Hierarchical protection method and system for collected data of power system

Abstract

The invention discloses a hierarchical protection method for collected data of an electric power system. The method comprises the following steps: acquiring data information of the collected data of a target electric power system; grading the collected data of the target power system; setting a data protection scheme of each level; setting a key management scheme of the target power system; and completing hierarchical protection of the collected data of the power system according to the obtained data information. The invention also discloses a system for realizing the hierarchical protection method for the acquired data of the power system. According to the method and the system, by grading the collected data of the power system and independently setting the data scheme and the key management scheme for the graded data, the graded protection of the collected data of the power system is realized, the reliability is higher, the process of indiscriminate encryption of all the data is avoided, and the efficiency is higher.

Description

Technical Field

[0001] The present invention belongs to the field of electrical automation, and in particular relates to a hierarchical protection method and system for collecting data of an electric power system. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring the stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] At present, more and more smart terminals are being used in power systems, such as drones, distributed photovoltaics, and charging piles. These smart terminals will generate a large amount of data of different types and different sensitivities, such as geographic location, electricity customer information, and power grid operation status. At the same time, smart terminals will also upload data to the power system through wired or wireless means to improve the reliability and accuracy of power system operation. However, this type of data faces the security risk of data leakage during data transmission. Once this type of data is leaked, especially some highly sensitive data, it may pose a serious threat to the safe and stable operation of the power system, and even cause safety accidents. Therefore, hierarchical protection of this type of data is particularly important.

[0004] At present, in response to the above problems, the power system adopts a data encryption scheme. The data encryption scheme can convert plaintext data into ciphertext data, making it impossible for unauthorized users to read the data content, thereby ensuring the security of the data. However, the existing data encryption scheme often changes the length of the data format and is not suitable for the encryption requirements of all data. Moreover, the existing data encryption scheme will indiscriminately encrypt all data, which undoubtedly increases the burden on the power system and has poor overall efficiency. Summary of the invention

[0005] One of the purposes of the present invention is to provide a hierarchical protection method for collecting data of an electric power system with high reliability and efficiency.

[0006] A second object of the present invention is to provide a system for implementing the hierarchical protection method for collecting data in the power system.

[0007] The hierarchical protection method for collecting data of the power system provided by the present invention comprises the following steps:

[0008] S1. Obtain data information of the target power system's collected data;

[0009] S2. Classify the collected data of the target power system according to the data information obtained in step S1;

[0010] S3. According to the classification results obtained in step S2, set data protection schemes at various levels;

[0011] S4. According to the data information obtained in step S2, a key management scheme for the target power system is set;

[0012] S5. Based on the data information obtained in steps S2 to S4, the hierarchical protection of the collected data of the power system is completed.

[0013] Step S2, according to the data information obtained in step S1, classifies the collected data of the target power system, and specifically includes the following steps:

[0014] According to the data information obtained in step S1, the collected data is classified according to the voltage level and data category corresponding to the collected data;

[0015] The classification includes a low sensitivity level, a medium sensitivity level and a high sensitivity level.

[0016] Step S3 sets data protection schemes at different levels according to the classification results obtained in step S2, and specifically includes the following steps:

[0017] No dedicated protection measures are used for collected data with low sensitivity levels;

[0018] For the collected data of medium sensitivity level, ordinary protection measures are adopted; the ordinary protection measures include watermark embedding and access control;

[0019] Advanced protection measures are adopted for collected data with high sensitivity levels; the advanced protection measures include: for data with restrictions on transmission and storage formats, or data that needs to be desensitized, the use of a conformal encryption algorithm for protection; for data with no restrictions on transmission and storage formats, or data that does not need to be desensitized, the use of a national secret symmetric encryption algorithm for protection.

[0020] The conformal encryption algorithm specifically includes the following steps:

[0021] A. Divide the data into two groups of equal length, represented as left group A and right group B, and set the current left group A1 to A and the current right group B1 to B;

[0022] B. There are N iterations in total, and the number of iterations i ranges from 0 to N-1. Each iteration includes the following steps:

[0023] B1. Use the following formula to calculate the fixed string Q:

[0024] Q=T||[0] (-t-b-1) mod16||[i] 1 ||[NUMradix (B)] b

[0025] Where T is the algorithm identifier; || is a string concatenation operation; [0] is a string consisting of 0s; t is the block size of the input data; b is the number of bits required for the cardinality of the input data; [i] is the binary representation of the current round number i; [NUM radix (B)] is the binary representation of base B;

[0026] B2. Calculate the round key R using the following formula:

[0027] R=PRF K (P||Q)

[0028] Where PRF K () is a reversible permutation function; P is a counter value, used to indicate the serial number of the round key being generated;

[0029] B3. The obtained R is processed by the CIPHK function for a set number of rounds, and the first several bytes of the processing result are obtained as the output S of the round function;

[0030] B4. Use the following formula to convert S into an integer:

[0031] y=NUM2(S)

[0032] Where y is the integer part of the output of the round function; NUM2() is the rounding function;

[0033] B5. Determine the current number of iterations i:

[0034] If i is an even number, set the value of the current left group A to y;

[0035] If i is an odd number, set the value of the current right group B to y;

[0036] B6. Use the following formula to calculate the output c of a round of Feistel network:

[0037] c=(NUM radix (A)+y)modradix m

[0038] Where NUM radix (A) is to convert the current left group A into a value based on the base radix; radix is ​​the base of the input data; m is the length of the current left group A, that is, the number of elements contained in A;

[0039] B7. Use the following formula to convert the output c of a round of Feistel network into a string form:

[0040]

[0041] Where C is the encrypted string; It is a function for converting numeric values ​​to strings;

[0042] B8. Modify the current left group A1 and the current right group B1:

[0043] Correct the value of the current left group A1 to the value of the current right group B1, and correct the value of the current right group B1 to C;

[0044] C. After the iteration of step B is completed, the current left group A1 and the current right group B1 are finally merged to obtain the encryption result.

[0045] The permutation function specifically adopts the CBC encryption mode.

[0046] The processing of the CIPHK function includes the following steps:

[0047] The CIPHK function is based on the Feistel structure and includes several iterations. Each iteration includes the following steps:

[0048] a. Divide the input data into two equal parts;

[0049] b. For the right part of the data in step a, use the obtained round key to calculate the round function: concatenate the right part of the data with the current round key, encrypt it using AES, and finally take the first several bytes of the encryption result as the output of the round function;

[0050] c. Perform an XOR operation on the output of the round function and the right partial data in step a, set the right partial data in step a as the new left partial data, and set the XOR result as the new right partial data to complete the iteration of the current round.

[0051] Step S4, according to the data information obtained in step S2, sets the key management scheme of the target power system, which specifically includes the following steps:

[0052] According to the data collection method of the power system, the key management scheme of the target power system is set;

[0053] Among them, the methods of data collection in the power system include network transmission and local mobile device copying;

[0054] The key management schemes set for local mobile device copying include:

[0055] A local terminal is used to temporarily generate a symmetric encryption key, and the generated symmetric encryption key is destroyed after the copying is completed; during the copying process, a dedicated confidentiality area is generated in the local mobile device to store the collected data of the power system;

[0056] The key management schemes set for network transmission include:

[0057] Establish a key management server; distribute and manage keys through the key management server.

[0058] The key generation method includes the following steps:

[0059] When you need to generate a key, get the current timestamp;

[0060] Use the SHA-256 algorithm to encrypt the acquired timestamp;

[0061] For the encrypted data, a fixed number of bits is intercepted as the key.

[0062] The present invention also provides a system for implementing the hierarchical protection method for the collected data of the power system, comprising a data acquisition module, a data classification module, a protection design module, a key management module and a hierarchical protection module; the data acquisition module, the data classification module, the protection design module, the key management module and the hierarchical protection module are connected in series in sequence; the data acquisition module is used to acquire data information of the collected data of the target power system, and upload the data information to the data classification module; the data classification module is used to classify the collected data of the target power system according to the received data information and the acquired data information, and upload the data information to the protection design module; the protection design module is used to set data protection schemes of various levels according to the received data information and the obtained classification results, and upload the data information to the key management module; the key management module is used to set the key management scheme of the target power system according to the received data information and the acquired data information, and upload the data information to the hierarchical protection module; the hierarchical protection module is used to complete the hierarchical protection of the collected data of the power system according to the received data information.

[0063] The hierarchical protection method and system for power system collected data provided by the present invention, by grading the power system collected data and separately setting data schemes and key management schemes for the graded data, not only achieves hierarchical protection of power system collected data with higher reliability, but also avoids the process of indiscriminate encryption of all data, thereby increasing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 The figure is a schematic diagram of the method flow of the present invention.

[0065] Figure 2Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0066] like Figure 1 The method flow chart of the method of the present invention is shown as follows: The hierarchical protection method for collecting data of the power system disclosed in the present invention comprises the following steps:

[0067] S1. Obtain data information of the target power system's collected data;

[0068] S2. According to the data information obtained in step S1, the collected data of the target power system is classified; specifically comprising the following steps:

[0069] According to the data information obtained in step S1, the collected data is classified according to the voltage level and data category corresponding to the collected data; at the same time, it is ensured that the classification result of the collected data can also be manually adjusted in real time;

[0070] The classification includes low sensitivity level, medium sensitivity level and high sensitivity level;

[0071] S3. According to the classification results obtained in step S2, set the data protection scheme for each level; specifically comprising the following steps:

[0072] No dedicated protection measures are used for collected data with low sensitivity levels;

[0073] For the collected data of medium sensitivity level, ordinary protection measures are adopted; the ordinary protection measures include watermark embedding and access control;

[0074] For highly sensitive collected data, advanced protection measures are adopted; the advanced protection measures include: for data with limited transmission and storage formats, or data that needs to be desensitized, the conformal encryption algorithm is used for protection; for data with no restrictions on transmission and storage formats, or data that does not need to be desensitized, the national secret symmetric encryption algorithm (such as SM4) is used for protection;

[0075] The conformal encryption algorithm specifically includes the following steps:

[0076] A. Divide the data into two groups of equal length, represented as left group A and right group B, and set the current left group A1 to A and the current right group B1 to B;

[0077] B. There are N iterations in total, and the number of iterations i ranges from 0 to N-1. Each iteration includes the following steps:

[0078] B1. Use the following formula to calculate the fixed string Q:

[0079] Q=T||[0] (-t-b-1)mod16||[i] 1 ||[NUM radix (B)] b

[0080] Where T is the algorithm identifier; || is a string concatenation operation; [0] is a string consisting of 0s; t is the block size of the input data; b is the number of bits required for the cardinality of the input data; [i] is the binary representation of the current round number i; [NUM radix (B)] is the binary representation of base B;

[0081] B2. Calculate the round key R using the following formula:

[0082] R=PRF K (P||Q)

[0083] Where PRF K () is a reversible permutation function; P is a counter value, used to indicate the serial number of the round key being generated;

[0084] B3. The obtained R is processed by the CIPHK function for a set number of rounds, and the first several bytes of the processing result are obtained as the output S of the round function;

[0085] B4. Use the following formula to convert S into an integer:

[0086] y=NUM2(S)

[0087] Where y is the integer part of the output of the round function; NUM2() is the rounding function;

[0088] B5. Determine the current number of iterations i:

[0089] If i is an even number, set the value of the current left group A to y;

[0090] If i is an odd number, set the value of the current right group B to y;

[0091] B6. Use the following formula to calculate the output c of a round of Feistel network:

[0092] c=(NUM radix (A)+y)modradix m

[0093] Where NUM radix (A) is to convert the current left group A into a value based on the base radix; radix is ​​the base of the input data; m is the length of the current left group A, that is, the number of elements contained in A;

[0094] B7. Use the following formula to convert the output c of a round of Feistel network into a string form:

[0095]

[0096] Where C is the encrypted string; It is a function for converting numeric values ​​to strings;

[0097] B8. Modify the current left group A1 and the current right group B1:

[0098] Correct the value of the current left group A1 to the value of the current right group B1, and correct the value of the current right group B1 to C;

[0099] C. After the iteration of step B is completed, the current left group A1 and the current right group B1 are finally merged to obtain the encryption result.

[0100] The permutation function specifically adopts the CBC encryption mode.

[0101] The processing of the CIPHK function includes the following steps:

[0102] The CIPHK function is based on the Feistel structure and includes several iterations. Each iteration includes the following steps:

[0103] a. Divide the input data into two equal parts;

[0104] b. For the right part of the data in step a, use the obtained round key to calculate the round function: concatenate the right part of the data with the current round key, encrypt it using AES, and finally take the first several bytes of the encryption result as the output of the round function;

[0105] c. Perform an XOR operation on the output of the round function and the right partial data in step a, set the right partial data in step a as the new left partial data, and set the XOR result as the new right partial data to complete the iteration of the current round.

[0106] By adopting the improved conformal encryption algorithm proposed by the present invention, the data type and data length of the data itself can be kept unchanged, and the encryption is more invisible; at the same time, some subsequent operations on the data can be performed without considering the data deformation caused by encryption; in addition, it can also ensure that the data always meets the data storage format requirements of certain file types; finally, the scheme of the present invention can also cooperate with the idea of ​​hierarchical protection, and allocate encryption operations according to data processing needs and data importance, so as to ensure both good effect and good performance;

[0107] S4. According to the data information obtained in step S2, a key management scheme for the target power system is set; specifically comprising the following steps:

[0108] According to the data collection method of the power system, the key management scheme of the target power system is set;

[0109] Among them, the methods of data collection in the power system include network transmission and local mobile device copying (such as USB flash drive);

[0110] The key management schemes set for local mobile device copying include:

[0111] A local terminal is used to temporarily generate a symmetric encryption key, and the generated symmetric encryption key is destroyed after the copying is completed; during the copying process, a dedicated confidentiality area is generated in the local mobile device to store the collected data of the power system;

[0112] In specific implementation, such as in drone inspection scenarios, the drone remote control terminal can be used to generate symmetric encryption keys, and the drone remote control terminal destroys the keys after use;

[0113] The key management schemes set for network transmission include:

[0114] Establish a key management server; distribute and manage keys through the key management server;

[0115] In specific implementation, the key generation method includes the following steps:

[0116] When you need to generate a key, get the current timestamp;

[0117] Use the SHA-256 algorithm to encrypt the acquired timestamp;

[0118] For the encrypted data, a fixed number of bits is intercepted as the key;

[0119] This encryption method can ensure the randomness and security of the key;

[0120] S5. Based on the data information obtained in steps S2 to S4, the hierarchical protection of the collected data of the power system is completed.

[0121] The subsequent decryption process can be carried out in reverse according to the above encryption process.

[0122] like Figure 2The figure shows a schematic diagram of the functional modules of the system of the present invention: the system of the hierarchical protection method for realizing the electric power system collected data disclosed in the present invention comprises a data acquisition module, a data classification module, a protection design module, a key management module and a hierarchical protection module; the data acquisition module, the data classification module, the protection design module, the key management module and the hierarchical protection module are connected in series in sequence; the data acquisition module is used to acquire data information of the collected data of the target electric power system, and upload the data information to the data classification module; the data classification module is used to classify the collected data of the target electric power system according to the received data information and the acquired data information, and upload the data information to the protection design module; the protection design module is used to set data protection schemes of various levels according to the received data information and the obtained classification results, and upload the data information to the key management module; the key management module is used to set the key management scheme of the target electric power system according to the received data information and the acquired data information, and upload the data information to the hierarchical protection module; the hierarchical protection module is used to complete the hierarchical protection of the electric power system collected data according to the received data information.

Claims

1. A hierarchical protection method for collecting data in a power system, comprising the following steps: S1. Obtain data information of the target power system's collected data; S2. Classify the collected data of the target power system according to the data information obtained in step S1; S3. According to the classification results obtained in step S2, set data protection schemes at various levels; S4. According to the data information obtained in step S2, a key management scheme for the target power system is set; S5. Based on the data information obtained in steps S2 to S4, the hierarchical protection of the collected data of the power system is completed.

2. The hierarchical protection method for power system data collection according to claim 1 is characterized in that Step S2, according to the data information obtained in step S1, classifies the collected data of the target power system, and specifically includes the following steps: According to the data information obtained in step S1, the collected data is classified according to the voltage level and data category corresponding to the collected data; The classification includes a low sensitivity level, a medium sensitivity level and a high sensitivity level.

3. The hierarchical protection method for collecting data in a power system according to claim 2 is characterized in that Step S3 sets data protection schemes at different levels according to the classification results obtained in step S2, and specifically includes the following steps: No dedicated protection measures are used for collected data with low sensitivity levels; For the collected data of medium sensitivity level, ordinary protection measures are adopted; the ordinary protection measures include watermark embedding and access control; For highly sensitive collected data, advanced protection measures are adopted; the advanced protection measures include: for data with limited transmission and storage formats, or data that needs to be desensitized, the use of conformal encryption algorithms for protection; For data with no restrictions on transmission and storage formats, or data that does not require desensitization, the national secret symmetric encryption algorithm is used for protection.

4. The hierarchical protection method for power system data collection according to claim 3 is characterized in that The conformal encryption algorithm specifically includes the following steps: A. Divide the data into two groups of equal length, represented as left group A and right group B, and set the current left group A1 to A and the current right group B1 to B; B. There are N iterations in total, and the number of iterations i ranges from 0 to N-1. Each iteration includes the following steps: B1. Use the following formula to calculate the fixed string Q: Q=T||[0] (-t-b-1) mod16||[i] 1 ||[NUM radix (B)] b Where T is the algorithm identifier; || is the string concatenation operation; [0] is a string consisting of 0s; t is the block size of the input data; b is the number of bits required for the cardinality of the input data; [i] is the binary representation of the current round number i; [NUM radix (B)] is the binary representation of base B; B2. Calculate the round key R using the following formula: R=PRF K (P||Q) Where PRF K () is a reversible permutation function; P is a counter value, used to indicate the serial number of the round key being generated; B3. The obtained R is processed by the CIPHK function for a set number of rounds, and the first several bytes of the processing result are obtained as the output S of the round function; B4. Use the following formula to convert S into an integer: y=NUM2(S) Where y is the integer part of the output of the round function; NUM2() is the rounding function; B5. Determine the current number of iterations i: If i is an even number, set the value of the current left group A to y; If i is an odd number, set the value of the current right group B to y; B6. Use the following formula to calculate the output c of a round of Feistel network: c=(NUM radix (A)+y)modradix m Where NUM radix (A) is to convert the current left group A into a value based on the base radix; radix is ​​the base of the input data; m is the length of the current left group A; B7. Use the following formula to convert the output c of a round of Feistel network into a string form: Where C is the encrypted string; It is a function for converting numeric values ​​to strings; B8. Modify the current left group A1 and the current right group B1: Correct the value of the current left group A1 to the value of the current right group B1, and correct the value of the current right group B1 to C; C. After the iteration of step B is completed, the current left group A1 and the current right group B1 are finally merged to obtain the encryption result.

5. The hierarchical protection method for collecting data in a power system according to claim 4 is characterized in that The permutation function specifically adopts the CBC encryption mode.

6. The hierarchical protection method for collecting data in a power system according to claim 5 is characterized in that The processing of the CIPHK function includes the following steps: The CIPHK function is based on the Feistel structure and includes several iterations. Each iteration includes the following steps: a. Divide the input data into two equal parts; b. For the right part of the data in step a, use the obtained round key to calculate the round function: concatenate the right part of the data with the current round key, encrypt it using AES, and finally take the first several bytes of the encryption result as the output of the round function; c. Perform an XOR operation on the output of the round function and the right partial data in step a, set the right partial data in step a as the new left partial data, and set the XOR result as the new right partial data to complete the iteration of the current round.

7. The hierarchical protection method for power system data collection according to claim 6 is characterized in that Step S4, according to the data information obtained in step S2, sets the key management scheme of the target power system, which specifically includes the following steps: According to the data collection method of the power system, the key management scheme of the target power system is set; Among them, the methods of data collection in the power system include network transmission and local mobile device copying; The key management schemes set for local mobile device copying include: A local terminal is used to temporarily generate a symmetric encryption key, and the generated symmetric encryption key is destroyed after the copying is completed; during the copying process, a dedicated confidentiality area is generated in the local mobile device to store the collected data of the power system; The key management schemes set for network transmission include: Establish a key management server; distribute and manage keys through the key management server.

8. The hierarchical protection method for collecting data in a power system according to claim 7 is characterized in that The key generation method includes the following steps: When you need to generate a key, get the current timestamp; Use the SHA-256 algorithm to encrypt the acquired timestamp; For the encrypted data, a fixed number of bits is intercepted as the key.

9. A system for implementing the hierarchical protection method for collecting data in a power system according to any one of claims 1 to 8, characterized in that It includes a data acquisition module, a data classification module, a protection design module, a key management module and a hierarchical protection module; the data acquisition module, the data classification module, the protection design module, the key management module and the hierarchical protection module are connected in series in sequence; the data acquisition module is used to obtain data information of the collected data of the target power system, and upload the data information to the data classification module; The data classification module is used to classify the collected data of the target power system according to the received data information and upload the data information to the protection design module; The protection design module is used to set data protection schemes at various levels according to the received data information and the obtained classification results, and upload the data information to the key management module; The key management module is used to set the key management scheme of the target power system according to the received data information and upload the data information to the hierarchical protection module; The hierarchical protection module is used to complete hierarchical protection of the power system collected data based on the received data information.

Images