rights, obtain the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station; generate a pre-master key according to the key-share information of the distribution terminal and the key-share information of the microgrid EMS master station; generate a temporary session key according to the random number of the distribution terminal, the random number of the microgrid EMS master station and the pre-master key, wherein the temporary session key is a symmetric cipher; process the digital certificate information and the unique identification information of the distribution terminal based on preset pairing rules to generate a processing result; encrypt the configuration information based on the temporary session key to generate encrypted configuration information; and send the encrypted configuration information to the distribution terminal to complete the connection establishment process.
[0074] In the present application, the microgrid EMS master station receives the digital certificate information, the unique identification information of the distribution terminal, the random number of the distribution terminal and the key-share information of the distribution terminal sent by the distribution terminal; the unique identification information of the distribution terminal is authenticated based on the preset processing rules to generate an authentication result; if the authentication result is that the distribution terminal has access rights, the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station are obtained; a pre-master key is generated according to the key-share information of the distribution terminal and the key-share information of the microgrid EMS master station; a temporary session key is generated according to the random number of the distribution terminal, the random number of the microgrid EMS master station and the pre-master key, wherein the temporary session key is a symmetric cipher; the digital certificate information and the unique identification information of the distribution terminal are processed based on the preset pairing rules to generate a processing result; configuration information is obtained based on the processing result; the configuration information is encrypted based on the temporary session key to generate encrypted configuration information; the encrypted configuration information is sent to the distribution terminal to complete the connection establishment process. The unique device identifier and digital certificate are used to complete identity authentication, and temporary session key negotiation is performed during the identity authentication process to meet the plug-and-play requirements of the end device. The inherent security of the network and system itself is strengthened, and the improvement of security mechanisms, embedded access control based on behavior judgment, and the implementation of system and network state changes in a virtual heterogeneous manner are considered in the design of communication protocols, and a secure execution environment is constructed.
[0075] In another embodiment of the present application, the processing module 202 is configured to send the encrypted configuration information to the power distribution terminal to complete the connection establishment process, and further include:
[0076] Receiving an encryption request message sent by a power distribution terminal, wherein the encryption request message includes first national secret information;
[0077] Selecting second national secret information from the first national secret information, and sending an encrypted confirmation message to the power distribution terminal, wherein the encrypted confirmation message includes the second national secret information;
[0078] Determine the national secret certificate based on the preset encryption rule, and sign the national secret certificate using the signature algorithm in the second national secret information to generate encrypted verification information;
[0079] sending the encrypted verification information to the power distribution terminal;
[0080] When data is interacted with the terminal, encryption / decryption is performed using the SM4 algorithm in the second national secret information.
[0081] In another embodiment of the present application, the processing module 202 is configured to select the second national secret information from the first national secret information, including:
[0082] All national secret algorithm suites in the first national secret information are extracted, and are screened according to a preset screening strategy, and the screened national secret algorithm suites are used as the second national secret information.
[0083] In another embodiment of the present application, the processing module 202 is configured to obtain configuration information based on the processing result, including:
[0084] Sending a certificate loading request to a certificate center, wherein the certificate loading request includes identification information, and the identification information is used to identify the processing priority of the certificate loading request in the certificate center;
[0085] Receiving the digital certificate returned by the certificate center;
[0086] The digital certificate in an expired state is replaced with a new digital certificate received from the certificate center.
[0087] In another embodiment of the present application, the processing module 202 is configured to send the encrypted configuration information to the power distribution terminal to complete the connection establishment process, and further include:
[0088] When the microgrid EMS master station completes the first handshake request, all domain name information supported by the digital certificate in the first handshake request, cross-domain name multiplexing information, and handshake multiplexing information associated with the digital certificate are stored in the mapping table;
[0089] Sending handshake multiplexing information to the power distribution terminal;
[0090] When the power distribution terminal is disconnected from the microgrid EMS master station and needs to be reconnected, a handshake request is completed with the power distribution terminal based on the handshake multiplexing information.
[0091] In another embodiment of the present application, the processing module 202 is configured to complete the handshake request with the power distribution terminal based on the handshake multiplexing information, including:
[0092] When the cross-domain name multiplexing information is cross-domain name multiplexing extension information carried by the terminal interaction message sent by the power distribution terminal;
[0093] Receiving a terminal interaction message sent by the power distribution terminal, wherein the terminal interaction message includes the SessionID information;
[0094] The session key is determined according to the session information associated with the Session ID information, and the handshake request with the power distribution terminal is completed.
[0095] In another embodiment of the present application, the processing module 202 is configured to complete the handshake request with the power distribution terminal based on the handshake multiplexing information, and further includes:
[0096] When the cross-domain name multiplexing information is a cross-domain name multiplexing flag bit carried in the New session ticket message sent by the power distribution terminal;
[0097] Receiving a terminal interaction message sent by the power distribution terminal, wherein the terminal interaction message includes session ticket information;
[0098] Send verification information to the power distribution terminal, wherein the verification information is information returned after successful verification of the session ticket information;
[0099] According to the session information associated with the Session ID information, a session key is determined to complete a handshake request with the power distribution terminal, wherein the session key is an asymmetric cipher.
[0100] The present application embodiment provides an electronic device, such as Figure 3 As shown, the electronic device 3 includes a first processor 300, a memory 301, a bus 302 and a communication interface 303. The first processor 300, the communication interface 303 and the memory 301 are connected via the bus 302; the memory 301 stores a computer program that can be run on the first processor 300, and when the first processor 300 runs the computer program, it executes the protection method for communication between the microgrid master station and the distribution terminal provided in any of the aforementioned embodiments of the present application.
[0101] The memory 301 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 303 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.
[0102] The bus 302 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. Among them, the memory 301 is used to store programs, and the first processor 300 executes the program after receiving the execution instruction. The protection method for the communication between the microgrid master station and the power distribution terminal disclosed in any implementation method of the aforementioned embodiment of the present application can be applied to the first processor 300, or implemented by the first processor 300.
[0103] The first processor 300 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the first processor 300. The above-mentioned first processor 300 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be embodied as a hardware decoding processor to execute, or a combination of hardware and software modules in the decoding processor to execute. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 301, and the first processor 300 reads the information in the memory 301 and completes the steps of the above method in combination with its hardware.
[0104] The electronic device provided in the above-mentioned embodiments of the present application and the protection method for communication between the microgrid master station and the distribution terminal provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.
[0105] The present application embodiment provides a computer-readable storage medium, such as Figure 4 As shown, the computer-readable storage medium stores 401 a computer program, and when the computer program is read and executed by the second processor 402, the protection method for communication between the microgrid master station and the distribution terminal as described above is implemented.
[0106] The technical solution of the embodiment of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling an electronic device (which can be an air conditioner, a refrigeration device, a personal computer, a microgrid EMS master station, or a network device, etc.) or a processor to execute all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.
[0107] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the protection method for communication between the microgrid master station and the distribution terminal provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.
[0108] An embodiment of the present application provides a computer program product, including a computer program, wherein the computer program is executed by a third processor to implement the method described above.
[0109] The computer program product provided in the above-mentioned embodiments of the present application and the protection method for communication between the microgrid master station and the distribution terminal provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.
[0110] It should be noted that, in this application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or still includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0111] Each embodiment in the present application is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the protection method, electronic device, electronic device, and readable storage medium embodiment for evaluating the communication between the microgrid master station and the distribution terminal, since it is basically similar to the protection method embodiment for the communication between the microgrid master station and the distribution terminal described above, the description is relatively simple, and the relevant parts can be referred to the partial description of the protection method embodiment for the communication between the microgrid master station and the distribution terminal described above.
[0112] Although the present application is disclosed as above, the present application is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the protection scope of the present application shall be subject to the scope defined by the claims.
Claims
1. A protection method for communication between a microgrid master station and a distribution terminal, characterized in that: include: Receive digital certificate information, unique identification information of the distribution terminal, random number of the distribution terminal and key-share information of the distribution terminal sent by the distribution terminal; Performing authentication processing on the unique identification information of the power distribution terminal based on a preset processing rule to generate an authentication result; If the authentication result shows that the power distribution terminal has access rights, obtaining the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station; Generate a pre-master key according to the key-share information of the power distribution terminal and the key-share information of the microgrid EMS master station; Generate a temporary session key according to the random number of the power distribution terminal, the random number of the microgrid EMS master station and the pre-master key, wherein the temporary session key is a symmetric cipher; Processing the digital certificate information and the unique identification information of the power distribution terminal based on a preset pairing rule to generate a processing result; Acquire configuration information based on the processing result; Encrypting the configuration information based on the temporary session key to generate encrypted configuration information; The encrypted configuration information is sent to the power distribution terminal to complete the connection establishment process.
2. The method according to claim 1, characterized in that: After sending the encrypted configuration information to the power distribution terminal to complete the connection establishment process, the process further includes: Receiving an encryption request message sent by a power distribution terminal, wherein the encryption request message includes first national secret information; Selecting second national secret information from the first national secret information, and sending an encrypted confirmation message to the power distribution terminal, wherein the encrypted confirmation message includes the second national secret information; Determine the national secret certificate based on the preset encryption rule, and sign the national secret certificate using the signature algorithm in the second national secret information to generate encrypted verification information; sending the encrypted verification information to the power distribution terminal; When data is interacted with the terminal, encryption / decryption is performed using the SM4 algorithm in the second national secret information.
3. The method according to claim 2, characterized in that The selecting the second national secret information from the first national secret information includes: All national secret algorithm suites in the first national secret information are extracted, and are screened according to a preset screening strategy, and the screened national secret algorithm suites are used as the second national secret information.
4. The method according to claim 1, characterized in that: The acquiring configuration information based on the processing result includes: Sending a certificate loading request to a certificate center, wherein the certificate loading request includes identification information, and the identification information is used to identify the processing priority of the certificate loading request in the certificate center; Receiving the digital certificate returned by the certificate center; The digital certificate in an expired state is replaced with a new digital certificate received from the certificate center.
5. The method according to claim 1, characterized in that After sending the encrypted configuration information to the power distribution terminal to complete the connection establishment process, the process further includes: When the microgrid EMS master station completes the first handshake request, all domain name information supported by the digital certificate in the first handshake request, cross-domain name multiplexing information, and handshake multiplexing information associated with the digital certificate are stored in the mapping table; Sending handshake multiplexing information to the power distribution terminal; When the power distribution terminal is disconnected from the microgrid EMS master station and needs to be reconnected, a handshake request is completed with the power distribution terminal based on the handshake multiplexing information.
6. The method according to claim 5, characterized in that The completing the handshake request with the power distribution terminal based on the handshake multiplexing information includes: When the cross-domain name multiplexing information is cross-domain name multiplexing extension information carried by the terminal interaction message sent by the power distribution terminal; Receiving a terminal interaction message sent by the power distribution terminal, wherein the terminal interaction message includes the SessionID information; The session key is determined according to the session information associated with the SessionID information, and the handshake request with the power distribution terminal is completed.
7. The method according to claim 5, characterized in that The completing the handshake request with the power distribution terminal based on the handshake multiplexing information also includes: When the cross-domain name multiplexing information is a cross-domain name multiplexing flag bit carried in the New session ticket message sent by the power distribution terminal; Receiving a terminal interaction message sent by the power distribution terminal, wherein the terminal interaction message includes session ticket information; Send verification information to the power distribution terminal, wherein the verification information is information returned after successful verification of the session ticket information; According to the session information associated with the SessionID information, a session key is determined to complete a handshake request with the power distribution terminal, wherein the session key is an asymmetric cipher.
8. A protection device for communication between a microgrid master station and a distribution terminal, characterized in that: include: An acquisition module is used to receive digital certificate information, unique identification information of the distribution terminal, random number of the distribution terminal and key-share information of the distribution terminal sent by the distribution terminal; Acquire configuration information based on the processing result; A processing module, used to perform authentication processing on the unique identification information of the power distribution terminal based on a preset processing rule to generate an authentication result; If the authentication result shows that the power distribution terminal has access rights, obtain the random number of the microgrid EMS master station and the key-share information of the microgrid EMS master station; generate a pre-master key according to the key-share information of the power distribution terminal and the key-share information of the microgrid EMS master station; generate a temporary session key according to the random number of the power distribution terminal, the random number of the microgrid EMS master station and the pre-master key, wherein the temporary session key is a symmetric cipher; process the digital certificate information and the unique identification information of the power distribution terminal based on a preset pairing rule to generate a processing result; The configuration information is encrypted based on the temporary session key to generate encrypted configuration information; and the encrypted configuration information is sent to the power distribution terminal to complete the connection establishment process.
9. An electronic device, characterized in that: include: a first processor; as well as A memory, configured to store executable instructions of the processor; Wherein, the processor is configured to execute the protection method for communication between the microgrid master station and the distribution terminal as described in any one of claims 1 to 7 by executing the executable instructions.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the second processor, the protection method for communication between the microgrid master station and the distribution terminal as described in any one of claims 1 to 7 is implemented.