2m communication encryption method and system based on dynamic encryption

Abstract

The application discloses a kind of based on dynamic encryption's security control system 2M communication encryption method and system, by combining the high efficiency of symmetric encryption and the security of asymmetric encryption, the encryption and decryption of 2M communication data between stations are realized.Security control system communication interface conversion device includes: central processing unit CPU, field programmable logic gate array FPGA, Ethernet PHY physical layer chip etc.The FPGA of communication interface conversion device integrates communication encryption and decryption IP core, is responsible for realizing application communication data encryption and decryption, the generation of shared session key, dynamic update and check process, improve the reliability and security of communication;CPU is connected with FPGA by parallel bus, is responsible for the disassembly package and package processing function of interface conversion application layer data.The method of dynamic updating of key mentioned in the application, which combines symmetric encryption and asymmetric encryption, is suitable for practical engineering, can solve the security problem and replay attack problem in conventional communication, and improves the security and reliability of the system.

Description

Technical Field

[0001] This invention relates to secure communication, specifically to a 2M communication encryption method and system for a security control system based on dynamic encryption. Background Technology

[0002] With the construction of ultra-high voltage (UHV) power grids, the power grid and communication network have formed a strongly coupled system, thus increasing the possibility of complex cascading failures. Improvements in stability control and protection technologies play a crucial supporting role in the construction of UHV power grids.

[0003] Inter-station mainframes are networked via dedicated 2M channels to form a stability control system, achieving safe and stable control of the large power grid, as shown in the attached diagram. Figure 1 As shown, this technology is widely used in systems such as tripping and switching, DC collaborative control, overload control, frequency and voltage emergency control, oscillation disconnection control, and wide-area automatic transfer switching in 220kV and above power grids. However, the current 2M inter-station communication uses plaintext data exchange based on the power grid private network, which poses security risks in terms of security and attack prevention.

[0004] The communication interface conversion device serves as a bridge for inter-station communication within the system. It includes a central processing unit (CPU) and a field-programmable gate array (FPGA). It communicates with the station's stability control host via a standard 100Mbps Ethernet and decomposes the communication data sent by the host into 8 channels of 2Mbps data, which are then output through an independent 2Mbps communication port for communication with remote locations.

[0005] In power systems, 2M communication between stations is a critical link in ensuring the stable operation of the power grid. However, traditional communication methods often face challenges due to security vulnerabilities such as data leakage, tampering, and replay attacks. Therefore, an efficient and secure encrypted communication method is needed to guarantee the integrity and confidentiality of data.

[0006] In existing technologies, such as Chinese patent application number 202111337490.0, a method and system for deploying national cryptographic algorithms on FPGA based on reconfigurable computing is disclosed. Its feature is that it can deploy multiple national cryptographic algorithm IP cores on demand, provide the optimal national cryptographic algorithm IP core, and meet the resource, power consumption and speed requirements of encryption algorithms under different time periods and different business operation modes such as high speed and energy saving. Although it provides a flexible national cryptographic algorithm IP core deployment scheme, it does not give a specific method for implementing various encryption algorithm combinations, nor does it conduct in-depth research on communication methods for 2M communication devices in security control systems.

[0007] Existing inter-station communication methods for security and stability control systems, such as Chinese patent application number 202111050107.3, disclose an optical fiber / E1 conversion device and an inter-station communication method for security and stability control systems. These methods primarily focus on the logical implementation of the application layer logic for the communication interface device's interface conversion, but do not address encryption and decryption technologies for 2M communication interaction. Another example is Chinese patent application number 202110621074.7, which discloses an encryption method and device for 2M communication in security control systems. This method introduces an SM4-like encryption approach, where the sender and receiver use a hash equation (SHA256) to generate a checksum based on the transmitted key, counter value, and information body for encrypted communication. However, these methods are mainly based on software implementation using general-purpose processors, resulting in low algorithm processing efficiency. The addition of encryption methods and the introduction of the SHA256 hash equation for checksum generation impact the real-time performance of existing application data transmissions. This is particularly pronounced when simultaneous 2M communication with different remote devices is required, where the software-based encryption methods significantly affect real-time communication. Furthermore, the encryption key update method has poor security and low reliability. Summary of the Invention

[0008] Purpose of the invention: To address the above shortcomings, this invention provides a secure, efficient, and reliable 2M communication encryption method and system for security control systems based on dynamic encryption.

[0009] Technical Solution: To solve the above problems, this invention adopts a 2M communication encryption method for security control systems based on dynamic encryption, comprising the following steps:

[0010] A public-private key pair and a random number are generated using the asymmetric encryption SM2 algorithm.

[0011] Send the generated public and private keys and random numbers to the communication object, and receive the public and private keys and random numbers generated by the communication object;

[0012] Using the elliptic curve Diffie-Hellman key exchange protocol, a session key is generated by combining one's own private key with the public key of the communication object, and the session key is used to encrypt the random number of the communication object;

[0013] Send the encrypted random number to the communication object and receive the encrypted random number from the communication object;

[0014] The session key is used to decrypt the encrypted random number received from the communication object, and the decrypted random number is obtained. If the decrypted random number is verified to be consistent with the random number initially generated, then the session key generated by the communication object is correctly shared, and the shared key is obtained.

[0015] It enables 2M communication with the communication partner and uses the symmetric encryption SM4 algorithm based on a shared key to encrypt and decrypt the application communication data exchanged between the two parties.

[0016] Furthermore, the 2M communication with the communication object includes receiving 2M communication data and sending 2M communication data;

[0017] The process of receiving 2M communication data is as follows: receiving data packets from the communication object, parsing, verifying, decrypting the data packets, and storing them in a secondary buffer;

[0018] The process of sending 2M communication data is as follows: the application data to be sent is filled into the data sending storage buffer of the corresponding channel according to the channel number, the application data to be sent is encrypted, encoded after encryption, and then output to the communication object.

[0019] Furthermore, the shared key used in the 2M communication with the communication object is periodically updated, and the generation and updating process of the updated shared key is achieved by reusing the original application data transmission channel.

[0020] Furthermore, the data packets of the receiving communication object are received by the CPU of the communication interface conversion device. The CPU processes the application data packets received from each channel according to the application logic and then sends them back to the MAC transceiver module of the FPGA via the PCIe bus. The MAC transceiver module then transmits the data to the stability control host via the Ethernet PHY in UDP packet format.

[0021] This invention also employs a 2M communication encryption system for security control based on dynamic encryption, comprising:

[0022] The key preparation module is used to generate a public-private key pair and a random number using the asymmetric encryption SM2 algorithm.

[0023] The key exchange module is used to send the generated public and private keys and random numbers to the communication object, and to receive the public and private keys and random numbers generated by the communication object; it is also used to send the encrypted random numbers to the communication object, and to receive the encrypted random numbers from the communication object.

[0024] The key generation module is used to generate a session key by combining its own private key and the public key of the communication object using the elliptic curve Diffie-Hellman key exchange protocol, and to encrypt the random number of the communication object using the session key;

[0025] The key verification module is used to decrypt the encrypted random number received from the communication object using the session key, and obtain the decrypted random number. If the decrypted random number is consistent with the initial random number it generated, it is correctly shared with the session key generated by the communication object, and a shared key is obtained.

[0026] The communication module is used to communicate with the communication object via 2M and uses the symmetric encryption SM4 algorithm based on a shared key to encrypt and decrypt the application communication data exchanged between the two parties.

[0027] Furthermore, it includes several 2M interface modules in the FPGA field-programmable gate array and a remote communication interface device that interacts with the corresponding 2M interface modules. The 2M interface modules and the corresponding remote communication interface devices perform 2M communication, including receiving 2M communication data and sending 2M communication data.

[0028] The process of receiving 2M communication data is as follows: the 2M interface module receives the data packet from the corresponding remote communication interface device, and stores the data packet in a secondary buffer after parsing, verifying and decrypting it.

[0029] The 2M communication data transmission process is as follows: the CPU of the communication interface conversion device fills the application data to be sent into the data transmission storage buffer of the corresponding channel according to the channel number, encrypts the application data to be sent, encodes it after encryption, and then outputs it to the corresponding remote communication interface device through the 2M interface module.

[0030] Furthermore, the CPU of the communication interface conversion device receives application message data from each channel 2M interface module and UDP messages from communication with the stability control host. The CPU performs corresponding logical judgments and packet splitting and reassembly operations according to the type and content of the data messages.

[0031] The CPU of the communication interface conversion device processes the application data packets received from each channel according to the application logic and then sends them back to the MAC transceiver module of the FPGA via the PCIe bus. The MAC transceiver module then transmits the data to the stability control host via the Ethernet PHY in UDP packet format. At the same time, it receives UDP packets sent by the stability control host, performs packet decomposition and processing, organizes the application packet data to be sent to the remote location according to the application logic, and fills it into the corresponding 2M channel transmission buffer.

[0032] The present invention also employs a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0033] The present invention also employs a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above method.

[0034] Beneficial Effects: Compared to existing technologies, the significant advantage of this invention is that it combines the national cryptographic algorithms SM2 and SM4, ensuring both the security of key exchange and distribution, and the high efficiency and real-time performance of encryption. Utilizing the high-performance processing capabilities of FPGA, the generation, updating, and verification of session keys, as well as the encryption and decryption of message data, ensures both real-time performance and communication security for 2M application data communication between stations. Dynamic updates of session keys effectively prevent the security risks that may arise from the long-term use of the same key. Seamless integration between the FPGA IP core and the CPU software program allows for the interactive reuse of the original application data message communication channel for key negotiation, encryption / decryption, and dynamic key updates, all without the CPU software being aware of the process, thus reducing implementation difficulty and cost. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a stability control system based on 2M inter-station communication via a communication interface device in the prior art.

[0036] Figure 2 This is a schematic diagram of the encrypted communication process in this invention.

[0037] Figure 3 This is a schematic diagram of the process for generating a shared session key in the inter-station communication interface conversion device of the present invention.

[0038] Figure 4 This is a schematic diagram of the communication stage in the encryption process of the inter-station communication interface conversion device in this invention.

[0039] Figure 5 This is a schematic diagram of the multi-channel 2M message reception and processing flow in this invention.

[0040] Figure 6 This is a schematic diagram of the multi-channel 2M message transmission process in this invention.

[0041] Figure 7 This is a schematic diagram of the communication interface conversion device in this invention. Detailed Implementation

[0042] Example 1

[0043] like Figure 2 As shown in this embodiment, a 2M communication encryption method for a security control system based on dynamic encryption combines the efficiency of symmetric encryption with the security of asymmetric encryption to achieve encryption and decryption of inter-station communication data. The method includes the following steps:

[0044] Step 1: Confirm the channel communication link connection.

[0045] Step 2: Session Key Generation: During the handshake phase, both communicating parties authenticate each other and negotiate a shared session key before commencing encrypted data transmission. During the power-on initialization phase of the communication interface conversion device, using asymmetric encryption technology (SM2 algorithm), each of the two FPGAs generates a public-private key pair and negotiates a shared session key using the elliptic curve Diffie-Hellman key exchange protocol by exchanging public keys. For example... Figure 3 As shown, the specific steps are as follows:

[0046] Step 2-1: Initialization Phase

[0047] Both communicating parties A and B use the asymmetric encryption algorithm SM2 to generate a public-private key pair: A generates the public key PK. A and private key SK A B generates public key PK B and private key SK B Simultaneously, both parties A and B generate their own random numbers for subsequent session key verification. A and B then share their respective certificates (containing the generated public key PK). A and PK B The generated random number is sent to the other party in a pre-defined message format.

[0048] The session key dynamic update and interactive multiplexing application data message communication channel has a maximum application data length of 48 bytes, which is filled and sent by the CPU side according to the fixed configuration and actual application needs. The session key interaction message has a maximum length of 36 bytes, which is filled by the FPGA according to the session key generation and update process mechanism. If the session key interaction message is too long, it will be divided into packets and transmitted in interrupts. The overall communication message frame format is as follows:

[0049] Application data (48 bytes) Session key update interaction message data (36 bytes) CRC_H CRC_L

[0050] Key initialization request message, A→B, format as follows:

[0051] meaning content Length (bytes) Frame header 0xA551 2 Channel address Channel number (0x5AA0~0x5AA7) 2 Checksum The sum and inversion of all the above characters 2

[0052] Key initialization request acknowledgment message, B→A, format as follows:

[0053] meaning content Length (bytes) Frame header 0xA552 2 Channel address Channel number (0x5AA0~0x5AA7) 2 Checksum The sum and inversion of all the above characters 2

[0054] Step 2-2: Session Establishment Phase

[0055] A and B obtain each other's certificates and random numbers through direct exchange. A and B then use the Elliptic Curve Diffie-Hellman key exchange protocol, combining their respective private keys with each other's public keys, to generate a session key K. A and K B .

[0056] Steps 2-3: Session Key Sharing and Authentication

[0057] A and B use their respective calculated session keys K A and K B The random number received from the other party in encryption step 2-2 is sent to the other party. Both parties use their self-calculated session key K. A and K B Decryption verifies whether the random number was generated by each party in step 2-1, to confirm whether both parties have successfully shared the same session key K. AB (K AB =K A =K B If the verification is successful, both parties confirm the session key K. AB K has been shared correctly. AB As a shared key.

[0058] Authentication and key negotiation message 1, (verification during key exchange), A<->B, format as follows:

[0059] meaning content Length (bytes) Frame header 0xA553 2 Channel address Channel number (0x5AA0~0x5AA7) 2 Verification information A digital certificate + random information (four bytes) data 100 Checksum The sum and inversion of all the above characters 2

[0060] Shared key verification returned message 1 (session key verification returned), A->B, in the following format:

[0061] meaning content Length (bytes) Frame header 0xA554 2 Channel address Channel number (0x5AA0~0x5AA7) 2 Session key encryption information Random messages encrypted using session keys 4 Checksum The sum and inversion of all the above characters 2

[0062] Shared key verification returned message 2 (session key verification returned), B->A, with the following format:

[0063]

[0064] Shared key verification returned message 3 (session key verification returned), A->B, with the following format:

[0065] meaning content Length (bytes) Frame header 0xA556 2 Channel address Channel number (0x5AA0~0x5AA7) 2 Session key verification result Session key verification result information 4 Checksum The sum and inversion of all the above characters 2

[0066] The session key is dynamically updated periodically to prevent security risks associated with prolonged use of the same key. The generation and updating of the new session key is achieved by reusing the original application data transmission channel, ensuring both real-time updates and security. Simultaneously, it avoids the need for physically adding new key transmission channels, reducing implementation costs. The flowchart of the dynamic session key update process for this patent's communication interface conversion device is shown below. Figure 4 As shown.

[0067] A and B agree in advance to update the session key at a fixed period. When the session key needs to be updated, A and B will repeat steps 2-1, 2-2, and 2-3 to negotiate a new session key K using the elliptic curve Diffie-Hellman key exchange protocol. AB ′.

[0068] New session key K AB The generation and update process of ' is achieved by reusing the original application data transmission channel. Once the new session key K is... AB Once verified by both parties, the two parties in the 2M communication switch to using the new session key for encrypting and decrypting 2M application data, and simultaneously discard the old session key K. AB .

[0069] Step 3: Apply data encryption and decryption for communication transmission.

[0070] Using symmetric encryption technology (SM4 algorithm) based on the shared key K negotiated in steps 2-3 AB The communication interface conversion device encrypts and decrypts the application communication data exchanged between the two parties. The FPGA's 2M interface module is responsible for interacting with external remote 2M communication. Each 2M interface module independently controls the encryption and decryption of application communication data for its corresponding channel and the dynamic update management of the shared session key for that channel. The CPU of the communication interface conversion device, as the core of the entire system, receives application message data from the 2M message processing modules of each channel and Ethernet UDP messages from the communication with the stability control host. The CPU performs corresponding logical judgments and packet splitting / reassembly operations based on the type and content of the data messages. The CPU of the communication interface conversion device reassembles the remote application data messages received from each 2M channel according to the application logic and then sends them back to the FPGA's MAC (Media Access Controller) transceiver module via the PCIe bus. The MAC transceiver module then transmits the data to the stability control host via the Ethernet PHY in UDP message format. Simultaneously, it receives UDP messages sent from the stability control host, performs packet splitting and reassembly processing, organizes the 2M application messages to be sent to the remote party according to the application logic, and fills them into the corresponding 2M channel's transmission buffer.

[0071] In this embodiment, the stable communication interface conversion device supports independent transmission and reception of up to eight 2M interface modules. The communication process between the two parties includes 2M communication data reception and 2M communication data transmission.

[0072] like Figure 5As shown, the specific process of 2M communication data reception is as follows: FPGA 2M encoding module 1 receives data packets from remote communication interface device 1, performs necessary encoding and format conversion to ensure the data meets the requirements of subsequent processing modules. Similarly, 2M encoding module 2 processes the data transmitted to interface device 2, and 2M encoding module 8 processes the data packets transmitted to interface device 8. The corresponding protocol conversion and parsing process is as follows: 2M packet input -> FPGA clock extraction -> HDB3 physical layer decoding -> 1B4B spread spectrum decoding -> HDLC data link layer decoding -> packet parsing -> CRC check -> FPGA 2M data decryption module -> data storage secondary buffer.

[0073] like Figure 6 As shown, the specific process of 2M communication data transmission is as follows: FPGA's 2M encoding module 1 sends data packets to the remote communication interface device 1, performing necessary encoding and format conversion to ensure compliance with 2M data transmission communication requirements. Similarly, 2M encoding module 2 sends data to the remote communication interface device 2, and 2M encoding module 8 processes and sends transmission data packets to the remote communication device 8. The corresponding protocol conversion and parsing process is as follows: the CPU of the communication interface conversion device fills the application data to be sent into the corresponding channel's data transmission storage buffer according to the channel number -> FPGA 2M data encryption module performs encryption processing -> HDLC data link layer encoding -> physical layer 1B4B spread spectrum encoding -> 2M message output.

[0074] Step 4: Communication link lost, session ends.

[0075] Example 2

[0076] like Figure 7 As shown, the communication interface conversion device includes a control host, a communication chassis, and several remote communication interface devices. The communication chassis includes a CPU (application message depacketizing / packet assembly module), an Ethernet PHY, and an FPGA. The FPGA includes a GMAC transceiver module, an encryption system, and several 2M interface modules. The CPU of the communication interface conversion device, as the core of the entire system, receives application message data from the 2M message processing modules of each channel and Ethernet UDP messages communicating with the control host. The CPU performs corresponding logical judgments and depacketizing / packet assembly operations based on the type and content of the data messages. The CPU of the communication interface conversion device processes the remote application data messages received from each 2M channel according to the application logic and then sends them back to the MAC (Media Access Controller) transceiver module of the FPGA via the PCIe bus. The MAC transceiver module then transmits the data to the control host in UDP message format via the Ethernet PHY. Simultaneously, it receives UDP messages sent from the control host, performs depacketizing, organizes the 2M application messages to be sent to the remote location according to the application logic, and fills them into the corresponding 2M channel transmission buffer.

[0077] In this embodiment, the encryption system adopts a 2M communication encryption system based on dynamic encryption technology, including:

[0078] The key preparation module is used to generate a public-private key pair and a random number using the asymmetric encryption SM2 algorithm.

[0079] The key exchange module is used to send the generated public and private keys and random numbers to the communication object, and to receive the public and private keys and random numbers generated by the communication object; it is also used to send the encrypted random numbers to the communication object, and to receive the encrypted random numbers from the communication object.

[0080] The key generation module is used to generate a session key by combining its own private key and the public key of the communication object using the elliptic curve Diffie-Hellman key exchange protocol, and to encrypt the random number of the communication object using the session key;

[0081] The key verification module is used to decrypt the encrypted random number received from the communication object using the session key, obtain the decrypted random number, and verify whether the decrypted random number is consistent with the initial random number it generated. If they are consistent, the shared key is correctly shared with the session key generated by the communication object.

[0082] The communication module is used to communicate with the communication object via 2M and uses the symmetric encryption SM4 algorithm based on a shared key to encrypt and decrypt the application communication data exchanged between the two parties.

[0083] Example 3

[0084] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0086] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0087] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0088] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A 2M communication encryption method for a security control system based on dynamic encryption, characterized in that, Includes the following steps: A public-private key pair and a random number are generated using the asymmetric encryption SM2 algorithm. Send the generated public and private keys and random numbers to the communication object, and receive the public and private keys and random numbers generated by the communication object; Using the elliptic curve Diffie-Hellman key exchange protocol, a session key is generated by combining one's own private key with the public key of the communication object, and the session key is used to encrypt the random number of the communication object; Send the encrypted random number to the communication object and receive the encrypted random number from the communication object; The session key is used to decrypt the encrypted random number received from the communication object, and the decrypted random number is obtained. If the decrypted random number is verified to be consistent with the random number initially generated, then the session key generated by the communication object is correctly shared, and the shared key is obtained. It enables 2M communication with the communication partner and uses the symmetric encryption SM4 algorithm based on a shared key to encrypt and decrypt the application communication data exchanged between the two parties. The 2M communication with the communication object includes receiving 2M communication data and sending 2M communication data. The process of receiving 2M communication data is as follows: receiving data packets from the communication object, parsing, verifying, decrypting the data packets, and storing them in a secondary buffer; The process of sending 2M communication data is as follows: the application data to be sent is filled into the data sending storage buffer of the corresponding channel according to the channel number, the application data to be sent is encrypted, encoded after encryption, and then output to the communication object.

2. The 2M communication encryption method for a security control system based on dynamic encryption according to claim 1, characterized in that, The shared key used in the 2M communication with the communication object is periodically updated. The generation and updating process of the updated shared key is achieved by reusing the original application data transmission channel.

3. The 2M communication encryption method for a security control system based on dynamic encryption according to claim 1, characterized in that, The data packets of the receiving communication object are received by the CPU of the communication interface conversion device. The CPU processes the application data packets received from each channel according to the application logic and then sends them back to the MAC transceiver module of the FPGA via the PCIe bus. The MAC transceiver module then transmits the data to the stability control host via the Ethernet PHY in UDP packet format.

4. A 2M communication encryption system for a security control system based on dynamic encryption, employing the method of any one of claims 1-3, characterized in that, include: The key preparation module is used to generate a public-private key pair and a random number using the asymmetric encryption SM2 algorithm. The key exchange module is used to send the generated public and private keys and random numbers to the communication object, and to receive the public and private keys and random numbers generated by the communication object; it is also used to send the encrypted random numbers to the communication object, and to receive the encrypted random numbers from the communication object. The key generation module is used to generate a session key by combining its own private key and the public key of the communication object using the elliptic curve Diffie-Hellman key exchange protocol, and to encrypt the random number of the communication object using the session key; The key verification module is used to decrypt the encrypted random number received from the communication object using the session key, and obtain the decrypted random number. If the decrypted random number is consistent with the initial random number it generated, it is correctly shared with the session key generated by the communication object, and a shared key is obtained. The communication module is used to communicate with the communication object via 2M and uses the symmetric encryption SM4 algorithm based on a shared key to encrypt and decrypt the application communication data exchanged between the two parties.

5. The 2M communication encryption system for security control based on dynamic encryption according to claim 4, characterized in that, It includes several 2M interface modules in an FPGA field-programmable gate array and a remote communication interface device that interacts with the corresponding 2M interface modules. The 2M interface modules and the corresponding remote communication interface devices perform 2M communication, including receiving and sending 2M communication data. The process of receiving 2M communication data is as follows: the 2M interface module receives the data packet from the corresponding remote communication interface device, and stores the data packet in a secondary buffer after parsing, verifying and decrypting it. The 2M communication data transmission process is as follows: the CPU of the communication interface conversion device fills the application data to be sent into the data transmission storage buffer of the corresponding channel according to the channel number, encrypts the application data to be sent, encodes it after encryption, and then outputs it to the corresponding remote communication interface device through the 2M interface module.

6. The 2M communication encryption system for security control based on dynamic encryption according to claim 5, characterized in that, The CPU of the communication interface conversion device receives application message data from each channel 2M interface module and UDP messages from communication with the stability control host. The CPU performs corresponding logical judgments and packet splitting and reassembly operations according to the type and content of the data messages. The CPU of the communication interface conversion device processes the application data packets received from each channel according to the application logic and then sends them back to the MAC transceiver module of the FPGA via the PCIe bus. The MAC transceiver module then transmits the data to the stability control host via the Ethernet PHY in UDP packet format. At the same time, it receives UDP packets sent by the stability control host, performs packet decomposition and processing, organizes the application packet data to be sent to the remote location according to the application logic, and fills it into the corresponding 2M channel transmission buffer.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

Images