SM9-based security gateway group communication method and device for nuclear power DCS (Distributed Control System)

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an SM9-based security gateway group communication method and device for a nuclear power DCS (Distributed Control System). According to the invention, an asymmetric group key negotiation algorithm is constructed based on a batch multi-signature method. The gateways in the group have the same public key, and each gateway in the group has different private keys; any member outside the group can send an encrypted message to the group through the group public key, and each intra-group gateway can decrypt and obtain a decrypted message by using the own private key. Under the application scene of large-scale group communication of the nuclear power DCS, the problem of low efficiency of a one-to-one SM9 key negotiation algorithm can be effectively solved, the real-time requirement of the nuclear power DCS is effectively met, and the confidentiality of the nuclear power DCS is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and in particular relates to a secure gateway group communication method and device based on SM9 for a nuclear power DCS system. Background Art

[0002] Nuclear power is a national strategic industry in my country's energy industry, and nuclear power DCS systems have more stringent safety requirements. Once a nuclear power network security accident occurs, in addition to affecting production operations, it may also cause environmental pollution and personnel radiation hazards, and further affect the global nuclear power industry.

[0003] At present, the defense measures against network attacks on nuclear power DCS systems include anomaly detection, whitelist protection strategies, etc., but these methods cannot guarantee the security of DCS system communications from the bottom up.

[0004] Considering that the underlying code of the nuclear power DCS system is not easy to change, the current protection measures for the inherent security of the nuclear power DCS system are mainly to add a security gateway and apply the national secret algorithm SM2, SM4 or SM9 algorithm to encrypt and decrypt communication messages to ensure communication confidentiality, and use SM2, SM3 or SM9 algorithm to ensure the integrity of communication messages.

[0005] In the related technologies, the application research of national secret key negotiation algorithm in one-to-one security gateway communication scenario is relatively mature. If only one-to-one key negotiation algorithm is used for integrated application in group security gateway communication scenario, the system communication overhead will increase greatly with the increase of gateways in the group. Therefore, it is necessary to study the group key negotiation algorithm in group security gateway communication to improve the efficiency of group key negotiation. Summary of the invention

[0006] In order to overcome the problems existing in the related art, a secure gateway group communication method and device based on SM9 for a nuclear power DCS system are provided.

[0007] According to one aspect of an embodiment of the present disclosure, a secure gateway group communication method based on SM9 for a nuclear power DCS system is provided, the method comprising:

[0008] Step 1: Obtain the master public key P selected by the key generation center KGC pub and the master private key ks, and the gateway ID for each group i Generate private key sk i , i is the sequence number of the gateway in the group, 1≤i≤n, n is the number of gateways in the group;

[0009] Step 2, each ID i Using sk i Determine the ID i Gateway public key pk i; Use each pk i , P pub , ks generates the first public key PK of the group, using each pk i , P pub , ks and each ID i Randomly generated random number r i , generate the second public key R of the group, each ID i The information sent is encrypted using PK and R;

[0010] Step 3, each ID i Use the group's public messages j and r i Determine batch multi-signatures i,j ,1≤j≤n, when i=j, s i,j =s i,i ,s i,i Not publicly released, when i≠j, s i,j Post publicly in the group;

[0011] Step 4: For each ID i Use public s j,i And the secrets kept by oneself i,i , determine the ID i The decryption key d i , d i For this ID i Decrypt the received encrypted information.

[0012] In a possible implementation, the method further includes:

[0013] Step 5: When a gateway outside the group joins the group, repeat steps 1 to 2 for the gateway outside the group and each gateway inside the group to update PK and R, and then use steps 3 to 4 to update the decryption key of the gateway outside the group.

[0014] In a possible implementation, in step 5, when multiple gateways outside the group have joined the group, steps 1 to 2 are repeated for the multiple gateways outside the group and each gateway within the group to update PK and R, and then steps 3 to 4 are used to update the decryption key of each gateway in the current group.

[0015] In a possible implementation, the method further includes: step 6, when a gateway within the group leaves the group, repeating steps 1 to 2 for each remaining gateway in the group to update PK and R, and then using steps 3 to 4 to update the decryption keys of the remaining gateways within the group.

[0016] According to another aspect of an embodiment of the present disclosure, a secure gateway group communication device based on SM9 for a nuclear power DCS system is provided, the device comprising:

[0017] Configuration module, used to obtain the master public key P selected by the key generation center KGC pub and the master private key ks, and the gateway ID for each group i Generate private key sk i , i is the sequence number of the gateway in the group, 1≤i≤n, n is the number of gateways in the group;

[0018] The first generation module is used to control each ID i Using sk i Determine the ID i Gateway public key pk i ; Use each pk i , P pub , ks generates the first public key PK of the group, using each pk i , P pub , ks and each ID i Randomly generated random number r i , generate the second public key R of the group, each ID i The information sent is encrypted using PK and R;

[0019] The second generation module is used to control each ID i Use the group's public messages j and r i Determine batch multi-signatures i,j ,1≤j≤n, when i=j, s i,j =s i,i ,s i,i Not publicly released, when i≠j, s i,j Post publicly in the group;

[0020] The third generation module is used to control each ID i Use public s j,i And the secrets kept by oneself i,i , determine the ID i The decryption key d i , d i For this ID i Decrypt the received encrypted information.

[0021] In a possible implementation manner, the device further includes:

[0022] The adding and updating module is used to repeat steps 1 to 2 to update PK and R for the gateway outside the group and each gateway inside the group when the gateway outside the group joins the group, and then use steps 3 to 4 to update the decryption key of the gateway outside the group.

[0023] In one possible implementation, in the adding update module, when multiple gateways outside the group are added to the group, the configuration module and the first generation module are executed for the multiple gateways outside the group and the gateways within each group to update PK and R, and then the second generation module and the third generation module are executed to update the decryption key of each gateway in the current group.

[0024] In a possible implementation, the device also includes: a push update module, which is used to execute the configuration module and the first generation module to update PK and R for each remaining gateway in the group when the gateway in the group leaves the group, and then execute the second generation module and the third generation module to update the decryption keys of the remaining gateways in the group.

[0025] According to another aspect of an embodiment of the present disclosure, a secure gateway group communication device based on SM9 for a nuclear power DCS system is provided, the device comprising:

[0026] processor;

[0027] a memory for storing processor-executable instructions;

[0028] Wherein, the processor is configured to execute the above method.

[0029] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0030] The beneficial effects of the present disclosure are as follows: the present disclosure provides a nuclear power DCS system based on SM9's secure gateway group communication device, which constructs an asymmetric group key negotiation algorithm based on a batch multi-signature method. The gateways in the group have the same public key, and each gateway in the group has a different private key; any member outside the group can send an encrypted message to the group through the group public key, and each gateway in the group can use its own private key to decrypt and obtain the decrypted message. In the application scenario of large-scale group communication of nuclear power DCS, it can effectively solve the problem of low efficiency of the one-to-one SM9 key negotiation algorithm, effectively meet the real-time requirements of the nuclear power DCS system, and ensure the confidentiality of the nuclear power DCS system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of a secure gateway group communication method based on SM9 for a nuclear power DCS system shown in an embodiment of the present disclosure.

[0032] Figure 2 It is a block diagram of a secure gateway group communication device based on SM9 for a nuclear power DCS system shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The present disclosure is further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0034] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0035] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0036] Figure 1 Schematic diagram of a secure gateway group communication method based on SM9 for a nuclear power DCS system shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, or a laptop computer. The embodiment of the present disclosure does not limit the type of the terminal device. Figure 1 As shown, the method includes:

[0037] Step 1: Obtain the master public key P selected by the key generation center KGC pub and the master private key ks, and the gateway ID for each group i Generate private key sk i , i is the sequence number of the gateway in the group, 1≤i≤n, and n is the number of gateways in the group.

[0038] Step 2, each ID i Using sk i Determine the ID i Gateway public key pk i ; Use each pk i , P pub , ks generates the first public key PK of the group, using each pki , P pub ,ks and each ID i Randomly generated random number r i , generate the second public key R of the group, and any node sends it to each ID i The information is encrypted with PK and R. The use of the first public key and the second public key ensures the dynamic and random nature of the public key, effectively protects information security, and enables members outside the group to use the group public key PK and R to send messages to the group without joining the group. After receiving the encrypted message, the gateway in the group can use its own decryption key d i Identify the original message.

[0039] Step 3, each ID i Use the group's public messages j and r i Determine batch multi-signatures i,j ,1≤j≤n, when i=j, s i,j =s i,i ,s i,i Not publicly released, when i≠j, s i,j Public release.

[0040] Step 4: For each ID i Use public s j,i , and the secrets stored by itself i,i Determine the ID i The decryption key d i , d i For this ID i Decrypt the received encrypted information.

[0041] Through multiple iterations of steps 3 and 4, the private key is dynamically calculated through the multiple signatures of the gateways in the group, making the private key of each gateway in the group difficult to crack, effectively improving the privacy and randomness of the private key of each gateway in the group.

[0042] Step 5: When a gateway outside the group joins the group, repeat steps 1 to 2 for the gateway outside the group and each gateway inside the group to update PK and R, and then use steps 3 to 4 to determine the decryption key of the gateway outside the group. For example, when multiple gateways outside the group join the group, repeat steps 1 to 2 for the multiple gateways outside the group and each gateway inside the group to update PK and R, and then use steps 3 to 4 to update the decryption key of each gateway in the current group.

[0043] Step 6: When the intra-group gateway leaves the group, repeat steps 1 to 2 for each remaining intra-group gateway in the group to update PK and R, and then use steps 3 to 4 to update the decryption keys of the remaining intra-group gateways.

[0044] Through steps 5 and 6, gateways in the group can dynamically leave and external members can dynamically join; and

[0045] According to another aspect of an embodiment of the present disclosure, a secure gateway group communication device based on SM9 for a nuclear power DCS system is provided, the device comprising:

[0046] Configuration module, used to obtain the master public key P selected by the key generation center KGC pub and the master private key ks, and the gateway ID for each group i Generate private key sk i , i is the sequence number of the gateway in the group, 1≤i≤n, n is the number of gateways in the group;

[0047] The first generation module is used to control each ID i Using sk i Determine the ID i Gateway public key pk i ; Use each pk i , P pub , ks generates the first public key PK of the group, using each pk i , P pub , ks and each ID i Randomly generated random number r i , generate the second public key R of the group, each ID i The information sent is encrypted using PK and R;

[0048] The second generation module is used to control each ID i Use the group's public messages j and r i Determine batch multi-signatures i,j ,1≤j≤n, when i=j, s i,j =s i,i ,s i,i Not publicly released, when i≠j, s i,j Post publicly in the group;

[0049] The third generation module is used to control each ID i Use public s j,i And the secrets kept by oneself i,i , determine the ID i The decryption key d i , d i For this ID i Decrypt the received encrypted information.

[0050] In a possible implementation manner, the device further includes:

[0051] The adding and updating module is used to repeat steps 1 to 2 to update PK and R for the gateway outside the group and each gateway inside the group when the gateway outside the group joins the group, and then use steps 3 to 4 to update the decryption key of the gateway outside the group.

[0052] In one possible implementation, in the adding update module, when multiple gateways outside the group are added to the group, the configuration module and the first generation module are executed for the multiple gateways outside the group and the gateways within each group to update PK and R, and then the second generation module and the third generation module are executed to update the decryption key of each gateway in the current group.

[0053] In a possible implementation, the device also includes: a push update module, which is used to execute the configuration module and the first generation module to update PK and R for each remaining gateway in the group when the gateway in the group leaves the group, and then execute the second generation module and the third generation module to update the decryption keys of the remaining gateways in the group.

[0054] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0055] Figure 2 1900 is a block diagram of a secure gateway group communication device based on SM9 for a nuclear power DCS system according to an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0056] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0057] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0058] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0059] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0060] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0061] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0062] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0063] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0064] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0065] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0066] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A secure gateway group communication method based on SM9 for a nuclear power DCS system, characterized in that: The method comprises: Step 1: Obtain the master public key P selected by the key generation center KGC pub and the master private key ks, and the gateway ID for each group i Generate private key sk i , i is the sequence number of the gateway in the group, 1≤i≤n, n is the number of gateways in the group; Step 2, each ID i Using sk i Determine the ID i Gateway public key pk i ; Use each pk i , P pub , ks generates the first public key PK of the group, using each pk i , P pub , ks and each ID i Randomly generated random number r i , generate the second public key R of the group, and any node sends it to each ID i The information is encrypted using PK and R; Step 3, each ID i Use the group's public messages j and r i Determine batch multi-signatures i,j ,1≤j≤n, when i=j, s i,j =s i,i ,s i,i Not publicly released, when i≠j, s i,j Post publicly in the group; Step 4: For each ID i Use public s j,i And the secrets kept by oneself i,i , determine the ID i The decryption key d i , d i For this ID i Decrypt the received encrypted information.

2. The method according to claim 1, characterized in that The method further comprises: Step 5: When a gateway outside the group joins the group, repeat steps 1 to 2 for the gateway outside the group and each gateway inside the group to update PK and R, and then use steps 3 to 4 to update the decryption key of the gateway outside the group.

3. The method according to claim 2, characterized in that In step 5, when multiple out-of-group gateways have joined the group, steps 1 to 2 are repeated for the multiple out-of-group gateways and each in-group gateway to update PK and R, and then steps 3 to 4 are used to update the decryption key of each out-of-group gateway in the multiple out-of-group gateways.

4. The method according to claim 1, characterized in that: The method further includes: step 6, when a gateway in the group leaves the group, repeating steps 1 to 2 for each remaining gateway in the group to update PK and R, and then using steps 3 to 4 to update the decryption keys of the remaining gateways in the group.

5. A secure gateway group communication device based on SM9 for a nuclear power DCS system, characterized in that: The device comprises: Configuration module, used to obtain the master public key P selected by the key generation center KGC pub and the master private key ks, and the gateway ID for each group i Generate private key sk i , i is the sequence number of the gateway in the group, 1≤i≤n, n is the number of gateways in the group; The first generation module is used to control each ID i Using sk i Determine the ID i Gateway public key pk i ; Use each pk i , P pub , ks generates the first public key PK of the group, using each pk i , P pub ,ks and each ID i Randomly generated random number r i , generate the second public key R of the group; The second generation module is used to control each ID i Use the group's public messages j and r i Determine batch multi-signatures i,j ,1≤j≤n, when i=j, s i,j =s i,i ,s i,i Not publicly released, when i≠j, s i,j Post publicly in the group; The third generation module is used to control each ID i Use public s j,i And the secrets kept by oneself i,i , determine the ID i The decryption key d i .

6. The device according to claim 1, characterized in that The device also includes: The adding and updating module is used to repeat steps 1 to 2 to update PK and R for the gateway outside the group and each gateway inside the group when the gateway outside the group joins the group, and then use steps 3 to 4 to update the decryption key of the gateway outside the group.

7. The device according to claim 2, characterized in that In the join update module, when multiple out-of-group gateways have joined the group, the configuration module and the first generation module are executed for the multiple out-of-group gateways and each in-group gateway to update PK and R, and then the second generation module and the third generation module are executed to update the decryption key of each out-of-group gateway in the multiple out-of-group gateways.

8. The device according to claim 1, characterized in that The device also includes: a push update module, which is used to execute the configuration module and the first generation module to update PK and R for each remaining gateway in the group when the gateway in the group leaves the group, and then execute the second generation module and the third generation module to update the decryption keys of the remaining gateways in the group.

9. A secure gateway group communication device based on SM9 for a nuclear power DCS system, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 4.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images