Hierarchical protection method and system for power system data collection

Abstract

The present invention discloses a hierarchical protection method for data collected by an electric power system, comprising obtaining data information of the data collected by the target electric power system; grading the data collected by the target electric power system; setting data protection schemes at various levels; setting a key management scheme for the target electric power system; and completing hierarchical protection of the data collected by the electric power system based on the obtained data information. The present invention also discloses a system for implementing the hierarchical protection method for data collected by the electric power system. The present invention not only achieves hierarchical protection of data collected by the electric power system by grading the data collected by the electric power system and separately setting data schemes and key management schemes for graded data, thereby achieving higher reliability, but also avoids the process of indiscriminate encryption of all data, thereby achieving higher efficiency.

Description

Technical Field

[0001] The present invention belongs to the field of electrical automation, and in particular relates to a hierarchical protection method and system for collecting data in an electric power system. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring a stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] Currently, an increasing number of smart terminals are being used in power systems, such as drones, distributed photovoltaic systems, and charging stations. These smart terminals generate large amounts of data of varying types and sensitivities, including geographic location, customer information, and grid operating status. Furthermore, these smart terminals upload this data to the power system via wired or wireless means to improve the reliability and accuracy of power system operations. However, this data carries the security risk of data leakage during transmission. Leakage of this data, especially of highly sensitive data, could pose a serious threat to the safe and stable operation of the power system and even trigger a safety incident. Therefore, the hierarchical protection of this type of data is particularly important.

[0004] Currently, power systems utilize data encryption solutions to address these issues. These solutions convert plaintext data into ciphertext, making it inaccessible to unauthorized users and thus ensuring data security. However, existing data encryption solutions often alter the length of the data format and are not suitable for all data encryption needs. Furthermore, existing data encryption solutions indiscriminately encrypt all data, which undoubtedly increases the burden on power systems and reduces overall efficiency. Summary of the Invention

[0005] One of the objectives of the present invention is to provide a hierarchical protection method for collecting data of an electric power system with high reliability and efficiency.

[0006] A second object of the present invention is to provide a system for implementing the hierarchical protection method for collecting data of the power system.

[0007] The hierarchical protection method for collecting data of a power system provided by the present invention comprises the following steps:

[0008] S1. Obtain data information of the target power system's collected data;

[0009] S2. According to the data information obtained in step S1, the collected data of the target power system is classified;

[0010] S3. According to the classification results obtained in step S2, set the data protection scheme for each level;

[0011] S4. According to the data information obtained in step S2, set the key management scheme of the target power system;

[0012] S5. Based on the data information obtained in steps S2 to S4, complete the hierarchical protection of the power system collected data.

[0013] Step S2, based on the data information acquired in step S1, classifies the collected data of the target power system, and specifically includes the following steps:

[0014] Based on the data information obtained in step S1, the collected data is classified according to the voltage level and data category corresponding to the collected data;

[0015] The classification includes a low sensitivity level, a medium sensitivity level and a high sensitivity level.

[0016] Step S3, based on the classification results obtained in step S2, sets data protection plans for each level, specifically including the following steps:

[0017] For collected data with low sensitivity levels, no dedicated protection measures are adopted;

[0018] For collected data of medium sensitivity level, common protection measures are adopted; the common protection measures include watermark embedding and access control;

[0019] For collected data with high sensitivity levels, advanced protection measures are adopted; the advanced protection measures include: for data with restrictions on transmission and storage formats, or data that needs to be desensitized, the use of a conformal encryption algorithm for protection; for data with no restrictions on transmission and storage formats, or data that does not require desensitization, the use of a national secret symmetric encryption algorithm for protection.

[0020] The conformal encryption algorithm specifically includes the following steps:

[0021] A. Divide the data into two equal-length groups, denoted as left group A and right group B, and set the current left group A1 to A and the current right group B1 to B;

[0022] B. Iterate N times in total, with the number of iterations i ranging from 0 to N-1. Each iteration includes the following steps:

[0023] B1. Use the following formula to calculate the fixed string Q:

[0024] Q=T||[0] (-t-b-1) mod16||[i] 1 ||[NUMradix (B)] b

[0025] Where T is the algorithm identifier; || is the string concatenation operation; [0] is a string consisting of 0s; t is the block size of the input data; b is the number of bits required for the cardinality of the input data; [i] is the binary representation of the current round number i; [NUM radix (B)] is the binary representation of base B;

[0026] B2. Calculate the round key R using the following formula:

[0027] R=PRF K (P||Q)

[0028] Where PRF K () is a reversible permutation function; P is a counter value used to indicate the serial number of the round key being generated;

[0029] B3. The obtained R is processed by the CIPHK function for a set number of rounds and the first several bytes of the processing result are obtained as the output S of the round function;

[0030] B4. Use the following formula to convert S into an integer:

[0031] y=NUM2(S)

[0032] Where y is the integer part of the output of the round function; NUM2() is the rounding function;

[0033] B5. Determine the current number of iterations i:

[0034] If i is an even number, set the value of the current left group A to y;

[0035] If i is an odd number, set the value of the current right group B to y;

[0036] B6. Use the following formula to calculate the output c of one round of the Feistel network:

[0037] c=(NUM radix (A)+y)modradix m

[0038] Where NUM radix (A) converts the current left group A into a value based on the base number radix; radix is ​​the base number of the input data; m is the length of the current left group A, that is, the number of elements contained in A;

[0039] B7. Use the following formula to convert the output c of one round of the Feistel network into a string:

[0040]

[0041] Where C is the encrypted string; It is a function for converting numeric values ​​to strings;

[0042] B8. Modify the current left group A1 and the current right group B1:

[0043] Correct the value of the current left group A1 to the value of the current right group B1, and correct the value of the current right group B1 to C;

[0044] C. After the iteration of step B is completed, the current left group A1 and the current right group B1 are finally merged to obtain the encryption result.

[0045] The permutation function specifically adopts the CBC encryption mode.

[0046] The processing of the CIPHK function includes the following steps:

[0047] The CIPHK function is based on the Feistel structure and includes several iteration rounds. Each iteration round includes the following steps:

[0048] a. Divide the input data into two equal parts;

[0049] b. For the right part of the data in step a, use the round key obtained to calculate the round function: concatenate the right part of the data with the current round key and encrypt it using AES. Finally, take the first several bytes of the encrypted result as the output of the round function;

[0050] c. Perform an XOR operation on the output of the round function and the right partial data in step a, set the right partial data in step a to the new left partial data, and set the XOR result to the new right partial data to complete the iteration of the current round.

[0051] Step S4, according to the data information obtained in step S2, sets the key management scheme of the target power system, which specifically includes the following steps:

[0052] Set up a key management scheme for the target power system based on the way the power system collects data;

[0053] Among them, the methods of data collection in the power system include network transmission and local mobile device copying;

[0054] The key management schemes set for local mobile device copying include:

[0055] A symmetric encryption key is temporarily generated using a local terminal and destroyed after the copy is completed. During the copy process, a dedicated confidentiality area is generated in the local mobile device to store the collected data of the power system.

[0056] The key management schemes set for network transmission include:

[0057] Establish a key management server; distribute and manage keys through the key management server.

[0058] The key generation method includes the following steps:

[0059] When you need to generate a key, get the current timestamp;

[0060] Use the SHA-256 algorithm to encrypt the obtained timestamp;

[0061] For the encrypted data, a fixed number of bits is intercepted and used as the key.

[0062] The present invention also provides a system for implementing the hierarchical protection method for the collected data of the power system, comprising a data acquisition module, a data classification module, a protection design module, a key management module and a hierarchical protection module; the data acquisition module, the data classification module, the protection design module, the key management module and the hierarchical protection module are connected in series in sequence; the data acquisition module is used to acquire data information of the collected data of the target power system, and upload the data information to the data classification module; the data classification module is used to classify the collected data of the target power system according to the received data information and the acquired data information, and upload the data information to the protection design module; the protection design module is used to set data protection schemes for each level according to the received data information and the obtained classification results, and upload the data information to the key management module; the key management module is used to set the key management scheme of the target power system according to the received data information and the acquired data information, and upload the data information to the hierarchical protection module; the hierarchical protection module is used to complete the hierarchical protection of the collected data of the power system according to the received data information.

[0063] The hierarchical protection method and system for power system collected data provided by the present invention, by grading the power system collected data and separately setting data schemes and key management schemes for the graded data, not only achieves hierarchical protection of power system collected data with higher reliability, but also avoids the process of indiscriminate encryption of all data, thereby improving efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 Schematic diagram of the process of the present invention.

[0065] Figure 2Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0066] like Figure 1 The method flow diagram of the present invention is shown as follows: The hierarchical protection method for collecting data of the power system disclosed in the present invention includes the following steps:

[0067] S1. Obtain data information of the target power system's collected data;

[0068] S2. Based on the data information obtained in step S1, the collected data of the target power system is classified; specifically comprising the following steps:

[0069] Based on the data information obtained in step S1, the collected data is classified according to the voltage level and data category corresponding to the collected data; at the same time, it is ensured that the classification results of the collected data can also be manually adjusted in real time;

[0070] The classification includes low sensitivity level, medium sensitivity level and high sensitivity level;

[0071] S3. According to the classification results obtained in step S2, set the data protection scheme for each level; specifically comprising the following steps:

[0072] For collected data with low sensitivity levels, no dedicated protection measures are adopted;

[0073] For collected data of medium sensitivity level, common protection measures are adopted; the common protection measures include watermark embedding and access control;

[0074] For highly sensitive collected data, advanced protection measures are adopted. These advanced protection measures include: for data with restricted transmission and storage formats, or data that requires desensitization, the use of a conformal encryption algorithm for protection; for data with no restrictions on transmission and storage formats, or data that does not require desensitization, the use of a national secret symmetric encryption algorithm (such as SM4) for protection;

[0075] The conformal encryption algorithm specifically includes the following steps:

[0076] A. Divide the data into two equal-length groups, denoted as left group A and right group B, and set the current left group A1 to A and the current right group B1 to B;

[0077] B. Iterate N times in total, with the number of iterations i ranging from 0 to N-1. Each iteration includes the following steps:

[0078] B1. Use the following formula to calculate the fixed string Q:

[0079] Q=T||[0] (-t-b-1)mod16||[i] 1 ||[NUM radix (B)] b

[0080] Where T is the algorithm identifier; || is the string concatenation operation; [0] is a string consisting of 0s; t is the block size of the input data; b is the number of bits required for the cardinality of the input data; [i] is the binary representation of the current round number i; [NUM radix (B)] is the binary representation of base B;

[0081] B2. Calculate the round key R using the following formula:

[0082] R=PRF K (P||Q)

[0083] Where PRF K () is a reversible permutation function; P is a counter value used to indicate the serial number of the round key being generated;

[0084] B3. The obtained R is processed by the CIPHK function for a set number of rounds and the first several bytes of the processing result are obtained as the output S of the round function;

[0085] B4. Use the following formula to convert S into an integer:

[0086] y=NUM2(S)

[0087] Where y is the integer part of the output of the round function; NUM2() is the rounding function;

[0088] B5. Determine the current number of iterations i:

[0089] If i is an even number, set the value of the current left group A to y;

[0090] If i is an odd number, set the value of the current right group B to y;

[0091] B6. Use the following formula to calculate the output c of one round of the Feistel network:

[0092] c=(NUM radix (A)+y)modradix m

[0093] Where NUM radix (A) converts the current left group A into a value based on the base number radix; radix is ​​the base number of the input data; m is the length of the current left group A, that is, the number of elements contained in A;

[0094] B7. Use the following formula to convert the output c of one round of the Feistel network into a string:

[0095]

[0096] Where C is the encrypted string; It is a function for converting numeric values ​​to strings;

[0097] B8. Modify the current left group A1 and the current right group B1:

[0098] Correct the value of the current left group A1 to the value of the current right group B1, and correct the value of the current right group B1 to C;

[0099] C. After the iteration of step B is completed, the current left group A1 and the current right group B1 are finally merged to obtain the encryption result.

[0100] The permutation function specifically adopts the CBC encryption mode.

[0101] The processing of the CIPHK function includes the following steps:

[0102] The CIPHK function is based on the Feistel structure and includes several iteration rounds. Each iteration round includes the following steps:

[0103] a. Divide the input data into two equal parts;

[0104] b. For the right part of the data in step a, use the round key obtained to calculate the round function: concatenate the right part of the data with the current round key and encrypt it using AES. Finally, take the first several bytes of the encrypted result as the output of the round function;

[0105] c. Perform an XOR operation on the output of the round function and the right partial data in step a, set the right partial data in step a to the new left partial data, and set the XOR result to the new right partial data to complete the iteration of the current round.

[0106] The improved conformal encryption algorithm proposed by the present invention does not change the data type and length, making encryption more invisible. At the same time, subsequent operations on the data can be performed without worrying about data deformation caused by encryption. Furthermore, it ensures that the data always conforms to the data storage format requirements of certain file types. Finally, the present invention can also incorporate the concept of hierarchical protection, allocating encryption operations based on data processing needs and data importance, ensuring both good results and good performance.

[0107] S4. According to the data information obtained in step S2, a key management scheme for the target power system is set; specifically comprising the following steps:

[0108] Set up a key management scheme for the target power system based on the way the power system collects data;

[0109] Among them, the methods of data collection in the power system include network transmission and copying to local mobile devices (such as USB flash drives);

[0110] The key management schemes set for local mobile device copying include:

[0111] A symmetric encryption key is temporarily generated using a local terminal and destroyed after the copy is completed. During the copy process, a dedicated confidentiality area is generated in the local mobile device to store the collected data of the power system.

[0112] In specific implementation, such as drone inspection scenarios, the drone remote control terminal can be used to generate a symmetric encryption key, and the drone remote control terminal will destroy the key after use;

[0113] The key management schemes set for network transmission include:

[0114] Establish a key management server; distribute and manage keys through the key management server;

[0115] In specific implementation, the key generation method includes the following steps:

[0116] When you need to generate a key, get the current timestamp;

[0117] Use the SHA-256 algorithm to encrypt the obtained timestamp;

[0118] For the encrypted data, a fixed number of bits is intercepted as the key;

[0119] This encryption method can ensure the randomness and security of the key;

[0120] S5. Based on the data information obtained in steps S2 to S4, complete the hierarchical protection of the power system collected data.

[0121] The subsequent decryption process is to perform the reverse process according to the above encryption process.

[0122] like Figure 2The figure shows a schematic diagram of the functional modules of the system of the present invention: the system disclosed in the present invention for realizing the hierarchical protection method of the power system collected data includes a data acquisition module, a data classification module, a protection design module, a key management module and a hierarchical protection module; the data acquisition module, the data classification module, the protection design module, the key management module and the hierarchical protection module are connected in series in sequence; the data acquisition module is used to acquire data information of the collected data of the target power system, and upload the data information to the data classification module; the data classification module is used to classify the collected data of the target power system according to the received data information and the acquired data information, and upload the data information to the protection design module; the protection design module is used to set data protection schemes for each level according to the received data information and the obtained classification results, and upload the data information to the key management module; the key management module is used to set the key management scheme of the target power system according to the received data information and the acquired data information, and upload the data information to the hierarchical protection module; the hierarchical protection module is used to complete the hierarchical protection of the power system collected data according to the received data information.

Claims

1. A hierarchical protection method for power system data collection, comprising the following steps: S1. Obtain data information of the target power system's collected data; S2. According to the data information obtained in step S1, the collected data of the target power system is classified; S3. According to the classification results obtained in step S2, set the data protection scheme for each level; specifically comprising the following steps: For collected data with low sensitivity levels, no dedicated protection measures are adopted; For collected data of medium sensitivity level, common protection measures are adopted; the common protection measures include watermark embedding and access control; For highly sensitive collected data, advanced protection measures are adopted; the advanced protection measures include: For data with limited transmission and storage formats, or data that needs to be desensitized, a conformal encryption algorithm is used for protection; for data with no restrictions on transmission and storage formats, or data that does not require desensitization, a national secret symmetric encryption algorithm is used for protection; The conformal encryption algorithm specifically includes the following steps: A. Divide the data into two equal-length groups, denoted as left group A and right group B, and set the current left group A1 to A and the current right group B1 to B; B. Iterate N times in total, with the number of iterations i ranging from 0 to N-1. Each iteration includes the following steps: B1. Use the following formula to calculate the fixed string Q: Q=T||[0] (-t-b-1) mod16||[i] 1 ||[NUM radix (B)] b Where T is the algorithm identifier; || is the string concatenation operation; [0] is a string consisting of 0s; t is the block size of the input data; b is the number of bits required for the cardinality of the input data; [i] is the binary representation of the current round number i; [NUM radix (B)] is the binary representation of base B; B2. Calculate the round key R using the following formula: R=PRF K (P||Q) Where PRF K () is a reversible permutation function; P is a counter value used to indicate the serial number of the round key being generated; B3. The obtained R is processed by the CIPHK function for a set number of rounds and the first several bytes of the processing result are obtained as the output S of the round function; B4. Use the following formula to convert S into an integer: y=NUM2(S) Where y is the integer part of the output of the round function; NUM2() is the rounding function; B5. Determine the current number of iterations i: If i is an even number, set the value of the current left group A to y; If i is an odd number, set the value of the current right group B to y; B6. Use the following formula to calculate the output c of one round of the Feistel network: c=(NUM radix (A)+y)modradix m Where NUM radix (A) converts the current left group A into a value based on the radix; radix is ​​the radix of the input data; m is the length of the current left group A; B7. Use the following formula to convert the output c of one round of the Feistel network into a string: Where C is the encrypted string; It is a function for converting numeric values ​​to strings; B8. Modify the current left group A1 and the current right group B1: Correct the value of the current left group A1 to the value of the current right group B1, and correct the value of the current right group B1 to C; C. After the iteration of step B is completed, the final current left group A1 and the current right group B1 are merged to obtain the encryption result; S4. According to the data information obtained in step S2, set the key management scheme of the target power system; S5. Based on the data information obtained in steps S2 to S4, complete the hierarchical protection of the power system collected data.

2. The hierarchical protection method for power system data collection according to claim 1 is characterized in that Step S2, based on the data information acquired in step S1, classifies the collected data of the target power system, and specifically includes the following steps: Based on the data information obtained in step S1, the collected data is classified according to the voltage level and data category corresponding to the collected data; The classification includes a low sensitivity level, a medium sensitivity level and a high sensitivity level.

3. The hierarchical protection method for power system data collection according to claim 1 is characterized in that The permutation function specifically adopts the CBC encryption mode.

4. The hierarchical protection method for power system data collection according to claim 3 is characterized in that The processing of the CIPHK function includes the following steps: The CIPHK function is based on the Feistel structure and includes several iteration rounds. Each iteration round includes the following steps: a. Divide the input data into two equal parts; b. For the right part of the data in step a, use the round key obtained to calculate the round function: concatenate the right part of the data with the current round key and encrypt it using AES. Finally, take the first several bytes of the encrypted result as the output of the round function; c. Perform an XOR operation on the output of the round function and the right partial data in step a, set the right partial data in step a to the new left partial data, and set the XOR result to the new right partial data to complete the iteration of the current round.

5. The hierarchical protection method for power system collected data according to claim 4 is characterized in that Step S4, according to the data information obtained in step S2, sets the key management scheme of the target power system, which specifically includes the following steps: Set up a key management scheme for the target power system based on the way the power system collects data; Among them, the methods of data collection in the power system include network transmission and local mobile device copying; The key management schemes set for local mobile device copying include: A symmetric encryption key is temporarily generated using a local terminal and destroyed after the copy is completed. During the copy process, a dedicated confidentiality area is generated in the local mobile device to store the collected data of the power system. The key management schemes set for network transmission include: Establish a key management server; distribute and manage keys through the key management server.

6. The hierarchical protection method for power system data collection according to claim 5 is characterized in that The key generation method includes the following steps: When you need to generate a key, get the current timestamp; Use the SHA-256 algorithm to encrypt the obtained timestamp; For the encrypted data, a fixed number of bits is intercepted and used as the key.

7. A system for implementing the hierarchical protection method for power system data collection according to any one of claims 1 to 6, characterized in that It includes a data acquisition module, a data classification module, a protection design module, a key management module and a hierarchical protection module; the data acquisition module, the data classification module, the protection design module, the key management module and the hierarchical protection module are connected in series in sequence; the data acquisition module is used to obtain the data information of the collected data of the target power system and upload the data information to the data classification module; The data classification module is used to classify the collected data of the target power system according to the received data information and upload the data information to the protection design module; The protection design module is used to set data protection plans at various levels based on the received data information and the obtained classification results, and upload the data information to the key management module; The key management module is used to set the key management scheme of the target power system based on the received data information and upload the data information to the hierarchical protection module; The hierarchical protection module is used to complete hierarchical protection of power system collected data based on the received data information.

Images