Methods and systems for secure cloud-edge data transmission in power systems

Abstract

This invention discloses a method for secure cloud-edge data transmission in a power system. The method includes: a cloud management platform generating a unique system identity identifier and a corresponding public-private key pair for an edge device and sending them to the edge device via a secure access gateway; the edge device initiating a gateway dynamic key request to the secure access gateway; the secure access gateway authenticating the edge device, generating a gateway dynamic key, encrypting it, and sending it to the edge device; the edge device obtaining a symmetric encryption session key through a time-series dynamic hash chain; the edge device encrypting the data to be transmitted and sending it to the cloud management platform via the secure access gateway; and the cloud management platform generating response data and sending it to the edge device via the secure access gateway to complete the secure cloud-edge data transmission in the power system. This invention also discloses a system for implementing the aforementioned secure cloud-edge data transmission method in a power system. This invention not only enables secure cloud-edge data transmission in power systems but also offers high reliability and strong security.

Description

Technical Field

[0001] This invention belongs to the field of data transmission security, specifically relating to a method and system for secure data transmission between the cloud and the edge in a power system. Background Technology

[0002] With economic and technological development and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and daily life, bringing endless convenience. Therefore, ensuring a stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] Currently, with the rapid development of the Internet of Things (IoT) and smart technologies, power systems are gradually moving towards cloud computing, edge computing, and large-scale device interconnection. In the context of the power IoT, numerous edge devices (such as sensors and edge control terminals) need to communicate and interact with the cloud to achieve device monitoring, status awareness, and business management. Therefore, the security of cloud-edge data transmission in power systems is of paramount importance.

[0004] Currently, cloud-edge data security transmission solutions in power systems still employ a simple static key authentication method. However, once this static key is leaked, attackers can monitor and tamper with communication data for extended periods. Furthermore, with the increasing number of IoT devices, the management difficulty of static keys has increased significantly. Therefore, existing static key authentication methods are no longer suitable for the increasingly demanding security requirements of power system cloud-edge data transmission scenarios. Summary of the Invention

[0005] One of the objectives of this invention is to provide a highly reliable and secure method for secure data transmission between the cloud and the edge in a power system.

[0006] The second objective of this invention is to provide a system for implementing the aforementioned method for secure data transmission between the cloud and the edge of a power system.

[0007] The cloud-edge data security transmission method for power systems provided by this invention includes the following steps:

[0008] S1. The cloud management platform generates a unique system identity and corresponding public-private key pair for the edge device, and sends the relevant information to the edge device through the secure access gateway;

[0009] S2. The edge device initiates a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity and device identity;

[0010] S3. The secure access gateway authenticates the edge device, generates a gateway dynamic key, encrypts it, and sends it to the edge device;

[0011] S4. The edge device obtains the symmetric encryption session key through a time-series dynamic hash chain based on the received gateway dynamic key, its own system identity, and device identity;

[0012] S5. The edge device encrypts the data to be transmitted based on the obtained symmetric encryption session key and sends it to the cloud management platform through the secure access gateway;

[0013] S6. The cloud management platform generates response data based on the received data and sends it to the edge device through the secure access gateway to complete the secure cloud-edge data transmission of the power system.

[0014] Step S1 describes a cloud management platform that generates a unique system identity and a corresponding public / private key pair for the edge device, and sends the relevant information to the edge device through a secure access gateway. Specifically, this includes the following steps:

[0015] When an edge device connects for the first time, the cloud management platform generates a unique system identity and a corresponding public-private key pair for the edge device.

[0016] The cloud management platform sends the system identity and private key to the edge device through the secure access gateway, and saves the public key to the cloud management platform.

[0017] Step S2 involves the edge device initiating a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity identifier, and device identifier. This specifically includes the following steps:

[0018] The edge device signs the system identity identifier based on the received private key to ensure the authenticity of its own identity;

[0019] The edge device combines its own device serial number and MAC address to generate a device identifier;

[0020] The edge dynamic key is generated using random numbers;

[0021] The edge device uses the public key of the secure access gateway to encrypt the system identity identifier, device identifier, and edge dynamic key, and sends them to the secure access gateway to initiate a gateway dynamic key request.

[0022] Step S3 involves the security access gateway authenticating the edge device, generating a gateway dynamic key, encrypting it, and then sending it to the edge device. Specifically, this includes the following steps:

[0023] The secure access gateway uses its private key to decrypt the data information sent by the edge device and obtain the system identity, device identity and edge dynamic key of the edge device.

[0024] The secure access gateway sends the received system identity identifier to the cloud management platform to achieve authentication of edge devices;

[0025] After authentication, the secure access gateway randomly generates a gateway dynamic key, which is used for subsequent calculation of the time-series dynamic hash chain;

[0026] The secure access gateway uses the received edge dynamic key to encrypt the generated gateway dynamic key before sending it to the edge device.

[0027] Step S4 describes the edge device obtaining a symmetric encryption session key based on the received gateway dynamic key, its own system identity, and its device identity through a time-series dynamic hash chain. Specifically, this includes the following steps:

[0028] The edge device decrypts the data information sent by the secure access gateway using the edge dynamic key to obtain the gateway dynamic key;

[0029] The edge device obtains the symmetric encryption session key by calculating the time-series dynamic hash chain based on the obtained gateway dynamic key, device identifier, and edge dynamic key.

[0030] The calculation of the time-series dynamic hash chain specifically includes the following steps:

[0031] The edge device and the secure access gateway synchronously generate a first dynamic salt value (salt1), a second dynamic salt value (salt2), and a third dynamic salt value (salt3) based on the gateway's dynamic key and the edge device's dynamic key.

[0032]

[0033]

[0034]

[0035] In the formula This indicates the BLAKE3 hash algorithm; For gateway dynamic keys; The edge dynamic key; T is the timestamp; This is a serial concatenation operation;

[0036] The timestamp T uses a time window mechanism. The data sender actively generates a timestamp t in the current second and rounds it down by 10. %, % indicates the remainder; the edge device and the security access gateway synchronize through the network to ensure that the timestamps are consistent; during the transmission process, the data receiver performs passive matching according to the local timestamp: if the matching fails, the current timestamp is decremented according to the set rules until a match is found; during the transmission delay, the timestamp is kept synchronized to ensure that it is not affected by the delay duration;

[0037] Time-series dynamic hash chain computation:

[0038] If the timestamp is a multiple of 20, the hash result is calculated using the following formula. :

[0039]

[0040]

[0041]

[0042] If the timestamp is not a multiple of 20, the hash result is calculated using the following formula. :

[0043]

[0044]

[0045]

[0046] In the formula, H1 is the temporary hash key 1; H2 is the system identifier for the edge device; H2 is temporary hash key 2. For edge device identification;

[0047] The resulting hash is used as the symmetric encryption session key.

[0048] During the secure data transmission between the cloud and the edge in the power system, the following steps are used to update the gateway dynamic key and the edge dynamic key:

[0049] Based on the set communication frequency per unit time, the importance of the transmitted service data, and the number of authentication failures per set number of authentication attempts, the communication risks of edge devices are classified as follows:

[0050] High-risk communication: If the communication frequency within a set unit of time is greater than or equal to the first communication threshold, or if the transmitted business data is highly sensitive business data, or if the number of authentication failures per set number of authentication attempts is greater than or equal to the first failure threshold, then each... The gateway dynamic key and the edge dynamic key are updated every few minutes.

[0051] Medium-risk communication: If the communication frequency within a set unit of time is greater than the second communication threshold but less than the first communication threshold, or if the transmitted business data is medium-sensitive business data, or if the number of authentication failures per set number of authentication attempts is greater than or equal to the second failure threshold but less than the first failure threshold, then each The gateway dynamic key and the edge dynamic key are updated every few minutes.

[0052] Low-risk communication: The communication frequency within a set unit of time is less than or equal to the second communication threshold, or the transmitted business data is low-sensitivity business data, or the number of authentication failures per set number of authentication attempts is less than the second failure threshold. The gateway dynamic key and the edge dynamic key are updated every few minutes.

[0053] Among them, the first communication threshold is greater than the second communication threshold, and the first failure threshold is greater than the second failure threshold. ;

[0054] Highly sensitive business data is defined as: business data that, if leaked or tampered with, would lead to serious consequences.

[0055] Sensitive business data is defined as: business data that would be affected by leakage or tampering, but the consequences are acceptable.

[0056] Low-sensitivity business data is defined as business data whose impact from leakage or tampering is negligible.

[0057] This invention also provides a system for implementing the aforementioned method for secure cloud-edge data transmission in a power system, comprising a device registration module, a key request module, a key generation module, a key hashing module, a data encryption module, and a data transmission module; the device registration module, key request module, key generation module, key hashing module, data encryption module, and data transmission module are connected in series; the device registration module is used by the cloud management platform to generate a unique system identity identifier and a corresponding public-private key pair for the edge device, and sends the relevant information to the edge device through a secure access gateway, and uploads the data information to the key request module; the key request module is used to, based on the received data information, the edge device initiates a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity identifier, and device identifier, and uploads the data information to the key generation module; the key generation module is used to, based on the received data information, ... The secure access gateway authenticates the edge device, generates and encrypts a gateway dynamic key, and sends it to the edge device. It also uploads the data to the key hash module. The key hash module, based on the received data, allows the edge device to obtain a symmetric encryption session key using the received gateway dynamic key, its own system identifier, and its device identifier through a time-series dynamic hash chain. This key hash key is then uploaded to the data encryption module. The data encryption module, based on the received data, allows the edge device to encrypt the data to be transmitted using the obtained symmetric encryption session key. This encrypted data is then sent to the cloud management platform through the secure access gateway, and the data is uploaded to the data transmission module. Finally, the data transmission module, based on the received data, allows the cloud management platform to generate response data, which is then sent to the edge device through the secure access gateway, thus completing the secure cloud-edge data transmission of the power system.

[0058] The cloud-edge data secure transmission method and system provided by this invention negotiates dynamic keys based on the system identity of the device and generates keys based on a time-series dynamic hash chain. Therefore, this invention can not only realize the secure transmission of cloud-edge data in the power system, but also has higher reliability and better security. Attached Figure Description

[0059] Figure 1 This is a schematic diagram of the method flow of the present invention.

[0060] Figure 2 This is a schematic diagram of the functional modules of the system of the present invention. Detailed Implementation

[0061] like Figure 1 The diagram shown is a flowchart of the method of the present invention: The cloud-edge data security transmission method for power systems disclosed in this invention includes the following steps:

[0062] S1. The cloud management platform generates a unique system identity and corresponding public / private key pair for each edge device, and sends the relevant information to the edge device through a secure access gateway; specifically, it includes the following steps:

[0063] When an edge device connects for the first time, the cloud management platform generates a unique system identity and a corresponding public-private key pair for the edge device.

[0064] The cloud management platform sends the system identity and private key to the edge device through the secure access gateway, and saves the public key to the cloud management platform.

[0065] S2. The edge device initiates a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity, and device identity; specifically, it includes the following steps:

[0066] The edge device signs the system identity identifier based on the received private key to ensure the authenticity of its own identity;

[0067] The edge device combines its own device serial number and MAC address to generate a device identifier;

[0068] The edge dynamic key is generated using random numbers;

[0069] The edge device uses the public key of the secure access gateway to encrypt the system identity identifier, device identifier, and edge dynamic key, and sends them to the secure access gateway to initiate a gateway dynamic key request.

[0070] S3. The secure access gateway authenticates the edge device, generates a gateway dynamic key, encrypts it, and sends it to the edge device; specifically, it includes the following steps:

[0071] The secure access gateway uses its private key to decrypt the data information sent by the edge device and obtain the system identity, device identity and edge dynamic key of the edge device.

[0072] The secure access gateway sends the received system identity identifier to the cloud management platform to achieve authentication of edge devices;

[0073] After authentication, the secure access gateway randomly generates a gateway dynamic key, which is used for subsequent calculation of the time-series dynamic hash chain;

[0074] The secure access gateway uses the received edge dynamic key to encrypt the generated gateway dynamic key before sending it to the edge device.

[0075] S4. The edge device, based on the received gateway dynamic key and its own system identity and device identity, obtains the symmetric encryption session key through a time-series dynamic hash chain; specifically, this includes the following steps:

[0076] The edge device decrypts the data information sent by the secure access gateway using the edge dynamic key to obtain the gateway dynamic key;

[0077] The edge device obtains the symmetric encryption session key by calculating the time-series dynamic hash chain based on the obtained gateway dynamic key, device identifier and edge dynamic key;

[0078] In practice, the calculation of the time-series dynamic hash chain includes the following steps:

[0079] The edge device and the secure access gateway synchronously generate a first dynamic salt value (salt1), a second dynamic salt value (salt2), and a third dynamic salt value (salt3) based on the gateway's dynamic key and the edge device's dynamic key.

[0080]

[0081]

[0082]

[0083] In the formula This indicates the BLAKE3 hash algorithm; For gateway dynamic keys; The edge dynamic key; T is the timestamp; This is a serial concatenation operation;

[0084] The timestamp T uses a time window mechanism. The data sender actively generates a timestamp t in the current second and rounds it down by 10. %, % indicates the remainder; edge devices and security access gateways ensure timestamp consistency through network synchronization (such as NTP); during transmission, the data receiver passively matches according to the local timestamp: if the match fails, the current timestamp is decremented according to the set rules (such as decrementing by 10 seconds) until a match is found; during transmission delay, timestamp synchronization is maintained to ensure that it is not affected by the delay duration;

[0085] Time-series dynamic hash chain computation:

[0086] If the timestamp is a multiple of 20, the hash result is calculated using the following formula. :

[0087]

[0088]

[0089]

[0090] If the timestamp is not a multiple of 20, the hash result is calculated using the following formula. :

[0091]

[0092]

[0093]

[0094] In the formula, H1 is the temporary hash key 1; H2 is the system identifier for the edge device; H2 is temporary hash key 2. For edge device identification;

[0095] The resulting hash is used as the symmetric encryption session key.

[0096] This invention generates a unique key for each session through dynamic salt injection and path selection using the BLAKE3 hash algorithm. This scheme not only significantly improves the security of key generation, but also effectively resists security vulnerabilities caused by pattern analysis and fixed paths through time-series salt injection and dynamic path selection, ensuring that timestamp synchronization can still be maintained even under communication delays, thus achieving the best balance between security and performance.

[0097] S5. The edge device encrypts the data to be transmitted based on the obtained symmetric encryption session key and sends it to the cloud management platform through the secure access gateway.

[0098] S6. The cloud management platform generates response data based on the received data and sends it to the edge device through the secure access gateway to complete the secure cloud-edge data transmission of the power system.

[0099] Furthermore, during the secure data transmission process between the cloud and the edge in the above power system, the following steps are used to update the gateway dynamic key and the edge dynamic key:

[0100] Based on the device's communication behavior and security status, the key re-authentication interval is adaptively adjusted to achieve a balance between security and performance;

[0101] Based on the set communication frequency per unit time, the importance of the transmitted service data, and the number of authentication failures per set number of authentication attempts (e.g., the number of authentication failures per 10 authentication attempts), the communication risks of edge devices are classified as follows:

[0102] High-risk communication: If the communication frequency within a set unit of time is greater than or equal to the first communication threshold, or if the transmitted business data is highly sensitive business data, or if the number of authentication failures per set number of authentication attempts is greater than or equal to the first failure threshold, then each... The gateway dynamic key and the edge dynamic key are updated every few minutes.

[0103] Medium-risk communication: If the communication frequency within a set unit of time is greater than the second communication threshold but less than the first communication threshold, or if the transmitted business data is medium-sensitive business data, or if the number of authentication failures per set number of authentication attempts is greater than or equal to the second failure threshold but less than the first failure threshold, then each The gateway dynamic key and the edge dynamic key are updated every few minutes.

[0104] Low-risk communication: The communication frequency within a set unit of time is less than or equal to the second communication threshold, or the transmitted business data is low-sensitivity business data, or the number of authentication failures per set number of authentication attempts is less than the second failure threshold. The gateway dynamic key and the edge dynamic key are updated every few minutes.

[0105] Among them, the first communication threshold is greater than the second communication threshold, and the first failure threshold is greater than the second failure threshold. In specific implementation, the preferred value for the first communication threshold is 50; the preferred value for the second communication threshold is 20; the preferred value for the first failure threshold is 3; and the preferred value for the second failure threshold is 1. The preferred value is 10; The preferred value is 5; The preferred value is 2;

[0106] Highly sensitive business data is defined as business data that, if leaked or tampered with, would lead to serious consequences. This type of data generally involves core business control instructions, user authentication data, or critical system status, such as control instruction data, device key data, etc.

[0107] Medium-sensitive business data is defined as business data that would have an impact on the system if leaked or tampered with, but the consequences are acceptable; this type of data generally includes general business data, such as equipment operating status data, alarm information data, etc.

[0108] Low-sensitivity business data is defined as business data whose impact from leakage or tampering is negligible; this type of data generally only involves auxiliary information, such as log information and general monitoring data.

[0109] The key update mechanism adopted in this invention achieves the best balance between system security and communication performance while responding to changes in communication risks in the power cloud-edge environment in real time, significantly improving the security and resource utilization efficiency of key negotiation and data transmission.

[0110] In this invention, the identity-driven dynamic key negotiation mechanism improves the credibility of device authentication and resists device identity forgery and attacks. By negotiating the system identity and signature, device identity, and dynamic key of the edge device, the credibility and dynamism of the key exchange process are ensured. The cloud management platform ensures the credibility of the edge device's identity through a unique identity and device public-private key system, laying the foundation for secure communication and ensuring the uniqueness and credibility of the edge device's identity. Combining the identity and public-private key mechanism can defend against common identity forgery and man-in-the-middle attacks.

[0111] The present invention introduces a time-series dynamic hash chain and the BLAKE3 hash algorithm. The dynamic hash chain generates a unique hash path and salt value for each session through dynamic salt injection and dynamic path selection, resisting pattern analysis and avoiding vulnerabilities caused by fixed patterns. It enhances the system's resistance to quantum computing threats and ensures the long-term security of future communications.

[0112] The present invention automatically adjusts the frequency of key re-verification based on factors such as the device's communication frequency, the sensitivity of business data, and the number of authentication failures. This flexible key verification mechanism can optimize performance, reduce unnecessary verification burden, and ensure security in high-risk scenarios. It optimizes the balance between performance and security, reduces communication burden, and improves the overall efficiency of the system.

[0113] This invention categorizes business data into high, medium, and low sensitivity levels based on their sensitivity, and formulates different encryption strategies for each level. High-sensitivity data (such as control commands and device keys) employs the strongest encryption strategy to ensure the security of core control information; medium-sensitivity data (such as device operating status and alarm information) is protected with appropriate encryption; and low-sensitivity data (such as log information and general monitoring data) can be protected with a lighter encryption strategy. This strategy not only enhances overall security but also allows different types of devices and communication needs to adopt different encryption strategies according to actual conditions, thereby improving the efficiency and responsiveness of the overall system.

[0114] The cloud-edge collaborative encryption and decryption and verification mechanism adopted in this invention uses a secure access gateway to perform data encryption, decryption and verification between the cloud and the edge, ensuring data security during transmission. The cloud platform and edge devices communicate through the gateway, which is responsible for device authentication, data encryption and decryption and key transmission. This approach enhances system security, simplifies device processing, and is suitable for large-scale power Internet of Things environments.

[0115] The method of the present invention will be further described below with reference to an embodiment: In the experimental environment setup, the test platform constructed a complete test network of cloud, gateway, and edge devices, using 20 edge node devices, including 5 devices for identity attacks, performing an access operation every 5 minutes. The data source simulated three types of business data in a real power system: highly sensitive data (such as control commands), moderately sensitive data (such as device status), and low-sensitivity data (such as log information). Data transmission was simulated via the MQTT protocol for cloud-edge interaction.

[0116] To evaluate the advantages of the present invention's solution in identity authentication mechanisms, this embodiment designed multiple comparative schemes, statistically analyzed the failure rate of identity authentication per 100 device access attempts, and measured the authentication time. The results are shown in the table below:

[0117] Table 1. Comparison of Identity Authentication Failure Rates (per 100 attempts)

[0118]

[0119] Among them, Scheme 1 is a static identity authentication scheme; Scheme 2 is a dynamic periodic key update scheme; Scheme 3 is a dynamic identity authentication and temporary authentication certificate scheme; and Scheme 4 is an authentication mechanism scheme based on device location and timestamp.

[0120] As shown in the table above, compared with existing solutions, the method of this invention significantly reduces the authentication failure rate from 6 failures per 100 authentication attempts to only 1 failure; the authentication time is 100ms. Although a dynamic key update mechanism is used, its optimized algorithm ensures the efficiency of the authentication process. This invention achieves a good balance between authentication failure rate and authentication time through an adaptive time-series dynamic key update mechanism, demonstrating strong advantages. The authentication failure rate is low, and the authentication time is controlled within a reasonable range.

[0121] like Figure 2The diagram shows the functional modules of the system of the present invention: The system for implementing the cloud-edge data secure transmission method of the power system disclosed in this invention includes a device registration module, a key request module, a key generation module, a key hashing module, a data encryption module, and a data transmission module; the device registration module, key request module, key generation module, key hashing module, data encryption module, and data transmission module are connected in series; the device registration module is used by the cloud management platform to generate a unique system identity identifier and a corresponding public-private key pair for the edge device, and sends the relevant information to the edge device through the secure access gateway, and uploads the data information to the key request module; the key request module is used to, based on the received data information, the edge device initiates a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity identifier, and device identifier, and uploads the data information to the key generation module; the key generation module is used to, based on the received data information, the edge device initiates a gateway dynamic key request to the secure access gateway ... registration module is used to, based on the received data information, the edge device initiates a gateway dynamic key request to the secure access gateway, and uploads the data information to the key generation module; the key generation module initiates a gateway dynamic key request to the edge device, based on the received data information, its own system identity identifier, and device identifier, and uploads the data information to the key generation module; the key generation module initiates a gateway dynamic key request to the edge device, based on the received data information, its own system identity identifier, and device identifier, and upload Upon receiving data, the secure access gateway authenticates the edge device, generates a gateway dynamic key, encrypts it, and sends it to the edge device. It also uploads the data to the key hash module. The key hash module, based on the received data, allows the edge device to obtain a symmetric encryption session key using the received gateway dynamic key, its own system identifier, and its device identifier through a time-series dynamic hash chain. This key hash key is then uploaded to the data encryption module. The data encryption module, based on the received data, uses the obtained symmetric encryption session key to encrypt the data to be transmitted. This encrypted data is then sent to the cloud management platform via the secure access gateway and uploaded to the data transmission module. Finally, the data transmission module, based on the received data, allows the cloud management platform to generate response data, which is then sent to the edge device via the secure access gateway, thus completing the secure cloud-edge data transmission for the power system.

Claims

1. A method for secure data transmission between cloud and edge in a power system, comprising the following steps: S1. The cloud management platform generates a unique system identity and corresponding public-private key pair for the edge device, and sends the relevant information to the edge device through the secure access gateway; S2. The edge device initiates a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity and device identity; S3. The secure access gateway authenticates the edge device, generates a gateway dynamic key, encrypts it, and sends it to the edge device; S4. The edge device obtains the symmetric encryption session key through a time-series dynamic hash chain based on the received gateway dynamic key, its own system identity, and device identity; In practice, the calculation of the time-series dynamic hash chain includes the following steps: The edge device and the secure access gateway synchronously generate a first dynamic salt value (salt1), a second dynamic salt value (salt2), and a third dynamic salt value (salt3) based on the gateway's dynamic key and the edge device's dynamic key. In the formula This indicates the BLAKE3 hash algorithm; For gateway dynamic keys; The edge dynamic key; T is the timestamp; This is a serial concatenation operation; The timestamp T uses a time window mechanism. The data sender actively generates a timestamp t in the current second and rounds it down by 10. %, which indicates the remainder; edge devices and the security access gateway synchronize through the network to ensure that the timestamps are consistent; During transmission, the data receiver passively matches the data according to its local timestamp. If the match fails, the current timestamp is decremented according to a set rule until a match is found. During transmission delays, the timestamp is kept synchronized to ensure that it is not affected by the delay duration. Time-series dynamic hash chain computation: If the timestamp is a multiple of 20, the hash result is calculated using the following formula. : If the timestamp is not a multiple of 20, the hash result is calculated using the following formula. : In the formula, H1 is the temporary hash key 1; H2 is the system identifier for the edge device; H2 is temporary hash key 2. For edge device identification; Use the resulting hash as the symmetric encryption session key; S5. The edge device encrypts the data to be transmitted based on the obtained symmetric encryption session key and sends it to the cloud management platform through the secure access gateway; S6. The cloud management platform generates response data based on the received data and sends it to the edge device through the secure access gateway to complete the secure cloud-edge data transmission of the power system.

2. The method for secure data transmission between cloud and edge in a power system according to claim 1, characterized in that... The cloud management platform described in step S1 generates a unique system identity and a corresponding public-private key pair for the edge device, and sends the relevant information to the edge device through a secure access gateway. Specifically, this includes the following steps: When an edge device connects for the first time, the cloud management platform generates a unique system identity and a corresponding public-private key pair for the edge device. The cloud management platform sends the system identity and private key to the edge device through the secure access gateway, and saves the public key to the cloud management platform.

3. The method for secure data transmission between cloud and edge in a power system according to claim 2, characterized in that... Step S2 involves the edge device initiating a gateway dynamic key request to the secure access gateway based on the received data information, its own system identity identifier, and device identifier. This specifically includes the following steps: The edge device signs the system identity identifier based on the received private key to ensure the authenticity of its own identity; The edge device combines its own device serial number and MAC address to generate a device identifier; The edge dynamic key is generated using random numbers; The edge device uses the public key of the secure access gateway to encrypt the system identity identifier, device identifier, and edge dynamic key, and sends them to the secure access gateway to initiate a gateway dynamic key request.

4. The method for secure data transmission between cloud and edge in a power system according to claim 3, characterized in that... Step S3 involves the security access gateway authenticating the edge device, generating a gateway dynamic key, encrypting it, and then sending it to the edge device. Specifically, this includes the following steps: The secure access gateway uses its private key to decrypt the data information sent by the edge device and obtain the system identity, device identity and edge dynamic key of the edge device. The secure access gateway sends the received system identity identifier to the cloud management platform to achieve authentication of edge devices; After authentication, the secure access gateway randomly generates a gateway dynamic key, which is used for subsequent calculation of the time-series dynamic hash chain; The secure access gateway uses the received edge dynamic key to encrypt the generated gateway dynamic key before sending it to the edge device.

5. The method for secure data transmission between cloud and edge in a power system according to claim 4, characterized in that... Step S4 describes the edge device obtaining a symmetric encryption session key based on the received gateway dynamic key, its own system identity, and its device identity through a time-series dynamic hash chain. Specifically, this includes the following steps: The edge device decrypts the data information sent by the secure access gateway using the edge dynamic key to obtain the gateway dynamic key; The edge device obtains the symmetric encryption session key by calculating the time-series dynamic hash chain based on the obtained gateway dynamic key, device identifier, and edge dynamic key.

6. The method for secure data transmission between cloud and edge in a power system according to claim 1, characterized in that... During the secure data transmission between the cloud and the edge in the power system, the following steps are used to update the gateway dynamic key and the edge dynamic key: Based on the set communication frequency per unit time, the importance of the transmitted service data, and the number of authentication failures per set number of authentication attempts, the communication risks of edge devices are classified as follows: High-risk communication: If the communication frequency within a set unit of time is greater than or equal to the first communication threshold, or if the transmitted business data is highly sensitive business data, or if the number of authentication failures per set number of authentication attempts is greater than or equal to the first failure threshold, then each... The gateway dynamic key and the edge dynamic key are updated every few minutes. Medium-risk communication: If the communication frequency within a set unit of time is greater than the second communication threshold but less than the first communication threshold, or if the transmitted business data is medium-sensitive business data, or if the number of authentication failures per set number of authentication attempts is greater than or equal to the second failure threshold but less than the first failure threshold, then each The gateway dynamic key and the edge dynamic key are updated every few minutes. Low-risk communication: The communication frequency within a set unit of time is less than or equal to the second communication threshold, or the transmitted business data is low-sensitivity business data, or the number of authentication failures per set number of authentication attempts is less than the second failure threshold. The gateway dynamic key and the edge dynamic key are updated every few minutes. Among them, the first communication threshold is greater than the second communication threshold, and the first failure threshold is greater than the second failure threshold. ; Highly sensitive business data is defined as: business data that, if leaked or tampered with, would lead to serious consequences. Sensitive business data is defined as: business data that would be affected by leakage or tampering, but the consequences are acceptable. Low-sensitivity business data is defined as business data whose impact from leakage or tampering is negligible.

7. A system for implementing the power system cloud-edge data secure transmission method according to any one of claims 1 to 6, characterized in that... It includes a device registration module, a key request module, a key generation module, a key hashing module, a data encryption module, and a data transmission module; the device registration module, key request module, key generation module, key hashing module, data encryption module, and data transmission module are connected in series; the device registration module is used by the cloud management platform to generate a unique system identity and corresponding public-private key pair for the edge device, and sends the relevant information to the edge device through the secure access gateway, and uploads the data information to the key request module; The key request module is used to send a gateway dynamic key request to the security access gateway based on the received data information, the edge device's own system identity and device identity, and upload the data information to the key generation module. The key generation module is used to securely access the gateway to authenticate the edge device based on the received data information, generate a gateway dynamic key, encrypt it, send it to the edge device, and upload the data information to the key hash module. The key hash module is used to obtain the symmetric encryption session key by the edge device based on the received gateway dynamic key, its own system identity and device identity, through a time-series dynamic hash chain, and then upload the data information to the data encryption module. The data encryption module is used to encrypt the data to be transmitted based on the received data information and the edge device using the obtained symmetric encryption session key. The data is then sent to the cloud management platform through the secure access gateway and uploaded to the data transmission module. The data transmission module is used to generate response data based on the received data information. The cloud management platform generates response data based on the received data and sends it to the edge device through the secure access gateway to complete the secure cloud-edge data transmission of the power system.

Images