Communication method and communication system

Abstract

The invention provides a communication method and a communication system. The communication method comprises the following steps: generating a client key pair according to a communication scene; negotiating with a server through an elliptic curve algorithm to generate a shared key; generating a client symmetric encryption key based on the shared key, the random number and the timestamp; encrypting the client request based on the client symmetric encryption key to generate first encrypted data, and sending the first encrypted data to the server; and receiving second encrypted data sent by the server, and decrypting the second encrypted data based on the symmetric encryption key of the client to obtain response data. In the mode, an efficient and lightweight encryption communication mechanism can be established between the server and the client, so that confidentiality, integrity and authenticity of data transmission are realized, eavesdropping, tampering and disguise attacks are effectively resisted, the security and reliability of server communication are improved, and meanwhile, the performance requirements of resource-constrained equipment are met.

Description

Technical Field

[0001] The present invention relates to the technical field of secure communications, and in particular to a communication method and a communication system. Background Art

[0002] With the rapid development of smart grids, service terminals (such as energy meters, concentrators, and collectors) are gradually connected to the Internet to achieve remote data collection, control, and management. However, traditional communication protocols lack a complete security mechanism and are vulnerable to data eavesdropping, tampering, and masquerade attacks, resulting in user privacy leaks and increased grid operation risks.

[0003] Existing encrypted communication methods usually use symmetric encryption or RSA public key system. Although symmetric encryption is efficient, the key distribution is complex and vulnerable to eavesdropping risks. Although RSA (asymmetric encryption algorithm) has high security, its high computational complexity and long key length make it difficult to meet the requirements of resource-constrained devices such as servers. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a communication method and a communication system, which can realize efficient key negotiation and data signature verification between the service end and the server, so as to ensure the confidentiality, integrity and authenticity of the communication data, and then effectively resist eavesdropping, tampering and spoofing attacks, and improve the security and reliability of server-side communications.

[0005] In the first aspect, an embodiment of the present invention provides a communication method, which is applied to a client, and the method includes: generating a client key pair according to a communication scenario; generating a shared key through negotiation with a server through an elliptic curve algorithm; generating a client symmetric encryption key based on the shared key, a random number and a timestamp; encrypting a client request based on the client symmetric encryption key, generating first encrypted data, and sending the first encrypted data to the server; receiving second encrypted data sent by the server, decrypting the second encrypted data based on the client symmetric encryption key, and obtaining response data; wherein the second encrypted data is obtained by the server processing the first encrypted data based on the server symmetric encryption key; the client symmetric encryption key is the same as the server symmetric encryption key.

[0006] Furthermore, the step of generating a client key pair according to the communication scenario includes: identifying the communication scenario; if the communication scenario is a temporary high-security scenario, generating a client temporary key pair; if the communication scenario is a low-frequency communication scenario or a short-term communication scenario, using a pre-set client static key pair; if the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, the client uses the client static key pair.

[0007] Furthermore, the step of generating a temporary client key pair includes: generating a first random number through a client random number generator as a temporary client private key; generating a temporary client public key based on the temporary client private key and an elliptic curve point operation; the temporary client public key is the product of the temporary client private key and an elliptic curve base point; and sending the temporary client public key to the server.

[0008] Furthermore, the client key pair includes a client public key and a client private key; the server key pair corresponding to the server includes a server public key and a server private key; the step of generating a client symmetric encryption key based on a shared key, a random number and a timestamp includes: receiving a server public key sent by the server; calculating a first shared key based on the server public key and the client private key through an elliptic curve algorithm; the first shared key is a point multiplication result of the server public key and the client private key; receiving a first verification value and a third random number sent by the server, wherein the first verification value is generated by the server based on a preset encryption algorithm, the third random number and the second shared key; calculating a first shared key based on the preset encryption algorithm, the third random number and the second shared key; calculating a first shared key based on an elliptic curve algorithm, the first verification value and the third random number; Three random numbers and a first shared key are used to generate a second verification value, and it is determined whether the second verification value is the same as the first verification value; if the second verification value is the same as the first verification value, a fourth random number is generated by a client random number generator, and a third verification value is generated based on a preset encryption algorithm, a fourth random number and the first shared key, and the third verification value and the fourth random number are sent to the server, so that the server determines whether the fourth verification value is the same as the third verification value; the fourth verification value is generated by the server based on the preset encryption algorithm, the fourth random number and the second shared key; the verification information sent by the server when the fourth verification value is the same as the third verification value is received, and the first shared key is determined to be the shared key.

[0009] Furthermore, the step of generating a client symmetric encryption key based on a shared key, a random number and a timestamp includes: generating a fifth random number based on a client random number generator, and sending the fifth random number to the server; receiving a sixth random number sent by the server; and generating a client symmetric encryption key based on the shared key, the fifth random number, the sixth random number, the current timestamp and a preset encryption algorithm.

[0010] Furthermore, the client key pair includes a client public key and a client private key; based on the client symmetric encryption key, the client request is encrypting to generate first encrypted data, and the first encrypted data is sent to the server, including: generating an initial client request, and encapsulating the initial client request according to a preset data format to generate an encapsulated client request; based on the client private key and the elliptic curve data signature algorithm, a first signature pair is generated; based on the client symmetric encryption key and the symmetric encryption algorithm, the client request and the first signature pair are encrypting to generate first encrypted data, and the first encrypted data is sent to the server through a preset secure communication channel.

[0011] The communication method provided in the embodiment of the present application is applied to the client. The client and the server negotiate a shared key based on the elliptic curve algorithm, and generate a symmetric encryption key in combination with a random number and a timestamp. This can achieve efficient and secure encrypted communication, thereby ensuring the confidentiality, integrity and source credibility of data transmission, thereby improving the security and reliability of server communications.

[0012] In the second aspect, an embodiment of the present invention provides a communication method, which is applied to a server, and the method includes: generating a server key pair according to a communication scenario; generating a shared key through an elliptic curve algorithm and negotiation with the server; generating a server symmetric encryption key based on the shared key, a random number and a timestamp; receiving first encrypted data sent by a client, decrypting the received first encrypted data based on the server symmetric encryption key, obtaining a client request, and generating response data; encrypting the response data based on the server symmetric encryption key, generating second encrypted data, and sending the second encrypted data to the client; the server symmetric encryption key is the same as the client symmetric encryption key.

[0013] Furthermore, the step of generating a server key pair according to the communication scenario includes: identifying the communication scenario; if the communication scenario is a temporary high-security scenario, generating a server temporary key pair; if the communication scenario is a low-frequency communication scenario or a short-term communication scenario, generating a server temporary key pair; if the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, using a pre-set server static key pair.

[0014] The communication method provided in the embodiment of the present invention is applied to the server. By generating a key pair, negotiating a shared key and verifying the key consistency on the server, the client request can be securely received and decrypted on the server, thereby preventing man-in-the-middle attacks and data tampering, and further establishing a secure and reliable two-way communication mechanism to ensure that the response data on the server is credible.

[0015] In the third aspect, an embodiment of the present invention provides a communication method, including: the client and the server respectively generate a key pair according to the communication scenario; the client and the server negotiate to generate a shared key through an elliptic curve algorithm; the client and the server respectively generate symmetric encryption keys based on the shared key, a random number and a timestamp; the client encrypts the client request based on the symmetric encryption key, generates first encrypted data, and sends the first encrypted data to the server; the server decrypts the received first encrypted data based on the symmetric encryption key, obtains the client request, and generates response data; the server encrypts the response data based on the symmetric encryption key, generates second encrypted data, and sends the second encrypted data to the client; the client decrypts the received second encrypted data based on the symmetric encryption key to obtain response data.

[0016] The communication method provided in the embodiment of the present invention can fully guarantee the security of server-side communication by generating key pairs, negotiating shared keys and symmetric encryption keys on the client and server respectively, and realizing two-way data encryption communication, thereby avoiding data eavesdropping, tampering and spoofing attacks, and further providing strong support for secure data transmission in smart grids.

[0017] In a fourth aspect, an embodiment of the present invention provides a communication system, which is applied to a client, and the system includes: a client key pair generation module, which is used to generate a client key pair in a communication scenario; a client shared key generation module, which is used to negotiate with a server to generate a shared key through an elliptic curve algorithm; a client symmetric encryption key generation module, which is used to generate a client symmetric encryption key based on a shared key, a random number and a timestamp; a client encryption communication module, which is used to encrypt a client request based on the client symmetric encryption key, generate first encrypted data, and send the first encrypted data to the server; the client encryption communication module is also used to receive second encrypted data sent by the server, decrypt the second encrypted data based on the client symmetric encryption key, and obtain response data; wherein the second encrypted data is obtained by the server processing the first encrypted data based on the server symmetric encryption key; the client symmetric encryption key is the same as the server symmetric encryption key.

[0018] In the fifth aspect, an embodiment of the present invention provides a communication system, which is applied to a server, and the system includes: a server key pair generation module, which is used to generate a server key pair according to a communication scenario; a server shared key generation module, which is used to negotiate with the server to generate a shared key through an elliptic curve algorithm; a server symmetric encryption key generation module, which is used to generate a server symmetric encryption key based on the shared key, a random number and a timestamp; a server encryption communication module, which is used to receive first encrypted data sent by a client, decrypt the received first encrypted data based on the server symmetric encryption key, obtain a client request, and generate response data; the server encryption communication module is also used to encrypt the response data based on the server symmetric encryption key, generate second encrypted data, and send the second encrypted data to the client; the server symmetric encryption key is the same as the client symmetric encryption key.

[0019] The embodiment of the present invention provides a communication method and a communication system, in which an efficient and lightweight encryption communication mechanism can be established between a client and a server by adopting an elliptic curve algorithm (ECDH) for shared key negotiation and combining a random number and a timestamp to generate a symmetric encryption key, thereby achieving confidentiality, integrity and authenticity of data transmission, and further effectively resisting eavesdropping, tampering and spoofing attacks, improving the security and reliability of server communications, and meeting the performance requirements of resource-constrained devices.

[0020] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0021] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A flow chart of a communication method applied to a client provided by an embodiment of the present invention;

[0024] Figure 2 A flow chart of a communication method applied to a server provided in an embodiment of the present invention;

[0025] Figure 3 A flow chart of a communication method provided by an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of communication interaction between a client and a server in a temporary high-security scenario provided by an embodiment of the present invention;

[0027] Figure 5 A schematic diagram of communication interaction between a client and a server in a low-frequency communication scenario or a short-term communication scenario provided by an embodiment of the present invention;

[0028] Figure 6 A schematic diagram of communication interaction between a client and a server in a high-frequency communication scenario or a long-term stable communication scenario provided by an embodiment of the present invention;

[0029] Figure 7 A schematic diagram of a communication system applied to a client provided by an embodiment of the present invention;

[0030] Figure 8 A schematic diagram of a communication system applied to a server provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] To facilitate understanding of this embodiment, the embodiment of the present invention is described in detail below.

[0033] With the rapid development of smart grids, servers are gradually connected to the Internet, realizing remote data collection, remote control and management functions. However, traditional server communication protocols lack a complete security mechanism and are vulnerable to data eavesdropping, tampering and masquerade attacks, resulting in user privacy leakage and increased grid operation risks. Due to the resource-constrained nature of the server, higher requirements are placed on the performance and security of encryption communication technology.

[0034] Existing encryption communication methods mainly rely on symmetric encryption or RSA public key system, but both have shortcomings: symmetric encryption requires the distribution of keys in advance, which increases management complexity and is vulnerable to eavesdropping attacks; although RSA has high security, it is not suitable for resource-constrained server devices due to its large computational workload and long key length. Therefore, traditional encryption methods are difficult to meet the requirements of security and efficiency in smart grids at the same time.

[0035] In order to solve the above problems, the embodiments of the present application provide a method for effectively solving the problems of complex key distribution, lack of identity authentication and risk of data tampering by introducing asymmetric key negotiation (such as elliptic curve Diffie-Hellman algorithm) and digital signature technology (such as elliptic curve digital signature algorithm). The present application takes into account both efficiency and security, and is particularly suitable for the secure communication needs of resource-constrained devices such as service terminals in smart grids.

[0036] Figure 1 A flow chart of a communication method applied to a client provided in an embodiment of the present application.

[0037] Reference Figure 1 , the communication methods applied to the client include:

[0038] Step S101: Generate a client key pair according to the communication scenario.

[0039] Here, the client usually refers to the management server in the power grid management system, which is responsible for initiating communication requests, establishing connections with multiple servers, sending control commands or receiving server data.

[0040] The server refers to terminals such as electricity meters, concentrators and collectors in the power grid. As the receiver, it responds to requests from the management server, processes control commands and returns real-time data.

[0041] A key pair consists of a public key and a private key. The private key is used for encryption and signature, and the public key is used to negotiate a shared key.

[0042] In one embodiment, the step of generating a client key pair according to the communication scenario in step S101 includes the following steps S401-S404.

[0043] Step S401, identifying a communication scenario.

[0044] Here, according to different communication needs and security requirements, choose the appropriate key pair type to balance security and communication efficiency.

[0045] The communication scenario is pre-defined through system configuration or business requirements, and the current scenario is dynamically determined based on the communication frequency, data type or security requirements.

[0046] Communication scenarios include temporary high-security scenarios, low-frequency communication scenarios or short-term communication scenarios, and high-frequency communication scenarios or long-term stable communication scenarios.

[0047] Temporary high-security scenarios such as first communication, device initialization, and critical data transmission (such as configuration modification or sensitive commands). These scenarios require higher security to avoid long-term key exposure.

[0048] Low-frequency communication scenarios or short-term communication scenarios such as local maintenance and low-frequency data collection. Since the communication frequency is low and the efficiency requirement is low, static key pairs can be used.

[0049] High-frequency communication scenarios or long-term stable communication scenarios such as real-time data collection, long-term operation of the device and the connection between the management server. Frequent communication and high latency requirements are suitable for using static key pairs to improve efficiency.

[0050] Step S402: If the communication scenario is a temporary high-security scenario, a temporary key pair for the client is generated.

[0051] Here, the server generates a temporary key pair.

[0052] Step S403: If the communication scenario is a low-frequency communication scenario or a short-term communication scenario, a preset client static key pair is used.

[0053] Here, the server generates a temporary key pair. The client static key pair includes the client static public key Q J-client And the client static private key D J-client .

[0054] Step S404: If the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, the client uses a client static key pair.

[0055] Here, the server uses the pre-set server static key pair. The server static key pair includes the server static public key Q J-server and the server static private key D J-server .

[0056] Temporary key pairs are used to improve the security of short-term communication processes and avoid the risk of leakage caused by long-term use of keys.

[0057] When the device is initialized, the client has generated a static key pair, including a static private key and a static public key, which are securely stored in the client device. The static private key is only stored in the device and is not transmitted during the communication process to avoid leakage.

[0058] The client sends the client static public key in the client static key pair to the server.

[0059] In one embodiment, the step of generating a temporary client key pair includes the following steps S501-S503.

[0060] Step S501: Generate a first random number R1 through a client random number generator as a temporary private key of the client.

[0061] Here, a first random number R1 is generated by a client random number generator to ensure the randomness and uniqueness of the client temporary private key, to prevent the private key from being predicted or reused, and thus to improve security.

[0062] Use the client's built-in high-quality random number generator (such as a hardware random number generator or a pseudo-random number generator) to generate a random number. The generated random number must be within the finite field range of the elliptic curve to ensure that the generated key is legal and meets the requirements of the elliptic curve algorithm. If it is out of range, regenerate a random number.

[0063] Set the generated random number as the client's temporary private key D L-client The temporary private key is only used in this communication and will be destroyed immediately after the communication is completed to prevent leakage or reuse.

[0064] Step S502, based on the client temporary private key and the elliptic curve point operation, generate the client temporary public key; the client temporary public key is the product of the client temporary private key and the elliptic curve base point.

[0065] Here, the elliptic curve point multiplication operation is used to map the temporary private key to a point on the elliptic curve, thereby generating a temporary public key of the client.

[0066] Use predefined elliptic curve parameters, including the base point G and the modulus p of the finite field.

[0067] According to the formula: Q L-client =D L-client G, where Q L-client Temporary public key of the client.

[0068] Generated Q L-client It is a two-dimensional coordinate point representing a unique position on the elliptic curve.

[0069] Due to the one-way nature of the point multiplication operation, even if the attacker obtains Q L-client , and it is impossible to infer D L-client , thereby ensuring the security of the private key.

[0070] Step S503: Send the client's temporary public key to the server.

[0071] Here, the client sends the client's temporary public key to the server to complete the negotiation of the shared key. The encapsulated temporary public key is sent to the server through a preset secure communication channel (such as TLS (Transport Layer Security Protocol) or an encrypted channel) to ensure that the public key is not tampered with or intercepted during the transmission process.

[0072] Step S102: Generate a shared key through negotiation with the server using an elliptic curve algorithm.

[0073] Here, the client key pair includes the client public key and the client private key; the server key pair corresponding to the server includes the server public key and the server private key. The client key includes the client static key pair and the client temporary key pair, and the server key pair includes the server static key pair and the server temporary key pair. The client static key pair includes the client static public key Q J-client And the client static private key D J-client The server static key pair includes the server static public key Q J-server and the server static private key D J-server .

[0074] In one embodiment, step S102 includes the following steps S601 - S606 .

[0075] Step S601, receiving the server public key sent by the server.

[0076] Here, the server sends the public key of its key pair to the client through the communication channel.

[0077] After the client receives the server public key, it verifies its format and integrity based on ECDSA (Elliptic Curve Digital Signature Algorithm) to ensure that the server public key is a valid elliptic curve point.

[0078] Step S4602, based on the server public key and the client private key, calculate the first shared key through the elliptic curve algorithm; the first shared key is the point multiplication result of the server public key and the client private key.

[0079] Here, the first shared key S client =Server public key Q server Client private key D client .

[0080] Step S603: Receive a first verification value Y1 and a third random number R3 sent by the server, wherein the first verification value Y1 is a random number generated by the server based on a preset encryption algorithm, the third random number R3 and the second shared key S server Generated.

[0081] Here, the preset encryption algorithm is pre-set according to actual conditions, and may be a hash algorithm (HASH) or an AES-GCM encryption algorithm (Advanced Encryption Standard-Galois / Counter Mode, a highly efficient algorithm combining encryption and identity authentication).

[0082] The server generates a first verification value based on the second shared key, the third random number and the preset encryption algorithm: Y1 = HASH (S server ,R3).

[0083] Step S604: Generate a second verification value based on a preset encryption algorithm, a third random number and a first shared key, and determine whether the second verification value is the same as the first verification value.

[0084] Here, the client uses the first shared key S client and the third random number R3, and generates the second verification value Y2 through the same preset algorithm as the server: Y2 = HASH (S client ,R3).

[0085] The second verification value is compared with the received first verification value: if they are the same, the verification succeeds, indicating that the shared key is consistent; if they are different, the verification fails and the communication is terminated.

[0086] Step S605, if the second verification value is the same as the first verification value, generate a fourth random number through the client random number generator, generate a third verification value based on the preset encryption algorithm, the fourth random number and the first shared key, and send the third verification value and the fourth random number to the server so that the server determines whether the fourth verification value is the same as the third verification value; the fourth verification value is generated by the server based on the preset encryption algorithm, the fourth random number and the second shared key.

[0087] Here, the client uses a random number generator to generate the fourth random number R4 to ensure randomness and unpredictability. The third verification value Y3 is: Y3 = HASH (S client ,R4).

[0088] The third verification value and the fourth random number are sent to the server for verification by the server.

[0089] Step S606: Receive verification information sent by the server when the fourth verification value is the same as the third verification value, and determine that the first shared key is the shared key.

[0090] Here, the server uses the second shared key S client and the received fourth random number R4 to generate a fourth verification value Y4: Y4 = HASH (S server ,R4).

[0091] The server compares the generated fourth verification value Y4 with the received third verification value Y3: if they are the same, the verification is successful, indicating that the shared keys of both parties are consistent. If they are different, the verification fails and the communication is terminated.

[0092] After the server confirms that the fourth verification value Y4 is consistent with the third verification value Y3, it sends a verification success message to the client.

[0093] After receiving the verification information, the client determines the first shared key S client is the shared key S used for subsequent communications.

[0094] Step S103: Generate a client symmetric encryption key based on the shared key, the random number and the timestamp.

[0095] In one embodiment, the steps of step S103 include the following steps S701-S703.

[0096] Step S701: Generate a fifth random number R5 based on the client random number generator, and send the fifth random number R5 to the server.

[0097] Here, the client encapsulates the generated fifth random number R5 into a data packet and sends it to the server through a secure communication channel to ensure that the transmission process is not eavesdropped or tampered with.

[0098] Step S702: receiving a sixth random number R6 sent by the server.

[0099] Here, the server generates a sixth random number R6 through its random number generator, and sends the sixth random number R6 to the client through a secure communication channel to ensure that the random number is not tampered with during transmission.

[0100] After receiving the sixth random number R6, the client verifies whether its length and format are correct, and stores it for subsequent calculation of the symmetric key.

[0101] Step S703: Generate a client symmetric encryption key K based on the shared key S, the fifth random number R5, the sixth random number R6, the current timestamp T and the preset encryption algorithm. client .

[0102] Here, the client symmetric encryption key K client Generating formula: K client =HASH(S||R5||R6||T).

[0103] The current timestamp T is used to prevent the key from being reused or replayed. The timestamps of the client and server need to be synchronized within a certain time tolerance range (e.g. ±5 seconds).

[0104] The client concatenates the shared key S, the fifth random number R5, the sixth random number R6 and the current timestamp T into a data stream, and calculates the symmetric key based on the hash value algorithm.

[0105] Since the client and server use the same input parameters, the generated symmetric keys are consistent, thus ensuring that symmetric encryption of communication can proceed normally.

[0106] Step S104: encrypt the client request based on the client symmetric encryption key, generate first encrypted data, and send the first encrypted data to the server.

[0107] In one embodiment, the steps of step S104 include the following steps S801-S803.

[0108] Step S801: Generate an initial client request, and encapsulate the initial client request according to a preset data format to generate an encapsulated client request.

[0109] Here, the initial request generated by the client usually contains the following information: the target operation of the request (such as data upload, status query or parameter setting); related parameters (such as device ID, meter status or control command); timestamp to prevent replay attacks.

[0110] Encapsulate the initial request according to the preset communication protocol. For example, encode the data using JSON or binary format and add necessary protocol headers (such as message type, data length, etc.).

[0111] Generate an encapsulated client request as input data for subsequent encryption and signing.

[0112] Step S802: Generate a first signature pair based on the client private key and the elliptic curve data signature algorithm.

[0113] Here, the Elliptic Curve Digital Signature Algorithm (ECDSA) is used to generate a signature pair (r, s). r, s are signature parameters generated based on the encapsulated client request.

[0114] Calculate the hash value H(M) of the encapsulated client request data M.

[0115] Use the client's private key D client And elliptic curve algorithm, calculate the signature pair: r, s = ECDSA (D client ,H(M)).

[0116] The generated signature pair (r, s) will be encrypted and transmitted together with the client request.

[0117] Step S803: encrypt the client request and the first signature pair based on the client symmetric encryption key and the symmetric encryption algorithm to generate first encrypted data, and send the first encrypted data to the server through a preset secure communication channel.

[0118] Here, a symmetric encryption algorithm (such as AES-GCM or AES-CTR) is used to encrypt the request data and signature pair. The encryption process supports message integrity verification (such as the verification tag attached to the GCM mode).

[0119] The encapsulated client request M and the first signature pair (r, s) are combined into encrypted input data.

[0120] Use the client symmetric encryption key K client And encryption algorithm to encrypt, generate the first encrypted data N1: N1 = AES_GCM (K client ,M||(r,s)).

[0121] The first encrypted data N1 includes the encrypted client request and signature, and an accompanying verification tag (such as additional data of AES-GCM).

[0122] Use secure communication channels (such as TLS) to transmit encrypted data, ensuring the confidentiality and integrity of data within the network.

[0123] Step S105, receiving the second encrypted data sent by the server, decrypting the second encrypted data based on the client symmetric encryption key, and obtaining response data; wherein the second encrypted data is obtained by the server processing the first encrypted data based on the server symmetric encryption key; the client symmetric encryption key is the same as the server symmetric encryption key.

[0124] Here, the client receives the second encrypted data returned by the server, which contains the response content of the server. Use the client's symmetric encryption key to decrypt the second encrypted data through a symmetric encryption algorithm (such as AES-GCM) to obtain plaintext data. Verify the signature pair of the server to ensure the integrity and source credibility of the response data. Extract the response content of the server, such as operation results, power data, etc.

[0125] The server uses the same shared key, random number, and timestamp as the client to generate the server-side symmetric encryption key to ensure that the keys are consistent.

[0126] Figure 2 A flow chart of a communication method applied to a server provided in an embodiment of the present invention.

[0127] Reference Figure 2 , the communication method applied to the server includes:

[0128] Step S201, generating a server key pair according to the communication scenario.

[0129] In one embodiment, step S201 includes the following steps S901 - S904 .

[0130] Step S901, identifying a communication scenario.

[0131] Step S902: If the communication scenario is a temporary high-security scenario, a server-side temporary key pair is generated.

[0132] Here, the client generates a client temporary key pair.

[0133] Step S903: If the communication scenario is a low-frequency communication scenario or a short-term communication scenario, a server-side temporary key pair is generated.

[0134] Here, the client uses a pre-set client static key pair. The client static key pair includes the client static public key Q J-client And the client static private key D J-client .

[0135] Step S904: If the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, a preset server-side static key pair is used.

[0136] Here, the server static key pair includes the server static public key Q J-server and the server static private key D J-server At this time, the client uses the client static key pair.

[0137] In one embodiment, the step of generating a temporary key pair on the server side includes the following steps S1001-1003.

[0138] Step S1001: Generate a second random number R2 through the server random number generator as the server temporary private key D L-server .

[0139] Step S1002: Based on the server's temporary private key D L-server Perform operations on the elliptic curve to generate the server's temporary public key Q L-server ; Server temporary public key Q L-server The temporary private key D of the server L-server The product Q of the elliptic curve base point G L-server =D L-server ·G.

[0140] Step S1003: Send the server's temporary public key Q L-server Sent to the client.

[0141] Here, the method for generating the temporary key pair on the server is the same as the method for generating the temporary key pair on the client, so it will not be repeated here.

[0142] Step S202: Generate a shared key through negotiation with the server using an elliptic curve algorithm.

[0143] In one embodiment, step S202 includes:

[0144] Receive the client public key Q sent by the client client .

[0145] Based on the client public key Q client and the server private key D server , calculate the second shared key S through the elliptic curve algorithm server ; Second shared key S server The client public key D client and the server private key Q server The result of the dot product operation.

[0146] The server generates a third random number R3 through a random number generator, based on a preset encryption algorithm, the third random number R3 and the second shared key S server , generate a first verification value Y1, and send the first verification value Y1 and the third random number R3 to the client, so that the client can determine whether the first verification value Y1 is the same as the second verification value Y2; the second verification value Y2 is the client based on the preset encryption algorithm, the third random number R3 and the first shared key S client Generated.

[0147] Receive the third verification value Y3 and the fourth random number R4 sent by the client when the first verification value Y1 and the second verification value Y2 are the same; the third verification value Y3 is the client based on the preset encryption algorithm, the fourth random number R4 and the first shared key S clientGenerated.

[0148] Based on the preset encryption algorithm, the fourth random number R4 and the second shared key S server , generate a fourth verification value Y4, and determine whether the fourth verification value Y4 is the same as the third verification value Y3.

[0149] If the fourth verification value Y4 is the same as the third verification value Y3, the verification result is sent to the client to determine the second shared key S server is the shared key S.

[0150] Step S203, generating a server-side symmetric encryption key based on the shared key, the random number and the timestamp.

[0151] The server generates a random number R6 and sends it to the client, and receives the random number R5 sent by the client. The server symmetric encryption key K server :K server =HASH(S||R5||R6||T).

[0152] Step S204, receiving the first encrypted data sent by the client, decrypting the received first encrypted data based on the server symmetric encryption key, obtaining the client request, and generating response data.

[0153] Here, the server receives the first encrypted data sent by the client from the communication channel. Using the server symmetric encryption key K server The first encrypted data is decrypted using a preset symmetric encryption algorithm (such as AES-GCM). After decryption, plaintext data is obtained, including the client request M and the signature pair (r, s).

[0154] Use the client public key Q client Verify the signature pair (r, s) with the Elliptic Curve Digital Signature Algorithm: Verify H(M) = ECDSA_Verify(Q client ,(r,s)).

[0155] If the verification is successful, the data integrity and source credibility are confirmed; otherwise, the request is rejected.

[0156] The server generates response data based on the client request content, such as status information, operation results, or meter data. The response data may include: server operation results (such as success or failure); data content (such as meter readings); timestamp or session ID (used to uniquely identify this response).

[0157] The server encapsulates the response data into a data packet that conforms to the format according to the preset communication protocol to ensure that the client can parse it correctly.

[0158] Step S205, encrypt the response data based on the server-side symmetric encryption key, generate second encrypted data, and send the second encrypted data to the client; the server-side symmetric encryption key is the same as the client-side symmetric encryption key.

[0159] Here, a hash algorithm is used to calculate the hash value of the encapsulated response data. The server's private key and elliptic curve digital signature algorithm are used to generate a signature pair.

[0160] The generated signature pair is appended to the response data for verification by the client.

[0161] The response data and the signature are encrypted using a symmetric encryption algorithm to generate second encrypted data. The second encrypted data includes the encrypted response data and the signature, and an additional verification tag.

[0162] The server encapsulates the second encrypted data into a transmission data packet according to the communication protocol, which may include the following contents: the second encrypted data, the verification tag and the server identification information (such as the device ID).

[0163] The server sends the second encrypted data to the client through a secure communication channel.

[0164] Figure 3 A flow chart of a communication method provided by an embodiment of the present invention.

[0165] Reference Figure 3 , communication methods, including:

[0166] Step S301: The client and the server generate a key pair respectively according to the communication scenario.

[0167] Step S302: The client and the server negotiate to generate a shared key using an elliptic curve algorithm.

[0168] Step S303: The client and the server generate symmetric encryption keys based on the shared key, the random number and the timestamp respectively.

[0169] Step S304: The client encrypts the client request based on the symmetric encryption key, generates first encrypted data, and sends the first encrypted data to the server.

[0170] Step S305: The server decrypts the received first encrypted data based on the symmetric encryption key, obtains the client request, and generates response data.

[0171] Step S306: The server encrypts the response data based on the symmetric encryption key, generates second encrypted data, and sends the second encrypted data to the client.

[0172] Step S307: The client decrypts the received second encrypted data based on the symmetric encryption key to obtain response data.

[0173] Here, if the communication scenario is a temporary high-security scenario, the client generates a client temporary key pair, and the server generates a server temporary key pair. Figure 4 It is the communication interaction between the client and the server in a temporary high-security scenario.

[0174] If the communication scenario is a low-frequency communication scenario or a short-term communication scenario, the client uses the pre-set client static key pair, and the server generates a server temporary key pair; the client sends the client temporary public key to the server. Figure 5 It is the communication interaction between the client and the server in low-frequency or short-term communication scenarios.

[0175] If the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, the client uses the client static key pair, and the server uses the pre-set server static key pair. Figure 6 It is the communication interaction between the client and the server in high-frequency communication scenarios or long-term stable communication scenarios.

[0176] The communication method provided by the embodiment of the present invention, the server-side secure communication method ensures the confidentiality, integrity and credibility of data by combining dynamic key generation, symmetric encryption and digital signature; adds timestamp and random number mechanism to effectively prevent replay attacks; adopts elliptic curve algorithm, takes into account both high efficiency and lightweight, and is suitable for resource-constrained server-side devices; at the same time, it flexibly adapts to high-security, low-frequency and high-frequency communication scenarios, significantly improves the communication security between servers, and provides reliable protection for data transmission in smart grids.

[0177] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the working principle of the device. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiment disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0178] The embodiment of the present application can divide the functional modules of the communication system according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or software functional module.

[0179] It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. Figure 7 A possible schematic diagram of the composition of the communication system involved in the above embodiments is shown.

[0180] like Figure 7 As shown, the communication system applied to the client includes:

[0181] The client key pair generation module 11 is used to generate a client key pair in a communication scenario.

[0182] The client shared key generation module 12 is used to generate a shared key through negotiation with the server through an elliptic curve algorithm.

[0183] The client symmetric encryption key generation module 13 is used to generate a client symmetric encryption key based on a shared key, a random number and a timestamp.

[0184] The client encryption communication module 14 is used to encrypt the client request based on the client symmetric encryption key, generate first encrypted data, and send the first encrypted data to the server.

[0185] The client encryption communication module 14 is also used to receive the second encrypted data sent by the server, and decrypt the second encrypted data based on the client symmetric encryption key to obtain response data; wherein the second encrypted data is obtained by the server processing the first encrypted data based on the server symmetric encryption key; the client symmetric encryption key is the same as the server symmetric encryption key.

[0186] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0187] The communication system provided in the embodiment of the present application is used to perform the above Figure 1 The communication method shown can therefore achieve the same effect as the above-mentioned communication method.

[0188] Figure 8 A schematic diagram of the communication system applied to the server involved in the above and embodiments is shown.

[0189] like Figure 8 As shown, the communication system applied to the server includes:

[0190] The server key pair generation module 21 is used to generate a server key pair according to the communication scenario.

[0191] The server-side shared key generation module 22 is used to generate a shared key through negotiation with the server through an elliptic curve algorithm.

[0192] The server-side symmetric encryption key generation module 23 is used to generate a server-side symmetric encryption key based on a shared key, a random number and a timestamp.

[0193] The server-side encryption communication module 24 is used to receive the first encrypted data sent by the client, decrypt the received first encrypted data based on the server-side symmetric encryption key, obtain the client request, and generate response data.

[0194] The server encryption communication module 24 is also used to encrypt the response data based on the server symmetric encryption key, generate second encrypted data, and send the second encrypted data to the client; the server symmetric encryption key is the same as the client symmetric encryption key.

[0195] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0196] The communication system provided in the embodiment of the present application is used to perform the above Figure 2 The communication method shown can therefore achieve the same effect as the above-mentioned communication method.

[0197] The computer program product provided in the embodiment of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be found in the method embodiment and will not be repeated here.

[0198] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0199] In addition, in the description of the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0200] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0201] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0202] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: Applied to the client, the methods include: Generate a client key pair based on the communication scenario; Generate a shared key through negotiation with the server using the elliptic curve algorithm; Generate a client symmetric encryption key based on the shared key, the random number and the timestamp; Encrypting the client request based on the client symmetric encryption key to generate first encrypted data, and sending the first encrypted data to the server; Receive the second encrypted data sent by the server, and decrypt the second encrypted data based on the client symmetric encryption key to obtain response data; wherein, the second encrypted data is obtained by the server processing the first encrypted data based on the server symmetric encryption key; the client symmetric encryption key is the same as the server symmetric encryption key.

2. The communication method according to claim 1, characterized in that: The step of generating a client key pair according to the communication scenario includes: identifying the communication scenario; If the communication scenario is a temporary high-security scenario, generating a client temporary key pair; If the communication scenario is a low-frequency communication scenario or a short-term communication scenario, a preset client static key pair is used; If the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, the client uses the client static key pair.

3. The communication method according to claim 1, characterized in that: The step of generating a client temporary key pair includes: Generate a first random number through a client random number generator as a temporary private key of the client; Generate a temporary public key of the client based on the temporary private key of the client and the elliptic curve point operation; the temporary public key of the client is the product of the temporary private key of the client and the elliptic curve base point; Send the client temporary public key to the server.

4. The communication method according to claim 1, characterized in that: The client key pair includes a client public key and a client private key; the server key pair corresponding to the server includes a server public key and a server private key; The step of generating a shared key through negotiation with the server using an elliptic curve algorithm includes: Receiving the server public key sent by the server; Based on the server public key and the client private key, a first shared key is calculated by using the elliptic curve algorithm; the first shared key is a point multiplication result of the server public key and the client private key; Receive a first verification value and a third random number sent by the server, wherein the first verification value is generated by the server based on a preset encryption algorithm, the third random number and a second shared key; Generate a second verification value based on the preset encryption algorithm, the third random number and the first shared key, and determine whether the second verification value is the same as the first verification value; If the second verification value is the same as the first verification value, generate a fourth random number through a random number generator on the client, generate a third verification value based on the preset encryption algorithm, the fourth random number and the first shared key, and send the third verification value and the fourth random number to the server, so that the server determines whether the fourth verification value is the same as the third verification value; the fourth verification value is generated by the server based on the preset encryption algorithm, the fourth random number and the second shared key; Receive verification information sent by the server when the fourth verification value is the same as the third verification value, and determine that the first shared key is a shared key.

5. The communication method according to claim 1, characterized in that: The step of generating a client symmetric encryption key based on the shared key, the random number and the timestamp comprises: Generate a fifth random number based on the client random number generator, and send the fifth random number to the server; Receiving a sixth random number sent by the server; A client symmetric encryption key is generated based on the shared key, the fifth random number, the sixth random number, a current timestamp and a preset encryption algorithm.

6. The communication method according to claim 1, characterized in that: The client key pair includes a client public key and a client private key; The step of encrypting the client request based on the client symmetric encryption key, generating first encrypted data, and sending the first encrypted data to the server includes: Generate an initial client request, and encapsulate the initial client request according to a preset data format to generate the encapsulated client request; Generate a first signature pair based on the client private key and the elliptic curve data signature algorithm; The client request and the first signature pair are encrypted based on the client symmetric encryption key and the symmetric encryption algorithm to generate the first encrypted data, and the first encrypted data is sent to the server through a preset secure communication channel.

7. A communication method, characterized in that: Applied to the server, the methods include: Generate a server key pair based on the communication scenario; Generate a shared key through negotiation with the server using the elliptic curve algorithm; Generate a server-side symmetric encryption key based on the shared key, the random number and the timestamp; Receive first encrypted data sent by the client, decrypt the received first encrypted data based on the server symmetric encryption key, obtain the client request, and generate response data; Based on the server-side symmetric encryption key, the response data is encrypted to generate second encrypted data, and the second encrypted data is sent to the client; the server-side symmetric encryption key is the same as the client-side symmetric encryption key.

8. The communication method according to claim 7, characterized in that: The step of generating a server key pair according to the communication scenario includes: identifying the communication scenario; If the communication scenario is a temporary high-security scenario, generate a temporary key pair on the server side; If the communication scenario is a low-frequency communication scenario or a short-term communication scenario, generating the server-side temporary key pair; If the communication scenario is a high-frequency communication scenario or a long-term stable communication scenario, a pre-set server-side static key pair is used.

9. A communication method, characterized in that: include: The client and server generate key pairs based on the communication scenario; The client and the server negotiate to generate a shared key through an elliptic curve algorithm; The client and the server respectively generate a symmetric encryption key based on the shared key, a random number and a timestamp; The client encrypts the client request based on the symmetric encryption key to generate first encrypted data, and sends the first encrypted data to the server; The server decrypts the received first encrypted data based on the symmetric encryption key, obtains the client request, and generates response data; The server encrypts the response data based on the symmetric encryption key to generate second encrypted data, and sends the second encrypted data to the client; The client decrypts the received second encrypted data based on the symmetric encryption key to obtain the response data.

10. A communication system, characterized in that: Applied to the client, the system includes: A client key pair generation module is used to generate a client key pair in a communication scenario; The client shared key generation module is used to negotiate with the server to generate a shared key through the elliptic curve algorithm; A client symmetric encryption key generation module, used to generate a client symmetric encryption key based on the shared key, a random number and a timestamp; A client encryption communication module, used to encrypt the client request based on the client symmetric encryption key, generate first encrypted data, and send the first encrypted data to the server; The client encryption communication module is also used to receive the second encrypted data sent by the server, and decrypt the second encrypted data based on the client symmetric encryption key to obtain response data; wherein, the second encrypted data is obtained by the server processing the first encrypted data based on the server symmetric encryption key; the client symmetric encryption key is the same as the server symmetric encryption key.

11. A communication system, characterized in that: Applied to the server, the system includes: A server key pair generation module, used to generate a server key pair according to the communication scenario; The server-side shared key generation module is used to negotiate with the server to generate a shared key through an elliptic curve algorithm; A server-side symmetric encryption key generation module, used to generate a server-side symmetric encryption key based on the shared key, a random number and a timestamp; The server-side encryption communication module is used to receive the first encrypted data sent by the client, decrypt the received first encrypted data based on the server-side symmetric encryption key, obtain the client request, and generate response data; The server-side encryption communication module is also used to encrypt the response data based on the server-side symmetric encryption key, generate second encrypted data, and send the second encrypted data to the client; the server-side symmetric encryption key is the same as the client-side symmetric encryption key.

Images