Dynamic key-based transformer substation data encryption and evaluation method, device, equipment and medium

Abstract

The invention discloses a transformer substation data encryption and evaluation method and device based on a dynamic key, equipment and a medium, and belongs to the field of electric power systems.The method comprises the steps that random key generation is conducted on a key generation node according to collected data, and the dynamic key is obtained; wherein the collected data comprises environment data and operation data of the transformer substation; fragmenting the dynamic key through a key sharing method, and distributing and storing the fragmented dynamic key in a plurality of key storage nodes; the method comprises the following steps: extracting a dynamic key from a predefined number of key storage nodes through an edge computing node for reconstruction, and carrying out dynamic encryption processing on to-be-encrypted data at the edge computing node based on the reconstructed dynamic key to obtain ciphertext data; wherein the to-be-encrypted data comprises a control instruction and state data of the transformer substation. Therefore, by implementing the method and the device, the problem that the substation data is easily attacked in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the field of power systems, and in particular to a method, device, equipment and medium for encrypting and evaluating substation data based on a dynamic key. Background Art

[0002] In modern power grid architectures, substations play a central role in power monitoring and data acquisition systems. They focus on real-time monitoring of the operating status and transmission information of distribution transformers, covering critical performance indicators such as voltage levels, current intensity, and power factor. Substations also provide detailed and accurate power usage details and operational data to support power system operations and maintenance, playing an indispensable role in demand-side management. However, in recent years, cybersecurity threats have become increasingly rampant and the situation has become increasingly severe. Attacks have escalated from sporadic actions by individual hackers to nationwide confrontations.

[0003] Currently, substation information security primarily adheres to the principle of "secure zoning, dedicated network, horizontal isolation, and vertical encryption" to build a protection system. This strategy effectively addresses current security challenges. However, while adhering to this principle, network data communications for core secondary equipment such as protection and control still often rely on simple encryption (single key or fixed algorithm) or direct plaintext transmission. This communication model is particularly vulnerable to network attacks such as third-party interception and analysis and brute force cracking, significantly threatening the confidentiality and availability of substation internal data information. Summary of the Invention

[0004] The present invention provides a method, device, equipment and medium for encrypting and evaluating substation data based on a dynamic key, which can solve the problem in the prior art that substation data is vulnerable to attacks.

[0005] An embodiment of the present invention provides a substation data encryption method based on dynamic keys, which is applicable to a substation data encryption system based on dynamic keys. The substation data encryption system includes: a key generation node, a key storage node, and an edge computing node. Data is transmitted between the nodes using a zero-trust communication protocol.

[0006] The substation data encryption method includes:

[0007] Generating a random key at a key generation node based on collected data to obtain a dynamic key; wherein the collected data includes environmental data and operating data of the substation;

[0008] Sharding the dynamic key by a key sharing method, and distributing and storing the sharded dynamic key in multiple key storage nodes;

[0009] The edge computing node extracts dynamic keys from a predefined number of key storage nodes for reconstruction, and dynamically encrypts the data to be encrypted based on the reconstructed dynamic keys at the edge computing node to obtain ciphertext data; wherein the data to be encrypted includes control instructions and status data of the substation.

[0010] The embodiments of the present invention generate dynamic keys based on real-time collected data and distribute them across nodes, ensuring that even if a single node is compromised, the keys cannot be fully retrieved. Dynamic encryption based on data type improves the unpredictability of the encryption algorithm and prevents targeted attacks. Data is transmitted between nodes using a zero-trust communication protocol, preventing spoofing and tampering. Compared to existing technologies, this application can improve the security of substation data.

[0011] Furthermore, the random key generation is performed at the key generation node based on the collected data to obtain a dynamic key, specifically:

[0012] The collected data is used as a random factor and combined with the preset seed key to obtain a dynamic key.

[0013] The embodiment of the present invention generates a dynamic key by using data collected in real time as a random factor, thereby enhancing the randomness and uniqueness of the key.

[0014] Furthermore, the dynamic key is fragmented by a key sharing method, and the fragmented dynamic key is distributed and stored in multiple key storage nodes, including:

[0015] The dynamic key is divided into n shares, one key storage node stores one share of the dynamic key, and at least t key storage nodes are required to store dynamic keys to reconstruct the complete dynamic key; wherein n and t are preset values, and n is greater than t.

[0016] The embodiment of the present invention generates a dynamic key based on real-time collected data and distributes and stores it in various nodes, thereby ensuring that the key cannot be completely obtained when a single node is compromised.

[0017] Furthermore, the method of sharding the dynamic key by a key sharing method and distributing and storing the sharded dynamic key in multiple key storage nodes further includes:

[0018] The expiration date of the dynamic key stored in the key storage node is judged. If the storage time of the dynamic key exceeds the preset update period, the dynamic key is regenerated and stored in shards;

[0019] Perform attack detection on the dynamic key stored in the key storage node. If the detection result is an attack, regenerate the dynamic key and store it in shards.

[0020] The embodiment of the present invention improves the security of the key by periodically updating the key and updating it immediately when attacked.

[0021] Furthermore, the edge computing node extracts a dynamic key from a predefined number of key storage nodes for reconstruction, and dynamically encrypts the data to be encrypted at the edge computing node based on the reconstructed dynamic key to obtain ciphertext data, including:

[0022] The edge computing node extracts the dynamic key from t key storage nodes and reconstructs it to obtain a complete dynamic key; where t is a preset value that is less than the total number of key storage nodes;

[0023] Based on the type of data to be encrypted and the complete dynamic key, encryption algorithms of different strengths are used for encryption processing at the edge computing node.

[0024] The embodiments of the present invention improve the unpredictability of encryption algorithms and prevent targeted attacks by performing dynamic encryption processing based on data types; through edge computing, data is processed where it is generated, avoiding the exposure of sensitive data during long-distance transmission.

[0025] Another embodiment of the present invention further provides a substation data evaluation method based on a dynamic key, comprising:

[0026] Extracting first ciphertext data to be evaluated from an edge computing node; wherein the first ciphertext data is generated according to a substation data encryption method based on a dynamic key of the present invention; and transmitting the first ciphertext data via a zero-trust communication protocol;

[0027] The first ciphertext data is calculated in a homomorphic encryption manner to obtain a monitoring status evaluation result of the substation.

[0028] The embodiments of the present invention improve the security of data processing by allowing data to directly participate in calculations in an encrypted state.

[0029] Another embodiment of the present invention further provides a substation data encryption device based on a dynamic key, comprising: a key generation module, a key sharding module and a dynamic encryption module;

[0030] The key generation module is used to generate a random key at the key generation node based on the collected data to obtain a dynamic key; wherein the collected data includes environmental data and operation data of the substation;

[0031] The key sharding module is used to shard the dynamic key using a key sharing method, and distribute and store the sharded dynamic key in multiple key storage nodes;

[0032] The dynamic encryption module is used to extract dynamic keys from a predefined number of key storage nodes through edge computing nodes for reconstruction, and dynamically encrypt the data to be encrypted at the edge computing node based on the reconstructed dynamic keys to obtain ciphertext data; wherein the data to be encrypted includes control instructions and status data of the substation.

[0033] Another embodiment of the present invention further provides a substation data evaluation device based on dynamic keys, comprising: a data extraction module and a homomorphic encryption module;

[0034] The data extraction module is configured to extract first ciphertext data to be evaluated from the edge computing node; wherein the first ciphertext data is generated according to a substation data encryption method based on a dynamic key of the present invention; and the first ciphertext data is transmitted via a zero-trust communication protocol;

[0035] The homomorphic encryption module is used to calculate the first ciphertext data in a homomorphic encryption manner to obtain a monitoring status evaluation result of the substation.

[0036] Another embodiment of the present invention also provides a terminal device, including: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the steps of a substation data encryption method based on dynamic keys and a substation data evaluation method based on dynamic keys as described in the present invention.

[0037] Another embodiment of the present invention also provides a computer-readable storage medium item, including: a stored computer program, which, when the computer program is running, controls the device where the computer-readable storage medium is located to execute the steps of a substation data encryption method based on dynamic keys and a substation data evaluation method based on dynamic keys of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of a process flow of a substation data encryption method based on a dynamic key provided by an embodiment of the present invention;

[0039] Figure 2 A schematic diagram of the process of dynamic key generation and storage provided by an embodiment of the present invention;

[0040] Figure 3 A schematic diagram of a flow chart of a substation data evaluation method based on a dynamic key provided in an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the data encryption and evaluation process provided by an embodiment of the present invention;

[0042] Figure 5A schematic diagram of the structure of a substation data encryption device based on a dynamic key provided by an embodiment of the present invention;

[0043] Figure 6 A schematic structural diagram of a substation data evaluation device based on dynamic keys provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0046] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly specify the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is more than two, unless otherwise clearly and specifically defined.

[0047] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0048] In the description of the embodiments of this application, the term "and / or" is simply a description of the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0049] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0050] See also Figure 1 To address the vulnerability of substation data to attacks in the prior art, an embodiment of the present invention provides a substation data encryption method based on a dynamic key, which is applicable to a substation data encryption system based on a dynamic key. The substation data encryption system includes a key generation node, a key storage node, and an edge computing node, and data transmission between the nodes is performed using a zero-trust communication protocol.

[0051] The substation data encryption method includes steps S101 to S103;

[0052] Step S101 : generating a random key at a key generation node based on collected data to obtain a dynamic key; wherein the collected data includes environmental data and operating data of the substation.

[0053] Furthermore, the step S101 is specifically as follows:

[0054] The collected data is used as a random factor and combined with the preset seed key to obtain a dynamic key.

[0055] Optionally, the collected data is environmental data (temperature, humidity, timestamp, etc.) and operating data (voltage, current, power factor, device identifier, etc.) of the substation acquired in real time by an intelligent collection terminal.

[0056] The embodiment of the present invention generates a dynamic key by using data collected in real time as a random factor, thereby enhancing the randomness and uniqueness of the key.

[0057] Step S102: shard the dynamic key using a key sharing method, and distribute and store the sharded dynamic key in multiple key storage nodes.

[0058] Furthermore, the step S102 includes:

[0059] The dynamic key is divided into n shares, one key storage node stores one share of the dynamic key, and at least t key storage nodes are required to store dynamic keys to reconstruct the complete dynamic key; wherein n and t are preset values, and n is greater than t.

[0060] It is worth noting that the key sharing method used in the embodiments of the present invention is based on Shamir's key sharing method. The overall concept of the key sharing method is: the key is divided into multiple parts, each participant holds a part of the key, and the key can only be reconstructed when the keys held by a predefined number of participants are combined. This concept can be expressed mathematically. A key sharing scheme is represented as (t, n), where n is the total number of shares allocated to the key and t is the minimum number of shares required to reconstruct the key. A polynomial of degree (t-1) is uniquely determined by t points. A key is modeled as a (t-1)-degree polynomial, such that each of the n participants is associated with a point on the polynomial, which encodes a key share. To recover the polynomial and thus the key, t points on the polynomial are required. That is, any combination of the key shares held by any t participants can reconstruct the key. For example, assuming t = 3 and n = 4, and modeling a quadratic polynomial: f(x) = s + a1×x + a2×x 2 , s represents the key value at the y-axis intercept (i.e., f(0)), and a1 and a2 are random numbers; the key distribution is stored in S1, S2, S3, S4, and each participant holds a key share S i =f(i); Only t (i.e. 3) participants are allowed to combine their shares to reconstruct the original key, and any other share combination of less than t participants cannot infer any important information about the original key. The Lagrange interpolation method is usually used for key reconstruction.

[0061] The embodiment of the present invention generates a dynamic key based on real-time collected data and distributes and stores it in various nodes, thereby ensuring that the key cannot be completely obtained when a single node is compromised.

[0062] Furthermore, the step S102 further includes:

[0063] The expiration date of the dynamic key stored in the key storage node is judged. If the storage time of the dynamic key exceeds the preset update period, the dynamic key is regenerated and stored in shards;

[0064] Perform attack detection on the dynamic key stored in the key storage node. If the detection result is an attack, regenerate the dynamic key and store it in shards.

[0065] Optionally, the update period of the dynamic key is in seconds, and the dynamic key can be updated instantly when an attack is detected.

[0066] The embodiment of the present invention improves the security of the key by periodically updating the key and updating it immediately when attacked.

[0067] like Figure 2As shown, based on the above method embodiment, a corresponding embodiment of dynamic key generation and storage is provided.

[0068] In step S103, the edge computing node extracts the dynamic key from a predefined number of key storage nodes for reconstruction, and dynamically encrypts the data to be encrypted at the edge computing node based on the reconstructed dynamic key to obtain ciphertext data; wherein, the data to be encrypted includes control instructions and status data of the substation.

[0069] Furthermore, the step S103 includes:

[0070] The edge computing node extracts the dynamic key from t key storage nodes and reconstructs it to obtain a complete dynamic key; where t is a preset value that is less than the total number of key storage nodes;

[0071] Based on the type of data to be encrypted and the complete dynamic key, encryption algorithms of different strengths are used for encryption processing at the edge computing node.

[0072] It's worth noting that edge computing is a distributed computing paradigm that extends computing, storage, and network processing capabilities from the cloud (data center) to devices close to the data source, such as IoT devices, sensors, and smart grids. The core concept of edge computing is to process data where it's generated, reducing data transmission latency and improving real-time performance.

[0073] Optionally, encryption algorithms include AES-256, lightweight encryption, and custom obfuscation algorithms. Dynamic switching of encryption algorithms is supported, and real-time synchronization is achieved through protocol negotiation.

[0074] The embodiments of the present invention improve the unpredictability of encryption algorithms and prevent targeted attacks by performing dynamic encryption processing based on data types; through edge computing, data is processed where it is generated, avoiding the exposure of sensitive data during long-distance transmission.

[0075] It is worth noting that the substation data encryption system based on dynamic keys is interconnected through industrial Ethernet or optical fiber and deployed between the substation interval layer and the process layer. Each node in the system transmits data through a zero-trust communication protocol. During the transmission process, each node performs dynamic identity authentication to avoid the risk of third-party interception, analysis, and attack interference caused by the use of international standard protocols.

[0076] The embodiments of the present invention generate dynamic keys based on real-time collected data and distribute them across nodes, ensuring that even if a single node is compromised, the keys cannot be fully retrieved. Dynamic encryption based on data type improves the unpredictability of the encryption algorithm and prevents targeted attacks. Data is transmitted between nodes using a zero-trust communication protocol, preventing spoofing and tampering. Compared to existing technologies, this application can improve the security of substation data.

[0077] like Figure 3 As shown, based on the above embodiment of the substation data encryption method based on dynamic keys, another embodiment of the present invention provides a substation data evaluation method based on dynamic keys, including steps S301 and S302;

[0078] Step S301: extract first ciphertext data to be evaluated from an edge computing node; wherein the first ciphertext data is generated according to a substation data encryption method based on a dynamic key of the present invention; the first ciphertext data is transmitted through a zero-trust communication protocol.

[0079] Step S302: Calculate the first ciphertext data in a homomorphic encryption manner to obtain a monitoring status evaluation result of the substation.

[0080] It is worth noting that homomorphic encryption means that data is directly involved in calculations in an encrypted state.

[0081] Optionally, monitoring status assessments include:

[0082] Assessing whether there are any anomalies in the substation's electrical data, including voltage, current, active power, reactive power, power factor, and frequency fluctuations;

[0083] Assessing whether there are any abnormalities in the substation's equipment status; where the equipment status includes operating conditions such as transformer temperature, oil level, and winding temperature, as well as circuit breaker status (open / closed);

[0084] Assess the integrity of the substation's communication links and data, including message integrity, message latency, and packet loss rates to check for tampering and replay attack traces.

[0085] Assess the health status of substations, including assessing equipment aging and abnormal trends, and assessing whether key substation components need maintenance or replacement;

[0086] Assess the substation's voltage / current over-limit risk, including evaluating whether the current operating voltage / current is approaching or exceeding safety thresholds;

[0087] Assess whether the substation has abnormal behavior and attacks, including assessing whether there are abnormal operations such as data injection, false control commands, and identity forgery.

[0088] like Figure 4 As shown, based on the above method embodiments, corresponding data encryption and evaluation embodiments are provided.

[0089] The embodiments of the present invention improve the security of data processing by allowing data to directly participate in calculations in an encrypted state.

[0090] like Figure 5 As shown, based on the above-mentioned embodiment of a substation data encryption method based on a dynamic key, a corresponding device embodiment is provided;

[0091] An embodiment of the present invention provides a substation data encryption device based on dynamic keys, comprising: a key generation module 501, a key sharding module 502 and a dynamic encryption module 503;

[0092] The key generation module 501 is used to generate a random key at a key generation node based on collected data to obtain a dynamic key; wherein the collected data includes environmental data and operating data of the substation;

[0093] The key sharding module 502 is configured to shard the dynamic key using a key sharing method, and distribute and store the sharded dynamic key in multiple key storage nodes;

[0094] The dynamic encryption module 503 is used to extract dynamic keys from a predefined number of key storage nodes through edge computing nodes for reconstruction, and dynamically encrypt the data to be encrypted at the edge computing nodes based on the reconstructed dynamic keys to obtain ciphertext data; wherein, the data to be encrypted includes control instructions and status data of the substation.

[0095] In the embodiment of the present invention, the key generation module 501 includes: a key generation submodule;

[0096] The key generation submodule is used to combine the collected data as a random factor with a preset seed key to obtain a dynamic key.

[0097] In the embodiment of the present invention, the key sharding module 502 includes: a key sharding submodule;

[0098] The key sharding submodule is used to divide the dynamic key into n shares, one key storage node stores one share of the dynamic key, and at least t key storage nodes are required to store dynamic keys to reconstruct the complete dynamic key; wherein n and t are preset values, and n is greater than t.

[0099] In the embodiment of the present invention, the key sharding module 502 further includes: a deadline determination submodule and an attack detection submodule;

[0100] The expiration determination submodule is used to determine the expiration of the dynamic key stored in the key storage node. If the storage time of the dynamic key exceeds the preset update period, the dynamic key is regenerated and stored in shards;

[0101] The attack detection submodule is used to perform attack detection on the dynamic key stored in the key storage node. If the detection result is that the dynamic key is attacked, the dynamic key is regenerated and stored in fragments.

[0102] In the embodiment of the present invention, the dynamic encryption module 503 includes: a key reconstruction submodule and a dynamic encryption submodule;

[0103] The key reconstruction submodule is used to extract dynamic keys from t key storage nodes through the edge computing node for reconstruction to obtain a complete dynamic key; where t is a preset value that is less than the total number of key storage nodes;

[0104] The dynamic encryption submodule is used to perform encryption processing at the edge computing node using encryption algorithms of different strengths based on the type of data to be encrypted and the complete dynamic key.

[0105] It can be understood that the above-mentioned device embodiment corresponds to the method embodiment of the present invention, which can implement any one of the above-mentioned method embodiments of the present invention to provide a substation data encryption method based on dynamic keys.

[0106] The embodiment of the present invention generates dynamic keys based on real-time collected data through a key generation module and a key sharding module and distributes and stores them in each node, ensuring that the key cannot be fully obtained even if a single node is compromised; the dynamic encryption module performs dynamic encryption processing according to the data type, thereby improving the unpredictability of the encryption algorithm and preventing targeted attacks; and the zero-trust communication protocol is used to transmit data between nodes to prevent disguise and tampering.

[0107] like Figure 6 As shown, based on the above-mentioned embodiment of a substation data evaluation method based on a dynamic key, a corresponding device embodiment is provided;

[0108] Another embodiment of the present invention provides a substation data evaluation device based on dynamic keys, comprising: a data extraction module 601 and a homomorphic encryption module 602;

[0109] The data extraction module 601 is configured to extract first ciphertext data to be evaluated from an edge computing node; wherein the first ciphertext data is generated according to a substation data encryption method based on a dynamic key of the present invention; and the first ciphertext data is transmitted via a zero-trust communication protocol;

[0110] The homomorphic encryption module 602 is used to calculate the first ciphertext data in a homomorphic encryption manner to obtain a monitoring status evaluation result of the substation.

[0111] It can be understood that the above-mentioned device embodiment corresponds to the method embodiment of the present invention, which can implement any of the above-mentioned method embodiments of the present invention to provide a substation data evaluation method based on dynamic keys.

[0112] The embodiments of the present invention improve the security of data processing by allowing data to directly participate in calculations in an encrypted state.

[0113] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Furthermore, in the drawings of the device embodiments provided by the present invention, the connection relationship between modules indicates that they have a communication connection, which may be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement the present invention without inventive effort.

[0114] Based on the above-mentioned embodiments of a substation data encryption method based on a dynamic key and a substation data evaluation method based on a dynamic key, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a substation data encryption method based on a dynamic key and a substation data evaluation method based on a dynamic key according to any embodiment of the present invention.

[0115] For example, in this embodiment, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to implement the present invention. The one or more module elements may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

[0116] The terminal device may be a computing device such as a desktop computer, a notebook computer, a PDA, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0117] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines.

[0118] Based on the above-mentioned method embodiments, another embodiment of the present invention provides a computer-readable storage medium, including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a substation data encryption method based on a dynamic key and a substation data evaluation method based on a dynamic key as described in any one of the above-mentioned method embodiments of the present invention.

[0119] Wherein, the module / unit integrated in the device / terminal equipment, if implemented in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0120] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A substation data encryption method based on dynamic keys, characterized in that: Applicable to the substation data encryption system based on dynamic keys; wherein, the substation data encryption system includes: key generation nodes, key storage nodes and edge computing nodes, and data transmission between each node is carried out through the zero-trust communication protocol; The substation data encryption method includes: Generating a random key at a key generation node based on collected data to obtain a dynamic key; wherein the collected data includes environmental data and operating data of the substation; Sharding the dynamic key by a key sharing method, and distributing and storing the sharded dynamic key in multiple key storage nodes; The edge computing node extracts dynamic keys from a predefined number of key storage nodes for reconstruction, and dynamically encrypts the data to be encrypted based on the reconstructed dynamic keys at the edge computing node to obtain ciphertext data; wherein the data to be encrypted includes control instructions and status data of the substation.

2. A method for encrypting substation data based on a dynamic key according to claim 1, characterized in that: The random key generation is performed at the key generation node based on the collected data to obtain a dynamic key, specifically: The collected data is used as a random factor and combined with the preset seed key to obtain a dynamic key.

3. A method for encrypting substation data based on a dynamic key according to claim 1, characterized in that: The method of sharding the dynamic key by a key sharing method and distributing and storing the sharded dynamic key in multiple key storage nodes includes: The dynamic key is divided into n shares, one key storage node stores one share of the dynamic key, and at least t key storage nodes are required to store dynamic keys to reconstruct the complete dynamic key; wherein n and t are preset values, and n is greater than t.

4. A method for encrypting substation data based on a dynamic key according to claim 1, characterized in that: The method of sharding the dynamic key by a key sharing method and distributing and storing the sharded dynamic key in a plurality of key storage nodes further includes: The expiration date of the dynamic key stored in the key storage node is judged. If the storage time of the dynamic key exceeds the preset update period, the dynamic key is regenerated and stored in shards; Perform attack detection on the dynamic key stored in the key storage node. If the detection result is an attack, regenerate the dynamic key and store it in shards.

5. The method for encrypting substation data based on dynamic keys according to claim 1, characterized in that: The edge computing node extracts dynamic keys from a predefined number of key storage nodes for reconstruction, and dynamically encrypts the data to be encrypted at the edge computing node based on the reconstructed dynamic keys to obtain ciphertext data, including: The edge computing node extracts the dynamic key from t key storage nodes and reconstructs it to obtain a complete dynamic key; where t is a preset value that is less than the total number of key storage nodes; Based on the type of data to be encrypted and the complete dynamic key, encryption algorithms of different strengths are used for encryption processing at the edge computing node.

6. A substation data evaluation method based on dynamic keys, characterized in that: include: Extracting first ciphertext data to be evaluated from an edge computing node; wherein the first ciphertext data is generated by a substation data encryption method based on a dynamic key according to any one of claims 1 to 5; and transmitting the first ciphertext data through a zero-trust communication protocol; The first ciphertext data is calculated in a homomorphic encryption manner to obtain a monitoring status evaluation result of the substation.

7. A substation data encryption device based on dynamic keys, characterized in that: include: Key generation module, key sharding module and dynamic encryption module; The key generation module is used to generate a random key at the key generation node based on the collected data to obtain a dynamic key; wherein the collected data includes environmental data and operation data of the substation; The key sharding module is used to shard the dynamic key using a key sharing method, and distribute and store the sharded dynamic key in multiple key storage nodes; The dynamic encryption module is used to extract dynamic keys from a predefined number of key storage nodes through edge computing nodes for reconstruction, and dynamically encrypt the data to be encrypted at the edge computing node based on the reconstructed dynamic keys to obtain ciphertext data; wherein the data to be encrypted includes control instructions and status data of the substation.

8. A substation data evaluation device based on dynamic keys, characterized in that: include: Data extraction module and homomorphic encryption module; The data extraction module is configured to extract first ciphertext data to be evaluated from the edge computing node; wherein the first ciphertext data is generated according to the substation data encryption method based on a dynamic key according to any one of claims 1 to 5; and the first ciphertext data is transmitted via a zero-trust communication protocol; The homomorphic encryption module is used to calculate the first ciphertext data in a homomorphic encryption manner to obtain a monitoring status evaluation result of the substation.

9. A terminal device, characterized in that: The invention comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the method for encrypting substation data based on a dynamic key as described in any one of claims 1 to 5 and the method for evaluating substation data based on a dynamic key as described in claim 6 are implemented.

10. A computer-readable storage medium, characterized in that include: A stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a substation data encryption method based on a dynamic key as described in any one of claims 1 to 5 and a substation data evaluation method based on a dynamic key as described in claim 6.

Images