A method for power grid data transmission encryption and decryption based on symmetric block encryption AES technology

Abstract

The present invention discloses a method for encrypting and decrypting power grid data transmission based on symmetric block encryption (AES) technology, comprising the following steps: S1, establishing a communication connection between a client and a server, and the server identifying the security of the client by setting a network IP whitelist; S2, transmitting the double-encrypted application layer data in ciphertext to the client via an MMS service based on a 5G air interface protocol; S3, the client decrypts the ciphertext data using a double decryption algorithm and parses the decrypted plaintext data. The present invention can solve security issues such as data header information being tampered with or intercepted when only the data body is encrypted; during the power system data transmission process, the plaintext data is packetized or padded to fix its transmission size to 1kB, which can solve the problem that the receiving end cannot determine the time when the received ciphertext is decrypted.

Description

Technical Field

[0001] The present invention relates to the technical field of secure encryption of data transmission, and in particular to a method for encrypting and decrypting power grid data transmission based on symmetric block encryption (AES) technology. Background Art

[0002] At present, actively promoting the application of intelligent operation and maintenance technology has become an inevitable requirement to ensure the safe operation of the power grid and reliable power supply, promote the construction of new power systems, and promote professional quality improvement.

[0003] The operation of new power systems relies on the interaction of massive amounts of data and the support of various digital platforms. By analyzing and processing this data, real-time control of the power system is achieved, ensuring its safety, reliability, efficiency, and energy conservation. However, data collection, analysis, transmission, and display face serious security challenges.

[0004] Among them, on the data collection side, in order to meet the diverse data collection needs of the power generation side, the transmission and distribution side, and the power consumption side, it is necessary to develop and deploy multiple collection systems based on multiple platforms on the Internet, which expands the attack surface; on the data display side and the upstream and downstream of data processing, data leakage caused intentionally or unintentionally by privileged users and suppliers is difficult to prevent; and because power production and dispatching have high requirements for stability, once maliciously contaminated data enters the digital power grid environment, it will cause serious damage to the power grid facilities, so urgent requirements are put forward for the security of data transmission. Summary of the Invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology, to solve the security problems such as data header information being tampered with or intercepted when only the data body is encrypted, and to solve the problem that the receiving end cannot determine the time when the received ciphertext is decrypted.

[0006] Technical solution: A method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology, including the following steps:

[0007] S1: The client establishes a communication connection with the server. The server identifies the security of the client by setting up a network IP whitelist.

[0008] S2, transmits the double-encrypted application layer data to the client via the MMS service based on the 5G air interface protocol;

[0009] S3: The client uses a double decryption algorithm to decrypt the ciphertext data and parse the decrypted plaintext data.

[0010] Furthermore, when the client wants to establish a communication link with the server, the server needs to detect whether the command source IP matches the client whitelist IP in its own setting parameters after receiving the TCP handshake command:

[0011] If they do not match, the communication link is refused to be established;

[0012] If they match, the communication link is established normally.

[0013] Furthermore, the double encryption is to encrypt the AES key of the AES algorithm using the asymmetric encryption algorithm RSA, and the implementation steps are as follows:

[0014] S21, the encryption end encrypts the original information with the AES key and encrypts the AES key with the asymmetric encryption algorithm RSA public key;

[0015] S22 uses the APK signature to verify the legitimacy of the so library call and implements the secure transmission of formatted string data;

[0016] S23, fixed transmission data size, set network IP whitelist.

[0017] Furthermore, the original information includes a message header and a message body; the message header and the message body are both composed of binary 0 and 1 characters, the binary string of the message header is located at the beginning of the message, and the message header is composed of an address code; the address code is a byte used to indicate the address of the terminal device specified by the user.

[0018] Furthermore, in step S22, the RSA public key and private key of the Android side are placed in the native layer, compiled to form a so dynamic link library, and the corresponding Java interface is opened for the upper-layer application to call; when the apk signature is inconsistent with its own signature, calling the so library will directly crash.

[0019] Furthermore, in step S23, in the plaintext stage, 1 kB is used as a fixed data size. If the data size exceeds 1 kB, packet splitting is performed; if the data size is less than 1 kB, data padding is performed.

[0020] Compared with the prior art, the present invention has the following significant effects:

[0021] 1. Data transmission encryption and decryption technology based on symmetric block encryption (AES) technology. The encryption end encrypts the original information with the AES key and uses the asymmetric RSA public key to encrypt the AES key, forming a double encryption of the plaintext data. The decryption end uses the RSA private key to decrypt the AES key and decrypts the original information with the AES key. At the same time, the APK signature is used to verify the legitimacy of the SO library call. This double encryption method realizes the secure transmission of formatted string data. Compared with traditional encryption and decryption algorithms, the data encryption and decryption speed is slightly improved and more balanced, the security is also improved, and the computational efficiency is superior to the original algorithm.

[0022] 2. Increase the security of network transmission by double encryption of transmitted data and matching settings of the transmission target network IP whitelist.

[0023] 3. Using AES and RSA dual encryption methods to encrypt the data header and data body at the same time, it can solve the security issues such as data header information being tampered or intercepted when only the data body is encrypted;

[0024] 4. During the data transmission process of the power system, the plaintext data is split or padded to fix its transmission size to 1kB, which can solve the problem that the receiving end cannot determine the time when the received ciphertext is decrypted. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the AES encryption and decryption process;

[0026] Figure 2 This is a schematic diagram of the encryption and decryption process of the AES key;

[0027] Figure 3 This is a flowchart of the whitelist function;

[0028] Figure 4 Schematic diagram of the encryption and decryption process of the application layer protocol. DETAILED DESCRIPTION

[0029] The present invention will be described in further detail below with reference to the accompanying drawings and specific implementations.

[0030] In power systems, the transmission principles and processes of MMS (Manufacturing Message Specification) messages are primarily based on the IEC 61850 standard, a globally accepted standard for power system automation. MMS messages are primarily used to transmit information between the station control layer and the bay layer, including customized information, waveform recordings, and other less real-time information.

[0031] The MMS message transmission process can be divided into the following steps:

[0032] A1) Establishing a TCP connection: First, the backend, acting as a 61850 client, requests a TCP connection from the device (acting as a 61850 server). This process follows the three-way handshake protocol, where the client sends a SYN request, the server responds with a SYN-ACK confirmation, and the client sends another ACK to complete the connection.

[0033] A2) Encapsulating MMS Messages: After a TCP connection is established, MMS messages are encapsulated within TCP messages for transmission. The MMS message structure consists of three layers: TPKT (Transport Protocol Data Unit), COTP (Connection Management Protocol), and MMS (Most Commonly Used Messaging). TPKT represents the Transport Protocol Data Unit (TPDU), COTP represents the Connection Management Protocol (CMP), and MMS represents the actual data content.

[0034] A3) Data Transmission: MMS messages are transmitted over the network to the target device. During transmission, MMS messages can contain various types of data, such as device parameter settings, real-time data, and monitoring information. This data is managed using object-oriented modeling technology to ensure interoperability between devices from different manufacturers.

[0035] A4) Receiving and Parsing: After receiving the MMS message, the target device parses and processes it. The parsing process includes analyzing the message structure byte by byte to extract the required data and control information.

[0036] A5) Response and Acknowledgement: If necessary, the target device generates a corresponding response message and returns it to the client through the same path. The response message also follows the structure of the MMS protocol to ensure the reliability and consistency of communication.

[0037] The MMS message transmission process involves multiple layers of protocols, from TCP / IP to COTP and then to MMS. Each step ensures the correct transmission and processing of data. This layered communication mechanism enables MMS to effectively support the complex information exchange requirements of power systems.

[0038] In power systems, data transmission between clients and servers uses a data frame format, with the transmission sequence being a binary byte stream. Integer, long integer, and floating-point data are stored with the low-order byte first and the high-order byte last. Transmitted MMS messages consist of a header and a body. The header contains basic message information, such as the message length, version number, source address, and destination address. This information is crucial for parsing and processing the message, ensuring that data is correctly transmitted and received across the network. The body contains the actual data content, which can include device status information, control commands, waveform recordings, and more. The structure and content of the body depend on the specific application scenario and requirements. For example, in a smart substation, MMS messages can be used to receive control commands, switch control, and gear adjustment operations.

[0039] The present invention adopts data transmission encryption and decryption technology based on symmetric block encryption AES technology, uses AES key to encrypt original information, namely message header and message body, and uses asymmetric encryption RSA public key to encrypt AES key. At the same time, APK signature is used to verify the legitimacy of SO library call, and the transmission size is fixed at 1kb. A network IP whitelist is set to realize data encryption and secure transmission.

[0040] Step 1: The encryption end encrypts the original information (message header and message body) with the AES key and encrypts the AES key with the asymmetric encryption algorithm RSA public key;

[0041] The message header and message body are both composed of binary 0s and 1s. During data transmission, the header and body together form a binary string. This binary string is located at the beginning of the message and typically consists of an address code, a single byte (8-bit binary code) that identifies the user-specified terminal device. Therefore, using the symmetric AES algorithm to encrypt the binary strings that identify the header and body encrypts the original data transmission information.

[0042] The key length of the symmetric encryption AES algorithm is flexible and supports multiple lengths. When the key length is 128 bits, the number of encryption rounds is 10. The AES encryption and decryption process of data is as follows: Figure 1 shown.

[0043] Let E be the AES encryption function. Then the encryption formula is C = E(K, P), where P is the plaintext, K is the key, and C is the ciphertext. The encryption process: Input a plaintext block and a 128-bit key. The plaintext block is represented as a state matrix, and the key is represented as a byte matrix. Then, perform 10 rounds of E to obtain the ciphertext.

[0044] The steps of the AES algorithm are as follows:

[0045] B1) Byte Replacement

[0046] Each element in the state matrix is ​​replaced with a new element through a table lookup (S-box). The upper 4 bits of each byte in the state matrix are used as the row index, and the lower 4 bits as the column index. The corresponding element in the S-box is then retrieved as the output. This step provides the AES algorithm with nonlinear transformation capabilities. During the construction of the S-box, the combination of a reversible affine transformation matrix and multiplicative inverses can prevent common algebraic attacks.

[0047] B2) Row Shift

[0048] Row shift is to perform a left circular shift on the state matrix. When the key length is 128 bits, the state matrix is ​​left shifted by 0B, 1B, 2B, and 3B from row 0 to row 3 respectively.

[0049] B3) Column confusion

[0050] The basic field of AES is the finite field GF(28). Each column of the input state matrix can be regarded as a polynomial on the basic field, and it is multiplied with a fixed polynomial C(x) = {03}x3 + {01}x2 + {01}x + {02}, and finally the modulo m(x) = x4 + 1 is taken.

[0051] B4) Round key addition

[0052] Complicating key expansion is an important step in ensuring the security of the algorithm. The round key addition operation is to perform a bit-by-bit XOR operation on the round key and the state matrix. Each subsequent round key is obtained through key expansion. When the key length is 128 bits, the AES encryption algorithm iterates 10 rounds and generates 11 sub-keys.

[0053] Due to the frequent data exchange between the front-end and back-end, the AES algorithm is used to encrypt data strings to ensure the speed of encryption and decryption during data exchange. During the encryption and decryption process, since the AES algorithm key is likely to be leaked, how to securely transmit the key to the decryption end is a major issue.

[0054] The present invention uses the asymmetric encryption algorithm RSA to encrypt the AES key of the AES algorithm. The encryption and decryption process is as follows: Figure 2 As shown, the implementation steps are as follows:

[0055] The encryption end encrypts the original information with the AES key, encrypts the AES key with the asymmetric encryption algorithm RSA public key, and formats the processed key and ciphertext into formatted data, which is transmitted to the decryption end; the decryption end obtains the data sent by the sender, parses the undecrypted AES key and ciphertext data, uses the RSA private key to decrypt the encrypted AES key to obtain the AES key, and uses the AES key to decrypt the original information.

[0056] Step 2: Use the APK signature to verify the legitimacy of the so library call to achieve secure transmission of formatted string data;

[0057] Due to the open source nature of the Android system, the storage of RSA keys is at risk of system root permission cracking and APK installation package cracking and leakage. Therefore, the present invention places the RSA public and private keys of the Android end in the native layer, forms a .so dynamic link library after compilation, and opens the corresponding Java interface to provide it to the upper application call. This can ensure the speed of encryption and decryption, while also increasing the difficulty of the dynamic link library .so being decompiled and cracked. In addition, to prevent the .so file from being stolen and repackaged, the .so library call legitimacy is verified by using the .apk signature. When the .apk signature is inconsistent with its own signature, calling the .so library will directly crash. Using double encryption means, the secure transmission of formatted string data is achieved.

[0058] The present invention conducted five sets of tests on a 128-bit character string. By analyzing the experimental results, it can be seen that compared with the traditional AES algorithm, the optimized dual encryption algorithm has a slightly improved data encryption and decryption speed. The encryption speed can be increased by about 21%, and the decryption speed can be increased by about 26%. In addition, the encryption and decryption speeds are more balanced, which has more advantages in computing efficiency than the original algorithm.

[0059] Step 3: Fixed the transmission data size to 1kb, set the network IP whitelist, and implement data encryption and secure transmission;

[0060] TCP is an IP-based transport layer protocol characterized by being connection-oriented and reliable. TCP is the most important transport protocol in the TCP / IP architecture. A TCP transport connection must be established first. Each TCP transport connection can only have one sender and one receiver, so only point-to-point data transmission is possible. After the data transmission is completed, the established TCP transport connection must be released. During the data transmission process, the data transmission unit of TCP is the traditional "data segment." Since the data segment size is determined by the size of the message sent by the application layer and the size of the MTU (Maximum Transmission Unit) in the network, the size of the TCP segment sent each time is not fixed.

[0061] During TCP transmission, the MSS (Maximum Segment Size) is used to determine whether a packet needs to be segmented. When the size of a packet sent by the application layer exceeds the MSS, the packet needs to be segmented. TCP determines the number of TCP segments that can be sent at a time based on the currently available "send window size." If the data sent by the application process to the TCP buffer is too long, TCP may segment it. If the data passed to the TCP buffer is too short, TCP will not process it until the buffer has enough data before assembling it into a single segment for transmission.

[0062] When encrypting application-layer user data, the present invention employs a method that encrypts both the header and the body of the message to prevent security issues such as tampering or interception of message header information, which can occur when only the body of the message is encrypted. However, if information such as the length of the data in the header is sent as ciphertext, the ciphertext length cannot be determined, and the receiving end cannot determine when the received ciphertext was decrypted. Therefore, for streaming protocols such as TCP, the present invention adopts a fixed transmission size approach.

[0063] In addition to encrypting plain text data and organizing it into ciphertext data for transmission, the 860 server should also identify the security of the 860 client by setting up a network IP whitelist. The whitelist process is as follows Figure 3 shown.

[0064] When an 860 client wants to establish a communication link with an 860 server, the server needs to detect whether the command source IP matches the client whitelist IP in its own setting parameters after receiving the TCP handshake command. If not, it will refuse to establish the communication link; if so, it will establish the communication link normally and transmit the double-encrypted application layer data ciphertext to the 860 client through the MMS service based on the 5G air interface protocol. The 860 client uses the double decryption algorithm studied in this paper to decrypt the ciphertext data and parse the decrypted plaintext data, which is applied to mobile writing application modules such as virtual LCD and site area network topology.

[0065] In this embodiment, according to the characteristics of AES encryption, when encrypting plaintext, it is in the form of groups, and each group size is 16 bytes. When the data size of a group is less than 16 bytes, the data is padded. Therefore, the present invention sets the TCP transmission fixed size value to 1kB. The data encryption and decryption process is as follows Figure 4 shown.

[0066] In the plaintext stage, the data size is fixed at 1kB. If the data size exceeds 1kB, the packet is split. If the data size is less than 1kB, data padding is performed. A double encryption method is used to encrypt the message header and message body at the same time. When the data received by the receiving end is a fixed size of 1kB, it can be decrypted to achieve data encryption and secure transmission.

Claims

1. A method for encrypting and decrypting power grid data transmission based on symmetric block encryption AES technology, characterized in that: The steps are as follows: S1: The client establishes a communication connection with the server. The server identifies the security of the client by setting up a network IP whitelist. S2, transmits the double-encrypted application layer data to the client via the MMS service based on the 5G air interface protocol; S3: The client uses a double decryption algorithm to decrypt the ciphertext data and parse the decrypted plaintext data. The double encryption is to encrypt the AES key of the AES algorithm using the asymmetric encryption algorithm RSA, and the implementation steps are as follows: S21, the encryption end encrypts the original information with the AES key and encrypts the AES key with the asymmetric encryption algorithm RSA public key; S22 uses the APK signature to verify the legitimacy of the SO dynamic link library call to achieve secure transmission of formatted string data; S23, fixed transmission data size, set network IP whitelist; The original information includes a message header and a message body; the message header and the message body are both composed of binary 0 and 1 characters, the binary string of the message header is located at the beginning of the message, and the message header is composed of an address code; the address code is a byte used to indicate the address of the terminal device specified by the user; In step S22, the RSA public key and private key of the Android side are placed in the native layer, compiled to form a so dynamic link library, and the corresponding Java interface is opened for the upper-layer application to call; when the apk signature is inconsistent with its own signature, calling the so dynamic link library will directly crash.

2. The power grid data transmission encryption and decryption method based on the symmetric block encryption AES technology according to claim 1 is characterized in that: When the client wants to establish a communication link with the server, the server needs to detect whether the command source IP matches the client whitelist IP in its own settings after receiving the TCP handshake command: If they do not match, the communication link is refused to be established; If they match, the communication link is established normally.

3. The power grid data transmission encryption and decryption method based on the symmetric block encryption AES technology according to claim 1 is characterized in that: In step S23, in the plaintext stage, 1 kB is used as a fixed data size. If the data size exceeds 1 kB, packet splitting is performed; if the data size is less than 1 kB, data padding is performed.

Images