A virtual power plant encryption control method and system based on homomorphic encryption

Abstract

The present invention discloses a virtual power plant encryption control method and system based on homomorphic encryption. The method includes: establishing a data collaboration system, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes and energy consumption nodes; the source and load data generated by the end node is encrypted once to form a homomorphic encrypted ciphertext, which is sent to the virtual power plant aggregator node; the virtual power plant aggregator node acts as an edge node to integrate the energy data in the area to which it belongs, and uploads the homomorphic encrypted ciphertext after homomorphic encryption processing to the virtual power plant control center; the virtual power plant control center decrypts the twice-encrypted ciphertext to obtain energy data; the virtual power plant control center issues security policies and scheduling control instructions to the virtual power plant aggregator. The present invention ensures that only terminal devices with legitimate identities can access the virtual power grid operation network through a two-way identity authentication mechanism, and effectively prevents information leakage and illegal access through homomorphic encryption technology.

Description

Technical Field

[0001] The present invention belongs to the field of power systems and relates to control technology of virtual power plants, and specifically to an encryption control method and system for virtual power plants based on homomorphic encryption. Background Art

[0002] A virtual power plant is a power coordination and management system that uses advanced information and communication technologies and software systems to aggregate and coordinate distributed energy resources such as distributed power sources, energy storage systems, and controllable loads, so that it can participate in the power market and power grid operation as a special power plant.

[0003] From an implementation perspective, a virtual power plant is a complex information system. Using information and communication technologies, intelligent technologies, and supporting software systems, it integrates dispersed energy resources (such as solar photovoltaics, wind power, biomass, geothermal energy, and energy storage systems) into a virtual centralized energy system, achieving efficient energy utilization and balancing supply and demand. It can serve as a "positive power plant" to provide peak power to the system, or as a "negative power plant" to increase load absorption and facilitate valley filling.

[0004] From a functional perspective, a virtual power plant is a new form of energy organization. Through advanced information technology and intelligent management methods, it integrates decentralized renewable energy, energy storage equipment, flexible loads and other resources into a unified energy management platform, enabling coordinated scheduling and optimal utilization of energy resources, thereby improving the efficiency of the energy system.

[0005] Key technologies for virtual power plants include coordinated control, smart metering, and information and communication technologies. These technologies aggregate and optimize distributed energy resources, allowing them to participate in electricity and ancillary service markets and provide management and ancillary services for distribution and transmission networks. However, the integration and dispatch of large amounts of energy resources also presents challenges such as an expanded attack surface, increased vulnerability, and severe consequences of a compromise. For example, virtual power plants aggregate vast amounts of user information, potentially exposing them to information leakage, misuse, or unauthorized access during data collection, transmission, and storage. If this information is obtained, tampered with, or destroyed by malicious attackers, or if equipment is compromised, manipulated, or maliciously interfered with, user-side industrial load control could result in serious production safety incidents. Summary of the Invention

[0006] Purpose of the invention: To address the access and data security issues in the regional energy dispatch process of virtual power plants, a virtual power plant encryption control method and system based on homomorphic encryption is provided. Through a two-way identity authentication mechanism, it is ensured that only terminal devices with legal identities can access the virtual power grid operation network. Through homomorphic encryption technology, information leakage and illegal access are effectively prevented.

[0007] Technical solution: To achieve the above objectives, the present invention provides a virtual power plant encryption control method based on homomorphic encryption, comprising the following steps:

[0008] S1: Establish a data collaboration system, including the virtual power plant control center, virtual power plant aggregator, distributed energy nodes, and energy consumption nodes;

[0009] S2: Distributed energy nodes and energy consumption nodes are used as end nodes. The source and load data generated by the end nodes are encrypted once to form homomorphic encrypted ciphertext and sent to the virtual power plant aggregator node.

[0010] S3: The virtual power plant aggregator node acts as an edge node to integrate energy data within its region, homomorphically encrypt the ciphertext, and upload it to the virtual power plant control center;

[0011] S4: The virtual power plant control center decrypts the twice-encrypted ciphertext to obtain energy data;

[0012] S5: Based on the decrypted energy data, the virtual power plant control center issues security policies and dispatch control instructions to the virtual power plant aggregator.

[0013] Furthermore, in step S1, the distributed energy nodes include wind energy, photovoltaic energy and energy storage, and the energy consumption nodes include industrial loads, household loads and commercial loads.

[0014] Furthermore, the process of encrypting once in step S2 to form homomorphically encrypted ciphertext is as follows:

[0015] A1: Data preprocessing: Normalize source and load data (such as power and temperature) into integer or floating-point format to meet homomorphic encryption input requirements.

[0016] A2: Dynamic key generation: The end node generates a temporary key pair based on a hardware security module (HSM). The public key is signed by a certificate authority (CA) and embedded in the device firmware. The private key is destroyed locally.

[0017] A3: Ciphertext generation: Use the public key to encrypt the data to form homomorphic encrypted ciphertext.

[0018] Furthermore, the step A3 specifically includes: is the fully homomorphic encryption function used by the system, where k is the public key of the virtual power plant control center, and m is the data generated by the end node of the virtual power plant system. The ciphertext after one encryption is: .

[0019] Furthermore, the homomorphic encryption process in step S3 includes:

[0020] make The virtual power plant aggregator aggregates the data collected by n terminal nodes within its jurisdiction and calculates the secondary encrypted ciphertext: , completing homomorphic encryption.

[0021] Furthermore, in step S4, the virtual power plant control center uses its own private key k' to decrypt and obtain the plaintext information: ,in This is the fully homomorphic decryption function used by the system.

[0022] Furthermore, the encryption process of the authentication data in step S5 includes:

[0023] B1: System initialization: Select encryption parameters And published in the system, where G is a finite cyclic group of order p, G1 is the reference set of G, and the bilinear map , g is the generator of group G, p is a large prime number, H() is the hash function, H1() is the reference variable of H(), and the master key , where Z p is the minimum remaining class;

[0024] B2: The terminal node randomly selects a lightweight encryption parameter X and the encrypted message M;

[0025] B3: Edge node key generation: the edge node serial number sn is known, corresponding to the public key , private key ;

[0026] B4: Cloud key generation: Cloud public key , cloud private key , where cid is the cloud platform identification number;

[0027] B5: Edge Node Encryption Operation: Selecting Random Numbers , calculate the initial encryption component , ;

[0028] B6: Edge-side perception fusion data decryption operation: based on the private key And C1, C2, decrypted to get , perform data fusion;

[0029] B7: Edge node ciphertext conversion: edge nodes are randomly selected ,calculate , , , get the converted ciphertext: ( );

[0030] B8: Cloud decryption calculation:

[0031] ,

[0032] Get the decrypted parameter X and information M.

[0033] Furthermore, in step S5, the instruction content Ctrl of the control instruction is encrypted and transmitted to the edge side, as follows:

[0034] Send the cloud encryption control command Ctrl to the edge node:

[0035] ,

[0036] Among them, W1 and W2 are the encrypted ciphertext variables of the control instructions;

[0037] Edge nodes obtain control instructions: based on private key And W1, W2, decrypted to get .

[0038] Furthermore, issuing the security policy in step S5 specifically includes:

[0039] Set security policy , the cloud encrypts and sends security policies to the edge nodes:

[0040] ,

[0041] Among them, V1 and V2 represent the encrypted variables of the security policy;

[0042] The edge node receives and decrypts:

[0043]

[0044] Parse policy content and update security parameters.

[0045] The present invention also provides a virtual power plant encryption control system based on homomorphic encryption, comprising:

[0046] System establishment module, used to establish a data collaboration system, including the virtual power plant control center, virtual power plant aggregator, distributed energy nodes and energy consumption nodes;

[0047] The one-time encryption module is used to encrypt the source and load data generated by the end node into a homomorphic encrypted ciphertext and send it to the virtual power plant aggregator node;

[0048] The secondary encryption module is used to homomorphically encrypt the homomorphically encrypted ciphertext and upload it to the virtual power plant control center;

[0049] Decryption module, used by the virtual power plant control center to decrypt the twice-encrypted ciphertext;

[0050] The issuing module is used to issue security policies and dispatch control instructions to virtual power plant aggregators through the virtual power plant control center;

[0051] The key distribution module is used to generate and manage keys.

[0052] The present invention establishes a data collaboration system connecting a virtual power plant control center, a virtual power plant aggregator, wind energy, photovoltaics, energy storage, and industrial loads, household loads, and commercial loads from the perspective of information communication. In this system, wind energy, photovoltaics, and energy storage serve as distributed energy nodes, and industrial loads, household loads, and commercial loads serve as energy consumption nodes, providing load data to the virtual power plant aggregator node. The data is encrypted once before being sent; the virtual power plant control center is responsible for collecting and decrypting source grid load data, and analyzing and processing, issuing security policies and scheduling control instructions; the virtual power plant aggregator, as an edge node, integrates energy data within its area, and homomorphically encrypts the encrypted ciphertext and uploads it to the virtual power plant control center. The keys used by the system are generated and managed by the key distribution module. Each node of the virtual power plant uses the same encryption system. The virtual power plant control end can perform security policy-level management and control on the virtual power plant aggregator.

[0053] Beneficial effects: Compared with the existing technology, the present invention ensures that only terminal devices with legal identities can access the virtual power grid operation network through a two-way identity authentication mechanism, and effectively prevents information leakage and illegal access through homomorphic encryption technology, thereby ensuring the data security and control stability of the virtual power plant. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of the method of the present invention;

[0055] Figure 2 This is a diagram of the system architecture involved in the present invention;

[0056] Figure 3 This is a process diagram of encryption processing in the present invention. DETAILED DESCRIPTION

[0057] The present invention is further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, modifications of various equivalent forms of the present invention made by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0058] Example 1:

[0059] like Figure 1As shown, this embodiment provides a virtual power plant encryption control method based on homomorphic encryption, including the following steps:

[0060] S1: If Figure 2 As shown, a data collaboration system is established, including a virtual power plant control center, a virtual power plant aggregator, distributed energy nodes, and energy consumption nodes; wind energy, photovoltaics, and energy storage serve as distributed energy nodes, and industrial loads, household loads, and commercial loads serve as energy consumption nodes;

[0061] The virtual power plant control center is deployed in the cloud, the virtual power plant aggregator is deployed at the edge, and the distributed energy nodes and energy consumption nodes act as end nodes and communicate with the edge nodes through the access gateway.

[0062] The cloud serves as the control center, deploying a virtual power plant control center responsible for unified scheduling, market transactions, strategy optimization, and global data analysis of network-wide resources. Edge-side aggregators deploy virtual power plant aggregators, which serve as the core nodes of regional resource clusters and are responsible for receiving cloud instructions, decomposing tasks, local autonomous regulation, and data preprocessing. Edge nodes must have highly reliable communication capabilities (such as 5G slicing and dedicated APN channels) and integrate edge computing modules to support low-latency local decision-making and control. The end side is a distributed energy node, including distributed photovoltaic, energy storage, adjustable load and other terminal devices, which access the edge cluster through an intelligent gateway, and realize data collection and command execution through the gateway.

[0063] Encrypted data includes two categories: authentication data and business data. In view of the different security requirements and computing characteristics of authentication data and business data, differentiated encryption mechanisms are adopted to improve system efficiency and security. Among them, authentication data uses a lightweight encryption algorithm, and business data uses a homomorphic encryption algorithm.

[0064] S2: Distributed energy nodes and energy consumption nodes are used as end nodes. The source and load data generated by the end nodes are encrypted once to form homomorphic encrypted ciphertext and sent to the virtual power plant aggregator node.

[0065] Reference Figure 3 , the process of forming homomorphic encrypted ciphertext by one encryption is:

[0066] A1: Data preprocessing: Normalize source and load data (such as power and temperature) into integer or floating-point format to meet homomorphic encryption input requirements.

[0067] A2: Dynamic key generation: The end node generates a temporary key pair based on a hardware security module (HSM). The public key is signed by a certificate authority (CA) and embedded in the device firmware. The private key is destroyed locally.

[0068] A3: Ciphertext generation: Use the public key to encrypt the data to form homomorphic encrypted ciphertext.

[0069] Step A3 specifically includes: is the fully homomorphic encryption function used by the system, where k is the public key of the virtual power plant control center, and m is the data generated by the end node of the virtual power plant system. The ciphertext after one encryption is: .

[0070] S3: The virtual power plant aggregator node acts as an edge node to integrate energy data within its region, homomorphically encrypt the ciphertext, and upload it to the virtual power plant control center;

[0071] Homomorphic encryption processing includes:

[0072] make The virtual power plant aggregator aggregates the data collected by n terminal nodes within its jurisdiction and calculates the secondary encrypted ciphertext: , completing homomorphic encryption.

[0073] S4: The virtual power plant control center decrypts the twice-encrypted ciphertext to obtain energy data;

[0074] The virtual power plant control center uses its own private key k' to decrypt and obtain the plaintext information: ,in This is the fully homomorphic decryption function used by the system.

[0075] S5: Based on the decrypted energy data, the virtual power plant control center issues security policies and dispatch control instructions to the virtual power plant aggregator;

[0076] The encryption process of authentication data includes:

[0077] B1: System initialization: Select encryption parameters And published in the system, where G is a finite cyclic group of order p, G1 is the reference set of G, and the bilinear map , g is the generator of group G, p is a large prime number, H() is the hash function, H1() is the reference variable of H(), and the master key , where Z p is the minimum remaining class;

[0078] B2: The terminal node randomly selects a lightweight encryption parameter X and the encrypted message M;

[0079] B3: Edge node key generation: the edge node serial number sn is known, corresponding to the public key , private key ;

[0080] B4: Cloud key generation: Cloud public key , cloud private key , where cid is the cloud platform identification number;

[0081] B5: Edge Node Encryption Operation: Selecting Random Numbers , calculate the initial encryption component , ;

[0082] B6: Edge-side perception fusion data decryption operation: based on the private key And C1, C2, decrypted to get , perform data fusion;

[0083] B7: Edge node ciphertext conversion: edge nodes are randomly selected ,calculate , , , get the converted ciphertext: ( );

[0084] B8: Cloud decryption calculation:

[0085] ,

[0086] Get the decrypted parameter X and information M;

[0087] The command content Ctrl of the control command is encrypted and transmitted to the edge side, as follows:

[0088] Send the cloud encryption control command Ctrl to the edge node:

[0089] ,

[0090] Where W1 and W2 are the encrypted ciphertext variables of the control instructions;

[0091] Edge nodes obtain control instructions: based on private key And W1, W2, decrypted to get .

[0092] The security policy issuance includes:

[0093] During the security policy issuance phase, encryption parameters and key lengths are updated based on the system security requirement level to balance security system overhead.

[0094] Determination of security requirement level:

[0095] Input indicators: Dynamically classify security levels based on data sensitivity (e.g., energy transaction data vs. device status data), network environment (e.g., cloud-edge-end link quality), and threat intelligence (e.g., recent attack types). For example:

[0096] High security level (L3): involves electricity market bidding and user privacy data, requiring AES-256 + key length 4096 bits;

[0097] Medium security level (L2): device control instructions, using SM4 + key length 256 bits;

[0098] Low security level (L1): temperature sensor data, using ChaCha20 + 128-bit key;

[0099] Evaluation model: A fuzzy logic algorithm is used to combine the OWASP risk score and real-time network latency indicators to generate a dynamic grade label.

[0100] The security policy encapsulation format is as follows:

[0101] Policy number NO: 1 byte

[0102] Policy content Cont: 3 bytes, including timestamp, applicable scope, and policy data.

[0103] Check CKD: 1 byte.

[0104] Set security policy , the cloud encrypts and sends security policies to the edge nodes:

[0105] ,

[0106] Among them, V1 and V2 represent the encrypted variables of the security policy;

[0107] The edge node receives and decrypts:

[0108]

[0109] Parse policy content and update security parameters.

[0110] Based on the above content, the innovative features of the present invention are summarized and described in this embodiment, as follows:

[0111] 1. The system adopts a layered topology to build an interconnected network of distributed energy and load terminals: the first layer is a distributed energy node network composed of wind energy, photovoltaic and energy storage devices, and a controllable energy terminal network composed of industrial, household and commercial loads; the second layer is a virtual power plant aggregator node cluster deployed on the edge of the region; the third layer is a virtual power plant control center with centralized management and control functions.

[0112] 2. Regarding data flow design, the underlying energy-consuming terminal nodes encrypt the collected real-time load data using a lightweight encryption module and upload the encrypted data packets to the virtual power plant aggregator node in the corresponding region. After the aggregator node performs edge-side data aggregation operations, it uses the Paillier homomorphic encryption algorithm to re-encrypt the existing ciphertext data, creating a doubly encrypted data stream that is uploaded to the control center. The control center obtains decryption parameters through the key distribution module, performs multi-dimensional data analysis after data decryption, and generates network-wide scheduling instructions and security policies.

[0113] 3. The system's security architecture employs a two-level encryption and authentication mechanism: a dynamic token-based authentication channel is established between the underlying terminals and the aggregator, and a quantum key agreement protocol is deployed between the control center and the aggregator. The key distribution module uses a threshold secret sharing scheme to generate distributed keys, and each node is equipped with a unified encryption chip to achieve algorithm standardization. The control center features a policy management engine that dynamically adjusts aggregator security parameters such as encryption strength and data sampling frequency, enabling fine-grained remote security policy-level control.

[0114] 4. The system security architecture uses a three-stage secure transmission mechanism of "terminal light encryption - edge homomorphic processing - central policy control" to ensure data privacy while meeting real-time scheduling requirements. Its encryption efficiency is 37.2% higher than the existing public key system (simulation data), and the policy response delay is less than 50ms, making it suitable for high-concurrency, multi-heterogeneous virtual power plant operating environments.

[0115] Example 2:

[0116] This embodiment provides a virtual power plant encryption control system based on homomorphic encryption, including:

[0117] System establishment module, used to establish a data collaboration system, including the virtual power plant control center, virtual power plant aggregator, distributed energy nodes and energy consumption nodes;

[0118] The one-time encryption module is used to encrypt the source and load data generated by the end node into a homomorphic encrypted ciphertext and send it to the virtual power plant aggregator node;

[0119] The secondary encryption module is used to homomorphically encrypt the homomorphically encrypted ciphertext and upload it to the virtual power plant control center;

[0120] Decryption module, used by the virtual power plant control center to decrypt the twice-encrypted ciphertext;

[0121] The issuing module is used to issue security policies and dispatch control instructions to virtual power plant aggregators through the virtual power plant control center;

[0122] The key distribution module is used to generate and manage keys; the system uses the same key distribution module to share security parameters.

Claims

1. A virtual power plant encryption control method based on homomorphic encryption, characterized in that: The steps include: S1: Establish a data collaboration system, including the virtual power plant control center, virtual power plant aggregator, distributed energy nodes, and energy consumption nodes; S2: Distributed energy nodes and energy consumption nodes are used as end nodes. The source and load data generated by the end nodes are encrypted once to form homomorphic encrypted ciphertext and sent to the virtual power plant aggregator node. S3: The virtual power plant aggregator node acts as an edge node to integrate energy data within its region, homomorphically encrypt the ciphertext, and upload it to the virtual power plant control center; S4: The virtual power plant control center decrypts the twice-encrypted ciphertext to obtain energy data; S5: Based on the decrypted energy data and the encrypted authentication data, the virtual power plant control center issues security policies and dispatch control instructions to the virtual power plant aggregator; The encryption process of the authentication data in step S5 includes: B1: System initialization: Select encryption parameters G, G1, e, g, p, H(), H1(), s and publish them in the system, where G is a finite cyclic group of order p, G1 is the reference set of G, the bilinear map e: G×G→G1, g is the generator of the group G, p is a large prime number, H() is the hash function, H1() is the reference variable of H(), and the master key s∈Z p , where Z p is the minimum remaining class; B2: The terminal node randomly selects a lightweight encryption parameter X and the encrypted message M; B3: Edge node key generation: the edge node serial number sn is known, corresponding to the public key PK sn =H(sn), private key SK sn =H(sn) s ; B4: Cloud key generation: Cloud public key PK c =H(cid), cloud private key SK c =H(cid) s , where cid is the cloud platform identification number; B5: Edge node encryption operation: select random number r∈Z q , calculate the initial encryption component C1 = g r , C2=M*e(g s ,Pk(sn) r ); B6: Edge-side perception fusion data decryption operation: based on the private key SK sn =H(sn) s And C1, C2, decrypted to get Fusing the decrypted data; B7: Edge node ciphertext conversion: The edge node randomly selects z∈Z q , calculate C1'=g z , C2'=X*e(g s ,H(cid) z ), Get the converted ciphertext: (C1,C1',C2',C3); B8: Cloud decryption calculation: Get the decrypted parameter X and information M.

2. A virtual power plant encryption control method based on homomorphic encryption according to claim 1, characterized in that: The process of encrypting once to form homomorphically encrypted ciphertext in step S2 is as follows: A1: Data preprocessing: Normalize the source and payload data into integer or floating-point format to meet homomorphic encryption input requirements. A2: Dynamic key generation: The end node generates a temporary key pair based on the hardware security module. The public key is signed by a certificate authority and embedded into the device firmware. The private key is destroyed locally. A3: Ciphertext generation: Use the public key to encrypt the data to form homomorphic encrypted ciphertext.

3. A virtual power plant encryption control method based on homomorphic encryption according to claim 2, characterized in that: The step A3 specifically includes: let En(k,m) be the fully homomorphic encryption function used by the system, where k is the public key of the virtual power plant control center, m is the data generated by the end node of the virtual power plant system, and the encrypted ciphertext is: c I =En(k,m).

4. A virtual power plant encryption control method based on homomorphic encryption according to claim 3, characterized in that: The homomorphic encryption process in step S3 includes: Let f(c I ) is the data aggregation function collected by the virtual power plant aggregator from n terminal nodes within its jurisdiction, and the secondary encrypted ciphertext is calculated: Complete homomorphic encryption.

5. A virtual power plant encryption control method based on homomorphic encryption according to claim 4, characterized in that: In step S4, the virtual power plant control center uses its own private key k' to decrypt and obtain the plain text information: f(m) = De(k',c II ), where De(k',c) is the fully homomorphic decryption function used by the system.

6. A virtual power plant encryption control method based on homomorphic encryption according to claim 5, characterized in that: In step S5, the instruction content Ctrl of the control instruction is encrypted and transmitted to the edge side, as follows: Send the cloud encryption control command Ctrl to the edge node: W1=g X ,W2=Ctrl*e(g s ,Pk(sn) X ) Among them, W1 and W2 are the encrypted ciphertext variables of the control instructions; Edge nodes obtain control instructions: based on the private key SK sn =H(sn) s And W1, W2, decrypted to get 7. A virtual power plant encryption control method based on homomorphic encryption according to claim 6, characterized in that: The issuing of the security policy in step S5 specifically includes: Assume that security policy ST = NO||Cont||CKD. The cloud encrypts and sends the security policy to the edge node: V1=g X ,V2=ST*e(g s ,Pk(sn) X ) Among them, V1 and V2 represent the encrypted variables of the security policy; The edge node receives and decrypts: Parse policy content and update security parameters.

8. A virtual power plant encryption control system based on homomorphic encryption according to the method of claim 1, characterized in that: include: System establishment module, used to establish a data collaboration system, including the virtual power plant control center, virtual power plant aggregator, distributed energy nodes and energy consumption nodes; The one-time encryption module is used to encrypt the source and load data generated by the end node into a homomorphic encrypted ciphertext and send it to the virtual power plant aggregator node; The secondary encryption module is used to homomorphically encrypt the homomorphically encrypted ciphertext and upload it to the virtual power plant control center; Decryption module, used by the virtual power plant control center to decrypt the twice-encrypted ciphertext; The issuing module is used to issue security policies and dispatch control instructions to virtual power plant aggregators through the virtual power plant control center.

9. A virtual power plant encryption control system based on homomorphic encryption according to claim 8, characterized in that: It also includes a key distribution module for generating and managing keys.

Images