Power distribution ring main unit communication method and system based on quantum random number and identity authentication

Abstract

The embodiment of the invention provides a distribution ring main unit communication method and system based on quantum random numbers and identity authentication, and relates to the technical field of quantum communication. The communication method comprises the following steps: acquiring an equipment identifier generated by a power distribution ring main unit terminal; bidirectional identity verification is carried out on the power distribution ring main unit terminal and the main center; obtaining an initial session key; generating a segmentation key according to the initial session key, and segmenting the service data; judging whether the time of encrypting the service data of the current segment by the current segment key is greater than a first time threshold and / or whether the message quantity of the service data of the current segment is greater than a first message threshold; and encrypting the service data of the current segment to generate a new segment key when the time threshold value and / or the first message threshold value are / is greater than the first time threshold value and / or the first message threshold value. According to the invention, a segmented key rotation mechanism triggered based on double thresholds of time and the number of messages is adopted, so that the service cycle of the key is shortened, the forward security and backward security capabilities are improved, and systematic risks caused by key leakage are prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of quantum communication, in particular to a power distribution ring network cabinet communication method and system based on quantum random numbers and identity authentication. BACKGROUND

[0002] Power distribution automation is a key component of the development of smart grids. As a core device in the power distribution system, the power distribution ring network cabinet is widely deployed in cities, industrial parks and large power consumption scenarios to realize the distribution, switching and remote monitoring and management of electric energy. With the continuous improvement of intelligentization, the ring network cabinet usually interacts with the master control center through wireless communication to realize functions such as fault positioning, voltage and current collection, and switch operation.

[0003] In the prior art, the wireless communication system of the power distribution ring network cabinet generally uses pre-set keys or encryption keys issued by the center node to ensure communication security. This method has many security and management problems in practical application. On the one hand, once the pre-set key is leaked, the entire communication system will be exposed to risk. On the other hand, static keys are easily brute-forced in long-term use and are difficult to meet the communication security needs in dynamic environments. In addition, the existing system generally lacks effective device identity authentication mechanisms, making it difficult to prevent the access of illegal or disguised devices. The key update process often relies on manual intervention or center node coordination control, which is complex and prone to key synchronization failures, affecting the stable operation of the system. Physically unclonable function (PUF) and quantum random number generator (QRNG) as emerging hardware security technologies have been gradually applied in the field of cryptography due to their device uniqueness and high entropy characteristics, to enhance the security and unpredictability of keys. At the same time, multi-center collaboration and segmented encryption mechanisms are gradually being promoted in industrial Internet of Things and power information systems to improve the fault tolerance and attack prevention capabilities of communication.

[0004] However, there is still a lack of a communication security solution that integrates PUF and quantum random sources, adapts to the characteristics of low-power terminals, supports dynamic key management and multi-center collaboration. In particular, in the actual power application scenarios such as power distribution ring network cabinets, how to realize high-security, high-reliability, and strong-adaptation encryption communication mechanisms is still a key technical problem that needs to be solved. SUMMARY

[0005] The embodiment of the application aims to provide a power distribution ring network cabinet communication method and system based on quantum random numbers and identity authentication, the application generates a unique physical fingerprint of equipment through a PUF module arranged on a power distribution ring network cabinet terminal, combines unpredictable high-entropy input provided by quantum random numbers, constructs a multi-source key derivation framework, fundamentally solves the security risks of key presetting and reuse, shortens the key use cycle based on a time and message quantity double-threshold triggered segmented key rotation mechanism, improves forward security and backward security capabilities, prevents systematic risks caused by key leakage, realizes rapid recovery of key state and uninterrupted communication through a double-node redundant structure of a main center and a backup center and the introduction of an auxiliary synchronization channel, and improves the stability of the system under failure or attack.

[0006] In order to achieve the above-mentioned purpose, the application provides a power distribution ring network cabinet communication method based on quantum random numbers and identity authentication, which comprises the following steps: obtaining an equipment identifier generated by a power distribution ring network cabinet terminal; performing bidirectional identity authentication on the power distribution ring network cabinet terminal and a main center; obtaining an initial session key; generating a segmented key according to the initial session key and segmenting business data; judging whether the time for which the segmented key encrypts the current segment of the business data is greater than a first time threshold value and / or whether the message quantity of the current segment of the business data is greater than a first message threshold value; when the first time threshold value and / or the first message threshold value is greater, encrypting the business data of the current segment, generating a new segmented key, and returning to the step of judging whether the time for which the segmented key encrypts the current segment of the business data is greater than a first time threshold value and / or whether the message quantity of the current segment of the business data is greater than a first message threshold value; judging whether the time for which the initial session key encrypts the business data is greater than a second time threshold value and / or whether the message quantity of the encrypted business data is greater than a second message threshold value; when the second time threshold value and / or the second message threshold value is greater, returning to the step of obtaining an initial session key.

[0007] Optionally, obtaining an equipment identifier generated by a power distribution ring network cabinet terminal comprises the following steps: calling a PUF module of the power distribution ring network cabinet terminal, inputting a challenge template in the PUF module, and generating a physical fingerprint of the power distribution ring network cabinet terminal; calling a QRNG module of the power distribution ring network cabinet terminal to generate quantum random numbers; generating an equipment identifier according to the physical fingerprint, the quantum random numbers and an initial time stamp; reconstructing a signature private key dynamically through a SHA3 hash function according to the physical fingerprint and the quantum random number; generating a signature public key corresponding to the signature private key based on an ECDSA algorithm; uploading the device identifier and the signature public key to a main center, a backup center and an audit center through the power distribution ring main unit terminal.

[0008] Optionally, the power distribution ring main unit terminal and the main center are bidirectionally authenticated, including: sending a first random challenge value generated by the main center to the power distribution ring main unit terminal; performing a first signature on the first random challenge value through a first signature private key reconstructed dynamically in the power distribution ring main unit terminal through a SHA3 hash function; verifying the first signature in the main center according to a first signature public key reconstructed dynamically through a SHA3 hash function; verifying the first signature in the main center according to a first signature public key reconstructed dynamically through a SHA3 hash function; verifying the first signature in the main center according to a first signature public key reconstructed dynamically through a SHA3 hash function; sending a second random challenge value generated by the power distribution ring main unit terminal to the main center; performing a second signature on the second random challenge value through a second signature private key reconstructed dynamically in the main center through a SHA3 hash function; verifying the second signature in the power distribution ring main unit terminal according to a second signature public key reconstructed dynamically through a SHA3 hash function; verifying the second signature in the power distribution ring main unit terminal according to a second signature public key reconstructed dynamically through a SHA3 hash function; verifying the second signature in the power distribution ring main unit terminal according to a second signature public key reconstructed dynamically through a SHA3 hash function;

[0009] Optionally, an initial session key is obtained, including: obtaining a second dynamic salt value through the power distribution ring main unit terminal according to the physical fingerprint and a SHA3 hash function; obtaining quantum random numbers respectively generated by the power distribution ring main unit terminal and the main center; deriving an initial session key through a function of formula (1) according to the second dynamic salt value, the quantum random numbers, a session center context and a timestamp, , (1) wherein, is the initial session key, is the second dynamic salt value, is a quantum random number generated by the power distribution ring main unit terminal, is a quantum random number generated by the main center,​ a timestamp, a session context, a function; sending, through an auxiliary channel of the power distribution ring main unit terminal, an encrypted digest, a session segment number, and a synchronization flag bit; verifying, by the main center, the encrypted digest; returning, through the auxiliary channel, a verification message; recording, at the audit center, a key agreement event.

[0010] Optionally, the service data of the current segment is encrypted, including: constructing a first dynamic salt value according to the service data of the current segment and an HKDF function; generating a new segment key according to the first dynamic salt value; generating a dynamic encryption parameter according to the new segment key; encrypting the service data of the current segment based on an improved QAES algorithm according to the dynamic encryption parameter.

[0011] Optionally, the improved QAES algorithm includes: introducing a dynamic round function perturbation to an AES-GCM algorithm; selecting a perturbation selector of formula (2) according to the new segment key and a quantum entropy source, , (2) wherein, is a selector, is a new segment key of the segment service data, is a positive integer, is a data packet, is a quantum entropy source, is the last 2 bits of the HMAC-SHA256 result, is an algorithm; adjusting an S-box, a column coefficient, or a round function order according to the selector.

[0012] Optionally, the dynamic encryption parameter includes additional authentication data and an initialization vector; obtaining additional authentication data according to formula (3), , (3) wherein, is additional authentication data, is a segment number of the segment service data, is a message sequence number, is a perturbation variable, a stable hash response for the PUF module, a hash function; an initialization vector is obtained according to formula (4), (4) wherein, is the initialization vector.

[0013] Optionally, the service data of the current segment is encrypted according to the dynamic encryption parameter based on the improved QAES algorithm, comprising: the service data of the current segment is encrypted according to formula (5), (5) wherein, is the ciphertext, is a 128-bit authentication tag, is the encryption plaintext, is a call algorithm for encrypting data.

[0014] Optionally, the communication method further comprises: sending a heartbeat signal to the main center and the standby center every first preset threshold time through the power distribution ring network cabinet terminal, and triggering switching to the standby center if the main center is not responded for more than a second preset threshold number of times in succession; obtaining a PUF digest of the last successful communication according to the log recorded by the audit center; calling a QRNG module to generate a new quantum random number; generating a new seed in the standby center according to the quantum random number and the PUF digest through formula (6), (6) wherein, is the new seed, is the PUF digest, is the new quantum random number, is a second dynamic salt value, is a algorithm; generating a new session key according to the new seed through formula (7), (7) wherein, is the new session key, is a session context, is a function; decrypting a new message according to the new session key and the QAES algorithm; The derived key is used to reconstruct the historical message and dynamically encrypt the parameters. The rotation and switching events are recorded in the audit center.

[0015] In another aspect, the application also provides a power distribution ring network cabinet communication system based on quantum random numbers and identity authentication, which comprises: A power distribution ring network cabinet terminal comprising a PUF module, a QRNG module, an AES-GCM algorithm processor and A function derivation unit for generating a device identifier; A multi-master center comprising a primary center, a backup center and an audit center; A communication link center for performing the communication method according to any one of the preceding aspects to complete encrypted communication between the power distribution ring network cabinet terminal and the multi-master center.

[0016] Through the above technical solution, the application provides a power distribution ring network cabinet communication method and system based on quantum random numbers and identity authentication, which performs bidirectional identity authentication on the power distribution ring network cabinet terminal and the primary center by obtaining the device identifier generated by the power distribution ring network cabinet terminal, obtains an initial session key, generates a segment key according to the initial session key, segments the business data, judges whether the time for the current segment key to encrypt the business data of the current segment is greater than a first time threshold and / or whether the number of messages of the business data of the current segment is greater than a first message threshold, encrypts the business data of the current segment when the first time threshold and / or the first message threshold is greater than, generates a new segment key, judges whether the time for the current initial session key to encrypt the business data is greater than a second time threshold and / or whether the number of messages of the encrypted business data is greater than a second message threshold, and returns to the step of obtaining the initial session key when the second time threshold and / or the second message threshold is greater than. The application generates a unique physical fingerprint of the device by setting a PUF module in the power distribution ring network cabinet terminal, constructs a multi-source key derivation framework by combining the unpredictable high-entropy input provided by the quantum random number, fundamentally solves the security risks of key preloading and reuse, shortens the key use period based on the segment key rotation mechanism triggered by the double threshold of time and message quantity, improves the forward security and backward security capability, prevents the systematic risk caused by key leakage, sets a double-node redundant structure of the primary center and the backup center, introduces an auxiliary synchronization channel, realizes quick recovery of the key state and uninterrupted communication, and improves the stability of the system under failure or attack.

[0017] Other features and advantages of the embodiments of the application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings are included to provide a further understanding of embodiments of the application, and are incorporated in and constitute a part of this specification, illustrate embodiments of the application, and together with the description serve to explain embodiments of the application, but do not limit the application. In the drawings: Figure 1 is a flow chart of a power distribution ring network cabinet communication method based on quantum random numbers and identity authentication according to an embodiment of the application; Figure 2 is a flow chart of obtaining a device identifier according to an embodiment of the application; Figure 3 is a flow chart of performing bidirectional identity authentication according to an embodiment of the application; Figure 4 is a flow chart of obtaining an initial session key according to an embodiment of the application; Figure 5 is a flow chart of service data encryption according to an embodiment of the application; Figure 6 is a flow chart of an improved QAES algorithm according to an embodiment of the application; Figure 7 is a flow chart of obtaining dynamic encryption parameters according to an embodiment of the application; Figure 8 is a flow chart of switching a backup center according to an embodiment of the application. DETAILED DESCRIPTION

[0019] The specific embodiments of the embodiments of the application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely intended to illustrate and explain the embodiments of the application, and are not intended to limit the embodiments of the application.

[0020] In the embodiments of the present application, some software, components, models, etc. in the industry may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the technical solutions in the embodiments of the present application, but does not mean that the applicant has or will necessarily use the scheme.

[0021] As shown in Figure 1 is a flow chart of a power distribution ring network cabinet communication method based on quantum random numbers and identity authentication according to an embodiment of the application. In the Figure 1 , the communication method can include: In step S1, a device identifier generated by a power distribution ring network cabinet terminal is obtained; In step S2, bidirectional identity authentication is performed on the power distribution ring network cabinet terminal and the main center; In step S3, an initial session key is obtained; In step S4, a segmented key is generated according to the initial session key, and service data is segmented; In step S5, it is determined whether the time for encrypting the service data of the current segment by the current segment key is greater than a first time threshold and / or whether the number of messages of the service data of the current segment is greater than a first message threshold; In step S6, when the time is greater than the first time threshold and / or the first message threshold, the service data of the current segment is encrypted, a new segment key is generated, and the process returns to the step of determining whether the time for encrypting the service data of the current segment using the current segment key is greater than the first time threshold and / or whether the number of service data messages in the current segment is greater than the first message threshold; In step S7, it is determined whether the time for encrypting the service data with the current initial session key is greater than a second time threshold and / or whether the number of encrypted service data messages is greater than a second message threshold; In step S8, when the time is greater than the second time threshold and / or the second message threshold, the process returns to the step of obtaining the initial session key.

[0022] In this Figure 1 In the method shown, step S1 can be used to obtain the device identifier generated by the distribution ring main unit terminal. When the distribution ring main unit terminal is manufactured or initially deployed, it is necessary to establish a trusted identity of the terminal and provide a security basis for subsequent communications. Static keys are not pre-set to reduce the risk of leakage. The method for obtaining the device identifier generated by the distribution ring main unit terminal can be in various forms known to those skilled in the art. In one example of the present invention, the method for obtaining the device identifier may include: Figure 2 The steps shown. Specifically: In step S11, the PUF module of the power distribution ring main unit terminal is called, and a challenge template is input into the PUF module to generate a physical fingerprint of the power distribution ring main unit terminal; In step S12, the QRNG module of the distribution ring main unit terminal is called to generate quantum random numbers; In step S13, a device identifier is generated based on the physical fingerprint, the quantum random number and the initial timestamp; In step S14, the signature private key is dynamically reconstructed through the SHA3 hash function based on the physical fingerprint and quantum random number; In step S15, a signature public key corresponding to the signature private key is generated based on the ECDSA algorithm; In step S16, the device identifier and signature public key are uploaded to the main center, backup center and audit center through the distribution ring main cabinet terminal.

[0023] In this Figure 2In the method shown, step S11 can be used to call the PUF module of the power ring network cabinet terminal, input the challenge template in the PUF module, and generate the physical fingerprint of the power ring network cabinet terminal. The physical fingerprint generated by utilizing the tiny difference in chip manufacturing to generate a unique response has non-replicability, and the physical fingerprint can be shown according to formula (8), , (8) wherein, is the physical fingerprint, is the challenge template, is the physically unclonable function.

[0024] Step S12 can be used to call the QRNG module of the power ring network cabinet terminal to generate quantum random numbers, and step S13 can be used to generate a device identifier according to the physical fingerprint, the quantum random numbers and the initial timestamp. When the power ring network cabinet terminal is powered on for the first time, the QRNG module of the power ring network cabinet terminal generates quantum random numbers, the PUF module generates a physical fingerprint, and a device identifier calculated according to formula (9) is generated according to an initial timestamp, , (9) wherein, is the device identifier, is the quantum random number generated by the QRNG module, is the initial timestamp, is the hash function.

[0025] Step S14 can be used to dynamically reconstruct a signature private key according to the physical fingerprint and the quantum random numbers through the SHA3 hash function. The physical fingerprint is generated through step S11, and the signature private key of formula (10) is dynamically reconstructed through the SHA3 hash function according to the physical fingerprint responded by the PUF module and the quantum random numbers generated by the power ring network cabinet terminal, , (10) wherein, is the first signature private key, is the quantum random number generated by the power ring network cabinet terminal.

[0026] Step S15 can be used to generate a signature public key corresponding to the signature private key based on the ECDSA algorithm, and the signature public key corresponding to the signature private key is calculated through the ECDSA algorithm, which is used for subsequent identity authentication, and the signature private key is not stored and needs to be dynamically reconstructed through the PUF module.

[0027] Step S16 can upload the device identifier and the signature public key to the main center, the backup center and the audit center through the power ring network cabinet terminal. The main center records the identity of the power ring network cabinet terminal, the backup center is backed up, and the audit center stores the hash chain log according to formula (11), , (11) wherein, is a power distribution ring main unit terminal registration log stored in a hash chain, contains registration time information. A unique device identity is generated by the PUF module and quantum random number, ensuring that the device identity cannot be forged and laying the foundation for subsequent key derivation and authentication.

[0028] Step S2 can be used for bidirectional identity authentication of the power distribution ring main unit terminal and the main center. The power distribution ring main unit terminal and the main center complete bidirectional identity authentication through a lightweight asymmetric authentication protocol to confirm the credibility of both parties' identities and establish a secure initial session state. This process utilizes the hardware uniqueness of Q-PUF combined with the ECDSA algorithm to ensure that the authentication process is efficient, secure, and does not require the storage of static private keys. In one example of the present application, the method of bidirectional identity authentication can include the steps shown in Figure 3 . Specifically: In step S21, the first random challenge value generated by the main center is sent to the power distribution ring main unit terminal; In step S22, the first random challenge value is first signed in the power distribution ring main unit terminal by the first signature private key dynamically reconstructed by the SHA3 hash function; In step S23, the first signature is verified in the main center according to the first signature public key dynamically reconstructed by the SHA3 hash function; In step S24, the verification is passed, confirming that the power distribution ring main unit terminal identity is trustworthy; In step S25, the second random challenge value generated by the power distribution ring main unit terminal is sent to the main center; In step S26, the second random challenge value is second signed in the main center by the second signature private key dynamically reconstructed by the SHA3 hash function; In step S27, the second signature is verified in the power distribution ring main unit terminal according to the second signature public key dynamically reconstructed by the SHA3 hash function; In step S28, the verification is passed, confirming that the main center identity is trustworthy; In step S29, after the power distribution ring main unit terminal and the main center are both verified, an initial session context is established; In step S30, the bidirectional identity authentication event is recorded in the audit center, and the hash chain log is updated.

[0029] In the method shown in Figure 2 , step S21 can be used to send the first random challenge value generated by the main center to the power distribution ring main unit terminal. Step S22 can be used to first sign the first random challenge value in the power distribution ring main unit terminal by the first signature private key dynamically reconstructed by the SHA3 hash function.

[0030] The first signature can be obtained according to formula (12): , (12) in, For the first signature, is the first random challenge value, is the current timestamp, To call Signing algorithm.

[0031] Step S23 can be used to verify the first signature in the main center based on the first signature public key dynamically reconstructed by the SHA3 hash function. Step S24 can be used to verify that the identity of the distribution ring network cabinet terminal is credible. The first signature is verified according to formula (13). , (13) in, The first signature public key corresponding to the first signature private key generated based on the ECDSA algorithm, For calling The algorithm is verified.

[0032] Step S25 can be used to send the second random challenge value generated by the distribution ring main unit terminal to the main center. Step S26 can be used to perform a second signature on the second random challenge value in the main center using the second signature private key dynamically reconstructed by the SHA3 hash function. The second signature can be obtained according to formula (14): , (14) in, For the second signature, is the second random challenge value, is the second signature private key, The primary center identifier.

[0033] Step S27 can be used to verify the second signature in the distribution ring main unit terminal according to the second signature public key dynamically reconstructed by the SHA3 hash function. Step S28 can be used to verify that the identity of the main center is credible. The second signature is verified according to formula (15). , (15) in, is the second signature public key.

[0034] Step S29 can be used to establish the initial session context after both the distribution ring main unit terminal and the main center have passed the verification. Step S30 can be used to record the two-way authentication event in the audit center and update the hash chain log. According to formula (16), the hash chain log is updated. , (16) wherein, is the current stored log, is the previous stored log, is the information containing the authentication time, both parties' identities and the signed digest.

[0035] Step S3 can be used to obtain the initial session key. By fusing the physical uniqueness of PUF and the high-entropy characteristics of quantum random numbers, the Q-PUF generates a secure initial session key and ensures the consistency of the keys of both parties through the auxiliary channel, laying the foundation for subsequent encrypted communication. For the method of obtaining the initial session key, there are various forms known to those skilled in the art. In one example of the present application, the method of obtaining the initial session key can include the steps as shown in Figure 4 . Specifically: In step S41, a second dynamic salt value is obtained by the power distribution ring network cabinet terminal according to the physical fingerprint and the SHA3 hash function; In step S42, quantum random numbers generated by the power distribution ring network cabinet terminal and the main center are obtained; In step S43, according to the second dynamic salt value, the quantum random number, the session center context and the timestamp, the initial session key is derived by the function of formula (1) , , (1) wherein, is the initial session key, is the second dynamic salt value, is the quantum random number generated by the power distribution ring network cabinet terminal, is the quantum random number generated by the main center, is the timestamp, is the session context, is the function; In step S44, the encrypted digest, the session segment number and the synchronization flag bit are sent through the auxiliary channel of the power distribution ring network cabinet terminal; In step S45, the encrypted digest is verified by the main center; In step S46, a verification message is returned through the auxiliary channel; In step S47, the key negotiation event is recorded in the audit center.

[0036] In the method as shown in Figure 4 , step S41 can be used to obtain a second dynamic salt value by the power distribution ring network cabinet terminal according to the physical fingerprint and the SHA3 hash function. According to formula (17), the second dynamic salt value is obtained, , (17) wherein, is a second dynamic salt value.

[0037] Step S42 can be used to obtain the quantum random number generated by the power distribution ring network cabinet terminal and the main center respectively. Step S43 can be used to derive the initial session key through formula (1) according to the second dynamic salt value, the quantum random number, the session center context and the timestamp, , (1) wherein, is the initial session key, is the second dynamic salt value, is the quantum random number generated by the power distribution ring network cabinet terminal, is the quantum random number generated by the main center, is the timestamp, is the session context, is function.

[0038] Step S44 can be used to send the encrypted digest, the session segment number and the synchronization flag bit through the auxiliary channel of the power distribution ring network cabinet terminal. Step S45 can be used to verify the encrypted digest through the main center, and confirm the key consistency. Step S46 can be used to return the verification message through the auxiliary channel. Step S47 can be used to record the key negotiation event in the audit center. According to formula (18), the key negotiation event is recorded, , (18) wherein, is the information containing the key negotiation, is the hash function with an output length of 256 bits.

[0039] Step S4 can be used to generate a segment key according to the initial session key, and segment the service data. Step S5 is to ensure the timeliness and segment independence of the key. Avoid affecting other segments after a communication segment is cracked, and the segment key at this time is the basic key of each communication segment, which has unpredictability. Specifically, the segment key can be generated for each communication segment according to formula (19), , (19) wherein, is the segment key, is the segment number of the current segment of service data, is the quantum random number of the current segment, is algorithm.

[0040] ​Step S5 can be used to determine whether the time for which the current segment key encrypts the service data of the current segment is greater than a first time threshold and / or whether the number of messages of the service data of the current segment is greater than a first message threshold. In an example of the present application, the first time threshold can be 300s and the first message threshold can be 50.

[0041] Step S6 can be used to encrypt the service data of the current segment when greater than the first time threshold and / or the first message threshold, generate a new segment key, and return to execute the step of determining whether the time for which the current segment key encrypts the service data of the current segment is greater than the first time threshold and / or whether the number of messages of the service data of the current segment is greater than the first message threshold. Although the segment key has been generated in step S5, the segment key at this time cannot be directly used for encryption. In order to resist key replay or prediction, the segment key needs to be further encrypted. The method of encrypting the service data of the current segment can be various forms known to those skilled in the art.

[0042] In an example of the present application, the method of encrypting the service data of the current segment can include the steps shown in Figure 5 . Specifically: In step S51, a first dynamic salt value is constructed according to the service data of the current segment and the HKDF function; In step S52, a new segment key is generated according to the first dynamic salt value; In step S53, a dynamic encryption parameter is generated according to the new segment key; In step S54, the service data of the current segment is encrypted based on the improved QAES algorithm according to the dynamic encryption parameter.

[0043] In the method shown in Figure 5 , step S51 can be used to construct a first dynamic salt value according to the service data of the current segment and the HKDF function. The first dynamic salt value is constructed according to formula (20), , (20) wherein, is the first dynamic salt value of the current segment, is a quantum random number generated by the power distribution ring network cabinet terminal, is a quantum random number generated by the main center, is the current segment number.

[0044] Step S52 can be used to generate a new segment key according to the first dynamic salt value. Step S53 can be used to generate a dynamic encryption parameter according to the new segment key. The first 256 bits of the dynamic salt value can be used for key derivation, and the last 256 bits can be used to generate a dynamic encryption parameter. The new segment key is generated according to formula (21) and formula (22), , (21) , (22) wherein, is a variable for an intermediate step of generating a new segment key, is a mask for a current segment, is a segment key at a previous time, is a new segment key.

[0045] Step S54 can encrypt the service data of the current segment according to the dynamic encryption parameter based on the improved QAES algorithm. The fixed round function design of the traditional AES-GCM algorithm can be threatened by side-channel attacks, such as power analysis, timing analysis or differential attacks. These attacks infer key information by analyzing the physical characteristics (such as power consumption pattern or electromagnetic radiation) of the device during the encryption process. In one example of the present application, the improved QAES algorithm can include steps as shown in Figure 6 . Specifically: In step S61, a dynamic round function perturbation is introduced to the AES-GCM algorithm; In step S62, a perturbation selector of formula (2) is obtained according to the new segment key and the quantum entropy source, , (2) wherein, is a selector, is a new segment key for the segment service data, is a positive integer, is a data packet, is a quantum entropy source, is the last 2 bits of the HMAC-SHA256 result; In step S63, the S-box, column coefficient or round function order is adjusted according to the selector.

[0046] In the method as shown in Figure 6 , step S61 can be used to introduce a dynamic round function perturbation to the AES-GCM algorithm. Changing the round function behavior of the AES-GCM kernel can increase the complexity and cost of side-channel attacks while maintaining the lightweight and compatibility of the algorithm. Based on the standard AES-GCM kernel, combined with quantum random number (QRNG) and segment key mechanism, the parameters or execution order of the round function are dynamically adjusted, and when generating the current segment key, the quantum entropy source is recorded as a perturbation seed, ensuring that the perturbation source has high entropy characteristics and cannot be predicted or reproduced. Through group-level perturbation control, the data packets within the segment are controlled by step S62 to obtain the perturbation selector of formula (2) according to the new segment key and the quantum entropy source, , (2) wherein, is a selector, is a first is a new segment key of the segment service data, is a positive integer, is a data packet, is a quantum entropy source, is the last 2 bits of the HMAC-SHA256 result.

[0047] Step S63 can be used to adjust the S-box, column coefficient or round function order according to the selector. Specifically, the perturbation mode can be selected according to Table 1 to increase the difficulty of side-channel attack.

[0048] Table 1

[0049] The standard mode (00) keeps the original AES-GCM round function, is compatible with low-risk scenarios, and ensures performance; the S-box replacement (01) replaces the standard AES S-box with a pre-configured differential-resistant S-box (S1), improves the differential attack resistance by optimizing the non-linear characteristics, and ensures equivalence with the standard S-box by mathematical analysis but has different power consumption characteristics. The column coefficient fine-tuning (10) adjusts the standard Galois field coefficient to the original value plus 0x1B (e.g., from 0x02 to 0x1D) in the MixColumns transformation, changes the data diffusion path, and increases the difficulty of power analysis; the round execution order replacement (11) adjusts the round function order, moves the ShiftRows operation to before the SubBytes operation, changes the data processing timing, and destroys the attacker's timing assumptions.

[0050] For the dynamic encryption parameter acquisition method in step S54, there are various forms known to those skilled in the art. In one example of the present application, it can include Figure 7 the steps shown. Specifically: the dynamic encryption parameter includes additional authentication data and an initialization vector, and the dynamic parameter is generated by binding the PUF state, realizing the deep integration of device physical characteristics and encryption process, and taking into account the lightness and high security.

[0051] In step S71, the additional authentication data is obtained according to formula (3), , (3) wherein, is the additional authentication data, is a segment number of the first segment service data, is a message sequence number, is a perturbation variable, is a stable hash of the PUF module response; In step S72, the initialization vector is obtained according to formula (4), , (4) wherein, is an initialization vector, is an operation that retains the first 96 bits of the input data.

[0052] Step S54 also encrypts the service data of the current segment according to formula (5), , (5) wherein, is the ciphertext, is a 128-bit authentication tag, is the encryption plaintext, is the call algorithm to encrypt the data.

[0053] Step S7 can be used to determine whether the time for the current initial session key to encrypt the service data is greater than a second time threshold and / or the number of packets of the encrypted service data is greater than a second packet threshold. In an example of the present application, the second time threshold can be 30000s, and the second packet threshold can be 5000. Step S8 can be used to return to the step of obtaining the initial session key when greater than the second time threshold and / or the second packet threshold. A new initial session key is generated.

[0054] In an example of the present application, the communication method further includes the steps as shown in Figure 8 , the anti-attack ability is enhanced by randomizing the rotation interval, the master center and standby center switching ensures uninterrupted communication, and the continuity is guaranteed by fusing the old and new algorithm processing data. Specifically: In step S81, the power distribution ring network cabinet terminal sends a heartbeat signal to the master center and standby center every first preset threshold time, and triggers the standby center switching when the master center does not respond for more than a second preset threshold number of times. In an example of the present application, the first preset threshold can be 10s, and the second preset threshold can be 3 times; In step S82, the last successful communication PUF digest is obtained according to the log recorded by the audit center; In step S83, a new quantum random number is generated by calling the QRNG module; In step S84, a new seed is generated in the standby center according to the quantum random number and the PUF digest by formula (6), , (6) wherein, is the new seed, is the PUF digest, is the new quantum random number, is a second dynamic salt value; In step S85, a new session key is generated according to the new seed by formula (7), , (7) wherein, is a new session key, is a session context; In step S86, the new message is decrypted according to the new session key and the QAES algorithm; In step S87, the derived key is obtained to reconstruct the dynamic encryption parameters of the historical message; In step S88, the rotation and switching events are recorded in the audit center.

[0055] In an example of the present application, the audit center generates an unforgeable log for all key events (such as registration, authentication, key agreement, encryption, rotation, and switching), verifies the continuity of the hash chain to confirm that the log has not been tampered with, and stores the log in the audit center for operation and maintenance analysis, security accountability, or judicial evidence. The primary and backup centers are synchronized regularly to ensure that the context is complete during switching.

[0056] On the other hand, the present application also provides a power distribution ring network cabinet communication system based on quantum random numbers and identity authentication, which comprises: A power distribution ring network cabinet terminal comprising a PUF module, a QRNG module, an AES-GCM algorithm processor, and A function derivation unit for generating a device identifier; A multi-master center comprising a primary center, a backup center, and an audit center; A communication link center for performing the communication method according to any one of the above to complete the encrypted communication between the power distribution ring network cabinet terminal and the multi-master center.

[0057] By the technical scheme, the application provides a power distribution ring network cabinet communication method and system based on quantum random numbers and identity authentication, device identifiers generated by a power distribution ring network cabinet terminal are acquired, two-way identity authentication is performed on the power distribution ring network cabinet terminal and a main center, an initial session key is acquired, a segmented key is generated according to the initial session key, business data is segmented, whether the time for the current initial session key to encrypt the current segment of business data is greater than a first time threshold and / or whether the message quantity of the current segment of business data is greater than a first message threshold is judged, when the first time threshold and / or the first message threshold is greater, the current segment of business data is encrypted, a new segmented key is generated, whether the time for the current initial session key to encrypt the business data is greater than a second time threshold and / or whether the message quantity of the encrypted business data is greater than a second message threshold is judged, when the second time threshold and / or the second message threshold is greater, the step of acquiring the initial session key is returned. The application generates a device unique physical fingerprint by setting a PUF module on the power distribution ring network cabinet terminal, combines unpredictable high-entropy input provided by quantum random numbers, constructs a multi-source key derivation framework, fundamentally solves the security risks of key presetting and reuse, and based on a segmented key rotation mechanism triggered by double thresholds of time and message quantity, shortens the key use period, improves forward security and backward security capability, prevents systematic risks caused by key leakage, sets a double-node redundant structure of a main center and a backup center, introduces an auxiliary synchronization channel, realizes quick recovery of key state and uninterrupted communication, and improves the stability of the system under faults or attacks.

[0058] Those skilled in the art will understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0059] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks

[0060] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0061] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that are executed on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0062] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0063] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the computer stores information such as computer program instructions. Memory is an example of computer readable media. A computer can further include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), flash memory, or non-volatile random access memory (NVRAM) about which the computer stores information, such as computer program instructions. Thus, computer readable media

[0064] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile discs (DVDs) or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0065] It should also be noted that the terms "comprising", "comprises" or other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0066] The above embodiments are only used to illustrate the present application, but not to limit it. Instead of the above, various modifications and changes can be made to the application by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall fall into the scope of the claims of the application.

Claims

1. A communication method for power distribution ring main unit based on quantum random numbers and identity authentication, characterized in that: The communication method comprises: Get the device identifier generated by the distribution ring main unit terminal; Perform two-way identity authentication between the distribution ring main unit terminal and the main center; Get the initial session key; Generate a segmentation key based on the initial session key to segment the service data; Determining whether the time for encrypting the service data of the current segment by the current segment key is greater than a first time threshold and / or whether the number of messages of the service data of the current segment is greater than a first message threshold; When the time interval is greater than the first time threshold and / or the first message threshold, encrypt the service data of the current segment, generate a new segment key, and return to the step of determining whether the time interval for encrypting the service data of the current segment using the current segment key is greater than the first time threshold and / or whether the number of messages of the service data of the current segment is greater than the first message threshold; Determining whether the time for encrypting the service data with the current initial session key is greater than a second time threshold and / or whether the number of encrypted service data messages is greater than a second message threshold; When the time is greater than the second time threshold and / or the second message threshold, return to the step of obtaining the initial session key.

2. The communication method according to claim 1, wherein: Obtain the device identifier generated by the distribution ring main unit terminal, including: Calling the PUF module of the power distribution ring main unit terminal, inputting a challenge template into the PUF module, and generating a physical fingerprint of the power distribution ring main unit terminal; Calling the QRNG module of the distribution ring main unit terminal to generate quantum random numbers; generating a device identifier according to the physical fingerprint, the quantum random number, and an initial timestamp; Dynamically reconstructing a signature private key using a SHA3 hash function based on the physical fingerprint and the quantum random number; Generate a signature public key corresponding to the signature private key based on the ECDSA algorithm; The device identifier and the signature public key are uploaded to the main center, backup center and audit center through the distribution ring network cabinet terminal.

3. The communication method according to claim 2, wherein: Perform two-way identity authentication between the distribution ring main unit terminal and the main center, including: Sending the first random challenge value generated by the main center to the distribution ring network cabinet terminal; Performing a first signature on the first random challenge value in the power distribution ring main unit terminal using a first signature private key dynamically reconstructed by a SHA3 hash function; Verifying the first signature in the main center according to the first signature public key dynamically reconstructed by the SHA3 hash function; The verification is successful, confirming that the identity of the distribution ring network cabinet terminal is credible; Sending the second random challenge value generated by the distribution ring main unit terminal to the main center; Performing a second signature on the second random challenge value in the main center using a second signature private key dynamically reconstructed by a SHA3 hash function; Verifying the second signature in the power distribution ring main unit terminal according to the second signature public key dynamically reconstructed by the SHA3 hash function; The verification is passed, confirming that the identity of the main center is credible; After both the power distribution ring main unit terminal and the main center are authenticated, an initial session context is established; The two-way authentication event is recorded in the audit center and the hash chain log is updated.

4. The communication method according to claim 3, wherein: Get the initial session key, including: Obtaining a second dynamic salt value through the distribution ring main unit terminal according to the physical fingerprint and the SHA3 hash function; Obtaining quantum random numbers generated by the distribution ring main unit terminal and the main center respectively; According to the second dynamic salt value, quantum random number, session center context and timestamp, through formula (1) Function to derive the initial session key, ，（1） in, is the initial session key, is the second dynamic salt value, The quantum random number generated for the distribution ring network cabinet terminal, The quantum random number generated by the main center, is the timestamp, is the session context, for function; Sending the encryption summary, session segment number and synchronization flag through the auxiliary channel of the distribution ring network cabinet terminal; verifying the encrypted digest by the master center; Returning a verification message via the auxiliary channel; Key negotiation events are recorded at the audit center.

5. The communication method according to claim 1, wherein: Encrypt the business data of the current segment, including: Constructing a first dynamic salt value according to the business data of the current segment and the HKDF function; generating a new segment key according to the first dynamic salt value; generating dynamic encryption parameters based on the new segment key; The business data of the current segment is encrypted according to the dynamic encryption parameters based on the improved QAES algorithm. The communication method according to claim 5 , wherein: The improved QAES algorithm includes: Introducing dynamic round function perturbation to the AES-GCM algorithm; According to the new segment key and the quantum entropy source, the perturbation selector of formula (2) is obtained. ，（2） in, For the selector, For the New segment key for segment business data, is a positive integer, To group the data, is the quantum entropy source, To get the last 2 digits of the HMAC-SHA256 result, for algorithm; The S-box, column coefficients or round function order is adjusted according to the selector.

7. The communication method according to claim 6, wherein: The dynamic encryption parameters include additional authentication data and an initialization vector; According to formula (3), additional authentication data is obtained. ，（3） in, To attach authentication data, For the Segment number of segment business data, is the message sequence number, is the disturbance variable, is the stable hash of the PUF module response, is a hash function; According to formula (4), the initialization vector is obtained. ，（4） in, is the initialization vector, An operation that retains the first 96 bits of input data.

8. The communication method according to claim 7, wherein: Encrypting the service data of the current segment according to the dynamic encryption parameters based on the improved QAES algorithm includes: The business data of the current segment is encrypted according to formula (5), ，（5） in, is the ciphertext, It is a 128-bit authentication tag. To encrypt plaintext, To call The algorithm encrypts the data.

9. The communication method according to claim 3, wherein: The communication method further includes: Sending a heartbeat signal to the main center and the backup center via the power distribution ring main unit terminal at intervals of a first preset threshold, and triggering switching of the backup center if no response is received from the main center for a number of times exceeding a second preset threshold; Obtaining the PUF summary of the last successful communication based on the log recorded by the audit center; Call the QRNG module to generate new quantum random numbers; A new seed is generated in the backup center according to the quantum random number and the PUF summary using formula (6). ，（6） in, For new seeds, is the PUF digest, is the new quantum random number, is the second dynamic salt value, for algorithm; A new session key is generated according to the new seed using formula (7), ，（7） in, is the new session key, is the session context, for function; Decrypting the new message using the new session key and the QAES algorithm; Obtain derived keys to reconstruct dynamic encryption parameters for historical messages; Rotation and switching events are recorded at the audit center.

10. A power distribution ring main unit communication system based on quantum random numbers and identity authentication, characterized in that: The communication system comprises: Distribution ring main unit terminal, including PUF module, QRNG module, AES-GCM algorithm processor and A function derivation unit for generating a device identifier; Multiple control centers, including main center, backup center and audit center; A communication link center, used to execute the communication method as described in any one of claims 1 to 9 to complete encrypted communication between the distribution ring network cabinet terminal and the multi-master control center.

Images