Intelligent microgrid security communication optimization method and system

Abstract

The application discloses a kind of intelligent microgrid security communication optimization method and system, the method includes receiving the unique identity identification sent by trusted third party, time stamp and one-time secret token, obtains corresponding initial device certificate and initial public key;Send the request of accessing specific electronic equipment group to trusted third party, determine the access strategy for specific electronic equipment group;With each electronic equipment in specific electronic equipment group in access strategy, carry out the exchange of initial device certificate and initial public key with electronic equipment, determine target device certificate and target public key;In response to the success instruction of exchange, according to target device certificate and target public key, corresponding authentication key is calculated;With the mechanism of layered handshake protocol introduced, session key is established based on authentication key;With session key, the information transmitted is encrypted, and the encrypted information is signed according to online / offline technology Processing, and sending to electronic equipment for verification.

Description

Technical Field

[0001] The present invention relates to the field of power grid security technology, and in particular to a method and system for optimizing secure communications in a smart microgrid. Background Art

[0002] Providing reliable and secure communication between microgrid components and between the microgrid and the larger grid is a functional requirement for microgrids. Microgrid communication protocols need to support a variety of communication scenarios to ensure that information exchange between different control layers meets real-time and security requirements. These scenarios include point-to-point communication, multicast communication, and broadcast communication.

[0003] Due to the limitations of its own conditions, the communication technology of traditional microgrids has poor security and real-time performance in the communication interaction process, which makes it difficult to meet the communication needs of smart microgrids, thus affecting the stable operation of smart microgrids.

[0004] Therefore, how to optimize the communication method of the microgrid and ensure the reliable operation of the communication process of the smart microgrid has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the Invention

[0005] The present invention provides a method and system for optimizing secure communication in smart microgrids, so as to solve the problem of how to build a distributed secure communication architecture between smart microgrids, establish an effective identity authentication and key establishment mechanism, and improve the security and confidentiality of interactions between communication devices.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a smart microgrid secure communication optimization method, which is applied to the information transmission process of the smart microgrid, including:

[0007] Receive the unique identity, timestamp, and one-time secret token sent by the trusted third party, and obtain the corresponding initial device certificate and initial public key;

[0008] Sending a request to the trusted third party to access a specific electronic device group, and determining an access policy for the specific electronic device group;

[0009] Accessing each electronic device in the specific electronic device group using the access policy, performing a revised exchange of the initial device certificate and the initial public key with the electronic device, and determining a target device certificate and a target public key;

[0010] In response to the modification exchange success instruction, calculating a corresponding authentication key according to the target device certificate and the target public key;

[0011] Establishing a session key based on the authentication key using the introduced layered handshake protocol mechanism;

[0012] The transmitted information is encrypted with the session key, the encrypted information is signed according to the online / offline technology, and sent to the electronic device for verification.

[0013] Furthermore, the process of obtaining the corresponding initial device certificate and initial public key includes:

[0014] Sending a certificate request including a random number, a timestamp, and a hash value to the trusted third party;

[0015] After receiving an instruction from the trusted third party that the parameters in the certificate request have been verified, receiving the initial device certificate sent by the trusted third party;

[0016] The initial device certificate is processed using elliptic curve cryptography to generate the initial public key.

[0017] Furthermore, the process of obtaining the corresponding initial device certificate and initial public key also includes:

[0018] Receive and store the identity hash value of each electronic device preloaded by the trusted third party.

[0019] Furthermore, the sending of a request to the trusted third party to access a specific electronic device group and determining an access policy for the specific electronic device group includes:

[0020] After sending an access request to the trusted third party, the trusted third party receives the access policy generated by the trusted third party based on the created tree-like access policy, identification information and authentication code; wherein the identification information is obtained by the trusted third party using the root node hash value as the authentication code, and binding it with the initial public key and shared key.

[0021] Furthermore, the performing the revised exchange of the initial device certificate and the initial public key with the electronic device includes:

[0022] In response to an access success instruction issued by the trusted third party, exchanging the initial device certificate and the initial public key with the electronic device using a preset key exchange protocol, and verifying the exchange result based on the public key of the trusted third party;

[0023] Based on the access policy, an access verification request is sent to the electronic device.

[0024] Furthermore, the layered handshake protocol mechanism introduced herein establishes a session key based on the authentication key, including:

[0025] Sending an initial handshake request to a target electronic device in the specific electronic device group, and upon success, processing the authentication key according to a preset key derivation algorithm to derive the session key and authentication token;

[0026] A subsequent handshake request is sent to non-target electronic devices in the specific electronic device group, and after the request is successful, the session key is updated by reusing the authentication token.

[0027] Furthermore, the encrypted information is signed according to the online / offline technology and sent to the electronic device for verification, including:

[0028] When in the offline stage, the generated one-time signature key pair is signed using a preset signature algorithm to generate first signature information;

[0029] When in the online stage, the encrypted ciphertext information is signed according to the one-time signature key pair to generate second signature information;

[0030] The ciphertext information, the first signature information and the second signature information are sent to the electronic device for decryption and signature verification.

[0031] Another embodiment of the present invention provides a smart microgrid security communication optimization system, including:

[0032] The certificate and key generation module is used to receive the unique identity, timestamp and one-time secret token sent by a trusted third party and obtain the corresponding initial device certificate and initial public key;

[0033] an access policy creation module, configured to send a request to the trusted third party to access a specific electronic device group and determine an access policy for the specific electronic device group;

[0034] a key exchange module, configured to access each electronic device in the specific electronic device group using the access policy, perform a revised exchange of the initial device certificate and the initial public key with the electronic device, and determine a target device certificate and a target public key;

[0035] an authentication key establishment module, configured to calculate a corresponding authentication key based on the target device certificate and the target public key in response to the modification exchange success instruction;

[0036] A session key establishment module, configured to establish a session key based on the authentication key using the introduced layered handshake protocol mechanism;

[0037] The communication verification module is used to encrypt the transmitted information with the session key, sign the encrypted information according to the online / offline technology, and send it to the electronic device for verification.

[0038] Yet another embodiment of the present invention provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the above-described smart microgrid secure communication optimization method when executing the computer program.

[0039] Yet another embodiment of the present invention provides a computer-readable storage medium storing a computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the smart microgrid secure communication optimization method as described above is implemented.

[0040] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0041] The embodiments of the present invention are intended to optimize the secure communications of smart microgrids, and have made improvements in the identity authentication, session key establishment and communication stages, which can solve the security risks at the power network boundary and the access control granularity problems. In the identity authentication stage, the present invention introduces two-way authentication and centralized management of a trusted third party for key exchange and identity authentication, and realizes rapid authentication of multiple users through a single initial authentication process, ensuring the legitimacy of identity and confidentiality of communication. In the session key establishment stage, a key exchange protocol is introduced to generate a temporary session key, which is combined with a timestamp and a random number to enhance forward secrecy and defend against replay attacks. In the communication stage, the introduction of online / offline signatures combined with fine-grained access control can improve the efficiency of signature and verification, and fully meet the requirements of real-time communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of a method for optimizing secure communication in a smart microgrid according to one embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of the overall process of intelligent microgrid communication transmission in one embodiment of the present invention;

[0044] Figure 3 This is a schematic structural diagram of a smart microgrid security communication optimization system in one embodiment of the present invention;

[0045] Figure 4 A structural block diagram of a preferred embodiment of a computer device provided by the present invention;

[0046] Reference numerals:

[0047] M1, certificate and key generation module; M2, access policy creation module; M3, key exchange module; M4, authentication key establishment module; M5, session key establishment module; M6, communication verification module. DETAILED DESCRIPTION

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0049] In the description of this application, the terms "first," "second," "third," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first," "second," "third," etc. may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0050] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be a communication between the two components. The terms "vertical", "horizontal", "left", "right", "up", "down" and similar expressions used herein are for illustrative purposes only, and do not indicate or imply that the device or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0051] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meanings as those commonly understood by those skilled in the art. The terms used in this specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. Those skilled in the art will understand the specific meanings of the above terms in this application in specific circumstances.

[0052] It should be understood that the process of information communication and transmission in a smart microgrid usually involves the sending device (dev), the receiving intelligent electronic device (IED), and a feasible third party (TTP). The embodiment of the present invention aims to provide a smart microgrid security communication optimization method to address the issues of real-time and security encryption in the information transmission process of the smart microgrid. For details, please refer to Figure 1 , Figure 1 The figure shows a flow chart of a method for optimizing secure communication of a smart microgrid in one embodiment of the present invention, which includes the following steps:

[0053] S1. Receive the unique identity, timestamp, and one-time secret token sent by the trusted third party, and obtain the corresponding initial device certificate and initial public key.

[0054] This phase is the registration phase for the sender's device. Prior to this, initialization is required to configure the initial parameters of the network device. Initiated by a trusted third party, this phase sets the mathematical foundation and security parameters required for the operation of the entire network communication system.

[0055] Furthermore, during the registration process, the trusted third party will first randomly select a unique identifier for the sender device, calculate the identifier hash value and timestamp, generate a one-time secret token, and provide the identifier, timestamp, and one-time secret token to the sender device during the offline phase to complete the registration. The timestamp represents the time when the sender device registered with the trusted third party. During the registration process of the sender device, the trusted third party needs to pre-load the identifiers of other devices, such as the identity hash values ​​of each electronic device, into the memory of the sender device for storage. It should be understood that the sender device needs to communicate with a specific group of electronic devices (such as sending control instructions). Pre-loading the identifiers of the target device, such as the hash value, can avoid frequent queries of device information from the trusted third party during real-time communication and reduce authentication delays.

[0056] The sending device then sends a certificate request containing a random number, timestamp, and hash value to the trusted third party. To ensure the legitimacy and integrity of the request, the trusted third party verifies the parameters in the certificate request. Once verified, it generates an initial device certificate and sends it to the sending device.

[0057] After the sending device receives the instruction from the trusted third party that the parameters in the certificate request have been verified, it simultaneously receives the initial device certificate sent by the trusted third party. The initial device certificate is processed using elliptic curve cryptography to generate the corresponding initial public key or private key.

[0058] S2. Send a request to the trusted third party to access a specific electronic device group, and determine an access policy for the specific electronic device group.

[0059] This step involves creating an access policy. As you can understand, the primary purpose of an access policy is to define which smart grid electronic devices the sender can access. This ensures that only authorized electronic devices can be accessed by the sender, thereby enhancing system security. Based on this, after the sender device sends a request to a trusted third party for access to a specific group of electronic devices, it will receive back the access policy for that specific group of electronic devices from the trusted third party.

[0060] It's worth noting that the generation of access policies relies on a trusted third party. Specifically, after receiving the request from the sender, the trusted third party consolidates the requested electronic devices into a logical group, known as a specific electronic device group. The trusted third party constructs a tree-like access policy based on a tree structure, such as a Merkle tree, where the leaf nodes are hash values ​​of the electronic devices' identities.

[0061] Furthermore, the root node is used as the authentication code for the tree-structured access policy. This code is then bound to the public key of the sender's device and a pre-shared symmetric key established between the sender and a trusted third party to obtain identification information for the tree-structured access policy. The trusted third party then sends this identification information to the sender. The sender's device, upon receiving this identification information, can determine the access policy for a specific group of electronic devices, achieving secure and efficient access.

[0062] S3-S4, accessing each electronic device in the specific electronic device group using the access policy, performing a revised exchange of the initial device certificate and the initial public key with the electronic device, and determining a target device certificate and a target public key.

[0063] This step involves the mutual authentication between the sender and receiver devices. It should be understood that during this process, a symmetric session key (SSK) is established to protect the message / information over an insecure public channel. This exchange establishes a secure communication channel through mutual authentication and key exchange between the sender and receiver, ensuring the security of information transmission.

[0064] First, before generating a session key, the sending device and the receiving electronic device exchange their respective certificates and public keys through a key exchange protocol. Afterwards, an authentication key is calculated and used to generate and exchange the session key. Specifically, in response to a successful access instruction from a trusted third party, the sending device and the receiving electronic device exchange their initial device certificates and initial public keys using a preset key exchange protocol, such as the ECDH key agreement, and the exchanged result is verified based on the trusted third party's public key. It should be understood that throughout the communication interaction and information transmission process, the receiving electronic device also sends a registration request to the trusted third party and similarly generates a device certificate and public key. During this stage, the two devices exchange their respective certificates and public keys and verify each other. The sending device calculates the electronic device's public key by combining the trusted third party's public key with the exchanged electronic device certificate. If the calculated result is inconsistent with the public key declared by the electronic device, communication is terminated. Otherwise, verification is successful. Simultaneously, based on the access policy, the sending device sends an access verification request to the electronic device.

[0065] As for the electronic device, it is necessary to verify whether the access permission sent by the sending device is correct through the previously determined identification information bound to the public key information of the sending device, that is, the access policy.

[0066] In response to the exchange success instruction, the target device certificate and target public key are determined based on the exchanged and revised data, and the corresponding authentication key is calculated. This calculation process is also implemented using the ECDH key agreement. It should be understood that the authentication key is a key shared by the sender and receiver and is used to establish the subsequent session key.

[0067] S5. Using the introduced layered handshake protocol mechanism, establish a session key based on the authentication key.

[0068] In this embodiment, the layered handshake protocol involves an initial handshake and a subsequent handshake, which are used together to perform identity authentication during the interaction between the sender and the receiver, that is, the process involving the above-mentioned key exchange, and can ensure the security of information transmission during the process.

[0069] Specifically, an initial handshake request is sent to a target electronic device within a specific electronic device group. If the request is successful, the authentication key is processed according to a preset key derivation algorithm to derive a session key and an authentication token (TK). The authentication token is used for rapid identity verification during subsequent handshakes. Preferably, the session key is derived using a key derivation function (KDF).

[0070] Synchronously, the electronic device will also receive the handshake request and derive the session key and authentication token in the same way.

[0071] After a successful initial handshake, a secure channel for interactive communication between the two parties is successfully established. Further, subsequent handshake requests are sent to non-target electronic devices within the specific electronic device group. Upon successful requests, the authentication token is reused to update the session key. For example, the sending device will use the authentication token generated by the initial handshake to initiate requests to other devices in the same group. This is authentication token reuse. Reusing authentication tokens can avoid repeated certificate verification, reduce computational overhead, and improve communication efficiency.

[0072] S6. Encrypt the transmitted information with the session key, sign the encrypted information according to the online / offline technology, and send it to the electronic device for verification.

[0073] This step, which is the communication phase of the message, utilizes online / offline signing technology to improve the efficiency of signing and verification. For example, during the offline phase, a key generation algorithm can be used to generate a temporary signing key and verification key pair, known as a one-time signing key pair. When the sender sends a message, the one-time verification key pair is signed using a pre-defined signature scheme (such as the ECDSA elliptic curve signature algorithm) to generate the first signature message. As will be appreciated, the temporary signing key must be kept confidential, while the verification key can be made public.

[0074] When in the online stage, the ciphertext information generated by encrypting the information with the session key is signed according to the one-time signature key pair pre-generated in the offline stage to generate second signature information.

[0075] The ciphertext information and the generated first and second signature information are used as the signature of the currently transmitted information, and the signature is sent to the electronic device for decryption and verification.

[0076] After receiving the message, the recipient's electronic device uses the verification key and signature key to decrypt and verify the message, respectively, verifying its integrity and origin. If verification succeeds, the recipient accepts the message and executes the relevant instructions sent by the sender; otherwise, the message is rejected.

[0077] This invention will provide a specific example to describe the authentication and key establishment process of the scheme in detail. Figure 2 As shown, Figure 2 The figure shows a schematic diagram of the overall process of intelligent microgrid communication transmission in one embodiment of the present invention, including the following steps:

[0078] 1. Initialization

[0079] For example, in one embodiment of the present invention, elliptic curve cryptography (ECC) is selected for initialization, and a non-singular elliptic curve is assigned to each sender and receiver device of the smart grid in each communication network. , expressed as:

[0080]

[0081] in, and is a constant, satisfying ,and is a large prime number, and mod is the modular operation.

[0082] Select a base point on the elliptic curve , whose order is ,satisfy , is a point at infinity. TTP determines a private key on this elliptic curve , is a finite field, then its public key Expressed as:

[0083]

[0084] At the same time, each device will be assigned a non-collision hash function , and 、 and public.

[0085] 2. Registration of IED registration and dev registration

[0086] Taking IED registration as an example, TTP randomly selects a unique identity for the IED , and calculate the corresponding device identity , timestamp and a one-time secret token , respectively expressed as follows:

[0087]

[0088]

[0089]

[0090] in, It is IED registration time.

[0091] TTP offline Provided to IED.

[0092] For dev, TTP also takes the same steps as above and offline Provided to the sender S. Among them, Is the unique identifier of the sender, The timestamp corresponding to dev, This is the one-time secret token generated by dev.

[0093] At the same time for IED and sender S, TTP preload to the IED's memory, where , TTP preload To the dev memory, where .

[0094] 3. Certificate Generation

[0095] Taking IED as an example, select random number and the current timestamp , calculate the temporary public key and verify the hash , respectively expressed as follows:

[0096]

[0097]

[0098] Will Send to TTP.

[0099] TTP verifies received Whether equal.

[0100] After successful verification, TTP generates the certificate corresponding to the IED and signature .

[0101] TTP Send Give IED.

[0102] in, .

[0103] Dev also requests TTP to generate a certificate for it in a similar way .

[0104] 4. Generation of access policies

[0105] TTP groups all target IEDs into a group containing IEDs, a total of The TTP defines a tree-structured access policy AP for the group, with the root node AC as the authentication code and the hash value of the leaf node as:

[0106]

[0107] in, The level at which the node is located.

[0108] The hash value of the root node It is obtained by recursive calculation and expressed as:

[0109]

[0110] in, ; ; .

[0111] Furthermore, the TTP generates identification information for the access policy , which is expressed as follows:

[0112]

[0113] in, It is the symmetric key pre-shared between the TTP and the IED.

[0114] Finally, the TTP sends the apID, IED group, and TTP public key to the Send to dev.

[0115] 5. Public key / private key generation stage

[0116] IED receives Then generate a public / private key pair, expressed as:

[0117]

[0118] in, is the IED private key, is the IED public key.

[0119] On the S side, dev generates its public / private key pair, which is expressed as:

[0120]

[0121] in, For the dev private key, The dev public key.

[0122] dev use and the TTP's public key Calculate the public key of the IED to verify the rationality of the IED public key. The calculation process is:

[0123]

[0124] dev receives its public key from the TTP Certificate and compare it with Embedded in apID. dev uses apID to authenticate its public key to IED .

[0125] After IED and dev exchange their Cert and K using ECDH key exchange protocol, authentication key AK is computed, which is expressed as follows:

[0126]

[0127] 6. Authentication and session key establishment

[0128] First is the initial handshake:

[0129] dev selects a random number and generates the current timestamp . Compute the one-time credential , and .

[0130] Wherein, and are authentication parameters, dev sends to IED.

[0131] IED verifies the validity of the timestamp , that is, checks , wherein, is the maximum delay of message transmission. Further, IED verifies the validity of by calculating the authentication parameter . After verification, IED selects a random number and generates the current timestamp . Similarly, its corresponding one-time credential is calculated and sent to the sender S.

[0132] dev verifies the validity of the timestamp , that is, checks . Dev verifies the validity of the one-time credential sent by IED by calculating the public key : of IED, and after successful verification, computes and sends to IED.

[0133] IED verifies , and after successful verification, computes and compares it with the received apID. After successful verification, IED computes and sends it to S, at which time a secure connection is successfully established. Wherein, , that is, the session key; Indicates the encryption operation using the public key Kc between smart grid devices.

[0134] Subsequent handshake:

[0135] dev chooses a random number And generate the current timestamp . Calculate one-time vouchers , and send to .

[0136] Verify Timestamp ,examine If valid, Pick a random number , and generate a timestamp Calculation voucher .

[0137] Use Kc to decrypt TK and extract 、 The AP calculates the local AC value based on the predefined access policy (e.g., through the hash chain of the AP tree). Is it consistent with the locally calculated value? If it is consistent, use the key generation function KDF to calculate the session key , and calculate ,send To the sender S.

[0138] dev verify timestamp , if valid, then use the key generation function to calculate , and verify If they are consistent, confirm that the SSK is valid and give feedback to .

[0139] Comparison and If they match, a secure channel is established.

[0140] 7. Signature and Verification

[0141] Furthermore, the elliptic curve signature algorithm and online / offline signature calculation will be combined to sign the received information / message, wherein a pair of temporary signature keys are generated during the offline signing stage. and verification key , recorded as generating a one-time signature pair , after signing using the elliptic curve signature algorithm, generate signature information .

[0142] During the online phase, the session key is used to encrypt the information , and use a one-time signature to Sign the encrypted information to generate signature information ,return The electronic device is used for decryption and signature verification.

[0143] In summary, the embodiment of the present invention integrates the elliptic curve cryptography system, online / offline signatures and tree access strategy to achieve efficient and secure device authentication and data interaction. The core of the invention is: through a trusted third party, global security parameters and device identity identification are uniformly configured, dynamic public and private key pairs and authentication keys are generated using elliptic curve cryptography technology, and fine-grained permission control is achieved in combination with a hash chain-based tree access strategy; through the collaborative and efficient authentication mechanism of the layered handshake protocol, authentication efficiency can be improved by reusing authentication tokens, significantly reducing computing and communication overhead; by decomposing the calculation process of the digital signature into an offline stage and an online stage, tasks with a large computational workload in the offline stage can be completed in idle time, thereby reducing the computational burden of the online stage. The embodiment of the present invention provides a reliable solution for high-real-time scenarios such as smart microgrids and industrial Internet of Things, meeting the core requirements of security and real-time performance of smart microgrids.

[0144] An embodiment of the present invention provides a smart microgrid security communication optimization system. For details, see Figure 3 As shown, Figure 3 FIG. 1 is a schematic diagram of a structure of a smart microgrid security communication optimization system according to one embodiment of the present invention, comprising:

[0145] The certificate and key generation module M1 is used to receive the unique identity, timestamp and one-time secret token sent by a trusted third party and obtain the corresponding initial device certificate and initial public key;

[0146] An access policy creation module M2 is configured to send a request to the trusted third party to access a specific electronic device group and determine an access policy for the specific electronic device group;

[0147] a key exchange module M3, configured to access each electronic device in the specific electronic device group using the access policy, perform a revised exchange of the initial device certificate and the initial public key with the electronic device, and determine a target device certificate and a target public key;

[0148] an authentication key establishing module M4, configured to calculate a corresponding authentication key based on the target device certificate and the target public key in response to the modification exchange success instruction;

[0149] A session key establishment module M5 is configured to establish a session key based on the authentication key using the introduced layered handshake protocol mechanism;

[0150] The communication verification module M6 is used to encrypt the transmitted information with the session key, sign the encrypted information according to the online / offline technology, and send it to the electronic device for verification.

[0151] The technical features and technical effects of the smart microgrid security communication optimization system proposed in the embodiment of the present invention are the same as the technical features and technical effects of the smart microgrid security communication optimization method proposed in the embodiment of the present invention, and will not be repeated here.

[0152] like Figure 4 As shown, an embodiment of the present invention further provides a computer device, Figure 4 This is a structural block diagram of a preferred embodiment of a computer device provided by the present invention, wherein the computer device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the above-mentioned method when executing the computer program.

[0153] Preferably, the computer program can be divided into one or more modules / units (e.g., computer program 1, computer program 2, ...). These one or more modules / units are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, and these instruction segments are used to describe the execution process of the computer program in the computer device.

[0154] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor. The processor is the control center of the terminal device, and various parts of the terminal device are connected using various interfaces and lines.

[0155] The memory mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function, and the like, and the data storage area can store relevant data and the like. In addition, the memory can be a high-speed random access memory, and can also be a non-volatile memory such as a plug-in hard disk, a SmartMedia Card (SMC), a Secure Digital (SD) card, a Flash Card, and the like, or the memory can also be other volatile solid-state storage devices.

[0156] It should be noted that the terminal device can include, but is not limited to, a processor and a memory, and those skilled in the art can understand that Figure 4 The structural block diagram is only an example of the terminal device, and does not constitute a limitation on the terminal device, and can include more or fewer components than the diagram, or combine certain components, or different components. Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiment methods. The storage medium can be a magnetic disk, an optical disk, a Read-Only Memory (ROM), or a Random Access Memory (RAM), and the like.

[0157] Correspondingly, the embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the steps in the above-mentioned embodiment methods, such as Figure 1 the steps S1-S6 in the above-mentioned embodiment methods.

[0158] The above-mentioned embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it cannot be understood as a limitation on the scope of the patent of the present application. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A smart microgrid security communication optimization method, applied to the information transmission process of the smart microgrid, characterized in that: include: Receive the unique identity, timestamp, and one-time secret token sent by the trusted third party, and obtain the corresponding initial device certificate and initial public key; Sending a request to the trusted third party to access a specific electronic device group, and determining an access policy for the specific electronic device group; Specifically, after sending the access request to the trusted third party, receiving the access policy generated by the trusted third party based on the created tree-structured access policy, identification information, and authentication code; wherein the identification information is obtained by the trusted third party by binding the initial public key and the shared key using the root node hash value as the authentication code; Accessing each electronic device in the specific electronic device group using the access policy, performing a revised exchange of the initial device certificate and the initial public key with the electronic device, and determining a target device certificate and a target public key; specifically, in response to an access success instruction issued by the trusted third party, exchanging the initial device certificate and the initial public key with the electronic device using a preset key exchange protocol, and verifying the exchange result based on the public key of the trusted third party; Based on the access policy, sending an access verification request to the electronic device; In response to the modification exchange success instruction, calculating a corresponding authentication key according to the target device certificate and the target public key; The layered handshake protocol mechanism is introduced to establish a session key based on the authentication key. Specifically, an initial handshake request is sent to a target electronic device in the specific electronic device group. If the request is successful, the authentication key is processed according to a preset key derivation algorithm to derive the session key and the authentication token. Sending a subsequent handshake request to a non-target electronic device in the specific electronic device group, and upon success, updating the session key by reusing the authentication token; The transmitted information is encrypted with the session key, the encrypted information is signed according to the online / offline technology, and sent to the electronic device for verification; specifically, when in the offline stage, the generated one-time signature key pair is signed using a preset signature algorithm to generate first signature information; when in the online stage, the encrypted ciphertext information is signed according to the one-time signature key pair to generate second signature information; the ciphertext information, the first signature information and the second signature information are sent to the electronic device for decryption and verification.

2. The method for optimizing secure communication of a smart microgrid according to claim 1, wherein: The process of obtaining the corresponding initial device certificate and initial public key includes: Sending a certificate request including a random number, a timestamp, and a hash value to the trusted third party; After receiving an instruction from the trusted third party that the parameters in the certificate request have been verified, receiving the initial device certificate sent by the trusted third party; The initial device certificate is processed using elliptic curve cryptography to generate the initial public key.

3. The method for optimizing secure communication of a smart microgrid according to claim 1, wherein: The process of obtaining the corresponding initial device certificate and initial public key also includes: Receive and store the identity hash value of each electronic device preloaded by the trusted third party.

4. An intelligent microgrid security communication optimization system, characterized in that: include: The certificate and key generation module is used to receive the unique identity, timestamp and one-time secret token sent by a trusted third party and obtain the corresponding initial device certificate and initial public key; an access policy creation module, configured to send a request to the trusted third party to access a specific electronic device group and determine an access policy for the specific electronic device group; Specifically, after sending the access request to the trusted third party, receiving the access policy generated by the trusted third party based on the created tree-structured access policy, identification information, and authentication code; wherein the identification information is obtained by the trusted third party by binding the initial public key and the shared key using the root node hash value as the authentication code; a key exchange module, configured to access each electronic device in the specific electronic device group using the access policy, perform a modified exchange of the initial device certificate and the initial public key with the electronic device, and determine a target device certificate and a target public key; specifically, in response to an access success instruction issued by the trusted third party, exchange the initial device certificate and the initial public key with the electronic device using a preset key exchange protocol, and verify the exchange result based on the public key of the trusted third party; Based on the access policy, sending an access verification request to the electronic device; an authentication key establishment module, configured to calculate a corresponding authentication key based on the target device certificate and the target public key in response to the modification exchange success instruction; a session key establishment module, configured to establish a session key based on the authentication key using the introduced layered handshake protocol mechanism; specifically, to send an initial handshake request to a target electronic device within the specific electronic device group; and upon a successful request, to process the authentication key according to a preset key derivation algorithm to derive the session key and authentication token; Sending a subsequent handshake request to a non-target electronic device in the specific electronic device group, and upon success, updating the session key by reusing the authentication token; The communication verification module is used to encrypt the transmitted information with the session key, sign the encrypted information according to the online / offline technology, and send it to the electronic device for verification; specifically, when in the offline stage, use a preset signature algorithm to sign the generated one-time signature key pair to generate first signature information; when in the online stage, sign the encrypted ciphertext information according to the one-time signature key pair to generate second signature information; and send the ciphertext information, the first signature information, and the second signature information to the electronic device for decryption and verification.

5. A computer device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for optimizing secure communication of a smart microgrid according to any one of claims 1 to 3 is implemented.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the smart microgrid security communication optimization method according to any one of claims 1 to 3 is implemented.

Images