Power grid data transmission encryption and decryption method based on symmetric block encryption AES technology

Abstract

The invention discloses a power grid data transmission encryption and decryption method based on an AES (Advanced Encryption Standard) technology, which comprises the following steps: S1, a client establishes communication connection with a server, and the server identifies the security of the client by setting a network IP white list; s2, transmitting the application layer data ciphertext subjected to double encryption to a client through an MMS service based on a 5G air interface protocol; and S3, the client decrypts the ciphertext data by using a double decryption algorithm, and analyzes the decrypted plaintext data. According to the invention, the security problem that the data header information is tampered or intercepted when only the data body is encrypted can be solved; in the data transmission process of the power system, a packet cutting or filling mode is adopted for plaintext data, so that the fixed transmission size of the plaintext data is 1kB, and the problem that a receiving end cannot determine the decryption time of a received ciphertext can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of secure encryption of data transmission, and in particular to a method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology. Background Art

[0002] Actively promoting the application of intelligent operation and maintenance technology has become an inevitable requirement to ensure the safe operation of the power grid and reliable power supply, advance the construction of new power systems, and promote professional quality improvement.

[0003] The operation of the new power system is inseparable from the interaction of massive data and the support of various types of digital platforms. Through the analysis and processing of these data, the power system can be controlled in real time to ensure the safety, reliability, efficiency and energy saving of the power system. At the same time, data collection, analysis, transmission and display will face severe security issues.

[0004] Among them, on the data collection side, in order to meet the diverse data collection needs of the power generation side, the transmission and distribution side, and the power consumption side, it is necessary to develop and deploy multiple collection systems based on multiple platforms on the Internet, which expands the attack surface; on the data display side and the upstream and downstream of data processing, data leakage caused intentionally or unintentionally by privileged users and suppliers is difficult to prevent; and because power production and dispatching have high requirements for stability, once maliciously contaminated data enters the digital power grid environment, it will cause serious damage to the power grid facilities, so urgent requirements are put forward for the security of data transmission. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a method for encryption and decryption of power grid data transmission based on symmetric block encryption AES technology, to solve the security problems such as data header information being tampered with or intercepted when only the data body is encrypted, and to solve the problem that the receiving end cannot determine the time when the received ciphertext is decrypted.

[0006] Technical solution: A method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology, comprising the following steps:

[0007] S1, the client establishes a communication connection with the server, and the server identifies the security of the client by setting up a network IP whitelist;

[0008] S2, transmits the double-encrypted application layer data to the client through the MMS service based on the 5G air interface protocol;

[0009] S3, the client uses the double decryption algorithm to decrypt the ciphertext data and parse the decrypted plaintext data.

[0010] Furthermore, when the client wants to establish a communication link with the server, the server needs to detect whether the command source IP matches the client whitelist IP in its own setting parameters after receiving the TCP handshake command:

[0011] If they do not match, the communication link is refused to be established;

[0012] If they match, the communication link is established normally.

[0013] Furthermore, the double encryption is to encrypt the AES key of the AES algorithm using the asymmetric encryption algorithm RSA, and the implementation steps are as follows:

[0014] S21, the encryption end encrypts the original information with the AES key and encrypts the AES key with the asymmetric encryption algorithm RSA public key;

[0015] S22, uses apk signature to verify the legitimacy of so library calls and implements secure transmission of formatted string data;

[0016] S23, fixed transmission data size, set network IP whitelist.

[0017] Furthermore, the original information includes a message header and a message body; the message header and the message body are both composed of binary 0 and 1 characters, the binary string of the message header is located at the beginning of the message, and the message header is composed of an address code; the address code is a byte used to indicate the address of the terminal device specified by the user.

[0018] Furthermore, in step S22, the RSA public key and private key of the Android side are placed in the native layer, compiled to form a so dynamic link library, and the corresponding Java interface is opened for the upper-layer application to call; when the apk signature is inconsistent with its own signature, calling the so library will directly crash.

[0019] Furthermore, in step S23, 1 kB is used as a fixed data size in the plain text stage. If the data size exceeds 1 kB, packet cutting is performed; if the data size is less than 1 kB, data padding is performed.

[0020] Compared with the prior art, the present invention has the following significant effects:

[0021] 1. Data transmission encryption and decryption technology based on symmetric block encryption AES technology. The encryption end uses AES key to encrypt the original information, and uses asymmetric encryption RSA public key to encrypt the AES key, forming double encryption of plaintext data; the decryption end uses RSA private key to decrypt the AES key, and decrypts the original information through the AES key; at the same time, the apk signature is used to verify the legitimacy of the so library call. This double encryption method realizes the secure transmission of formatted string data. Compared with traditional encryption and decryption algorithms, the data encryption and decryption speed has been slightly improved and more balanced, and the security is also improved, which has more advantages in computing efficiency than the original algorithm;

[0022] 2. Increase the security of network transmission by double encryption of transmitted data and matching settings of the transmission target network IP whitelist.

[0023] 3. The dual encryption method of AES and RSA is used to encrypt the data header and data body at the same time, which can solve the security problems such as the data header information being tampered or intercepted when only the data body is encrypted;

[0024] 4. During the data transmission process of the power system, the plaintext data is cut or padded to make its fixed transmission size 1kB, which can solve the problem that the receiving end cannot determine the time when the received ciphertext is decrypted. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the AES encryption and decryption process;

[0026] Figure 2 This is a schematic diagram of the encryption and decryption process of the AES key;

[0027] Figure 3 This is a whitelist action flow chart;

[0028] Figure 4 This is a schematic diagram of the encryption and decryption process of the application layer protocol. DETAILED DESCRIPTION

[0029] The present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0030] In the power system, the transmission principle and process of MMS (Manufacturing Message Specification) messages are mainly based on the IEC 61850 standard, which is a global standard in the field of power system automation. MMS messages are mainly used for information transmission between the station control layer and the bay layer, including customized information, recording information and other information with low real-time requirements.

[0031] The transmission process of MMS message can be divided into the following steps:

[0032] A1) Establishing a TCP connection: First, the backend, as a 61850 client, requests the device (as a 61850 server) to establish a TCP connection. This process follows the three-way handshake protocol, that is, the client sends a SYN request, the server responds with a SYN-ACK confirmation, and the client sends an ACK again to complete the connection establishment.

[0033] A2) Encapsulate MMS message: After the TCP connection is established, the MMS message is encapsulated in the TCP message for transmission. The structure of the MMS message includes three levels: TPKT, COTP and MMS. TPKT is the transmission protocol data unit, COTP is the connection management protocol, and MMS is the actual data content.

[0034] A3) Data transmission: MMS messages are transmitted to the target device through the network. During the transmission process, MMS messages can contain various types of data, such as device parameter setting information, real-time data, and monitoring information. These data are managed through object-oriented modeling technology to ensure interoperability between devices from different manufacturers.

[0035] A4) Receiving and parsing: After receiving the MMS message, the target device will parse and process it. The parsing process includes byte-by-byte analysis of the message structure to extract the required data and control information.

[0036] A5) Response and confirmation: If necessary, the target device will generate a corresponding response message and return it to the client through the same path. The response message also follows the structure of the MMS protocol to ensure the reliability and consistency of communication.

[0037] The transmission process of MMS messages involves multiple layers of protocols, from TCP / IP to COTP to MMS, and each step ensures the correct transmission and processing of data. This layered communication mechanism enables MMS to effectively support the complex information exchange requirements in the power system.

[0038] Among them, in the power system, data transmission between the client and the server adopts the data frame mode, the transmission sequence is a binary byte stream, and the integer, long integer and floating point data are stored in the order of low-order bytes in front and high-order bytes in the back. The transmitted MMS message includes a message header and a message body. The message header contains some basic information of the message, such as the length, version number, source address and destination address of the message. This information is crucial for parsing and processing messages to ensure that data can be correctly transmitted and received in the network. The message body contains the actual data content, which can be equipment status information, control commands, recording information, etc. The structure and content of the message body depend on the specific application scenario and requirements. For example, in a smart substation, MMS messages can be used to receive control commands, switch control, gear adjustment and other operations.

[0039] The present invention adopts data transmission encryption and decryption technology based on symmetric block encryption AES technology, uses AES key to encrypt original information, namely message header and message body, and uses asymmetric encryption RSA public key to encrypt AES key. At the same time, apk signature is used to verify the legitimacy of so library call, and the transmission size is fixed to 1kb, and a network IP whitelist is set to realize data encryption and secure transmission.

[0040] Step 1: The encryption end encrypts the original information (message header and message body) with the AES key, and encrypts the AES key with the asymmetric encryption algorithm RSA public key;

[0041] The message header and message body are both composed of binary 0 and 1 characters. During the data transmission process, the message header and message body together form a binary string. The binary string of the message header is specifically located at the beginning of the message. The message header is usually composed of an address code, which is a byte (8-bit binary code) used to indicate the address of the terminal device specified by the user. Therefore, the encryption of the original information of data transmission can be achieved by encrypting the binary string that identifies the message header and message body using the symmetric encryption AES algorithm.

[0042] The key length of the symmetric encryption AES algorithm is flexible and supports multiple lengths. When the key length is 128 bits, the number of encryption rounds is 10. The AES encryption and decryption process of data is as follows: Figure 1 shown.

[0043] Assume that the AES encryption function is E, then the encryption formula is C = E (K, P), where P is plain text, K is the key, and C is the cipher text. Encryption process: Input plain text group and 128-bit key, the plain text group is represented as a state matrix, the key is represented as a byte matrix, execute 10 round functions E, and finally get the cipher text.

[0044] The steps of the AES algorithm are as follows:

[0045] B1) Byte Replacement

[0046] Each element in the state matrix is ​​replaced with a new element by looking up a table (S-box), and the upper 4 bits of each byte in the state matrix are used as the row index and the lower 4 bits as the column index, and the corresponding element in the S-box is taken out as the output. This step provides the nonlinear transformation capability of the AES algorithm. During the construction of the S-box, the reversible affine transformation matrix and the multiplication inverse element are combined to avoid general algebraic attacks.

[0047] B2) Row shift

[0048] Row shift is to perform a left circular shift on the state matrix. When the key length is 128 bits, the state matrix is ​​left shifted by 0B, 1B, 2B, and 3B from row 0 to row 3 respectively.

[0049] B3) Column confusion

[0050] The basic domain of AES is the finite field GF(28). Each column of the input state matrix can be regarded as a polynomial on the basic field, and it is multiplied with a fixed polynomial C(x)={03}x3+{01}x2+{01}x+{02}, and finally the modulo m(x)=x4+1 is taken.

[0051] B4) Round Key Addition

[0052] Complicating key expansion is an important step to ensure the security of the algorithm. The round key addition operation is to perform a bit-by-bit XOR operation on the round key and the state matrix. Each subsequent round key is obtained through key expansion. When the key length is 128 bits, the AES encryption algorithm iterates 10 rounds and generates 11 sub-keys.

[0053] Since the front-end and back-end frequently interact with each other, the AES algorithm is used to encrypt the data string to ensure the speed of encryption and decryption during data interaction. During the encryption and decryption process, since the key of the AES algorithm is likely to be leaked, how to securely transmit the key to the decryption end is a major focus.

[0054] The present invention uses the asymmetric encryption algorithm RSA to encrypt the AES key of the AES algorithm. The encryption and decryption process is as follows: Figure 2 As shown, the implementation steps are as follows:

[0055] The encryption end encrypts the original information with the AES key, encrypts the AES key with the asymmetric encryption algorithm RSA public key, forms formatted data with the processed key and ciphertext, and transmits it to the decryption end; the decryption end obtains the data sent by the sender, parses the undecrypted AES key and ciphertext data, uses the RSA private key to decrypt the encrypted AES key to obtain the AES key, and uses the AES key to decrypt the original information.

[0056] Step 2: Use the apk signature to verify the legitimacy of the so library call to achieve secure transmission of formatted string data;

[0057] Due to the open source nature of the Android system, the storage of RSA keys is subject to the risk of cracking the system root permissions and cracking the apk installation package. Therefore, the present invention places the RSA public key and private key of the Android end in the native layer, forms a so dynamic link library after compilation, and opens the corresponding Java interface to provide it to the upper application call. It can not only ensure the speed of encryption and decryption, but also increase the difficulty of the dynamic link library so being decompiled and cracked. In addition, in order to avoid the so file being stolen and packaged twice, the apk signature is used to verify the legitimacy of the so library call. When the apk signature is inconsistent with its own signature, calling the so library will directly crash. Use double encryption means to achieve secure transmission of formatted string data.

[0058] The present invention conducts 5 groups of tests on a 128-bit character string. By analyzing the experimental results, it can be seen that compared with the traditional AES algorithm, the optimized double encryption algorithm can slightly improve the data encryption and decryption speed, the encryption speed can be increased by about 21%, and the decryption speed can be increased by about 26%. In addition, the encryption and decryption speeds are more balanced, which has more advantages in computing efficiency than the original algorithm.

[0059] Step 3: fix the transmission data size to 1kb, set the network IP whitelist, and realize data encryption and secure transmission;

[0060] TCP is a transport layer protocol based on IP, which is connection-oriented and reliable. TCP is the most important transport protocol in the TCP / IP architecture. A TCP transport connection must be established first. Each TCP transport connection can only have one sender and one receiver, so only point-to-point data transmission can be achieved. After the data transmission is completed, the established TCP transport connection must be released. During the data transmission process, the data transmission unit of TCP is the traditional "data segment". Since the data segment size is determined by the size of the message sent by the application layer and the size of the MTU (Maximum Transmission Unit) in the network, the size of the TCP segment sent each time is not fixed.

[0061] When TCP is transmitting, it uses the MSS (Maximum Segment Size) to determine whether the data packet needs to be segmented. When the size of the data packet sent by the application layer exceeds the MSS, the data packet needs to be segmented. TCP determines how many TCP segments can be sent at a time based on the currently available "send window size" limit. If the data sent by the application process to the TCP buffer is too long, TCP can segment it. If the data passed to the TCP buffer is too short, TCP will not process it at this time, and will wait until the data in the buffer reaches a certain amount before forming a data segment for sending.

[0062] When encrypting application layer user data, the present invention adopts a method of encrypting the message header and the message body in order to prevent the security problems such as the message header information being tampered or intercepted that may occur when only the message body is encrypted. However, if information such as the data length in the message header is sent in the form of ciphertext, the ciphertext length cannot be determined, so the receiving end cannot determine the time when the received ciphertext is decrypted. Therefore, for streaming media protocols such as TCP, the present invention adopts a fixed transmission size method.

[0063] In addition to encrypting plaintext data and organizing it into ciphertext data for transmission, the 860 server should also identify the security of the 860 client by setting up a network IP whitelist. Figure 3 shown.

[0064] When an 860 client wants to establish a communication link with an 860 server, after receiving the TCP handshake command, the server needs to detect whether the command source IP matches the client whitelist IP in its own setting parameters. If not, it will refuse to establish a communication link; if it matches, it will establish a communication link normally and transmit the double-encrypted application layer data ciphertext to the 860 client through the MMS service based on the 5G air interface protocol. The 860 client uses the double decryption algorithm studied in this paper to decrypt the ciphertext data and parse the decrypted plaintext data, which is applied to mobile writing application modules such as virtual LCD and site area network topology.

[0065] In this embodiment, according to the characteristics of AES encryption, the plaintext is encrypted in the form of groups, and each group size is 16 bytes. When the data size in a group is less than 16 bytes, the data is padded. Therefore, the present invention sets the TCP transmission fixed size value to 1kB. The data encryption and decryption process is as follows Figure 4 shown.

[0066] In the plaintext stage, 1kB is used as a fixed size. If the data size exceeds 1kB, the packet is cut; if the data size is less than 1kB, data padding is performed. A double encryption method is used to encrypt the message header and message body at the same time. When the data received by the receiving end is a fixed size of 1kB, it can be decrypted to achieve data encryption and secure transmission.

Claims

1. A method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology, characterized in that: The steps include: S1, the client establishes a communication connection with the server, and the server identifies the security of the client by setting up a network IP whitelist; S2, transmits the double-encrypted application layer data to the client through the MMS service based on the 5G air interface protocol; S3, the client uses the double decryption algorithm to decrypt the ciphertext data and parse the decrypted plaintext data.

2. According to claim 1, the method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology is characterized in that: When the client wants to establish a communication link with the server, after receiving the TCP handshake command, the server needs to detect whether the command source IP matches the client whitelist IP in its own setting parameters: If they do not match, the communication link is refused to be established; If they match, the communication link is established normally.

3. According to claim 1, the method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology is characterized in that: The double encryption is to encrypt the AES key of the AES algorithm using the asymmetric encryption algorithm RSA, and the implementation steps are as follows: S21, the encryption end encrypts the original information with the AES key and encrypts the AES key with the asymmetric encryption algorithm RSA public key; S22, uses apk signature to verify the legitimacy of so library calls and implements secure transmission of formatted string data; S23, fixed transmission data size, set network IP whitelist.

4. According to claim 3, the method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology is characterized in that: The original information includes a message header and a message body; both the message header and the message body are composed of binary 0 and 1 characters, the binary string of the message header is located at the beginning of the message, and the message header is composed of an address code; the address code is a byte used to indicate the address of the terminal device specified by the user.

5. According to claim 3, the method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology is characterized in that: In step S22, the RSA public key and private key of the Android side are placed in the native layer, compiled to form a so dynamic link library, and the corresponding Java interface is opened for the upper-layer application to call; when the apk signature is inconsistent with its own signature, calling the so library will directly crash.

6. The method for power grid data transmission encryption and decryption based on symmetric block encryption AES technology according to claim 3 is characterized in that: In step S23, in the plain text stage, 1 kB is used as a fixed data size. If the data size exceeds 1 kB, packet cutting is performed; if the data size is less than 1 kB, data padding is performed.

Images