A method for securely encrypting protection of air-cooled control data

Abstract

The application relates to a security encryption protection method for air-cooled control data and belongs to the technical field of data encryption. The method comprises the following steps: obtaining operation data collected by an air-cooled control device; adopting a symmetric encryption algorithm to perform encryption processing on the operation data to generate encrypted data; generating and managing an encryption key through a key management system; performing integrity check on the encrypted data to generate a check value; transmitting the encrypted data and the check value to a target device; and using the encryption key to decrypt the encrypted data through the target device to obtain decrypted operation data, and verifying the integrity of the decrypted operation data according to the check value. The application realizes safe collection, transmission and processing of operation data of an air-cooled control device of a transformer substation, effectively improves the safety and reliability of the system, and provides a powerful guarantee for safe and stable operation of the transformer substation equipment.

Description

Technical Field

[0001] This invention belongs to the field of data encryption technology, specifically relating to a secure encryption protection method for air-cooled control data. Background Technology

[0002] As a critical piece of equipment in the power system, the secure transmission and processing of operational data from substation air-cooled control devices is essential for ensuring the stable operation of the power grid. However, in practical applications, the substation operating environment is complex and variable, and data transmission faces multiple security threats. The connection between the substation's internal and external networks increases the risk of data leakage; malicious attackers may exploit network vulnerabilities to steal sensitive data. Air-cooled control devices are widely distributed, and communication between various sub-control modules is susceptible to interference and tampering, making it difficult to guarantee data integrity. The security of control command transmission directly affects the accuracy of equipment operation; tampering can lead to serious consequences. The complexity of key management increases the difficulty of system maintenance; how to ensure both security and system efficiency has become a major challenge. Traditional single encryption methods are insufficient to cope with increasingly complex security threats. How to construct a multi-layered, comprehensive security protection system that protects data security while ensuring system availability and flexibility has become a core issue that urgently needs to be addressed in this field. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a secure encryption protection method for air-cooled control data.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0005] A secure encryption protection method for air-cooled control data includes the following steps:

[0006] Step (1): Obtain the operating data collected by the air-cooled control device; wherein, the operating data includes at least status data and control command data;

[0007] Step (2): Encrypt the running data using a symmetric encryption algorithm to generate encrypted data;

[0008] Step (3): Generate and manage encryption keys through the key management system; wherein, the encryption key includes a master key and subkeys derived from the master key;

[0009] Step (4): Perform integrity verification on the encrypted data and generate a verification value;

[0010] Step (5): Transmit encrypted data and verification value to the target device;

[0011] Step (6): Decrypt the encrypted data using the encryption key on the target device to obtain the decrypted running data, and verify the integrity of the decrypted running data based on the check value.

[0012] Furthermore, preferably, the secure encryption protection method for air-cooled control data includes the following steps:

[0013] Step (1): Collect the operating data of the substation air-cooled control device through the data acquisition module to obtain raw data including voltage, current and power factor;

[0014] Step (2): Use a national cryptographic security chip to perform symmetric encryption on the collected running data to generate encrypted ciphertext data;

[0015] Step (3): Generate and manage encryption keys through the key management system; wherein, the encryption key includes a master key and subkeys derived from the master key;

[0016] Step (4): Calculate the MAC value of the ciphertext data according to the symmetric encryption algorithm, and use the MAC value as the integrity verification value;

[0017] Step (5): Upload the encrypted ciphertext data and MAC value to the centralized control module through the transmission channel;

[0018] Step (6): Obtain the complete data packet, and use the national cryptographic security chip in the centralized control module to decrypt the received ciphertext data to obtain the restored running data;

[0019] The decrypted running data is verified based on the received MAC value to determine the integrity and correctness of the data. If the verification passes, the decrypted voltage, current and power factor data are analyzed by the centralized control module to generate corresponding control command data.

[0020] Step (7): Use a symmetric encryption algorithm to encrypt the control command data and calculate the MAC value to obtain the encrypted command data packet. Send the encrypted command data packet to the sub-control module through the transmission channel to obtain the executable control command.

[0021] Furthermore, preferably, in step (2), during the encryption process, the national cryptographic security chip generates a symmetric key and obtains a fixed key length;

[0022] The running status data is divided into groups and segments based on the symmetric key to obtain the grouped data blocks;

[0023] The data blocks are encrypted one by one using a symmetric encryption algorithm to obtain the encrypted running data.

[0024] In step (4), the MAC value is calculated on the encrypted running data using the national cryptographic security chip, and the MAC value is used as the integrity verification value; then the encrypted running data and the integrity verification value are obtained, and a transmission data packet containing the verification value is generated.

[0025] In step (7), the data packet is sent to the sub-control module through the transmission channel; if the data transmission is completed and the sub-control module receives the data packet, it uses the symmetric key to decrypt the encrypted running data in the data packet to obtain the decrypted running data.

[0026] Integrity verification is performed based on the decrypted runtime data and the MAC value in the transmitted data packet to determine whether the data is consistent.

[0027] If the integrity verification passes, the sub-control module executes the corresponding control instructions based on the decrypted running data and obtains the execution result.

[0028] Furthermore, preferably, when the national cryptographic security chip generates a symmetric key, it does so through a multi-level key distribution mechanism. The symmetric key is distributed from the root key into business keys, and the business keys are further distributed into terminal keys, which are then stored in the national cryptographic security chip. Specifically:

[0029] The business root key is obtained by performing distributed computation using the SM1 cryptographic algorithm on the master key;

[0030] The application key is generated by performing a distribution operation based on the business root key and the input parameters.

[0031] Business data is encrypted using an application key to obtain a business subkey;

[0032] The terminal key is generated by combining the business subkey and the terminal identification information;

[0033] The terminal key is encrypted and stored using the built-in algorithm of the national cryptographic security chip, and the storage location is determined.

[0034] Obtain the storage address of the terminal key and record the hierarchical relationship through the key management system;

[0035] If the terminal initiates a data request, the business sub-key is invoked according to the recorded hierarchical relationship to verify its legitimacy.

[0036] If valid, the terminal key is decrypted using the business root key to obtain the plaintext key. The terminal data is then encrypted using the plaintext key to obtain the encryption result.

[0037] Furthermore, preferably, in step (2), a symmetric encryption algorithm is used to encrypt the collected data in groups, and a fixed-length symmetric key is obtained based on the group encryption result to encrypt each group of data;

[0038] In step (6), the centralized control module uses the corresponding symmetric key to decrypt the encrypted running data, and obtains the decrypted running data and extracts the data content therein through the decryption process;

[0039] Based on the decrypted runtime data, calculate the MAC value used for verification and compare it with the received MAC value. If the comparison results are consistent, the data integrity verification is deemed successful, confirming that the runtime data has not been tampered with.

[0040] Furthermore, preferably, the security encryption protection method for air-cooled control data further includes the following steps:

[0041] The public and private keys of the asymmetric encryption algorithm are generated in the centralized control module by the national cryptographic security chip.

[0042] The private key is stored in the national cryptographic security chip of the centralized control module to ensure that the private key is protected by hardware.

[0043] Obtain the public key and transmit it to the sub-control module. Determine if the sub-control module has received the public key. Store the received public key through the national cryptographic security chip of the sub-control module to obtain the deployment of the public key in the sub-control module.

[0044] The identity authentication process is initiated using a centralized control module, which generates identity authentication data.

[0045] The identity authentication data is encrypted using a public key to obtain the encrypted identity authentication data;

[0046] The encrypted authentication data is obtained and sent to the centralized control module, and the data transmission is deemed complete.

[0047] The received encrypted data is decrypted using the private key to obtain the decrypted authentication data.

[0048] The legitimacy of the sub-control module's identity is determined by comparing the decrypted data with the initial identity authentication data.

[0049] Furthermore, preferably, the centralized control module generates identity authentication data and uses a private key to sign the authentication data to obtain a signature result;

[0050] The signature result is sent to the sub-control module via the transmission channel;

[0051] The sub-control module receives the signature result;

[0052] The sub-control module obtains the public key of the central control module and verifies the legality of the signature result using the public key. If the verification is successful, the sub-control module uses the public key to encrypt the identity authentication data and obtains the encrypted authentication data.

[0053] The encrypted authentication data is returned to the centralized control module via the transmission channel;

[0054] The centralized control module receives encrypted data and uses its private key to decrypt the encrypted data to obtain the decrypted identity authentication data.

[0055] The decrypted identity authentication data is compared with the original identity authentication data to determine whether the comparison results are consistent. If the comparison is consistent, the centralized control module generates an authentication pass message and sends it to the sub-control module through the transmission channel.

[0056] The sub-control module receives the authentication pass message and obtains interaction permissions.

[0057] Furthermore, preferably, the identity authentication data is generated by using a random number generation algorithm to obtain unique identity authentication data;

[0058] The centralized control module encrypts the identity authentication data using the public key of the sub-control module to obtain the encrypted identity authentication data;

[0059] The centralized control module sends encrypted authentication data to the sub-control module via a communication channel;

[0060] The sub-control module receives the encrypted authentication data, verifies the data integrity using its own public key, and obtains the encrypted content.

[0061] The sub-control module processes the encrypted identity authentication data using a symmetric encryption algorithm and generates the returned encrypted identity authentication data.

[0062] The sub-control module sends back encrypted authentication data, which is then transmitted to the central control module via the communication channel;

[0063] The centralized control module receives the returned encrypted identity authentication data, decrypts the encrypted identity authentication data using a private key, and obtains the decrypted identity authentication data.

[0064] The centralized control module compares the decrypted identity authentication data with the original identity authentication data and uses a byte matching algorithm to determine consistency. If the consistency is successful, the centralized control module generates an identity authentication success message and sends it to the sub-control module through an encrypted channel.

[0065] Furthermore, preferably, identity authentication data is generated through a national cryptographic security chip, and a unique authentication identifier is obtained by using a random number generation algorithm;

[0066] The centralized control module obtains the public key of the sub-control module and encrypts the identity authentication data using an asymmetric encryption algorithm to obtain ciphertext data;

[0067] The centralized control module sends encrypted data through the transmission channel, and the sub-control module receives the encrypted data and stores it in the local cache.

[0068] The sub-control module extracts the ciphertext data encrypted with the public key through the built-in national cryptographic security chip, and decrypts it with the corresponding private key to obtain the original identity authentication data;

[0069] The sub-control module sends back the decrypted authentication data through an encrypted channel, and the centralized control module receives the sent-back data and stores it in a temporary verification area.

[0070] The centralized control module uses a comparison algorithm to verify whether the received feedback data matches the initially generated identity authentication data.

[0071] If the comparison results match, the centralized control module generates an authentication pass message using its built-in key, and then encrypts the message using the public key of the sub-control module to obtain an encrypted authentication message.

[0072] The centralized control module sends encrypted authentication messages through the transmission channel, and the sub-control module receives the encrypted authentication messages and decrypts them using its private key to obtain the plaintext authentication pass message.

[0073] The sub-control module verifies the identity by parsing the plaintext authentication message, obtains business interaction permissions, and enters the normal business interaction state.

[0074] Furthermore, preferably, in step (7), corresponding control command data is generated based on the running data; a symmetric encryption algorithm is used to encrypt the control command data through block encryption to obtain encrypted control command data;

[0075] Obtain the encrypted control command data and calculate the integrity check value using the SHA-256 algorithm;

[0076] Based on the integrity check value, the check value is appended to the end of the encrypted control command data to form a complete data packet. Then, the encrypted control command data with the check value is sent to the sub-control module through the transmission channel.

[0077] The data received by the sub-control module is obtained, and the same SHA-256 algorithm and key are used to calculate the check value, and it is determined whether it is consistent with the received check value.

[0078] If the verification values ​​match, it is determined that the data has not been tampered with, and usable control command data is obtained to perform adjustment operations on the cooling system.

[0079] In this invention, the terminal is the terminal device used by administrators to ultimately display and receive data.

[0080] This invention performs integrity verification on encrypted data to obtain the encrypted data; it calculates a fixed-length checksum on the encrypted data using a preset integrity algorithm and a subkey; it appends the checksum to the encrypted data to form a data packet to be transmitted; the target device decrypts the encrypted data using the encryption key and obtains the same subkey as used during encryption from the key management system; for the encrypted data, it decrypts it using the subkey according to the decryption algorithm corresponding to the encryption, obtaining the decrypted running data; based on the checksum and the same integrity algorithm, it calculates the verification result of the decrypted running data and compares it with the received checksum.

[0081] This invention acquires operational data collected by an air-cooled control device, obtains status data from the centralized control module of the air-cooled control device, obtains control command data from the sub-control module, preprocesses the status data and control command data to generate operational data in a unified format, transmits encrypted data and verification values ​​to the target device, encapsulates the encrypted data and verification values ​​into a transmission data packet through a preset communication channel, performs secondary encryption on the transmission data packet using a symmetric encryption system to generate a secondary encrypted data packet, and transmits the secondary encrypted data packet to the target device.

[0082] Compared with the prior art, the beneficial effects of this invention are as follows:

[0083] This invention employs a multi-level key distribution mechanism to generate symmetric keys, protects key security through a national cryptographic security chip, encrypts operational data using a symmetric encryption algorithm, generates public-private key pairs using an asymmetric encryption algorithm to authenticate sub-control modules, and ensures the security of control command data through encrypted transmission. Furthermore, by comprehensively utilizing multiple encryption technologies and security mechanisms, it achieves secure acquisition, transmission, and processing of operational data from substation air-cooled control devices, effectively improving system security and reliability and providing strong support for the safe and stable operation of substation equipment. Attached Figure Description

[0084] Figure 1 This is a flowchart of the secure encryption protection method for air-cooled control data according to the present invention; Detailed Implementation

[0085] The present invention will now be described in further detail with reference to the embodiments.

[0086] Those skilled in the art will understand that the following embodiments are for illustrative purposes only and should not be construed as limiting the scope of the invention. Where specific techniques or conditions are not specified in the embodiments, they are performed in accordance with the techniques or conditions described in the literature in the field or according to the product instructions. Materials or equipment whose manufacturers are not specified are all conventional products that can be obtained by purchase. Example 1

[0087] A secure encryption protection method for air-cooled control data includes the following steps:

[0088] Step (1): Obtain the operating data collected by the air-cooled control device; wherein, the operating data includes at least status data and control command data;

[0089] Step (2): Encrypt the running data using a symmetric encryption algorithm to generate encrypted data;

[0090] Step (3): Generate and manage encryption keys through the key management system; wherein, the encryption key includes a master key and subkeys derived from the master key;

[0091] Step (4): Perform integrity verification on the encrypted data and generate a verification value;

[0092] Step (5): Transmit encrypted data and verification value to the target device;

[0093] Step (6): Decrypt the encrypted data using the encryption key on the target device to obtain the decrypted running data, and verify the integrity of the decrypted running data based on the check value. Example 2

[0094] A secure encryption protection method for air-cooled control data includes the following steps:

[0095] Step (1): Collect the operating data of the substation air-cooled control device through the data acquisition module to obtain raw data including voltage, current and power factor;

[0096] Step (2): Use a national cryptographic security chip to perform symmetric encryption on the collected running data to generate encrypted ciphertext data;

[0097] Step (3): Generate and manage encryption keys through the key management system; wherein, the encryption key includes a master key and subkeys derived from the master key;

[0098] Step (4): Calculate the MAC value of the ciphertext data according to the symmetric encryption algorithm, and use the MAC value as the integrity verification value;

[0099] Step (5): Upload the encrypted ciphertext data and MAC value to the centralized control module through the transmission channel;

[0100] Step (6): Obtain the complete data packet, and use the national cryptographic security chip in the centralized control module to decrypt the received ciphertext data to obtain the restored running data;

[0101] The decrypted running data is verified based on the received MAC value to determine the integrity and correctness of the data. If the verification passes, the decrypted voltage, current and power factor data are analyzed by the centralized control module to generate corresponding control command data.

[0102] Step (7): Use a symmetric encryption algorithm to encrypt the control command data and calculate the MAC value to obtain the encrypted command data packet. Send the encrypted command data packet to the sub-control module through the transmission channel to obtain the executable control command.

[0103] Specifically:

[0104] The operating data of the substation air-cooled control device was collected to obtain raw data including voltage 220V, current 50A and power factor 0.9;

[0105] The collected running data is symmetrically encrypted using the SM4 algorithm of the national cryptographic security chip to generate encrypted ciphertext data with a key length of 128 bits.

[0106] Encryption keys are generated and managed through a key management system; the encryption key includes a master key and subkeys derived from the master key.

[0107] The MAC value of the ciphertext data is calculated based on the symmetric encryption algorithm HMAC-SM3 to determine the integrity verification information of the data and generate a 32-byte checksum.

[0108] The encrypted ciphertext data and MAC value are uploaded to the centralized control module via the transmission channel;

[0109] The complete data packet is obtained. The data packet format includes ciphertext data and a checksum. The SM4 algorithm of the national cryptographic security chip in the centralized control module is used to decrypt the received ciphertext data to obtain the restored operating data, including voltage 220V, current 50A and power factor 0.9.

[0110] The decrypted running data is verified based on the received MAC value to determine the integrity and correctness of the data. If the verification code matches, the verification is passed. If the verification is passed, the decrypted voltage, current and power factor data are analyzed by the centralized control module to generate corresponding control command data. The control commands include adjusting the voltage to 230V and the current to 55A.

[0111] The control command data is encrypted using the symmetric encryption algorithm SM4 and the MAC value is calculated to obtain the encrypted command data packet. The key length is 128 bits and the check code is 32 bytes. The encrypted command data packet is sent to the sub-control module through the transmission channel to obtain the executable control commands. After receiving the commands, the sub-control module performs voltage and current adjustment operations. Example 3

[0112] A secure encryption protection method for air-cooled control data includes the following steps:

[0113] Step (1): Collect the operating data of the substation air-cooled control device through the data acquisition module to obtain raw data including voltage, current and power factor;

[0114] Step (2): Use a national cryptographic security chip to perform symmetric encryption on the collected running data to generate encrypted ciphertext data;

[0115] Step (3): Generate and manage encryption keys through the key management system; wherein, the encryption key includes a master key and subkeys derived from the master key;

[0116] Step (4): Calculate the MAC value of the ciphertext data according to the symmetric encryption algorithm, and use the MAC value as the integrity verification value;

[0117] Step (5): Upload the encrypted ciphertext data and MAC value to the centralized control module through the transmission channel;

[0118] Step (6): Obtain the complete data packet, and use the national cryptographic security chip in the centralized control module to decrypt the received ciphertext data to obtain the restored running data;

[0119] The decrypted running data is verified based on the received MAC value to determine the integrity and correctness of the data. If the verification passes, the decrypted voltage, current and power factor data are analyzed by the centralized control module to generate corresponding control command data.

[0120] Step (7): Use a symmetric encryption algorithm to encrypt the control command data and calculate the MAC value to obtain the encrypted command data packet. Send the encrypted command data packet to the sub-control module through the transmission channel to obtain the executable control command.

[0121] In step (2), during encryption, the national cryptographic security chip generates a symmetric key and obtains a fixed key length;

[0122] The running status data is divided into groups and segments based on the symmetric key to obtain the grouped data blocks;

[0123] The data blocks are encrypted one by one using a symmetric encryption algorithm to obtain the encrypted running data.

[0124] In step (4), the MAC value is calculated on the encrypted running data using the national cryptographic security chip, and the MAC value is used as the integrity verification value; then the encrypted running data and the integrity verification value are obtained, and a transmission data packet containing the verification value is generated.

[0125] In step (7), the data packet is sent to the sub-control module through the transmission channel; if the data transmission is completed and the sub-control module receives the data packet, it uses the symmetric key to decrypt the encrypted running data in the data packet to obtain the decrypted running data.

[0126] Integrity verification is performed based on the decrypted runtime data and the MAC value in the transmitted data packet to determine whether the data is consistent.

[0127] If the integrity verification passes, the sub-control module executes the corresponding control instructions based on the decrypted running data and obtains the execution result.

[0128] Specifically:

[0129] A symmetric key is generated by the national cryptographic security chip in the centralized control module, and a 256-bit key is generated using the AES-256 algorithm.

[0130] The running status data is divided into groups based on the symmetric key, and the data is divided into groups of 128 bits to obtain the grouped data blocks;

[0131] The AES-256 algorithm is used to encrypt the grouped data blocks one by one, and ECB mode is used to encrypt each group of data to obtain the encrypted running data;

[0132] The MAC value is calculated by using a national cryptographic security chip to encrypt the running data, and the HMAC-SHA256 algorithm is used to perform a hash operation on the encrypted data to obtain a 32-byte integrity check value.

[0133] The encrypted running data and integrity verification value are obtained, and the encrypted data and verification value are concatenated in a fixed format to generate a transmission data packet containing the verification value. The transmission data packet is sent to the sub-control module through the transmission channel, and the transmission data packet is encrypted and transmitted using the TLS1.3 protocol.

[0134] Once the data transmission is confirmed to be complete, if the sub-control module receives the transmitted data packet, it uses the symmetric key to decrypt the encrypted running data in the data packet, and uses the AES-256 algorithm to decrypt the encrypted data to obtain the decrypted running data.

[0135] Integrity verification is performed based on the MAC value in the decrypted running data and the transmitted data packet. The HMAC-SHA256 algorithm is used to calculate the check value of the decrypted data, and it is compared with the check value in the transmitted packet to determine whether the data is consistent.

[0136] If the integrity verification passes, the sub-control module executes the corresponding control instructions based on the decrypted running data, parses the control parameters in the data packet and executes the control logic to obtain the execution result. Example 4

[0137] The difference between Example 4 and Example 3 is as follows:

[0138] When the national cryptographic security chip generates a symmetric key, it does so through a multi-level key distribution mechanism. The symmetric key is distributed from the root key into business keys, and the business keys are further distributed into terminal keys, which are then stored in the national cryptographic security chip. Specifically:

[0139] The business root key is obtained by performing distributed computation using the SM1 cryptographic algorithm on the master key;

[0140] The application key is generated by performing a distribution operation based on the business root key and the input parameters.

[0141] Business data is encrypted using an application key to obtain a business subkey;

[0142] The terminal key is generated by combining the business subkey and the terminal identification information;

[0143] The terminal key is encrypted and stored using the built-in algorithm of the national cryptographic security chip, and the storage location is determined.

[0144] Obtain the storage address of the terminal key and record the hierarchical relationship through the key management system;

[0145] If the terminal initiates a data request, the business sub-key is invoked according to the recorded hierarchical relationship to verify its legitimacy.

[0146] If valid, the terminal key is decrypted using the business root key to obtain the plaintext key. The terminal data is then encrypted using the plaintext key to obtain the encryption result.

[0147] Everything else is the same.

[0148] Specifically:

[0149] The master key is distributed using the SM1 cryptographic algorithm, employing a 128-bit key length and a specific dispersion factor to generate the business root key;

[0150] The business root key, combined with input parameters such as the business identifier and timestamp, performs a distribution operation to generate the application key;

[0151] The application key is used to encrypt the business data, and the SM4 algorithm is used for block encryption to obtain the business subkey;

[0152] The service subkey and terminal identification information are combined and calculated to generate the terminal key through a hash function;

[0153] The terminal key is encrypted and stored using the AES algorithm built into the national cryptographic security chip. The storage location is determined to be the key storage area of ​​the chip. The key management system obtains the storage address of the terminal key and records the hierarchical relationship, including the association information of the master key, business root key, business sub-key and terminal key.

[0154] If the terminal initiates a data request, the business sub-key is called for verification according to the recorded hierarchical relationship, and the hash value is calculated using the SM3 algorithm to determine the legality.

[0155] If valid, the business root key is used to decrypt the terminal key to obtain the plaintext key. The plaintext key is then used to perform encryption operations on the terminal data, employing the SM2 algorithm for asymmetric encryption to obtain the encryption result. Example 5

[0156] The difference between Example 5 and Example 2 is as follows:

[0157] In step (2), a symmetric encryption algorithm is used to encrypt the collected data in groups. Based on the group encryption results, a fixed-length symmetric key is obtained to encrypt each group of data.

[0158] In step (6), the centralized control module uses the corresponding symmetric key to decrypt the encrypted running data, and obtains the decrypted running data and extracts the data content therein through the decryption process;

[0159] Based on the decrypted running data, calculate the MAC value used for verification and compare it with the received MAC value. If the comparison results are consistent, the data integrity verification is deemed to have passed, confirming that the running data has not been tampered with.

[0160] Everything else is the same.

[0161] Specifically:

[0162] The system collects operating status data such as voltage, current, active power, and reactive power, and uses the national cryptographic symmetric encryption algorithm SM4 to encrypt the collected data in groups of 128 bits each.

[0163] Based on the block encryption results, a fixed-length symmetric key with a key length of 256 bits is obtained. Each group of data is encrypted to generate 128-bit encrypted ciphertext. The encrypted running data is obtained through encryption. The corresponding MAC value is calculated using the HMAC-SHA256 algorithm to ensure data integrity.

[0164] The encrypted runtime data and calculated MAC value are transmitted to the centralized control module using a TLS secure transmission channel.

[0165] During transmission, the AES-256 encryption algorithm is used to protect the transmission channel. After the transmitted data is acquired, the centralized control module uses the corresponding symmetric key to decrypt the encrypted running data. The SM4 algorithm is used to decrypt the 128-bit ciphertext group by group to restore the original data. Through decryption processing, the decrypted running data is obtained and the data content, including the specific values ​​of voltage and current, is extracted.

[0166] Based on the decrypted operating data, the MAC value used for verification is recalculated using the HMAC-SHA256 algorithm and compared with the received MAC value. If the comparison results are consistent, the data integrity verification is deemed successful, confirming that the operating data has not been tampered with. Then, the current operating status information of the transformer is obtained, including power factor and operating time, and subsequent processing is performed based on this information to generate control commands or risk warnings. Example 6

[0167] The difference between Example 6 and Example 4 is that Example 6 further includes the following steps:

[0168] The public and private keys of the asymmetric encryption algorithm are generated in the centralized control module by the national cryptographic security chip.

[0169] The private key is stored in the national cryptographic security chip of the centralized control module to ensure that the private key is protected by hardware; the public key is obtained and transmitted to the sub-control module; it is determined that the sub-control module has received the public key; the received public key is stored in the national cryptographic security chip of the sub-control module to obtain the deployment of the public key in the sub-control module.

[0170] The identity authentication process is initiated using a centralized control module, which generates identity authentication data.

[0171] The authentication data is encrypted using a public key to obtain the encrypted authentication data.

[0172] The encrypted authentication data is obtained and sent to the centralized control module, which then determines that the data transmission is complete.

[0173] The received encrypted data is decrypted using the private key to obtain the decrypted authentication data.

[0174] The legitimacy of the sub-control module's identity is determined by comparing the decrypted data with the initial identity authentication data.

[0175] Everything else is the same.

[0176] Specifically, it also includes the following steps:

[0177] The public and private keys are generated using the RSA-2048 algorithm. The public key is 2048 bits long, and the private key is 2048 bits long.

[0178] The private key is stored in the national cryptographic security chip of the centralized control module, and the hardware protection of the private key is implemented using the PKCS#11 standard interface to ensure that the private key does not leave the host encryption server.

[0179] The public key is obtained and transmitted to the sub-control module. The public key is encrypted and transmitted using the TLS 1.3 protocol. After the sub-control module receives the public key, it returns an acknowledgment signal. The received public key is stored in the national cryptographic security chip of the sub-control module. The public key is stored in the storage area of ​​the national cryptographic security chip to ensure the integrity and security of the public key.

[0180] The identity authentication process is initiated by a centralized control module, which generates a 128-bit random number as identity authentication data to ensure the uniqueness and unpredictability of the data. The identity authentication data is encrypted using a public key and the RSA-2048 algorithm to generate encrypted identity authentication data.

[0181] The system acquires encrypted authentication data and sends it to the centralized control module. It transmits encrypted data via the MQTT protocol, determines when data transmission is complete, and records the transmission log.

[0182] The received encrypted data is decrypted using the private key, and the data is then decrypted using the RSA-2048 algorithm to obtain the decrypted identity authentication data.

[0183] The decrypted data is compared with the initial identity authentication data. The data consistency is verified by comparing the data byte by byte. After confirming the legality of the sub-control module's identity, the authentication result is recorded. Example 7

[0184] The difference between Example 7 and Example 6 is as follows:

[0185] The centralized control module generates identity authentication data and uses a private key to sign the authentication data to obtain the signature result;

[0186] The signature result is sent to the sub-control module via the transmission channel;

[0187] The sub-control module receives the signature result;

[0188] The sub-control module obtains the public key of the central control module and verifies the legality of the signature result using the public key. If the verification is successful, the sub-control module uses the public key to encrypt the identity authentication data and obtains the encrypted authentication data.

[0189] The encrypted authentication data is returned to the centralized control module via the transmission channel;

[0190] The centralized control module receives encrypted data and uses its private key to decrypt the encrypted data to obtain the decrypted identity authentication data.

[0191] The decrypted identity authentication data is compared with the original identity authentication data to determine if the comparison results are consistent. If they are consistent, the centralized control module generates an authentication pass message and sends it to the sub-control module through the transmission channel. The sub-control module receives the authentication pass message and obtains interaction permissions.

[0192] Everything else is the same.

[0193] Specifically:

[0194] Generate authentication data containing the random number 12345, and sign the authentication data using the national cryptographic SM2 algorithm and a private key to obtain the signature result;

[0195] The signature result is transmitted to the sub-control module via TCP / IP protocol;

[0196] The sub-control module receives the signature result and stores it in the cache;

[0197] The sub-control module obtains the public key of the central control module from the key management system, and verifies the legality of the signature result using the public key and the SM2 algorithm to confirm whether the signature was generated by the central control module. If the verification is successful, the sub-control module uses the public key and the SM2 algorithm to encrypt the identity authentication data. The encrypted identity authentication data is 256 bytes long.

[0198] The encrypted authentication data is returned to the centralized control module via the TCP / IP protocol;

[0199] The centralized control module receives encrypted data and stores it in memory. The centralized control module uses a private key and the SM2 algorithm to decrypt the encrypted data and obtain the decrypted identity authentication data 12345.

[0200] The decrypted identity authentication data is compared with the original identity authentication data to determine if they are completely consistent. If they are consistent, the centralized control module generates an authentication pass message containing an "authentication successful" status code and sends it to the sub-control module via TCP / IP protocol. The sub-control module receives the authentication pass message, parses the status code, obtains subsequent business interaction permissions, and completes the identity authentication process. Example 8

[0201] The difference between Example 8 and Example 7 is as follows:

[0202] Generate identity authentication data by using a random number generation algorithm to obtain unique identity authentication data;

[0203] The centralized control module encrypts the identity authentication data using the public key of the sub-control module to obtain the encrypted identity authentication data;

[0204] The centralized control module sends encrypted authentication data to the sub-control module via the communication channel;

[0205] The sub-control module receives the encrypted authentication data, verifies the data integrity using its own public key, and obtains the encrypted content.

[0206] The sub-control module processes the encrypted identity authentication data using a symmetric encryption algorithm and generates the returned encrypted identity authentication data.

[0207] The sub-control module sends back encrypted authentication data, which is then transmitted to the central control module via the communication channel;

[0208] The centralized control module receives the returned encrypted identity authentication data, decrypts the encrypted identity authentication data using a private key, and obtains the decrypted identity authentication data.

[0209] The centralized control module compares the decrypted identity authentication data with the original identity authentication data and uses a byte matching algorithm to determine consistency. If the consistency is successful, the centralized control module generates an identity authentication success message and sends it to the sub-control module through an encrypted channel.

[0210] Everything else is the same.

[0211] Specifically:

[0212] The centralized control module uses a random number generation algorithm to generate a 128-bit identity authentication data, for example, using the AES algorithm to generate the random number "3f7a9b2c4d5e6f78";

[0213] The centralized control module uses the public key of the sub-control module to encrypt the identity authentication data using the RSA-2048 algorithm, resulting in the encrypted identity authentication data "a1b2c3d4e5f6g7h8";

[0214] The centralized control module transmits the encrypted authentication data to the sub-control module via TCP / IP protocol, with a data packet size of 256 bytes.

[0215] The sub-control module receives the encrypted identity authentication data, uses its own public key to verify the data integrity through the RSA-2048 algorithm, and parses out the encrypted content "a1b2c3d4e5f6g7h8";

[0216] The sub-control module performs hash calculation on the encrypted identity authentication data using the SHA-256 algorithm to generate the returned encrypted identity authentication data "x9y8z7w6v5u4t3s2";

[0217] The sub-control module transmits the returned encrypted authentication data to the central control module via the UDP protocol, with a data packet size of 128 bytes.

[0218] The centralized control module receives the returned encrypted identity authentication data, uses its own private key to decrypt the data using the RSA-2048 algorithm, and obtains the decrypted identity authentication data "3f7a9b2c4d5e6f78";

[0219] The centralized control module compares the decrypted identity authentication data with the original identity authentication data using a byte matching algorithm to determine whether the two are completely consistent. If the consistency is successful, the centralized control module generates an authentication success message "success", which is encrypted using the AES-256 algorithm and sent to the sub-control module through an SSL channel. Example 9

[0220] The difference between Example 9 and Example 8 is as follows:

[0221] Identity authentication data is generated using a national cryptographic security chip, and a unique authentication identifier is obtained by using a random number generation algorithm.

[0222] The centralized control module obtains the public key of the sub-control module and encrypts the identity authentication data using an asymmetric encryption algorithm to obtain ciphertext data;

[0223] The centralized control module sends encrypted data through the transmission channel, and the sub-control module receives the encrypted data and stores it in the local cache.

[0224] The sub-control module extracts the ciphertext data encrypted with the public key through the built-in national cryptographic security chip, and decrypts it with the corresponding private key to obtain the original identity authentication data;

[0225] The sub-control module sends back the decrypted authentication data through an encrypted channel, and the centralized control module receives the sent-back data and stores it in a temporary verification area.

[0226] The centralized control module uses a comparison algorithm to verify whether the received feedback data matches the initially generated identity authentication data.

[0227] If the comparison results match, the centralized control module generates an authentication pass message using its built-in key, and then encrypts the message using the public key of the sub-control module to obtain an encrypted authentication message.

[0228] The centralized control module sends encrypted authentication messages through the transmission channel, and the sub-control module receives the encrypted authentication messages and decrypts them using its private key to obtain the plaintext authentication pass message.

[0229] The sub-control module verifies the identity by parsing the plaintext authentication message, obtains business interaction permissions, and enters the normal business interaction state.

[0230] Everything else is the same.

[0231] Specifically:

[0232] The centralized control module generates identity authentication data through a built-in national cryptographic security chip and uses a random number generation algorithm to generate a unique authentication identifier with a length of 128 bits.

[0233] The centralized control module obtains the public key of the sub-control module. This public key is generated based on the RSA2048 algorithm and is used to encrypt the identity authentication data using an asymmetric encryption algorithm to generate ciphertext data.

[0234] The centralized control module sends encrypted data through the transmission channel, and the sub-control module receives the encrypted data and stores it in the local cache.

[0235] The sub-control module extracts the ciphertext data encrypted with the public key through the built-in national cryptographic security chip, and decrypts it using the corresponding RSA2048 private key to restore the original identity authentication data;

[0236] The sub-control module sends back the decrypted authentication data through an encrypted channel, and the centralized control module receives the sent-back data and stores it in a temporary verification area.

[0237] The centralized control module generates a hash value for the initial identity authentication data using the SHA-256 algorithm, compares it with the hash value of the returned data, and determines whether the two are consistent.

[0238] If the comparison results match, the centralized control module generates an authentication pass message using the built-in AES256 algorithm and generates an encrypted authentication message using the public key of the sub-control module.

[0239] The centralized control module sends encrypted authentication messages through the transmission channel, and the sub-control module receives the encrypted authentication messages and decrypts them using the RSA2048 private key to obtain the plaintext authentication pass message.

[0240] The sub-control module verifies the identity by parsing the plaintext authentication message, obtains business interaction permissions, and enters the normal business interaction state. Example 10

[0241] The difference between Example 10 and Example 9 is as follows:

[0242] The decrypted operating data was obtained and determined to include data such as voltage 220V, current 10A, active power 5kW, reactive power 3kVar, power factor 0.8, energy 50kWh, and operating time 8 hours.

[0243] Based on the operating data, corresponding control command data is generated, including commands to adjust the cooling fan speed to 1500 rpm and to start the backup cooling module; the AES symmetric encryption algorithm is used to encrypt the control command data with a 256-bit key. The control command data is divided into 128-bit data blocks by block encryption and encrypted block by block to obtain the encrypted control command data.

[0244] Obtain the encrypted control command data and calculate the integrity check value using the SHA-256 algorithm;

[0245] Based on the integrity check value, the check value is appended to the end of the encrypted control command data to form a complete data packet. Then, the encrypted control command data with the check value is sent to the sub-control module through the transmission channel.

[0246] The data received by the sub-control module is obtained, and the same SHA-256 algorithm and key are used to calculate the check value, and it is determined whether it is consistent with the received check value.

[0247] If the verification values ​​match, it is determined that the data has not been tampered with, and usable control command data is obtained to perform adjustment operations on the cooling system.

[0248] Everything else is the same.

[0249] Specifically:

[0250] The centralized control module uses the SM4 symmetric encryption algorithm and a 128-bit key to encrypt the control command data containing the "start fan" command, generating encrypted control command data.

[0251] The MAC value of the encrypted data is calculated using the HMAC-SM3 algorithm, and a 32-byte checksum is generated. The encrypted control command data and MAC value are then transmitted to the sub-control module via the TCP / IP protocol, and the transmission success status is recorded.

[0252] After receiving data, the sub-control module checks if the data packet length is 160 bytes to confirm data packet integrity. If the data packet is intact, the sub-control module uses the same 1... 2 The 8-bit SM4 key is used to decrypt the encrypted control command data to obtain the original command "Start the fan"; the received MAC value is extracted from the decrypted data to obtain the information to be verified; the sub-control module uses the HMAC-SM3 algorithm to recalculate the MAC value of the decrypted command data to generate a new 32-byte checksum.

[0253] The recalculated MAC value is compared byte by byte with the received MAC value. If they match, it is confirmed that the instruction data has not been tampered with and the instruction is deemed valid. The sub-control module then executes the fan start operation according to the valid instruction "start fan" to complete the instruction processing.

[0254] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for secure encryption protection of air-cooled control data, characterized in that, The method comprises the following steps: Step (1), collecting operation data of the air-cooled control device of the transformer substation through a data acquisition module to obtain original data containing voltage, current and power factor; Step (2), symmetrically encrypting the collected operation data by using a national secret security chip to generate encrypted ciphertext data; Step (3), generating and managing an encryption key through a key management system; wherein the encryption key comprises a master key and a sub-key obtained by dispersing the master key; Step (4), calculating the MAC value of the ciphertext data according to a symmetric encryption algorithm, and taking the MAC value as an integrity check value; Step (5), uploading the encrypted ciphertext data and the MAC value to a centralized control module through a transmission channel; Step (6), obtaining a complete data packet, decrypting the received ciphertext data by using a national secret security chip in the centralized control module to obtain restored operation data; According to the received MAC value, the decrypted operation data is checked to judge the integrity and correctness of the data, and if the check is passed, the decrypted voltage, current and power factor data are analyzed by the centralized control module to generate corresponding control instruction data; Step (7), encrypting the control instruction data by using a symmetric encryption algorithm and calculating the MAC value to obtain an encrypted instruction data packet, and downloading the encrypted instruction data packet to a sub-control module through a transmission channel to obtain executable control instructions; Further comprising the following steps: Generating a public-private key pair of an asymmetric encryption algorithm by the national secret security chip in the centralized control module to obtain a public key and a private key; Storing the private key in the national secret security chip of the centralized control module to determine that the private key is protected by hardware; Obtaining the public key and transmitting it to the sub-control module, judging that the sub-control module receives the public key, storing the received public key by the national secret security chip of the sub-control module to obtain the deployment of the public key in the sub-control module; Initiating an identity authentication process by using the centralized control module to generate identity authentication data; Encrypting the identity authentication data by using the public key to obtain encrypted identity authentication data; Obtaining the encrypted identity authentication data and sending it to the centralized control module to judge that the data transmission is completed; Decrypting the received encrypted data according to the private key to obtain decrypted identity authentication data; Comparing the decrypted data with the initial identity authentication data to determine the legitimacy of the identity of the sub-control module.

2. The method for securely encrypting and protecting air-cooled control data according to claim 1, characterized in that: In step (2), when encrypting, the national secret security chip generates a symmetric key and obtains a fixed key length; Grouping and cutting the operation state data according to the symmetric key to obtain grouped data blocks; Encrypting the grouped data blocks by using a symmetric encryption algorithm to obtain encrypted operation data; In step (4), calculating the MAC value of the encrypted operation data by using the national secret security chip, taking the MAC value as an integrity check value, then obtaining the encrypted operation data and the integrity check value to generate a transmission data packet containing the check value; In step (7), sending the transmission data packet to the sub-control module through a transmission channel; Determine that the data transmission is completed, if the child control module receives the transmission data packet, then use the symmetric key to decrypt the encrypted operation data in the data packet to obtain decrypted operation data; According to the decrypted operation data and the MAC value in the transmission data packet, integrity verification is performed to determine whether the data is consistent; If the integrity verification passes, the child control module executes the corresponding control instruction according to the decrypted operation data to obtain an execution result.

3. The method for security encryption protection of air cooling control data according to claim 2, characterized in that, When the SM security chip generates a symmetric key, the symmetric key is generated through a multi-level key dispersion mechanism. The symmetric key is dispersed from a root key to a business key, and the business key is further dispersed to a terminal key and stored in the SM security chip. Specifically: The SM1 cryptographic algorithm is used to perform dispersion calculation on the master key to obtain a business root key; According to the business root key, a dispersion operation is performed in combination with an input parameter to generate an application key; The application key is used to encrypt the business data to obtain a business sub-key; The terminal key is generated by combining and calculating the business sub-key and terminal identification information; The terminal key is encrypted and stored by using the built-in algorithm of the SM security chip to determine the storage location; The storage address of the terminal key is obtained, and the dispersion level relationship is recorded by the key management system; If the terminal initiates a data request, the business sub-key is called for verification according to the recorded level relationship to determine the legality; If it is legal, the terminal key is decrypted by using the business root key to obtain a plaintext key, and the terminal data is encrypted by using the plaintext key to obtain an encryption result.

4. The method for security encryption protection of air cooled control data according to claim 1, wherein, In step (2), the collected data is grouped and encrypted by using a symmetric encryption algorithm. According to the grouping encryption result, a symmetric key of fixed length is used to encrypt each group of data; In step (6), the centralized control module decrypts the encrypted operation data by using the corresponding symmetric key, and obtains the decrypted operation data and extracts the data content therein by decryption processing; According to the decrypted operation data, the MAC value for verification is calculated and compared with the received MAC value. If the comparison result is consistent, it is determined that the data integrity verification passes, and it is determined that the operation data has not been tampered with.

5. The method for security encryption protection of air cooling control data according to claim 4, characterized in that, The centralized control module generates identity authentication data, and uses a private key to sign the authentication data to obtain a signature result; The signature result is sent to the child control module through the transmission channel; The child control module receives the signature result; The child control module obtains the public key of the centralized control module, and verifies the legality of the signature result by using the public key; If the verification passes, the child control module encrypts the identity authentication data by using the public key to obtain encrypted authentication data; The encrypted authentication data is returned to the centralized control module through the transmission channel; The centralized control module receives the encrypted data, and decrypts the encrypted data by using the private key to obtain decrypted identity authentication data; The decrypted identity authentication data is compared with the original identity authentication data to determine whether the comparison result is consistent. If the comparison is consistent, the centralized control module generates an authentication pass message and sends it to the child control module through the transmission channel; The child control module receives the authentication pass message and obtains the interaction permission.

6. The method for security encryption protection of air cooling control data according to claim 5, characterized in that, Identity authentication data is generated, and a unique identity authentication data is obtained by using a random number generation algorithm; The centralized control module encrypts the identity authentication data by the public key of the sub-control module to obtain encrypted identity authentication data; The centralized control module sends the encrypted identity authentication data to the sub-control module through a communication channel; The sub-control module receives the encrypted identity authentication data, verifies the data integrity using its own public key and obtains the encrypted content; The sub-control module processes the encrypted identity authentication data through a symmetric encryption algorithm to generate returned encrypted identity authentication data; The sub-control module sends the returned encrypted identity authentication data to the centralized control module through a communication channel; The centralized control module receives the returned encrypted identity authentication data, decrypts the encrypted identity authentication data using a private key to obtain decrypted identity authentication data; The centralized control module compares the decrypted identity authentication data with the original identity authentication data, judges consistency by byte matching algorithm, and if the consistency is passed, the centralized control module generates an identity authentication pass message and sends it to the sub-control module through an encryption channel.

7. The method for security encryption protection of air cooling control data according to claim 6, characterized in that, Identity authentication data is generated through a national secret security chip, and a unique authentication identifier is obtained using a random number generation algorithm; The centralized control module obtains the public key of the sub-control module and encrypts the identity authentication data through an asymmetric encryption algorithm to obtain ciphertext data; The centralized control module sends the ciphertext data through a transmission channel, and the sub-control module receives the ciphertext data and stores it in a local cache area; The sub-control module extracts the ciphertext data encrypted by the public key through the built-in national secret security chip, and decrypts it using the corresponding private key to obtain the original identity authentication data; The sub-control module returns the decrypted identity authentication data through an encryption channel, and the centralized control module receives the returned data and stores it in a temporary verification area; The centralized control module verifies the returned data received and the initially generated identity authentication data by comparison algorithm to determine whether they are consistent; If the comparison result is consistent, the centralized control module generates an authentication pass message through the built-in key, encrypts it using the public key of the sub-control module to obtain an encrypted authentication message; The centralized control module sends the encrypted authentication message through a transmission channel, and the sub-control module receives the encrypted authentication message and decrypts it using the private key to obtain a plaintext authentication pass message; The sub-control module confirms the identity is legal by analyzing the plaintext authentication pass message, obtains the business interaction permission and enters the normal business interaction state.

8. The method for security encryption protection of air cooled control data according to claim 1, wherein, In step (7), according to the running data, corresponding control instruction data is generated; the control instruction data is encrypted by a symmetric encryption algorithm through a group encryption method to obtain encrypted control instruction data; The encrypted control instruction data is obtained, and the SHA-256 algorithm is used to calculate the integrity check value; According to the integrity check value, the check value is attached to the tail of the encrypted control instruction data to form a complete data packet, and then the encrypted control instruction data with the check value is sent to the sub-control module through a transmission channel; The data received by the sub-control module is used to calculate the check value using the same SHA-256 algorithm and key, and it is judged whether it is consistent with the received check value; If the check values are consistent, it is determined that the data has not been tampered with, and the available control instruction data is obtained for executing the adjustment operation of the cooling system.

Images