Virtual power plant encryption control method and system based on homomorphic encryption

Abstract

The invention discloses a homomorphic encryption-based virtual power plant encryption control method and system, and the method comprises the steps: building a data collaboration system which comprises a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes and energy utilization nodes; source load data generated by the end node form a homomorphic encryption ciphertext through primary encryption, and the homomorphic encryption ciphertext is sent to the virtual power plant aggregator node; the virtual power plant aggregator node is used as an edge node to fuse energy data in the area to which the node belongs, and the homomorphic encryption ciphertext is subjected to homomorphic encryption processing and then is uploaded to the virtual power plant control center; the virtual power plant control center decrypts the secondarily encrypted ciphertext to obtain energy data; and the virtual power plant control center issues a security policy and a scheduling control instruction to the virtual power plant aggregator. According to the invention, through a bidirectional identity authentication mechanism, it is ensured that only the terminal device with a legal identity can access the virtual power grid operation network, and through a homomorphic encryption technology, information leakage and illegal access are effectively prevented.

Description

Technical Field

[0001] The present invention belongs to the field of power systems, relates to the control technology of virtual power plants, and particularly relates to a virtual power plant encryption control method and system based on homomorphic encryption. Background Art

[0002] A virtual power plant is a power coordination management system that realizes the aggregation and coordinated optimization of distributed energy resources such as distributed power sources, energy storage systems, and controllable loads through advanced information and communication technologies and software systems, and participates in the power market and grid operation as a special power plant.

[0003] From an implementation perspective, a virtual power plant is a complex information system that integrates dispersed energy resources (such as solar photovoltaic, wind power, biomass energy, geothermal energy, energy storage systems, etc.) into a virtual centralized energy system through information and communication technologies, intelligent technologies, and supporting software systems to achieve efficient utilization of energy and supply-demand balance. It can either act as a "positive power plant" to supply power and regulate the peak load of the system, or act as a "negative power plant" to increase load consumption and cooperate with the system to fill valleys.

[0004] From a functional perspective, a virtual power plant is a new type of energy organization form that integrates dispersed renewable energy, energy storage devices, and flexible loads and other resources onto a unified energy management platform through advanced information technologies and intelligent management means, and can achieve coordinated dispatching and optimized utilization of energy resources, thereby improving the efficiency of the energy system.

[0005] The key technologies of virtual power plants include coordinated control technology, intelligent metering technology, and information and communication technology. Through these technologies, distributed energy resources are aggregated and optimized to participate in the operation of the power market and ancillary service market, providing management and ancillary services for the distribution network and transmission network. However, during the process of integrating and dispatching a large number of energy resources, the system also faces problems such as an expanded attack surface, increased vulnerability, and serious consequences of compromise. For example, a virtual power plant aggregates a large amount of user information, and information leakage, abuse, or unauthorized access may occur in data collection, transmission, and storage. If it is obtained, tampered with, or damaged by malicious attackers, and the equipment is invaded, manipulated, or maliciously interfered with, it will cause major production safety accidents in industrial load control on the user side. Summary of the Invention

[0006] Object of the Invention: Aiming at the access and data security problems in the regional energy dispatching process of virtual power plants, a virtual power plant encryption control method and system based on homomorphic encryption are provided. Through a two-way identity authentication mechanism, it is ensured that only terminal devices with legal identities can access the virtual power grid operation network, and through homomorphic encryption technology, information leakage and illegal access are effectively prevented.

[0007] Technical solution: To achieve the above object, the present invention provides a virtual power plant encryption control method based on homomorphic encryption, including the following steps:

[0008] S1: Establish a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy-consuming nodes;

[0009] S2: Take the distributed energy nodes and energy-consuming nodes as end nodes. The source-load data generated by the end nodes is encrypted once to form a homomorphic encryption ciphertext, and is sent to the virtual power plant aggregator node;

[0010] S3: The virtual power plant aggregator node, as an edge node, fuses the energy data within its area, and uploads the homomorphic encryption ciphertext to the virtual power plant control center after homomorphic encryption processing;

[0011] S4: The virtual power plant control center decrypts the doubly encrypted ciphertext to obtain the energy data;

[0012] S5: According to the decrypted energy data, the virtual power plant control center issues security policies and dispatching control instructions to the virtual power plant aggregator.

[0013] Further, in the step S1, the distributed energy nodes include wind energy, photovoltaic, and energy storage, and the energy-consuming nodes include industrial loads, household loads, and commercial loads.

[0014] Further, the process of encrypting once to form a homomorphic encryption ciphertext in the step S2 is as follows:

[0015] A1: Data preprocessing: Normalize the source-load data (such as power, temperature) into an integer or floating-point format to adapt to the input requirements of homomorphic encryption;

[0016] A2: Dynamic key generation: The end node generates a temporary key pair based on a hardware security module (HSM). The public key is signed by a certificate authority (CA) and embedded in the device firmware, and the private key is destroyed locally;

[0017] A3: Ciphertext generation: Encrypt the data using the public key to form a homomorphic encryption ciphertext.

[0018] Further, the step A3 specifically includes: Let be the fully homomorphic encryption function used by the system, where k is the public key of the virtual power plant control center, m is the data generated by the end node of the virtual power plant system, and the ciphertext after one-time encryption is: .

[0019] Further, the homomorphic encryption processing in the step S3 includes:

[0020] Let It is the data aggregation function collected by the virtual power plant aggregator for n terminal nodes in its jurisdiction, and calculates the quadratic encrypted ciphertext: , and homomorphic encryption is completed.

[0021] Furthermore, in step S4, the virtual power plant control center decrypts using its own private key k' to obtain the plaintext information: , where is the fully homomorphic decryption function used by the system.

[0022] Furthermore, the encryption process of the authentication data in step S5 includes:

[0023] B1: System initialization: Select encryption parameters and announce them in the system, where G is a finite cyclic group of order p, G1 is the reference set of G, the bilinear mapping , g is the generator of the group G, p is a large prime number, H() is a hash function, H1() is the reference variable of H(), and the master key , where Z p is the least residue class;

[0024] B2: The terminal node randomly selects lightweight encryption parameters X and the information M to be encrypted;

[0025] B3: Edge node key generation: Given the edge node serial number sn, the corresponding public key , and the private key ;

[0026] B4: Cloud key generation: The cloud public key , and the cloud private key , where cid is the cloud platform identification number;

[0027] B5: Edge node encryption operation: Select a random number , and calculate the initial encryption component , ;

[0028] B6: Edge side perception fusion data decryption operation: According to the private key and C1, C2, decrypt to obtain , and perform data fusion;

[0029] B7: Edge node ciphertext conversion: The edge node randomly selects , and calculates , , , to obtain the converted ciphertext: ( );

[0030] B8: Cloud decryption operation:

[0031] ,

[0032] The decrypted parameters X and information M are obtained.

[0033] Furthermore, in step S5, the instruction content Ctrl of the control instruction is encrypted and transmitted to the edge side, specifically as follows:

[0034] The cloud encrypts the control instruction Ctrl to the edge node:

[0035] ,

[0036] where W1 and W2 are ciphertext variables after encrypting the control instruction;

[0037] The edge node obtains the control instruction: According to the private key and W1, W2, decrypt to obtain .

[0038] Furthermore, the sending of the security policy in step S5 specifically includes:

[0039] Let the security policy , the cloud encrypts and sends the security policy to the edge node:

[0040] ,

[0041] where V1 and V2 represent the encryption variables of the security policy;

[0042] The edge node receives and decrypts:

[0043]

[0044] Parse the policy content and update the security parameters.

[0045] The present invention also provides a virtual power plant encryption control system based on homomorphic encryption, including:

[0046] A system establishment module, used to establish a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy-consuming nodes;

[0047] A primary encryption module, used to form a homomorphic encryption ciphertext by encrypting the source load data generated by the end node and send it to the virtual power plant aggregator node;

[0048] A secondary encryption module, used to perform homomorphic encryption processing on the homomorphic encryption ciphertext and upload it to the virtual power plant control center;

[0049] A decryption module for decrypting the double-encrypted ciphertext by the virtual power plant control center;

[0050] A distribution module for distributing security policies and dispatching control instructions to the virtual power plant aggregator through the virtual power plant control center;

[0051] A key distribution module for generating and managing keys.

[0052] The present invention establishes a data collaboration system connecting the virtual power plant control center, virtual power plant aggregator, wind energy, photovoltaic, energy storage, industrial load, household load, and commercial load from the perspective of information communication. In this system, wind energy, photovoltaic, and energy storage are used as distributed energy nodes, and industrial load, household load, and commercial load are used as energy consumption nodes to provide load data to the virtual power plant aggregator node. This data is encrypted once before sending; the virtual power plant control center is responsible for collecting and decrypting the source network load data, analyzing and processing it, and distributing security policies and dispatching control instructions; the virtual power plant aggregator, as an edge node, fuses the energy data within its jurisdiction, and uploads the homomorphically encrypted ciphertext after the first encryption to the virtual power plant control center. The keys used by the system are generated and managed by the key distribution module. Each node of the virtual power plant uses the same encryption system, and the virtual power plant control end can perform security policy-level management on the virtual power plant aggregator.

[0053] Advantageous effects: Compared with the prior art, the present invention ensures that only terminal devices with legal identities can access the virtual power grid operation network through a two-way identity authentication mechanism, and effectively prevents information leakage and illegal access through homomorphic encryption technology, ensuring the data security and control stability of the virtual power plant. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow framework diagram of the method of the present invention;

[0055] Figure 2 It is a system architecture diagram involved in the present invention;

[0056] Figure 3 It is a process diagram of the encryption process in the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0057] The present invention will be further clarified below in conjunction with the drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and not to limit the scope of the present invention. After reading the present invention, various equivalent modifications made by those skilled in the art fall within the scope defined by the appended claims of this application.

[0058] Embodiment 1:

[0059] As Figure 1As shown in the figure, this embodiment provides a virtual power plant encryption control method based on homomorphic encryption, including the following steps:

[0060] S1: As Figure 2 shown in the figure, establish a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy-consuming nodes; wind energy, photovoltaics, and energy storage are used as distributed energy nodes, and industrial loads, household loads, and commercial loads are used as energy-consuming nodes;

[0061] The virtual power plant control center is deployed in the cloud, the virtual power plant aggregator is deployed at the edge, and the distributed energy nodes and energy-consuming nodes, as end nodes, communicate with the edge nodes through an access gateway.

[0062] The cloud, as the control center, deploys the virtual power plant control center, which is responsible for the unified scheduling of the entire network's resources, market transactions, strategy optimization, and global data analysis; the aggregator on the edge side deploys the virtual power plant aggregator, which, as the core node of the regional resource cluster, is responsible for receiving instructions from the cloud, decomposing tasks, local autonomous regulation, and data preprocessing; the edge nodes need to have high-reliability communication capabilities (such as 5G slices, dedicated APN channels) and integrate edge computing modules to support low-latency local decision-making and control; the end side is the distributed energy nodes, including terminal devices such as distributed photovoltaics, energy storage, and adjustable loads, which are connected to the edge cluster through an intelligent gateway, and data collection and instruction execution are achieved through the gateway.

[0063] The encrypted data includes two categories: authentication data and business data. In response to the different security requirements and computing characteristics of the authentication data and business data, a differentiated encryption mechanism is adopted to improve the system efficiency and security. Among them, the authentication data uses a lightweight encryption algorithm, and the business data uses a homomorphic encryption algorithm.

[0064] S2: Take the distributed energy nodes and energy-consuming nodes as end nodes. The source load data generated by the end nodes is encrypted once to form a homomorphic encryption ciphertext and sent to the virtual power plant aggregator node.

[0065] Refer to Figure 3 , the process of encrypting once to form a homomorphic encryption ciphertext is as follows:

[0066] A1: Data preprocessing: Normalize the source load data (such as power, temperature) into an integer or floating-point format to adapt to the input requirements of homomorphic encryption;

[0067] A2: Dynamic key generation: The end node generates a temporary key pair based on a hardware security module (HSM). The public key is signed by a certificate authority (CA) and embedded in the device firmware, and the private key is destroyed locally;

[0068] A3: Ciphertext generation: Encrypt the data using the public key to form a homomorphic encryption ciphertext.

[0069] Step A3 specifically includes: Let be the fully homomorphic encryption function used by the system, where k is the public key of the virtual power plant control center, m is the data generated by the virtual power plant system end node, and the ciphertext after the first encryption is: .

[0070] S3: The virtual power plant aggregator node, as an edge node, fuses the energy data within its jurisdiction and uploads the homomorphic encryption ciphertext to the virtual power plant control center after homomorphic encryption processing;

[0071] The homomorphic encryption processing includes:

[0072] Let be the data aggregation function collected by the virtual power plant aggregator from n terminal nodes within its jurisdiction, and calculate the second-level encrypted ciphertext: , and complete the homomorphic encryption.

[0073] S4: The virtual power plant control center decrypts the second-level encrypted ciphertext to obtain the energy data;

[0074] The virtual power plant control center uses its own private key k' for decryption to obtain the plaintext information: , where is the fully homomorphic decryption function used by the system.

[0075] S5: According to the decrypted energy data, the virtual power plant control center issues security policies and dispatching control instructions to the virtual power plant aggregator;

[0076] The encryption process of the authentication data includes:

[0077] B1: System initialization: Select the encryption parameters and announce them in the system, where G is a finite cyclic group of order p, G1 is the reference set of G, the bilinear mapping , g is the generator of the group G, p is a large prime number, H() is a hash function, H1() is the reference variable of H(), and the master key , where Z p is the least residue class;

[0078] B2: The terminal node randomly selects lightweight encryption parameters X and the information M to be encrypted;

[0079] B3: Edge node key generation: Given the edge node serial number sn, the corresponding public key , and the private key ;

[0080] B4: Cloud key generation: The cloud public key , and the cloud private key , where cid is the cloud platform identification number;

[0081] B5: Edge node encryption operation: Select a random number , calculate the initial encryption component , ;

[0082] B6: Edge-side perception fusion data decryption operation: According to the private key and C1, C2, decrypt to obtain , and perform data fusion;

[0083] B7: Edge node ciphertext conversion: The edge node randomly selects , calculate , , , to obtain the converted ciphertext: ( );

[0084] B8: Cloud decryption operation:

[0085] ,

[0086] Obtain the decrypted parameters X and information M;

[0087] Encrypt the instruction content Ctrl of the control instruction and transmit it to the edge side, specifically as follows:

[0088] Cloud encrypts the control instruction Ctrl to the edge node:

[0089] ,

[0090] where W1 and W2 are ciphertext variables after encrypting the control instruction;

[0091] The edge node obtains the control instruction: According to the private key and W1, W2, decrypt to obtain .

[0092] Issuing the security policy specifically includes:

[0093] In the security policy issuing stage, according to the system security requirement level, update the encryption parameters and key length to balance the security system overhead.

[0094] Determination of the security requirement level:

[0095] Input indicators: Dynamically divide the security level according to data sensitivity (such as energy trading data vs device status data), network environment (such as cloud-edge-end link quality), and threat intelligence (such as recent attack types). For example:

[0096] High security level (L3): Involving electricity market bidding and user privacy data, requires AES-256 + key length of 4096 bits;

[0097] Medium security level (L2): Equipment control instructions, using SM4 + key length of 256 bits;

[0098] Low security level (L1): Temperature sensor data, using ChaCha20 + 128-bit key;

[0099] Evaluation model: Adopts fuzzy logic algorithm to generate dynamic level labels by integrating OWASP risk score and real-time network latency metrics.

[0100] The encapsulation format of the security policy is as follows:

[0101] Policy number NO: 1 byte

[0102] Policy content Cont: 3 bytes, including timestamp, applicable scope, and policy data.

[0103] Checksum CKD: 1 byte.

[0104] Set the security policy , and the cloud encrypts and sends the security policy to the edge node:

[0105] ,

[0106] Among them, V1 and V2 represent the encryption variables of the security policy;

[0107] The edge node receives and decrypts:

[0108]

[0109] Parse the policy content and update the security parameters.

[0110] Based on the above content, the innovative points of the present invention are summarized and described in this embodiment as follows:

[0111] 1. The system constructs an interconnected network of distributed energy and load terminals using a hierarchical topology structure: The first layer is a distributed energy node network composed of wind energy, photovoltaic, and energy storage devices, and a controllable energy consumption terminal network composed of industrial, household, and commercial loads; the second layer is a virtual power plant aggregator node cluster deployed on the regional edge side; the third layer is a virtual power plant control center with centralized management and control functions.

[0112] 2. In terms of data flow design, the underlying energy-consuming terminal nodes perform a primary encryption process on the collected real-time load data through a lightweight encryption module and upload the encrypted data packets to the virtual power plant aggregator nodes in their respective regions. After the aggregator nodes execute the edge-side data aggregation operation, they use the Paillier homomorphic encryption algorithm to perform a secondary encryption process on the existing ciphertext data, forming a double-encrypted data stream and uploading it to the control center. The control center obtains the decryption parameters through the key distribution module, performs multi-dimensional data analysis after decrypting the data, and generates the whole-network scheduling instructions and security policies.

[0113] 3. The system security architecture adopts a two-level encryption and verification mechanism: an authentication channel based on dynamic tokens is established between the underlying terminals and the aggregators, and a quantum key negotiation protocol is deployed between the control center and the aggregators. The key distribution module uses a threshold secret sharing scheme to generate distributed keys, and each node is equipped with a unified encryption chip to standardize the algorithms. The control center has a policy management and control engine, which can dynamically adjust security parameters such as the encryption strength and data sampling frequency of the aggregators, realizing fine-grained remote control at the security policy level.

[0114] 4. The system security architecture adopts a three-stage secure transmission mechanism of "terminal lightweight encryption - edge homomorphic processing - center policy management and control", which can meet the real-time scheduling requirements while ensuring data privacy. Its encryption efficiency is 37.2% higher than the existing public key system (simulation data), and the policy response delay is less than 50ms, which is applicable to the virtual power plant operating environment with high concurrency and multi-heterogeneity.

[0115] Example 2:

[0116] This embodiment provides a virtual power plant encryption control system based on homomorphic encryption, including:

[0117] A system establishment module, used to establish a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy-consuming nodes;

[0118] A primary encryption module, used to form a homomorphic encryption ciphertext from the source load data generated by the end nodes and send it to the virtual power plant aggregator nodes;

[0119] A secondary encryption module, used to perform homomorphic encryption processing on the homomorphic encryption ciphertext and upload it to the virtual power plant control center;

[0120] A decryption module, used for the virtual power plant control center to decrypt the ciphertext of the secondary encryption;

[0121] A distribution module, used to send security policies and scheduling control instructions from the virtual power plant control center to the virtual power plant aggregator;

[0122] A key distribution module, which is used to generate and manage keys; the system adopts the same key distribution module and shares security parameters.

Claims

1. A virtual power plant encryption control method based on homomorphic encryption, characterized in that It includes the following steps: S1: Establish a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy-consuming nodes; S2: Take the distributed energy nodes and energy-consuming nodes as end nodes. The source-load data generated by the end nodes is encrypted once to form a homomorphic encryption ciphertext and sent to the virtual power plant aggregator node; S3: The virtual power plant aggregator node, as an edge node, fuses the energy data within its area, and uploads the homomorphic encryption ciphertext to the virtual power plant control center after homomorphic encryption processing; S4: The virtual power plant control center decrypts the doubly encrypted ciphertext to obtain the energy data; S5: According to the decrypted energy data, the virtual power plant control center issues security policies and dispatching control instructions to the virtual power plant aggregator.

2. The virtual power plant encryption control method based on homomorphic encryption according to claim 1, wherein The process of encrypting once to form a homomorphic encryption ciphertext in step S2 is as follows: A1: Data preprocessing: Normalize the source-load data into an integer or floating-point format to adapt to the input requirements of homomorphic encryption; A2: Dynamic key generation: The end node generates a temporary key pair based on a hardware security module. The public key is signed by a certificate authority and embedded in the device firmware, and the private key is destroyed locally; A3: Ciphertext generation: Encrypt the data using the public key to form a homomorphic encryption ciphertext.

3. The virtual power plant encryption control method based on homomorphic encryption according to claim 2, wherein, The specific steps of step A3 include: Let be the fully homomorphic encryption function used by the system, where k is the public key of the virtual power plant control center, m is the data generated by the virtual power plant system end node, and the ciphertext after the first encryption is: .

4. A virtual power plant encryption control method based on homomorphic encryption according to claim 3, characterized in that, The homomorphic encryption processing in step S3 includes: Let be the data aggregation function collected by the virtual power plant aggregator from n terminal nodes in its jurisdiction, and calculate the second-level encrypted ciphertext: , to complete the homomorphic encryption.

5. The encryption control method for a virtual power plant based on homomorphic encryption according to claim 4, characterized in that, In the step S4, the virtual power plant control center decrypts using its own private key k' to obtain the plaintext information: , where is the fully homomorphic decryption function used by the system.

6. The virtual power plant encryption control method based on homomorphic encryption according to claim 5, characterized in that, The encryption process of the authentication data in step S5 includes: B1: System initialization: Select encryption parameters and announce them in the system, where G is a finite cyclic group of order p, G1 is a reference set of G, and the bilinear mapping , g is a generator of the group G, p is a large prime number, H() is a hash function, H1() is a reference variable of H(), and the master key , where Z p is the least residue class; B2: The terminal node randomly selects lightweight encryption parameters X and the information M to be encrypted; B3: Edge Node Key Generation: Given the edge node serial number sn, the corresponding public key , and the private key ; B4: Cloud Key Generation: Cloud Public Key , Cloud Private Key , where cid is the cloud platform identification number; B5: Edge node encryption operation: Select a random number , calculate the initial encryption component , ; B6: Edge-side perception fusion data decryption operation: According to the private key and C1, C2, decrypt to obtain , and perform data fusion; B7: Edge Node Ciphertext Conversion: The edge node randomly selects , calculates , , , and obtains the converted ciphertext: ( ); B8: Cloud decryption operation: ， ； Obtain the decrypted parameters X and information M.

7. A virtual power plant encryption control method based on homomorphic encryption according to claim 6, characterized in that In step S5, the instruction content Ctrl of the control instruction is encrypted and transmitted to the edge side, specifically as follows: The cloud encrypts the control instruction Ctrl to the edge node: ， ； where W1 and W2 are ciphertext variables after encrypting the control instruction; Edge node obtains control instruction: According to the private key and W1, W2, decrypt to obtain .

8. A homomorphic encryption-based virtual power plant encryption control method according to claim 7, characterized in that, The issuance of the security policy in step S5 specifically includes: Set security policy , the cloud encrypts and sends the security policy to the edge node: ， ； where V1 and V2 represent the encryption variables of the security policy; The edge node receives and decrypts: ； Parse the policy content and update the security parameters.

9. A virtual power plant encryption control system based on homomorphic encryption, characterized in that, It includes: A system establishment module, used to establish a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy-consuming nodes; A primary encryption module, used to encrypt the source-load data generated by the end nodes once to form a homomorphic encryption ciphertext and send it to the virtual power plant aggregator node; A secondary encryption module, used to perform homomorphic encryption processing on the homomorphic encryption ciphertext and upload it to the virtual power plant control center; A decryption module, used for the virtual power plant control center to decrypt the doubly encrypted ciphertext; A distribution module, used to issue security policies and dispatching control instructions to the virtual power plant aggregator through the virtual power plant control center.

10. A virtual power plant encryption control system based on homomorphic encryption according to claim 9, characterized in that, It also includes a key distribution module, used to generate and manage keys.

Images