An image encryption system and method for a smart grid environment

Abstract

This invention discloses an image encryption system and method for a smart grid environment, aiming to solve the problems of static encryption strategies and lack of adaptability in existing technologies. The image encryption system includes terminal devices, edge devices, and a central device. A dynamic key generation unit on the terminal device collaboratively utilizes the device's Physically Unclonable Feature (PUF) and the real-time load of the power grid to generate a dynamic key. A hierarchical encryption unit performs encryption of different strengths based on the complexity of the image content. The system's topology-aware transmission module uses a graph neural network (GNN) to analyze the power grid topology and dynamically optimize transmission. Furthermore, the image encryption system integrates low-density parity-check code encoding / decoding and an adaptive decryption strategy to enhance anti-interference capabilities. By constructing an integrated adaptive security system encompassing perception, decision-making, and execution, this invention significantly improves the security, efficiency, and robustness of image data transmission in smart grids.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an image encryption system and method in a smart grid environment. Background Technology

[0002] With the rapid development of smart grids and digital transformation, a massive number of visual sensing devices (such as surveillance cameras, drones, and inspection robots) are widely deployed in various stages of power transmission, substation, and distribution for equipment status monitoring, fault diagnosis, and environmental perception. The image data generated by these devices not only contains information about the grid's operating status but may also involve the topology of critical infrastructure and potential security vulnerabilities, making it highly sensitive and valuable. Therefore, ensuring the confidentiality, integrity, and availability of this image data during acquisition, transmission, and storage has become a key challenge in the smart grid security system.

[0003] Existing technologies for encryption and secure transmission of image data have the following main shortcomings:

[0004] Static and generic encryption strategies: Most schemes employ standard, static encryption algorithms (such as AES and DES) and fixed keys. This model is ill-suited to the highly heterogeneous device environment of smart grids. For example, using the same complex encryption algorithms for front-end cameras with limited computing power as for the central server would significantly consume their computing resources and increase processing latency; conversely, if lightweight algorithms are uniformly adopted, the security of core fault images during transmission cannot be guaranteed. This lack of content-sensitive and device-aware encryption strategies leads to a severe imbalance between security and efficiency.

[0005] Vulnerabilities in Key Management: Traditional key management schemes typically rely on pre-configured keys or centralized key distribution centers. In this approach, if a key is leaked during storage or transmission, the security of the entire system is at risk. Furthermore, the key generation process is completely decoupled from the protected device entity and the state of the business environment (such as power grid load fluctuations), making the keys themselves lack dynamism and contextual relevance, and thus more easily predicted and attacked.

[0006] Insufficient adaptability to dynamic network topology: The smart grid is a dynamically evolving network whose topology changes frequently due to factors such as equipment maintenance, grid connection / off-grid connection of distributed energy sources (such as photovoltaic and wind power), and line faults. Existing encrypted transmission schemes are usually based on static, preset routes, lacking the ability to perceive network topology changes in real time. When critical communication links become congested or interrupted, the system cannot intelligently and dynamically adjust the allocation of encrypted resources and the priority of data transmission, which may lead to delays or failures in the transmission of important fault images.

[0007] Lack of robustness in complex channels: The communication environment of smart grids is complex, especially outdoors and under high voltage. Wireless channels are often affected by strong electromagnetic interference and signal fading, leading to bit errors or packet loss during data transmission. Traditional encryption algorithms do not have error correction capabilities. If even a single bit of the ciphertext is corrupted during transmission, it usually leads to the failure of decryption of the entire data block, complete loss of image information, and a significant reduction in system availability.

[0008] Therefore, how to provide an intelligent image encryption and secure transmission scheme that can adaptively adjust across the entire link based on image content, device computing power, network topology, and channel quality is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0009] In view of this, the present invention aims to at least partially solve at least one of the problems existing in the prior art, such as static encryption strategies, fragile key management, inability to adapt to dynamic network topology, and lack of robustness under complex channels.

[0010] This invention provides an image encryption system for a smart grid environment, characterized in that it includes:

[0011] At least one terminal device, the terminal device comprising: an image acquisition unit for acquiring real-time images of power grid equipment; a dynamic key generation unit for generating a dynamic session key through a hyperchaotic system using the physical non-cloning characteristics of the terminal device and real-time load data of the power grid nodes associated with the terminal device; and a hierarchical encryption unit for analyzing the real-time images and performing hierarchical encryption on them using the dynamic session key; at least one edge device, the edge device comprising: a data receiving and preprocessing unit for receiving encrypted data from the terminal device and performing format conversion and integrity verification on it; and a collaborative encryption unit for performing enhanced encryption on high-complexity regions in the received encrypted data; and a central device, the central device comprising: a global key management unit for generating and distributing a master key to the terminal device and the edge device; and a decryption and restoration unit for decrypting and restoring the encrypted data received from the edge device.

[0012] Optionally, the dynamic key generation unit is further configured to: hash the physical non-clonable feature and use it as the initial state value of the hyperchaotic system; and quantize the real-time operating state data into a load fluctuation factor to dynamically modulate the system parameters of the hyperchaotic system.

[0013] Optionally, the central device is also configured to perform the following actions: analyze the data output by the decryption and restoration unit to identify potential operational risks to the power grid; and generate and issue dispatch instructions or safety warnings based on the potential operational risks.

[0014] Optionally, the system further includes a blockchain evidence storage module, which is configured to: capture key operations in the layered encryption, enhanced encryption, and decryption process; and record the key operations on a distributed ledger.

[0015] Optionally, the hierarchical encryption unit is further configured to perform the following actions: calculate the gradient entropy value of each image block in the real-time image; determine the image block with the gradient entropy value greater than a preset threshold as a high-complexity region; and encrypt the high-complexity region using a first encryption strategy, and encrypt the non-high-complexity region using a second encryption strategy different from the first encryption strategy.

[0016] Optionally, the system further includes a topology-aware transmission module, which is configured to: construct and dynamically update a topology map representing the current smart grid; input the topology map into a graph neural network model to calculate the priority of each data transmission link; and schedule data transmission between the terminal device and the edge device according to the priority.

[0017] Optionally, the collaborative encryption unit is further configured to perform the enhanced encryption on the high-complexity region using a hybrid encryption algorithm, the hybrid encryption algorithm comprising: scrambling the pixels of the high-complexity region using a hyperchaotic system; and further encrypting the scrambled pixel data using the AES algorithm.

[0018] Optionally, the edge device further includes a low-density parity check encoding unit for encoding the data before transmission; the decryption and restoration unit in the central device further includes a low-density parity check decoding unit, which is further configured to: monitor the channel quality parameters of the data transmission channel; and adaptively adjust its decoding and error correction strategy according to the channel quality parameters.

[0019] Optionally, the low-density parity-check code decoding unit adaptively adjusts its decoding strategy by increasing the number of iterations of the hyperchaotic system used for decryption and / or increasing the number of iterations of low-density parity-check code decoding when the channel quality parameter indicates that the channel quality has deteriorated and exceeds a preset threshold.

[0020] Optionally, the central device further includes a federated learning center module, which is configured to: aggregate encrypted model parameter updates from multiple edge devices; train a globally optimized model locally; and distribute the optimized model parameters to each edge device.

[0021] Another aspect of the present invention provides an image encryption method in a smart grid environment, the method comprising encryption, transmission and decryption steps performed by any of the aforementioned system schemes, corresponding to the functions of each unit or module.

[0022] Specifically, this invention provides a collaborative, end-to-end adaptive image encryption security system that integrates encryption strategies with device physical characteristics, real-time service status, dynamic network topology, and channel transmission quality. Compared with existing technologies, this invention can ensure a high level of security while also considering the computational efficiency of heterogeneous devices and transmission robustness under complex channels, significantly improving the intelligence level and overall performance of critical image data security protection in smart grid environments.

[0023] To more intuitively demonstrate the workflow of this invention, a simplified algorithm flow example is provided below.

[0024] In a specific scenario, when a terminal device with ID T-001 acquires an image containing a device fault: 1. Dynamic Key Generation: The device extracts its unique PUF feature "A1B2C3D4" and detects that the current load fluctuation factor is 2.3. Based on these two real-time parameters—the PUF feature and the current load fluctuation factor—its internal hyperchaotic system is dynamically configured and iterates 1000 times to generate a 256-bit dynamic session key. 2. Layered Encryption and Collaborative Enhanced Encryption: The device divides the image into blocks and calculates the image block containing the fault point. If the gradient entropy of this image block is greater than a preset threshold of 4.0, it is determined to be a high-complexity region. Subsequently, the terminal device performs a strong encryption on this region, specifically using the Chaos-SPECK algorithm (an encryption scheme that concatenates chaotic scrambling with the SPECK algorithm). After the data is transmitted to the edge device, the already strongly encrypted high-complexity area will undergo enhanced encryption again. This enhanced encryption refers to a secondary encryption on top of the existing encryption layer, specifically using the HyperChaos-AES algorithm (a hybrid encryption scheme that cascades four-dimensional hyperchaotic scrambling with the AES algorithm). 3. Topology-aware transmission: Simultaneously, the central device's GNN model determines that the core link carrying the faulty image data has a transmission priority of 0.95, and accordingly allocates higher network bandwidth resources and a more frequent key update strategy. 4. Interference resistance and adaptive decryption: The data is interfered with during transmission, and the channel bit error rate (BER) rises to 8%. 5. Adaptive decoding and restoration: Upon detecting this situation, the central device's decryption and restoration unit triggers an adaptive decryption mechanism, automatically increasing the number of iterations of the hyperchaotic system used for decryption from the usual 1000 to 1200, and performing 50 low-density parity-check code decoding iterations, ultimately successfully restoring the image clarity to over 98%.

[0025] This embodiment clearly demonstrates how, in practical applications, the present invention achieves end-to-end, highly secure, and highly reliable encryption and transmission of critical image data through intelligent collaboration across multiple devices and stages.

[0026] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] To more clearly illustrate the technical content of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0029] Figure 1 This illustration schematically shows a top-level functional module structure block diagram of an image encryption system in a smart grid environment provided by an embodiment of this application;

[0030] Figure 2 The core flowchart of the smart grid image encryption method provided in the embodiments of this application is illustrated schematically. Detailed Implementation

[0031] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0032] The following specific examples illustrate the implementation of this disclosure. Those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0033] It should be noted that various aspects of the embodiments described below are within the scope of the appended claims. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the apparatus and / or practice the method. Additionally, this apparatus and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0034] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0035] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0036] This embodiment provides an image encryption system for a smart grid environment. The system utilizes an innovative architecture involving three levels of collaborative operation: terminal devices, edge devices, and central devices. This architecture enables end-to-end adaptive security protection for power grid image data, from acquisition and encryption to transmission and decryption.

[0037] Please see Figure 1 The figure schematically illustrates the physical and logical layered architecture upon which the encryption system provided in this embodiment relies. In a preferred embodiment, the system mainly includes at least one terminal device 10, at least one edge device 20, and a central device 30.

[0038] Please see Figure 1 The figure schematically illustrates a system structure block diagram of an image encryption system in a smart grid environment provided by an embodiment of this application. In a preferred embodiment, the system mainly includes a terminal device 10, an edge device 20, and a central device 30.

[0039] Terminal device 10 is the source of perception and encryption for the entire system. It is typically an intelligent sensing device deployed at the monitoring site, such as a high-definition surveillance camera or an inspection drone. Its core function is to complete the raw image acquisition and the first stage of lightweight intelligent encryption processing.

[0040] In one specific embodiment, the terminal device 10 includes the following core units:

[0041] Image acquisition unit 101: Responsible for acquiring real-time images of power grid equipment. For example, it captures operational status images of key equipment such as transformers and insulators at a rate of 30 frames per second using a high-resolution CMOS sensor.

[0042] Dynamic Key Generation Unit 102: This is crucial for achieving "one key per device, one key per time." It is configured to generate a dynamic session key using the Physically Unclonable Feature (PUF) of the terminal device and real-time load data from the power grid nodes associated with the terminal device, via a hyperchaotic system. Specifically, the hyperchaotic system is a four-dimensional hyperchaotic system. To elaborate further, the mechanism by which this unit utilizes a "two-factor" approach is as follows: First, a unique, uncopyable PUF fingerprint sequence is extracted by reading the power-on state of the SRAM array on the device chip or the frequency of the ring oscillator. This PUF fingerprint sequence is processed by standard hash algorithms such as SHA-256, and the output PUF value is used as the initial state value of a hyperchaotic system. Simultaneously, the unit obtains real-time active power or current data from local power grid nodes (such as PMUs) as load data and quantizes it into a load fluctuation factor α(t) using mathematical methods such as fractional derivatives. This factor is used to dynamically modulate one or more key system parameters of the hyperchaotic system; for example, a' = a + k0 * α(t). Where: a' represents the parameters of the hyperchaotic system after dynamic modulation and immediate effect, which directly affects the subsequent evolution trajectory of the chaotic sequence. 'a' represents a base value or default value for this parameter. This is a preset benchmark constant that ensures the hyperchaotic system remains in a chaotic state. k0 is a modulation coefficient or scaling factor. This coefficient controls the degree of influence of load fluctuations on system parameters, and its value can be preset according to the safety level requirements of the actual application scenario. α(t) is the real-time load fluctuation factor calculated at time point t. As a time-varying variable, it introduces the actual operating state of the power grid into the hyperchaotic system.

[0043] Thus, the dynamic session key ultimately generated by the hyperchaotic system is not only unique to each device, but its evolution trajectory is also constantly affected by the actual business state of the power grid, giving it extremely high randomness, anti-predictability, and contextual relevance.

[0044] Layered Encryption Unit 103: This unit is responsible for performing content-sensitive differential encryption. It analyzes the real-time image and performs layered encryption using the dynamic session key. The process of layered encryption is as follows: First, the acquired image is divided into blocks of a preset size (e.g., 16×16 pixels). Then, the gradient entropy of each image block is calculated. Gradient entropy effectively measures the complexity of image texture and the density of information. Then, image blocks with gradient entropy greater than a preset threshold are identified as high-complexity regions containing key information, while the rest are considered non-high-complexity regions. Finally, different encryption algorithms are invoked (e.g., a first encryption strategy, such as Chaos-SPECK, is used for high-complexity regions, and a second encryption strategy, such as SPECK, is used for non-high-complexity regions) and encryption is performed using the newly generated dynamic session key.

[0045] Edge device 20, acting as a bridge between terminal devices and central devices, is typically deployed in substations or regional aggregation rooms and possesses stronger computing and storage capabilities than terminal devices. It is responsible for preprocessing and further enhancing encryption of encrypted data.

[0046] In one specific embodiment, the edge device 20 includes the following core units:

[0047] Data receiving and preprocessing unit 201: Responsible for receiving encrypted data from the terminal device and performing format conversion and integrity verification on it. For example, it encapsulates the raw data stream uploaded by the terminal into a standard TCP / IP data packet with metadata such as timestamp, device ID, and encryption policy identifier, and calculates its MD5 hash value for subsequent integrity verification.

[0048] Collaborative Encryption Unit 202: This unit is responsible for performing enhanced encryption on high-complexity regions in the received encrypted data. It should be noted that this enhanced encryption is a hybrid encryption strategy. For example, this unit can first use a hyperchaotic key issued by the central device and associated with the edge device to perform secondary pixel-level scrambling on the already encrypted key image block data, further disrupting its statistical properties; then, it calls the hardware-accelerated AES-128 algorithm to perform a high-speed, high-strength block encryption on the scrambled data. This combination of "scrambling + block encryption" can greatly improve the defense against brute-force and statistical analysis attacks.

[0049] Central device 30, this component is the core of the entire system, usually deployed on a cloud server or regional control center, and has the most powerful computing, storage and management capabilities.

[0050] In one specific embodiment, the central device 30 includes the following core units:

[0051] Global key management unit 301: Responsible for generating and distributing master keys to the terminal devices and edge devices. It should be noted that, to achieve the highest level of security, this unit can preferably employ quantum key distribution (QKD) technology when generating and distributing the master key. By utilizing the no-cloning principle of quantum states, QKD can ensure the absolute security of the master key during the distribution process; even if eavesdropping occurs, it will be detected immediately, thus eliminating the risk of master key leakage at its source.

[0052] Decryption and restoration unit 302: Responsible for decrypting and restoring encrypted data received from the edge device. It should be noted that the decryption process of this unit is a sophisticated multi-level inverse operation. First, it needs to perform low-density parity-check code decoding and error correction to repair possible bit errors in complex channels; then, based on the metadata in the data packet, it calls the corresponding decryption algorithm (such as AES inverse operation) for decryption; finally, if the data has been scrambled, it also needs to perform hyperchaotic inverse scrambling based on the permutation index stored in the encryption stage to ultimately restore the pixels to their original positions and restore a clear image.

[0053] Through the precise collaboration of the aforementioned "end-edge-cloud" three-level devices and their internal units, this system constructs a hierarchical and progressive security protection system.

[0054] In a preferred embodiment, the dynamic key generation unit 102 is further configured to: process the physical unclonable feature using a hash algorithm such as SHA-256 and use it as the initial state value of the hyperchaotic system; and quantize real-time operating status data (such as power grid load) into a load fluctuation factor to dynamically modulate one or more system parameters of the hyperchaotic system.

[0055] In a preferred embodiment, the central device 30 is further configured to perform data analysis and decision-making actions, including: first, analyzing the image data output by the decryption and restoration unit 302, for example by comparing it with a normal state image library or using an image recognition algorithm, to identify potential operational risks to the power grid (such as equipment overheating or insulator damage); then, based on the level and type of the potential operational risks, automatically generating and issuing corresponding scheduling instructions (such as adjusting regional loads) or safety warnings (such as pushing alarm information to the mobile terminals of maintenance personnel).

[0056] In a preferred embodiment, the system further includes a blockchain evidence storage module. This module is configured to: capture key operational information such as the timestamp of the operation, the device ID executing the operation, and the hash value of the key used, at critical nodes in the encryption process (such as key generation, layered encryption, enhanced encryption, and decryption); subsequently, package this information into an immutable transaction and record it on a distributed ledger. This approach provides immutable security auditing and post-event traceability for all encryption operations.

[0057] In a preferred embodiment, the specific decision-making and execution actions of the layered encryption unit 103 when performing layered encryption include: first, calculating the gradient entropy value of each image block in the real-time image; then, determining the image block with the gradient entropy value greater than a preset threshold as a high-complexity region; finally, using a cascaded hyperchaotic encryption and block cipher algorithm as a first encryption strategy to encrypt the high-complexity region; and using a lightweight block cipher algorithm (such as SPECK) as a second encryption strategy to encrypt the non-high-complexity region.

[0058] In a preferred embodiment, the system further includes a topology-aware transmission module. This module is configured to perform the following actions: first, by reading network management data, constructing and dynamically updating a topology map that characterizes the current state of smart grid communication links; then, inputting the topology map into a pre-trained graph neural network (GNN) model, which calculates the priority of each data transmission link; finally, based on the priority, the system schedules encrypted data packets to be transmitted preferentially through higher-priority links.

[0059] In a preferred embodiment, the enhanced encryption employed by the collaborative encryption unit 202 is a hybrid encryption algorithm. The specific steps of this algorithm include: first, using a hyperchaotic system to perform pixel-level scrambling on the highly complex region, disrupting its spatial correlation; then, further using the AES (Advanced Encryption Standard) algorithm to encrypt the scrambled pixel data to provide high-strength cryptographic protection.

[0060] In a preferred embodiment, to enhance the robustness of the system under complex channels, the edge device 20 further includes a low-density parity-check (LDPC) encoding unit for encoding the data before transmission. Correspondingly, the decryption and recovery unit 302 in the central device 30 also includes a LPC decoding unit, which is further configured to: first, monitor channel quality parameters of the data transmission channel, such as the bit error rate (BER); then, when the channel quality parameters indicate a decline in channel quality exceeding a preset threshold (e.g., BER > 5%), the unit adaptively increases the number of iterations of the hyperchaotic system used for decryption and / or increases the number of iterations of the LPC decoding, sacrificing some decryption speed in exchange for the highest success rate of data recovery under poor channel conditions.

[0061] It should be noted that the low-density parity-check (LDPC) code is a high-performance linear block code. Its core idea is to strategically add redundant parity-check bits to the original information bit sequence based on a pre-defined, sparse parity-check matrix. The final codewords generated by this encoding method have specific algebraic constraints between their internal bits. When a codeword carrying this redundant information is transmitted through the channel and an error occurs, the decoder at the receiving end can utilize these constraints and iterative algorithms such as belief propagation to detect and correct the error with a high probability, thereby recovering the original information. Because its parity-check matrix has a "low density" characteristic (i.e., the number of "1" elements in the matrix is ​​far less than "0"), the low-density parity-check code achieves an excellent balance between decoding complexity and error correction performance, making it particularly suitable for communication systems with extremely high reliability requirements.

[0062] In a preferred embodiment, the central device 30 further includes a federated learning center module. This module aims to continuously optimize the performance of encryption algorithms (especially hyperchaotic systems) in the system through distributed collaborative training without uploading the raw sensitive data from each device. Its workflow includes: first, aggregating locally generated encryption model parameter updates (e.g., gradient information) from multiple edge devices; then, updating and training a globally optimized model locally (i.e., on the central device) using this aggregated information to generate optimized global model parameters; finally, distributing the optimized global model parameters to each edge device to guide them in updating their local models, thereby achieving the collaborative evolution and continuous optimization of the entire system's encryption model.

[0063] In practice, the workflow of this system can be broken down into the following collaborative stages:

[0064] 1. In the data acquisition and key pre-generation stage, on the terminal device 10, the image acquisition unit 101 first acquires real-time images. Simultaneously, the dynamic key generation unit 102 begins operation:

[0065] A1) Extracting PUF features: A random sequence is generated by reading the device hardware noise (such as SRAM voltage fluctuations), and dimensionality reduction can be performed using methods such as principal component analysis (PCA). Finally, a unique 64-bit integer is extracted and converted as the PUF feature of the device.

[0066] A2) Obtain real-time load data of the power grid: Synchronously collect active power data within a preset time window (e.g., 600 seconds) to form a load time series.

[0067] B1) Generating a Dynamic Key: The PUF features obtained in step A1 are hashed and used as the initial state values ​​of the hyperchaotic system. A real-time load fluctuation factor is calculated from the load sequence obtained in step A2 using methods such as fractional integration. This load fluctuation factor is used to dynamically modulate the parameters (e.g., a, b, c, d, q) of the hyperchaotic system. Finally, by iterating through this "double-modulated" hyperchaotic system, a dynamic session key deeply bound to both the device and grid states is generated.

[0068] 2. Layered encryption processing stage, which is also performed on terminal device 10 by layered encryption unit 103:

[0069] C1) Image Analysis and Decision Making: Divide the acquired image into 16×16 pixel blocks and calculate the gradient entropy for each block. Set a gradient entropy threshold (e.g., 4.0). If the gradient entropy of an image block is greater than the threshold, it is determined to be a high-complexity region (i.e., a critical block) containing rich textures (such as equipment nameplates or fault points); otherwise, it is a non-high-complexity region.

[0070] D1) Encryption strategy selection and execution: For high-complexity regions, a Chaos-SPECK strong encryption strategy is adopted.

[0071] E1) This strategy first uses a hyperchaotic sequence to generate a pixel permutation index, and then scrambles the pixel positions of the three RGB channels of the image block respectively;

[0072] E2) Then, the SPECK block cipher algorithm is called to encrypt the scrambled data. For non-high-complexity regions, the lightweight SPECK encryption strategy is used directly to save computational resources.

[0073] (E3) After encryption, all data blocks undergo low-density parity check (LDPC) coding. In this process, redundant parity bits are added to encode the original data using LDPC to generate the encoded codewords. A preferred implementation uses a 0.8 LDPC code, which adds 25% redundancy to the original information. This enables effective error correction in channels with bit error rates up to, for example, 5%, significantly enhancing the anti-interference capability of data transmission.

[0074] 3. Topology-aware transmission phase, which is led by the topology-aware transmission module of the central device 30:

[0075] F1) GNN Topology Awareness and Priority Calculation: This module abstracts the power grid topology as graph data, where devices are nodes and communication links are edges. Then, this graph data is input into a pre-trained GCN (Graph Convolutional Network) model, which comprehensively considers the connection relationships of nodes and real-time status (such as load) to output the transmission priority of each communication link.

[0076] F2) Dynamic Scheduling: Encrypted data packets will be scheduled according to the calculated priority. For example, data packets originating from critical substations carrying data from highly complex areas will be prioritized for transmission on higher-priority links. It should be noted that if the GNN detects a change in the topology (such as the addition of new equipment), it will recalculate the priority and may trigger dynamic adjustments to the encryption parameters of the relevant links (such as increasing the key update frequency or the number of hyperchaotic iterations) to ensure that the encryption strength matches the importance of the link in real time.

[0077] 4. Anti-interference reception and decryption stage, which is mainly performed in the decryption and restoration unit of the central device 30:

[0078] G1) Adaptive decryption: The receiver first monitors the bit error rate (BER) of the transmission channel. If the BER is higher than a preset threshold (e.g., 5%), the decryption program will automatically increase the number of iterations of the hyperchaotic system used for decryption to enhance the decryption success rate under poor channel conditions.

[0079] G2) Low-density parity-check code decoding: The Belief Propagation (BP) algorithm is used to iteratively decode the received data (e.g., iterate 50 times) to correct errors generated during transmission.

[0080] G3) Super-chaotic reverse scrambling and restoration: After decryption and decoding are completed, the reverse operation is performed based on the permutation index saved in the encryption stage to restore the pixels to their original order and finally restore a clear image.

[0081] It should be noted that, in the highest security scenarios, the decryption process can also incorporate quantum key distribution (QKD) technology, which uses a one-time quantum key to decrypt the key of the hyperchaotic system a second time, in order to achieve the level of information-theoretical security.

[0082] 5. In the quality assessment phase, to verify the encryption effect, the system may also include a quality assessment module. The assessment metrics include: the information entropy of the encrypted image (which should be close to the ideal value of 8.0 to prove that the obfuscation is sufficient), and the peak signal-to-noise ratio (PSNR) of the decrypted image and the original image (which should be greater than 30dB to ensure visual lossless restoration).

[0083] Another aspect of the present invention provides an image encryption method for a smart grid environment. This method aims to achieve intelligent and adaptive secure processing of image data through a series of logically interconnected steps.

[0084] Please see Figure 2 This figure schematically illustrates the core process of the image encryption method provided in this embodiment. In a preferred embodiment, the method mainly includes the following steps:

[0085] Step S100: Dynamically generate encryption keys. This is the starting point and security foundation of the entire encryption process. This step abandons static, pre-set keys and instead adopts a dynamic generation mechanism that is linked to physical entities and real-time states.

[0086] Specifically, the steps include: First, acquiring the Physical Unclonable Feature (PUF) of the terminal device to be encrypted; simultaneously, acquiring real-time load data (such as operating status) of the power grid nodes associated with the terminal device. Then, these two heterogeneous factors are combined and used as input parameters to drive an iterative hyperchaotic system, ultimately generating the dynamic encryption key required for this encryption session. As described in Example 1, the PUF feature can be used as the initial value of the hyperchaotic system, and the operating status data can be used as a perturbation factor for the system parameters.

[0087] Step S200: Perform content-sensitive layered encryption. After obtaining the dynamic key, this step performs differentiated encryption processing on the acquired raw image data.

[0088] Specifically, the steps include: First, analyzing the content complexity of the image to be encrypted. This can be achieved by calculating the gradient entropy of each image patch. Then, based on the analysis results, the image is divided into high-complexity regions (such as those containing device details) and low-complexity regions (such as the background). Finally, different encryption strategies are applied to these two types of regions. For example, a strong encryption strategy consisting of hyperchaotic scrambling and block cipher concatenation is used for high-complexity regions, while a lightweight block cipher algorithm is used for low-complexity regions.

[0089] Step S300: Perform topology-aware intelligent transmission. After data encryption is complete, this step is responsible for intelligently planning its transmission path and resources.

[0090] Specifically, the steps include: First, using a graph neural network (GNN) model to analyze the current smart grid topology, the model outputs the transmission priority of each available communication link. Then, the system dynamically adapts encryption resources to different encrypted data packets based on the calculated priorities. For example, more important data packets containing highly complex regions are scheduled for transmission on higher-priority links.

[0091] Step S400: Perform anti-interference coding and transmission. To address data transmission errors in complex channels, this step performs an enhancement process on the encrypted data before it is officially sent.

[0092] Specifically, this step includes: performing forward error correction encoding on the encrypted data packet. A preferred encoding method is low-density parity-check code encoding, which enhances the data's resilience to corruption by adding redundant parity bits. After encoding, the data is sent to the receiving end.

[0093] Step S500: Perform adaptive decoding and restoration. This is the reverse process performed at the data receiving end.

[0094] Specifically, the steps include: First, receiving data and monitoring the channel quality parameters (such as the bit error rate, BER) of its transmission channel. Then, performing low-density parity-check (LDPC) decoding and error correction to repair any potential bit errors. It's important to note that this decoding process is adaptive. If the detected channel quality is poor (e.g., the BER exceeds a preset threshold), the decoding program automatically increases the number of iterations of the hyperchaotic system used for decryption and / or the number of iterations of the LPC decoding to improve the data recovery success rate under adverse conditions. Finally, after decryption and possible descrambling operations, the data is restored to the original image.

[0095] By organically combining the above steps, this method constructs an intelligent, adaptive encryption and secure transmission scheme that covers the entire process from key generation to final restoration.

[0096] To further clarify the implementation details of the core algorithms involved in this invention, the following will provide a detailed mathematical and logical description of several key algorithm modules. It should be understood that the following description represents a preferred, but not the only, implementation of this invention.

[0097] 1. PUF Characteristics and Load Data Processing: First, collect the PUF characteristics of the equipment and generate a unique identifier. Simultaneously, real-time load data L(t) is acquired, and the load fluctuation factor is calculated using fractional derivatives. : Where: α(t) is the load fluctuation factor calculated at time point t. Represents the load function Perform a 0.5 order differential operation. It is the load observation value at the historical time point τ. It is the gamma function, an extension of the factorial function to real and complex numbers. When the order is 0.5, Γ(0.5) = sqrt(π). It's important to note that the physical meaning of this formula is that it doesn't simply calculate the instantaneous rate of change of the current load, but rather by performing a weighted integral over all historical load observations L(τ). The weight of historical data closer to the current time point t is determined by... The larger the decision, the better.

[0098] Parameter initialization of hyperchaotic systems: After hashing, it is converted into the initial state value of the hyperchaotic system. Meanwhile, the parameters of the hyperchaotic system are dynamically adjusted according to α(t):

[0099] ;

[0100] Among them: SHA256 ( ) represents the identifier The result of the hash operation. [0:8], [8:16], [16:24], and [24:32] all represent slice operations, representing specific byte segments from which the hash value is extracted. `int(..., 16)` converts a hexadecimal string to an integer. 2³² - 1 is a constant used for normalization, representing the maximum value of a 32-bit unsigned integer.

[0101] Furthermore, the evolutionary behavior of the hyperchaotic system is determined by a set of system parameters (a, b, c, d, q). To ensure the key reflects the real-time state of the power grid, these parameters will be dynamically modulated using the previously calculated load fluctuation factor α(t). A preferred linear modulation scheme is as follows:

[0102] ;

[0103] Where mod represents the mathematical modular operation;

[0104] Key generation iteration: Iterating through the hyperchaotic system based on the initialized parameters: ;

[0105] in, , , , These represent the time derivatives of the system state variables x, y, z, and v, respectively. After multiple iterations, the system state variables x, y, z, and v are mapped to a fixed-length byte array, which serves as the final encryption key.

[0106] The underlying logic is device-specific binding: the uniqueness of the PUF feature ensures that the key generated by each device is unique at the hardware level. For example, different smart meters have different PUF features due to differences in chip manufacturing processes, resulting in different initial values ​​and thus different keys. Attackers cannot obtain the same key by cloning devices.

[0107] Dynamic correlation of power grid status: Power grid load data reflects the real-time operating status of the power grid. The load fluctuation factor is incorporated into the parameters of the hyperchaotic system, making the key closely correlated with the power grid status. During peak electricity consumption, the load fluctuation factor increases, the parameters of the hyperchaotic system change, and the generated key changes accordingly, ensuring that the encryption strategy adapts to the dynamic operation of the power grid.

[0108] Advantages of hyperchaotic systems: Compared to traditional chaotic systems, hyperchaotic systems possess multiple positive Lyapunov exponents, making them extremely sensitive to minute changes in initial values ​​and parameters. Even if the PUF characteristics or grid load data of two devices differ only slightly, the keys generated after iteration through a hyperchaotic system will be drastically different, greatly enhancing the randomness and attack resistance of the keys.

[0109] 2. Edge-Center Collaborative Layered Encryption Algorithm

[0110] The algorithm addresses the significant differences in computing power among smart grid devices, ranging from terminal sensors and edge servers to central control servers, and the varying importance of different regions within image data. Based on device type and the gradient entropy characteristics of image blocks, this algorithm implements differentiated encryption, ensuring data security while improving encryption efficiency and resource utilization.

[0111] Algorithm flow, image patch feature analysis: After dividing the image into patches of a preset size, calculate the gradient entropy of each image patch. Measure its complexity:

[0112] ;

[0113] in: This is the calculated gradient entropy value. M and N are the width and height of the image patch, respectively (in pixels). p(i0,j0) is the probability of the gradient (or gradient level) occurring at pixel (i0,j0) in the gradient map. Σ represents the summation operation.

[0114] At the same time, deep learning models are used to determine whether image patches are critical regions, such as whether they contain equipment, instruments, or fault features.

[0115] In the encryption system of this invention, the selection of encryption strategy is not static, but a dynamic decision-making process that comprehensively considers device type, power grid status, and image patch features. The following will describe in detail the encryption strategy selection logic for different devices in different scenarios:

[0116] (1) For terminal devices (Type T): These devices typically have limited computing power, and their encryption strategy selection mainly depends on the content complexity of the image patch itself. When an image patch is determined to be a non-high-complexity region (e.g., a background region with low gradient entropy), the system will choose to execute the SPECK lightweight encryption algorithm in order to pursue the highest efficiency. When an image patch is determined to be a high-complexity region (e.g., containing critical device details), the system will choose to execute the more secure Chaos-SPECK encryption algorithm, which adds a hyper-chaotic scrambling operation on the basis of SPECK encryption.

[0117] (2). For edge devices (Class E): These devices have stronger computing power, and their encryption strategy not only considers the features of image blocks but also the real-time status of the power grid. When the power grid status is "normal", the edge device performs HyperChaos-AES enhanced encryption on all received image blocks, that is, it first performs a four-dimensional hyperchaotic scrambling and then performs AES encryption. When the power grid status is determined to be "fault" or "warning", its processing logic is the same as in the normal state, but it will feed back the encryption model features (such as chaotic parameters) used in processing key image blocks to the central device through the federated learning mechanism to participate in the optimization of the global model.

[0118] (3) For central equipment (Category C): This type of equipment possesses the strongest security and computing capabilities, and its encryption strategy selection is primarily targeted at core data and scenarios with the highest security level. When received image data is determined to be core data (e.g., directly related to major fault diagnosis) and the power grid status is "faulty," the system will initiate the highest security level Quantum-HyperChaos hybrid encryption. This strategy utilizes a one-time key generated by quantum key distribution (QKD) technology to provide secondary protection for the hyperchaotic encryption process, achieving an information-theoretic security level. When the power grid status is "normal," the central equipment typically performs a HyperChaos-AES encryption strategy similar to that of edge equipment on the received data, or archives the data based on its importance. Through this hierarchical, context-aware encryption strategy selection logic, this invention ensures that security resources are allocated in the most reasonable way and in accordance with the risk level throughout the entire "end-edge-cloud" architecture.

[0119] Encryption operation execution: After selecting an encryption algorithm, the image block is encrypted accordingly. For example, when using a four-dimensional hyperchaotic image scrambling algorithm, the chaotic values ​​generated by the hyperchaotic system are used to permutate the positions of image pixels.

[0120] Underlying logic and device computing power adaptation: Terminal devices have limited resources, so a lightweight SPECK algorithm is used for non-critical and low-complexity image blocks, which can be encrypted in a short time to meet the real-time monitoring image transmission requirements of the power grid; edge devices and central devices have strong computing power, so high-strength algorithms such as hyperchaotic-AES hybrid encryption and quantum-hyperchaotic encryption are used for critical image blocks to ensure the security of core data.

[0121] Image patch differentiation processing: By judging the complexity and key areas of image patches, different encryption strengths are applied to areas of different importance. In power grid equipment monitoring images, the equipment instrument area is related to the judgment of equipment operating status and is encrypted with high strength; while the background environment area is encrypted with lower strength to balance security and encryption efficiency.

[0122] Collaborative optimization mechanism: During the encryption process, edge devices feed back the encrypted features of image blocks to the central device through federated learning. The central device then optimizes the parameters of the hyperchaotic system based on this feedback, enabling the encryption strategy to achieve global collaborative optimization throughout the smart grid system and improving the overall encryption effect.

[0123] 3. Topology-aware dynamic encrypted link algorithm

[0124] The algorithm addresses the challenge of ensuring secure data transmission in smart grid networks where the network topology frequently changes due to distributed power source integration and equipment failures. Traditional static encrypted links cannot guarantee data security. This algorithm, based on graph neural networks (GNNs), analyzes the grid topology and equipment status, dynamically adjusting the encrypted links to ensure that critical data transmissions receive priority encryption protection.

[0125] Algorithm flow and data preparation: The power grid topology is transformed into an adjacency matrix, and equipment status information (such as online rate, load, etc.) is collected as node features to construct the input data for the GNN model.

[0126] Priority Calculation: Encryption priority between devices is calculated through forward propagation using the GNN model.

[0127] ;

[0128] ;

[0129] in: Is device node i at the ? The hidden feature representation of the layer (or node embedding). σ is a non-linear activation function, such as the ReLU function. It is the set of neighboring nodes of device node i (including device node i itself). Let i be a neighboring node of device node i. Features of the next higher level of neighbor node j . and They are the first The learnable weight matrix and bias vector of the layer network. After propagation and aggregation through L layers (L is the total number of layers in the network), the final formula uses the softmax function to convert the final node features... Convert to encryption priority probability .

[0130] Encryption priority probability between output devices High-priority links are selected.

[0131] Link Adjustment: Real-time monitoring of power grid topology changes; when devices are added, deleted, or their status changes, the encrypted links are adjusted according to the link priority update formula.

[0132] ;

[0133] in: This indicates the priority of the new link from device node f to device node g in the current evaluation period. This value will serve as the direct basis for subsequent encryption resource allocation and transmission scheduling. This indicates the priority of the old link from device node f to device node g, which was calculated in the previous evaluation period. "Device status unchanged" is a criterion indicating that the system has not detected any significant changes in the network topology or critical node status exceeding a preset threshold within the current evaluation period. Under this condition, the system will directly use the old priority value to maintain stability. "Device Addition / Deletion / Status Change" is a mutually exclusive condition with the previous one, representing that the system has detected at least one event affecting the overall network status, such as a new device joining the network, a device going offline due to a fault, or a sharp fluctuation in the load of a critical node. The updated value represents the new link priority value obtained after the system triggers the aforementioned Graph Neural Network (GNN) model to perform a complete forward propagation calculation based on the latest network topology and node feature data when the "Device Addition / Deletion / Status Change" condition is met.

[0134] Underlying logic and topology modeling: The power grid topology is abstracted as graph data, with adjacency matrices describing device connections and node features reflecting device status. The GNN model effectively captures the connections and features between nodes in the graph data, accurately assessing the importance of each link in data transmission. For example, when analyzing the connections between multiple substations and distributed power sources in a power grid, GNN can identify critical transmission links.

[0135] Dynamic Priority Assessment: Equipment status, such as online rate and load, directly affects data transmission reliability and urgency. These factors are incorporated into priority calculations, allowing encryption strategies to dynamically adjust based on grid operating conditions. When distributed power sources are connected to the grid, changes in the equipment status of related links trigger GNN to recalculate priorities, ensuring that newly connected equipment receives appropriate encryption strength for its data transmission links.

[0136] Rapid response mechanism: When the power grid topology changes, the algorithm promptly detects and adjusts the encrypted links according to the priority update formula. If a device fails and goes offline, the encrypted resources of the links related to that device are immediately removed and reallocated to other important links to avoid security vulnerabilities caused by topology changes and ensure data transmission security.

[0137] 4. Robust encryption algorithm against interference

[0138] The algorithm addresses the challenges of complex communication environments in smart grids, including electromagnetic interference and data loss, where traditional encryption algorithms cannot guarantee accurate decryption and recovery. This algorithm combines low-density parity-check coding with adaptive decryption to enhance data resilience in complex environments and ensure reliable image data transmission.

[0139] Algorithm flow, data preprocessing and encoding / encryption concatenation: After dividing the image data into blocks, low-density parity check encoding is performed first, and redundant parity bits are added: Where H is the low-density parity-check matrix, c is the encoded codeword vector, and T represents the matrix or vector transpose. After encoding, the data block is encrypted using a hyperchaotic encryption algorithm.

[0140] Adaptive decryption and error correction: The receiver adjusts the decryption strategy based on the current channel bit error rate (BER). When the BER is high, the number of iterations of the hyperchaotic system is increased; error correction is performed using a belief propagation decoding iteration formula.

[0141] ;

[0142] in: It is in the In each iteration, the message passed from the verification node p to the variable node r (usually the log-likelihood ratio LLR). It represents the set of all other variable nodes that are connected to the verification node p, but exclude the variable node r; It is a symbolic function; This indicates that the minimum value is taken among the absolute values ​​of all incoming messages; It is in the In this iteration, the message that verification node z passes to verification node p; It is the detection value received from the channel and associated with the check node p. The messages between the check node and the variable node are iteratively updated to gradually approach the correct decoding result, and data integrity is verified through block marking.

[0143] The underlying logic and error correction coding principle: Low-density parity-check (LDPC) coding adds redundant check bits to the original data through the operation relationship between the parity-check matrix and the codeword vector. This redundancy allows the receiver to detect and correct errors in data transmission based on the parity-check equation. For example, when electromagnetic interference causes partial data corruption, the receiver can use the redundant bits to recover the original data, improving data transmission reliability.

[0144] Encryption and encoding work in tandem: Low-density parity-check encoding is used before encryption to ensure the security of redundant check information during transmission. The high randomness and obfuscation characteristics of hyperchaotic encryption further protect the encoded data, preventing attackers from decrypting it by analyzing redundant information.

[0145] Adaptive adjustment: Decryption parameters are dynamically adjusted based on the channel bit error rate. When the bit error rate is high, the number of iterations of the hyperchaotic system is increased to enhance anti-interference capabilities; when the bit error rate is low, the standard decryption process is adopted to reduce computational overhead. Confidence propagation decoding iteratively updates messages, gradually correcting errors, and combines block marking to verify data integrity, ensuring that the decrypted data is accurate and usable.

[0146] To more clearly demonstrate the workflow of the system described in this invention under different practical application scenarios, this embodiment provides a comprehensive application scenario description.

[0147] In a typical application scenario, such as equipment monitoring at a substation in a certain area, a monitoring camera deployed at the site serves as a terminal device 10. When it acquires a real-time image containing the transformer dashboard, its internal dynamic key generation unit 102 extracts the PUF (Programmable Instance Function) feature of the camera and combines it with real-time load data obtained from the substation to generate a dynamic session key that is bound to both the equipment and the current operating condition. Subsequently, the layered encryption unit 103 determines that the dashboard area is a high-complexity area and applies a Chaos-SPECK strong encryption strategy to it; while for non-critical areas such as the background wall, a SPECK lightweight encryption strategy is used.

[0148] The encrypted data is sent to edge devices 20 deployed within the substation, such as edge servers. The collaborative encryption unit 202 of this server performs enhanced encryption using "hyperchaotic scrambling + AES-128" on the critical data block of the instrument panel. Before sending the data to the central device 30 (such as the regional control center), the data is further processed by a low-density parity-check encoding unit to enhance its anti-interference capability. During this process, the topology-aware transmission module uses a GNN model to determine that the link from the substation to the control center is of high priority and allocates optimal transmission resources to it.

[0149] It should be noted that the application scenarios of this invention are not limited to this. For example, in the scenario of emergency repair of power distribution network faults, the smart handheld terminal of the on-site staff can serve as terminal device 10. After quickly performing layered encryption on the fault point, the data is transmitted to nearby edge computing nodes through low-latency, high-reliability communication protocols such as 5G-URLLC. At the same time, in order to ensure the traceability of the operation, the central device 30 can also introduce a blockchain evidence storage module to store key logs of the entire encryption and transmission process on the blockchain.

[0150] For example, in the scenario of distributed renewable energy power stations, this system can adapt well to the drastic changes in network topology caused by frequent grid connection / off-grid operations of photovoltaic and wind power equipment. The GNN model monitors these changes in real time and dynamically adjusts the priority and encryption parameters of encrypted links to ensure stable and secure data transmission.

[0151] Furthermore, there are alternative implementations for each of the technical modules described in this invention. For example, the low-density parity-check code can be replaced with the higher-performance Turbo code; the GNN model can employ a graph attention network (GAT) to improve feature extraction accuracy; and the hyperchaotic system can be replaced with an improved Lorenz hyperchaotic system, etc. These alternatives all fall within the protection scope of this invention.

[0152] This application provides an image encryption system and method for a smart grid environment. Through a collaborative, end-to-end adaptive security protection system encompassing the "end-edge-cloud" architecture, it achieves intelligent and robust protection of critical image data from acquisition to restoration. First, the system fundamentally eliminates the vulnerability of static keys by constructing a "two-factor" dynamic key generation mechanism based on Physically Unclonable Features (PUF) and real-time grid load on the front-end device, ensuring the device uniqueness, unpredictability, and context-dependent nature of the encryption key. Second, the system innovatively employs a content-sensitive layered encryption strategy, intelligently identifying the complexity of image content through indicators such as gradient entropy and matching different encryption algorithms of varying strengths to different regions. This approach perfectly resolves the contradiction between security and computational efficiency in heterogeneous device environments. More importantly, the system creatively applies Graph Neural Networks (GNNs) to the field of encrypted transmission. Through real-time perception of the dynamic topology of the power grid, it achieves intelligent and priority scheduling of encrypted links and resources, overcoming the fundamental deficiency of traditional solutions in adapting to network changes. Furthermore, by deeply integrating low-density parity-check error correction coding with an adaptive decryption strategy, this system exhibits strong robustness in the face of complex electromagnetic interference and channel errors, ensuring reliable data recovery. Through the synergistic effect of the aforementioned key technologies, this invention overcomes the limitations of traditional encryption schemes, constructing a new security paradigm that can adapt to device, content, network, and channel environments, significantly improving the security protection level of visual data throughout its entire lifecycle in critical infrastructures such as smart grids.

[0153] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0154] The terms "an embodiment," "embodiment," or "one or more embodiments" as used herein mean that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment of this application. Furthermore, please note that the examples of the phrase "in one embodiment" do not necessarily all refer to the same embodiment.

[0155] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0156] In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An image encryption system for a smart grid environment, characterized in that, include: At least one terminal device, the terminal device comprising: an image acquisition unit for acquiring real-time images of power grid equipment; a dynamic key generation unit for generating a dynamic session key through a hyperchaotic system using the physical non-cloning characteristics of the terminal device and real-time load data of the power grid nodes associated with the terminal device; and a hierarchical encryption unit for analyzing the real-time images and using the dynamic session key to perform hierarchical encryption on high-complexity regions and non-high-complexity regions in the real-time images using two different encryption strategies; the dynamic key generation unit is further configured to: hash the physical non-cloning characteristics and use them as the initial state value of the hyperchaotic system; and quantize the real-time load data into a load fluctuation factor to dynamically modulate the system parameters of the hyperchaotic system. At least one edge device, the edge device comprising: a data receiving and preprocessing unit for receiving encrypted data from the terminal device and performing format conversion and integrity verification on it; and a collaborative encryption unit for performing enhanced encryption on high-complexity regions in the received encrypted data; And a central device, the central device comprising: a global key management unit for generating and distributing master keys to the terminal device and the edge device; and a decryption and restoration unit for decrypting and restoring encrypted data received from the edge device.

2. The system according to claim 1, characterized in that, The central device is also configured to perform the following actions: The data output by the decryption and restoration unit is analyzed to identify potential operational risks to the power grid; based on these potential operational risks, dispatch instructions or safety warnings are generated and issued.

3. The system according to claim 1, characterized in that, The system also includes a blockchain-based evidence storage module, which is configured as follows: The key operations in the layered encryption, enhanced encryption, and decryption process are captured, including timestamps, operation subjects, and key hashes; these key operations are recorded as transactions on a distributed ledger to provide tamper-proof security auditing and traceability.

4. The system according to claim 1, characterized in that, The layered encryption unit is further configured to perform the following actions: Calculate the gradient entropy value of each image block in the real-time image; determine the image blocks with gradient entropy values ​​greater than a preset threshold as high-complexity regions; encrypt the high-complexity regions using a first encryption strategy, and encrypt the non-high-complexity regions using a second encryption strategy different from the first encryption strategy; The first encryption strategy is a concatenation of hyperchaotic encryption and block cipher algorithms, and the second encryption strategy is a lightweight block cipher algorithm.

5. The system according to claim 1, characterized in that, The system also includes a topology-aware transmission module configured to perform the following actions: Construct and dynamically update a topology graph representing the current smart grid; input the topology graph into a graph neural network model to calculate the priority of each data transmission link; schedule data transmission between the terminal device and the edge device according to the priority.

6. The system according to claim 1, characterized in that, The collaborative encryption unit is further configured to perform the enhanced encryption on the high-complexity region using a hybrid encryption algorithm, the hybrid encryption algorithm comprising: The high-complexity region is scrambled using a hyperchaotic system; the scrambled pixel data is then encrypted using the AES algorithm.

7. The system according to claim 1, characterized in that, The edge device further includes a low-density parity check encoding unit for encoding the data before transmission; the decryption and restoration unit in the central device further includes a low-density parity check decoding unit, which is further configured to: When the channel quality parameters indicate a decline in channel quality exceeding a preset threshold, the number of iterations of the hyperchaotic system used for decryption is adaptively increased, and / or the number of iterations of low-density parity-check code decoding is increased.

8. The system according to any one of claims 1 to 7, characterized in that, The central equipment also includes a federated learning center module, which is configured as follows: The encrypted model parameter updates from multiple edge devices are aggregated to form an aggregate gradient; the aggregate gradient is then used to locally update and train a globally optimized model to generate optimized global model parameters; The optimized global model parameters are distributed to each edge device to achieve collaborative evolution of the encryption model.

9. An image encryption method in a smart grid environment, characterized in that, The method includes encryption, transmission, and decryption steps performed by the system according to any one of claims 1 to 8, corresponding to the functions of each unit or module.

Images