Key data transmission and storage safety protection system for thermal power plant

Abstract

The invention discloses a key data transmission and storage security protection system for a thermal power plant, and relates to the technical field of data transmission. Acquiring original data of the thermal power plant, and preprocessing the original data to obtain key data; obtaining a first key and a second key, and performing asymmetric encryption on the key data according to the first key to obtain a first ciphertext; symmetrically encrypting the first ciphertext according to a second key to obtain a second ciphertext, and segmenting the second ciphertext to obtain a ciphertext block set; screening the ciphertext blocks in the ciphertext block set to obtain a target ciphertext block set, and determining an optimization target according to the target ciphertext block set; and determining a target transmission path according to the optimization target and performing data transmission. The safety and confidentiality of thermal power plant data are improved through double encryption, the data quality is optimized through preprocessing, the processing flexibility and adaptability are improved, ciphertext blocks are segmented and screened, the transmission path is optimized, the transmission load is reduced, the reliability and stability are enhanced, and the data transmission efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, specifically to a security protection system for critical data transmission and storage in thermal power plants. Background Technology

[0002] With the continuous improvement of information technology levels in thermal power plants, data transmission is becoming increasingly important in production monitoring, equipment management, and energy dispatch. However, existing data transmission technologies face many challenges, such as data security risks, low transmission efficiency, and insufficient adaptability to complex network environments.

[0003] Publication No. CN119739111A discloses a management method and system for a flue gas CEMS data transmission system in thermal power plants. The flue gas CEMS data transmission system management platform can monitor the real-time operating status of the CEMS industrial control computer and data acquisition instrument, and promptly issue alarms when data exceeds limits, data remains constant, data is missing, or network interruptions occur. By deploying an independent server in the information center and establishing a local area network with a dedicated fiber optic connection, stable transmission of flue gas CEMS data from thermal power plants is achieved, reducing the risks during data transmission and shortening transmission time. By detecting fiber optic connections and using a one-way network gateway, problems such as prolonged data loss or transmission interruptions are avoided.

[0004] In existing technologies, thermal power plant data is easily leaked or tampered with during transmission, resulting in insufficient security and confidentiality; the original data has problems such as missing, abnormal and duplicate issues, affecting data quality and reducing processing flexibility and adaptability; traditional transmission methods have problems such as high transmission load and unreasonable path selection, resulting in low transmission efficiency and insufficient reliability and stability. Summary of the Invention

[0005] The purpose of this invention is to address the issues mentioned in the background art, such as the ease with which data can be leaked or tampered with during transmission, resulting in insufficient security and confidentiality; the presence of missing, abnormal, and duplicate original data, affecting data quality and reducing processing flexibility and adaptability; and the problems of high transmission load and unreasonable path selection in traditional transmission methods, leading to low transmission efficiency, insufficient reliability, and instability. Therefore, this invention proposes a security protection system for critical data transmission and storage in thermal power plants.

[0006] A first aspect of this invention provides a security protection system for critical data transmission and storage in thermal power plants, the system comprising:

[0007] The data preprocessing module is used to acquire raw data from the thermal power plant and preprocess the raw data to obtain key data.

[0008] The first encryption module is used to obtain a first key and a second key, and to perform asymmetric encryption on the key data according to the first key to obtain the first ciphertext.

[0009] The second encryption module is used to perform symmetric encryption on the first ciphertext according to the second key to obtain the second ciphertext, and to divide the second ciphertext into a ciphertext block set;

[0010] The target determination module is used to filter the ciphertext blocks in the ciphertext block set to obtain a target ciphertext block set, and determine the optimization target based on the target ciphertext block set;

[0011] The data transmission module is used to determine the target transmission path according to the optimization objective, and the target ciphertext set is transmitted through the target transmission path.

[0012] Optionally, the data preprocessing module is further configured to: sequentially fill missing data, remove abnormal data, and deduplicate duplicate data in the original data to obtain key data.

[0013] Optionally, the first encryption module includes:

[0014] The parameter determination module is used to determine basic operating parameters and generate a key population based on the basic operating parameters. The basic operating parameters include: population size, maximum number of iterations, exploration factor, utilization factor, and key search range. The key population contains multiple individuals, and each individual contains an ECC public key candidate value and an AES secret key candidate value.

[0015] The probability ratio calculation module is used to calculate the probability ratio using the probability ratio formula. If the probability ratio is not less than the probability ratio threshold, an update operation is performed on the key population using a first preset algorithm.

[0016] The key update module is used to perform an update operation on the key population using a second preset algorithm if the probability ratio is less than the probability ratio threshold.

[0017] The key output module is used to calculate the fitness of each individual in the key population until a preset condition is met, and to select the individual with the highest fitness value as the optimal individual, and to determine the first key and the second key based on the optimal individual.

[0018] Optionally, the probability ratio calculation module is further configured to randomly select α individuals and β individuals from the key population, and update the target individual using a first update formula; the target individual is any one of the key population.

[0019] First updated formula: X i,j+1 =X i,j +A×(X α,j -X β ,j)+rand×(X best,j -X i,j );

[0020] Among them, X i,j+1 Let X be the key value of the i-th individual in the (j+1)-th iteration. i,j Let X be the key value of the i-th individual in the j-th iteration, A be the exploration factor, and X be the key value of the i-th individual in the j-th iteration. α,j Let X be the key value of individual α in the j-th iteration. β ,j is the key value of individual β in the j-th iteration, rand is a random number taking values ​​in [0,1], X best,j This is the key value with the highest fitness in the j-th iteration.

[0021] Optionally, the key update module is further configured to randomly select a local population from the key population, update the local population using a preset algorithm to obtain a target local population, determine the local optimal individual based on the target local population, and update the target individual using a second update formula; the target individual is any one of the key populations.

[0022] Second updated formula: X i,j+1 =X P-best,j +B×rand×(X best,j -X i,j );

[0023] Among them, X i,j+1 Let X be the key value of the i-th individual in the (j+1)-th iteration. i,j Let X be the key value of the i-th individual in the j-th iteration. P-best,j Let B be the key value with the highest fitness among the local individuals in the j-th iteration, B be the utilization factor, and rand be a random number taking values ​​in [0,1].

[0024] Optionally, the first encryption module includes:

[0025] The key data processing module is used to obtain elliptic curve parameters, randomly generate a private key, and perform hash processing on the key data to obtain a hash value.

[0026] The ciphertext encryption module is used to map the plaintext points according to the elliptic curve parameters and the hash value, and encrypt the plaintext points with the first key to obtain the first ciphertext.

[0027] Optionally, the second encryption module includes:

[0028] The key expansion module is used to expand the key based on the second key to obtain a key group, and to group the first ciphertext into multiple plaintext blocks; the key group contains multiple round keys.

[0029] The key encryption module is used to perform an XOR operation between the target plaintext block and the round key to obtain a first encrypted ciphertext, and to perform an encryption operation on the first encrypted ciphertext to obtain a second encrypted ciphertext; the target plaintext block is any one of a plurality of plaintext blocks; the encryption operation includes: byte substitution, row shifting, column mixing, and round key addition;

[0030] The final encryption module is used to sequentially perform byte substitution, row shifting and round key addition on the second encrypted ciphertext to obtain the third encrypted ciphertext, and concatenate the third encrypted ciphertext corresponding to each plaintext block to obtain the second ciphertext.

[0031] Optionally, the second encryption module further includes:

[0032] The ciphertext segmentation module is used to segment the second ciphertext into a data block set according to a preset length, and add tags to each data block in the data block set to obtain a ciphertext block set;

[0033] The target determination module includes:

[0034] The duplicate detection module is used to determine a ciphertext block as a duplicate ciphertext block if there are ciphertext blocks with the same label in the ciphertext block set, and to remove all duplicate ciphertext blocks in the ciphertext block set to obtain a deduplicated ciphertext block set.

[0035] The similarity calculation module is used to convert each ciphertext block in the deduplicated ciphertext block set into a numerical vector set according to a preset rule, and to calculate the similarity of each numerical vector in the numerical vector set to obtain multiple similarities; there is a one-to-one correspondence between the ciphertext block and the numerical vector.

[0036] The second duplicate detection module is used to determine the ciphertext block as a duplicate ciphertext block if the similarity is greater than the similarity threshold, generate a reference address for each duplicate ciphertext block, and combine the ciphertext block with the reference address to obtain the target ciphertext block set if the similarity is not greater than the similarity threshold.

[0037] Optionally, the data transmission module includes:

[0038] The broadcast module is used to acquire a set of transmission nodes and broadcast path request packets to each transmission node in the set of transmission nodes, so that the transmission nodes can determine whether the relay conditions are met based on the path request packets.

[0039] The path determination module is used to send the path request packet to the next transmission node if the relay condition is met, until the terminal receives the path request packet, records the transmission path, calculates the path probability based on the transmission path, and combines each transmission path and each path probability to obtain the path optimization set.

[0040] Optionally, the system further includes:

[0041] The first operation module is used to set a path probability table, use the path optimization set as an initial solution set, and randomly select the current solution from the initial solution set;

[0042] The second operation module is used to explore adjacent solutions. If an adjacent solution is greater than the current solution, the adjacent solution is added to the path probability table.

[0043] The third operation module is used to repeatedly execute the second operation module until the initial solution set has been traversed, and the solution with the highest probability in the path probability table is taken as the target transmission path.

[0044] The beneficial effects of this invention are:

[0045] This invention proposes a security protection system for critical data transmission and storage in thermal power plants. It enhances the security and confidentiality of thermal power plant data through dual encryption, optimizes data quality through preprocessing, improves processing flexibility and adaptability, segments and filters ciphertext blocks and optimizes transmission paths to reduce transmission load, enhance reliability and stability, and improve data transmission efficiency. Attached Figure Description

[0046] Figure 1 This is a framework diagram of a critical data transmission and storage security protection system for thermal power plants, provided as an embodiment of the present invention. Detailed Implementation

[0047] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0048] This invention provides a security protection system for critical data transmission and storage in thermal power plants. See also... Figure 1 , Figure 1 This invention provides a framework diagram of a critical data transmission and storage security protection system for thermal power plants, as illustrated in an embodiment of the present invention. It includes:

[0049] The data preprocessing module is used to acquire raw data from thermal power plants and preprocess the raw data to obtain key data.

[0050] The first encryption module is used to obtain the first key and the second key, and to perform asymmetric encryption on the key data according to the first key to obtain the first ciphertext.

[0051] The second encryption module is used to symmetrically encrypt the first ciphertext according to the second key to obtain the second ciphertext, and to divide the second ciphertext into a ciphertext block set;

[0052] The target determination module is used to filter the ciphertext blocks in the ciphertext block set to obtain the target ciphertext block set, and to determine the optimization target based on the target ciphertext block set.

[0053] The data transmission module is used to determine the target transmission path based on the optimization objective, and the target encrypted text set is transmitted through the target transmission path.

[0054] The present invention provides a security protection system for critical data transmission and storage in thermal power plants. This system enhances the security and confidentiality of thermal power plant data through dual encryption, optimizes data quality through preprocessing, improves processing flexibility and adaptability, segments and filters ciphertext blocks and optimizes transmission paths, reduces transmission load, enhances reliability and stability, and improves data transmission efficiency.

[0055] In one implementation, a dual encryption mechanism is formed by using a first key to perform asymmetric encryption on key data, and then using a second key to perform symmetric encryption on the first ciphertext. Asymmetric encryption utilizes the public-key encryption and private-key decryption property to ensure that only the recipient holding the private key can decrypt the data, greatly enhancing the confidentiality of data during transmission. Symmetric encryption further improves encryption efficiency and ensures the integrity of the data during the encryption process. This dual encryption method effectively prevents data from being stolen or tampered with during transmission, improving the security and confidentiality of data in thermal power plants.

[0056] In one implementation, the ciphertext is segmented to obtain a set of ciphertext blocks, and a target set of ciphertext blocks is obtained by filtering. This can effectively remove redundant information and unnecessary data blocks, reduce the data transmission load, and improve the data transmission efficiency. Based on the target set of ciphertext blocks, an optimization target is determined, and a target transmission path is selected accordingly. This ensures that the data is transmitted on the optimal path, further reducing transmission delay and energy consumption, and improving the data transmission efficiency of thermal power plants.

[0057] In one implementation, a target ciphertext block set is obtained by filtering the ciphertext block set, and an optimized target and target transmission path are determined based on the target ciphertext block set. This process effectively avoids data loss and errors during transmission. The selection of the target transmission path, based on the optimized target, ensures that interference and errors encountered by the data during transmission are minimized.

[0058] In one embodiment, the data preprocessing module is further configured to: sequentially fill in missing data, remove abnormal data, and deduplicate data from the original data to obtain key data.

[0059] In one implementation, by sequentially performing missing data imputation, outlier removal, and deduplication on the original data, the quality and usability of the data can be significantly improved. Missing data imputation ensures data integrity, preventing subsequent data analysis and processing from being biased or impossible due to missing data, providing a solid foundation for further data utilization. Outlier removal eliminates erroneous data that may interfere with the analysis results, ensuring the accuracy and reliability of the data and avoiding erroneous conclusions or decisions due to outliers. Deduplication further optimizes the dataset, reduces redundant information, and improves data purity and processing efficiency.

[0060] In one embodiment, the first encryption module includes:

[0061] The parameter determination module is used to determine the basic operating parameters and generate a key population based on the basic operating parameters. The basic operating parameters include: population size, maximum number of iterations, exploration factor, utilization factor, and key search range. The key population contains multiple individuals, and each individual contains an ECC public key candidate value and an AES secret key candidate value.

[0062] The probability ratio calculation module is used to calculate the probability ratio using the probability ratio formula. If the probability ratio is not less than the probability ratio threshold, the key population is updated using the first preset algorithm.

[0063] The key update module is used to perform an update operation on the key population using a second preset algorithm if the probability ratio is less than the probability ratio threshold.

[0064] The key output module is used to calculate the fitness of each individual in the key population until the preset conditions are met, and to select the individual with the highest fitness value as the optimal individual, and to determine the first key and the second key based on the optimal individual.

[0065] In one implementation, the population size is the number of initial key candidate solutions (individuals), for example, 10 individuals, which needs to balance computational overhead and search range; the maximum number of iterations is the maximum number of loops the algorithm can terminate, for example, 25. The more iterations, the more likely it is to find the optimal solution, but the computation time increases; the exploration factor controls the strength of the first preset algorithm, set to 0.5; the utilization factor controls the strength of the second preset algorithm, set to 0.7; the key search range is limited to the value range of both the ECC public key (first key) and the AES key (second key) to [1,30], which is used to balance the security of the encryption algorithm and the computational efficiency. Exceeding the range will lead to a weak key or a surge in computational overhead.

[0066] In one implementation, within a preset key search range [1,30], N initial key candidate solutions (i.e., population individuals) are randomly generated. Each individual contains two parameters: an ECC public key candidate value and an AES secret key candidate value.

[0067] In one implementation, the fitness calculation formula is: S = SP / ET, where S is the fitness, SP is the plaintext data size, and ET is the encryption time. The fitness is also the throughput of the encryption system. The system throughput (unit: data volume / time, such as MB / s) is higher when the value is larger.

[0068] In one implementation, traditional algorithms are prone to imbalance during the search phase during optimization. Therefore, the probability ratio is calculated using the probability ratio formula: GL=2×rand×(1-T / T) max ), where GL is the probability ratio, rand is a random number in the interval [0,1] (to increase the randomness of the search), and T is the current iteration number (starting from 1 and increasing with each iteration). max This represents the maximum number of iterations; in the early stages of iteration, T / T max Approaching 0, (1-T / T) max Since GL is close to 1, GL ≈ 2 × rand × 1. Since rand ∈ [0, 1], the range of Es is [0, 2], which expands the key search range and avoids getting trapped in local optima.

[0069] In one implementation, during the later stages of the iteration, T / T max Approximately 1, (1-T / T) max As the number of iterations increases, the search tends to be more refined near the already found optimal solution, thus improving the convergence accuracy.

[0070] In one embodiment, the probability ratio calculation module is further configured to randomly select α individuals and β individuals from the key population, and update the target individual using a first update formula; the target individual is any one of the key population.

[0071] First updated formula: X i,j+1 =X i,j +A×(X α,j -X β ,j)+rand×(X best,j -X i,j );

[0072] Among them, X i,j+1 Let X be the key value of the i-th individual in the (j+1)-th iteration. i,j Let X be the key value of the i-th individual in the j-th iteration, A be the exploration factor, and X be the key value of the i-th individual in the j-th iteration. α,j Let X be the key value of individual α in the j-th iteration. β ,j is the key value of individual β in the j-th iteration, rand is a random number taking values ​​in [0,1], X best,jThis is the key value with the highest fitness in the j-th iteration.

[0073] In one implementation, random selection of individuals α and β, combined with a first update formula, is used to update the target individual, introducing randomness and differences among individuals within the population; A×(X) in the formula... α,j -X β,j In the ) part, the difference in key values ​​between two random individuals is used to introduce exploratory changes to the key update, allowing individuals to escape the limitations of local optima and explore a wider solution space; rand×(X best,j -X i,j The first part retains information about the current optimal solution, guiding individuals to evolve in a better direction, but it does not rely entirely on the current optimal solution, thus avoiding premature convergence of the algorithm. It can effectively improve the diversity of the key population, enhance the algorithm's global search capability in complex environments, help find safer and more reliable keys, and improve the security of the encryption system.

[0074] In one implementation, in the update formula, X best,j The key value representing the highest fitness in the j-th iteration is introduced into the update process of the target individual, allowing each individual to refer to the information of the current optimal solution during the update. The optimal solution-guided update mechanism enables the key population to evolve towards a better direction more quickly, accelerating the convergence process. In each iteration, the individual adjusts its own key value, reducing the blindness in the search process. Since the update formula also includes random factors and differences between individuals, it avoids the algorithm getting stuck in local optima and unable to optimize further. This ensures that while accelerating convergence, the quality of the solution is not sacrificed. This update operation can significantly improve the convergence speed of the key population and improve the efficiency of encryption key generation while ensuring key quality.

[0075] In one embodiment, the key update module is further configured to randomly select a local population from the key population, update the local population using a preset algorithm to obtain a target local population, determine the local optimal individual based on the target local population, and update the target individual using a second update formula; the target individual is any one of the key populations.

[0076] Second updated formula: X i,j+1 =X P-best,j +B×rand×(X best,j -X i,j );

[0077] Among them, X i,j+1 Let X be the key value of the i-th individual in the (j+1)-th iteration. i,j Let X be the key value of the i-th individual in the j-th iteration. P-best,jLet B be the key value with the highest fitness among the local individuals in the j-th iteration, B be the utilization factor, and rand be a random number taking values ​​in [0,1].

[0078] In one implementation, a local population is obtained through random selection, and a genetic algorithm is used to update the local population, enabling in-depth mining of high-quality solutions within the local region. The crossover and mutation operations in the genetic algorithm generate new genetic combinations within the local population, allowing individuals to fully explore the local region and increasing the probability of finding a better solution. The X in the update formula... P-best,j As a locally optimal key value, it provides a clear local guiding direction for individual updates; combined with B×rand×(X best,j -X i,j The first part retains the guidance of the global optimal solution, and through the pull of the local optimal solution, it enables the target individual to adjust the key value more accurately in the local area when updating, thereby improving the search accuracy of the key population in the local area. This helps to find higher quality keys that are more suitable for the current local needs in complex encryption environments, and improves the security and reliability of the encryption system.

[0079] In one implementation, in each iteration, a local population is randomly selected and updated, and the locally optimal individual is determined based on the target local population. This dynamic local population update mechanism enables the key population to respond promptly to changes in the environment and new search requirements. During the local population update process, the genetic algorithm (pre-defined algorithm) simulates the process of natural selection, enabling it to quickly adapt to changes in the internal structure and environment of the population and generate individuals adapted to the new environment. The random factor rand in the update formula enhances the randomness and dynamism of individual updates, allowing each individual to adjust based on new local and global information in each iteration. This allows the key population to continuously optimize its structure during iteration, better adapt to the ever-changing challenges in the encryption process, improve the flexibility and robustness of the key generation process, and ensure that the encryption system maintains efficient and secure operation when facing different encryption requirements.

[0080] In one embodiment, the first encryption module includes:

[0081] The key data processing module is used to obtain elliptic curve parameters, randomly generate private keys, and perform hash processing on key data to obtain hash values.

[0082] The ciphertext encryption module is used to map plaintext points to elliptic curve parameters and hash values, and then encrypt the plaintext points with the first key to obtain the first ciphertext.

[0083] In one implementation, elliptic curve parameters are obtained, which are elliptic curve parameters conforming to encryption standards, such as standard curves like secp256r1; the parameters include: finite field, curve equation, and base point; a private key is randomly generated, and a random integer d is selected as the private key, satisfying 1 < d < n - 1 (n is the order of the base point G); the optimized public key value (the first key) is mapped to a point on the curve, and the public key Q = d×G (that is, the d - multiple point of the base point G, realized by repeatedly performing elliptic curve point addition), where the first key corresponds to the encoded value of the public key Q.

[0084] In one implementation, the key data is hashed (such as SHA - 256) to obtain a hash value h of a fixed length, and a point P M =(x, y) that satisfies the condition is found on the elliptic curve by the trial method, such that there is a mapping relationship between x and h (such as x = h mod p), and then it is verified whether it satisfies the curve equation; if found, P M is determined, otherwise h is fine - tuned (such as adding 1) and retried until a valid point is found.

[0085] In one implementation, the plaintext point P is encrypted using the optimized ECC public key Q M to generate an ECC ciphertext (consisting of two points): a random integer k is randomly selected (1 < k < n - 1, randomly generated each time for encryption); calculate the point C1 = k×G (the k - multiple point of the base point G); calculate the point C2 = P M + k×Q (the sum of the plaintext point P M and the k - multiple point of the public key Q); the ECC ciphertext (the first ciphertext) is C ecc =(C1, C2).

[0086] In one embodiment, the second encryption module includes:

[0087] A key expansion module, which is used to expand according to the second key to obtain a key group, and group the first ciphertext to obtain multiple plaintext blocks; the key group contains multiple round keys;

[0088] A key encryption module, which is used to perform an exclusive - or operation on the target plaintext block and the round key to obtain a first encrypted ciphertext, and perform an encryption operation on the first encrypted ciphertext to obtain a second encrypted ciphertext; the target plaintext block is any one of the multiple plaintext blocks; the encryption operation includes: byte substitution, row shift, column mixing, and round key addition;

[0089] A final encryption module, which is used to perform byte substitution, row shift, and round key addition on the second encrypted ciphertext in sequence to obtain a third encrypted ciphertext, and splice the third encrypted ciphertexts corresponding to each plaintext block to obtain the second ciphertext.

[0090] In one implementation, the key group is obtained by expanding the second key, for example: splitting the original key: splitting the 128-bit optimized AES key (16 bytes) into four 32-bit "words" (w0-w3) as the initial round key (round 0); expanding to generate the remaining words: generating words from the 5th word (w4) to the 44th word (w... 43 If the word index is a multiple of 4 (e.g., i = 4, 8...): first perform a circular left shift (RotWord), byte substitution (SubWord) on the previous word, then XOR it with the round constant (Rcon), and finally XOR it with the word 4 positions before it to obtain the current word; other indices: directly XOR the word 4 positions before the current word with the previous word to obtain the current word; round key group: every 4 consecutive words form a round key group, a total of 11 groups (key groups), corresponding to the 11 rounds of AES operation (rounds 0 to 10).

[0091] In one implementation, the first ciphertext is divided into multiple plaintext blocks: the first ciphertext is divided into 128-bit (16-byte) blocks, if C ecc If the length is not a multiple of 16 bytes, padding is performed using PKCS#7 (e.g., if k bytes are missing, k bytes with a value of k are used to fill the gap), resulting in multiple plaintext blocks; for each plaintext block B... i Perform an XOR operation with the first round key (w0-w3): State: A 16-byte state matrix (a 4×4-byte matrix, storing block data column-wise); Key0: The initial round key (the first set of extended keys).

[0092] In one implementation, an encryption operation is performed on the first encrypted ciphertext to obtain the second encrypted ciphertext: each round contains 4 operations (executed in sequence): byte substitution: each byte in State is replaced using an S-box (8×8 byte substitution table) (non-linear transformation, enhancing security); row shift: row 0 remains unchanged, row 1 is shifted left by 1 byte, row 2 is shifted left by 2 bytes, and row 3 is shifted left by 3 bytes (diffusing data); column mixing: each column of State is treated as a 4th-order polynomial and multiplied by a fixed polynomial over a finite field (further diffusion); round key addition: State is XORed with the current round keys Key1 to Key9 (introducing key information).

[0093] In one embodiment, the second encryption module further includes:

[0094] The ciphertext segmentation module is used to segment the second ciphertext into a data block set according to a preset length, and add tags to each data block in the data block set to obtain a ciphertext block set.

[0095] The target determination module includes:

[0096] The duplicate detection module is used to determine that if there are ciphertext blocks with the same label in the ciphertext block set, the ciphertext block is a duplicate ciphertext block, and all duplicate ciphertext blocks in the ciphertext block set are removed to obtain a deduplicated ciphertext block set.

[0097] The similarity calculation module is used to transform each ciphertext block in the deduplicated ciphertext block set into a numerical vector set according to preset rules, and to calculate the similarity of each numerical vector in the numerical vector set to obtain multiple similarities; there is a one-to-one correspondence between the ciphertext block and the numerical vector.

[0098] The second duplicate detection module is used to determine the ciphertext block as a duplicate ciphertext block if the similarity is greater than the similarity threshold, generate a reference address for each duplicate ciphertext block, and combine the ciphertext block with the reference address to obtain the target ciphertext block set if the similarity is not greater than the similarity threshold.

[0099] In one implementation, the second ciphertext is divided into a set of data blocks according to a preset length. The second ciphertext is divided into multiple independent ciphertext blocks according to a preset length, such as 128 bytes or 256 bytes. The block division rules, such as fixed-length block division or sliding window block division, ensure that the dimensions of each ciphertext block are the same.

[0100] In one implementation, labels are added to each data block in the data block set to obtain a set of ciphertext blocks. A label is generated for each new ciphertext block, such as a hash value based on SHA-256 or a feature digest of the ciphertext block. The ciphertext blocks are quickly filtered by label. If the label of a new ciphertext block is exactly the same as the label of an existing ciphertext block, it is judged as a duplicate (skipping the subsequent Euclidean distance calculation to improve efficiency). If the labels are different, a fine comparison of Euclidean distance is performed to avoid misjudgment caused by label collision.

[0101] In one implementation, the ciphertext block is a binary data stream, which cannot be directly used for similarity calculation using Euclidean distance. Instead, the binary data of each ciphertext block is converted into a numerical vector according to fixed rules. For example, the ciphertext block is split into bytes (1 byte = 8 bits), and each byte corresponds to a decimal value (e.g., byte 0x1A corresponds to decimal 26). If the size of the ciphertext block is 128 bytes, then a numerical vector with a dimension of 128 is generated.

[0102] In one implementation, if the similarity is greater than a similarity threshold, the ciphertext block is determined to be a duplicate ciphertext block, and a reference address is generated for each duplicate ciphertext block. If the similarity is not greater than the similarity threshold, the ciphertext block and the reference address are combined to obtain the target ciphertext block set. If the ciphertext blocks are similar to each other, they are determined to be duplicates. The duplicate ciphertext blocks are not stored, and only the reference address of the duplicate ciphertext block is retained to avoid occupying storage space, thereby reducing the actual storage amount and reducing space occupation and transmission bandwidth. For example, if ciphertext block A is similar to ciphertext block B, then ciphertext block A is removed, and the address of ciphertext block B is used as the reference address of ciphertext block A.

[0103] In one embodiment, the data transmission module includes:

[0104] The broadcast module is used to obtain the transmission node set and broadcast path request packets to each transmission node in the transmission node set, so that the transmission nodes can determine whether the relay conditions are met based on the path request packets.

[0105] The path determination module is used to send the path request packet to the next transmission node if the relay condition is met, until the terminal receives the path request packet and records the transmission path. The path probability is calculated based on the transmission path, and the path optimization set is obtained by combining each transmission path and each path probability.

[0106] In one implementation, a path request packet is broadcast, and the transmission node determines and forwards the request based on relay conditions (whether the transmission path is congested). This method can dynamically explore multiple feasible transmission paths, which not only increases the diversity of path selection but also improves the reliability of data transmission. In complex network environments, some paths may become unavailable due to node failures, signal interference, or other problems. The system can select the optimal or available path from multiple paths for data transmission, thereby effectively avoiding the risks associated with single-path dependence. It allows cross-cluster forwarding of request packets and prioritizes nodes closer to the terminal, further enhancing the flexibility of path selection. This enables data to reach its destination more efficiently, reducing transmission latency and energy consumption.

[0107] In one implementation, the path probability is calculated based on the transmission path, and the path optimization set is obtained by combining each transmission path and each path probability: for adjacent nodes in the path, the path length (Pl) and delay (De) of any node are processed to be dimensionless, and the local probability is obtained by 1 / (Pl+De). The path probability is obtained by accumulating the local probabilities of all nodes in a single path.

[0108] In one implementation, each complete path from the transmission node to the terminal is recorded, and these paths are combined to form a path optimization set, providing a rich data foundation for subsequent path optimization. Based on the above path information, the performance of each path, such as energy consumption, latency, and bandwidth, can be further analyzed and evaluated, thereby selecting the optimal path for data transmission. This can meet the needs of different data transmission scenarios and improve transmission efficiency. For example, in high-energy-consumption scenarios, the path with the lowest energy consumption can be selected; in scenarios with high real-time requirements, the path with the lowest latency can be selected. This enables dynamic adjustment and optimization of paths, selecting the best path in real time according to changes in network status, further improving the performance and efficiency of data transmission.

[0109] In one embodiment, the system further includes:

[0110] The first operation module is used to set the path probability table, use the path optimization set as the initial solution set, and randomly select the current solution from the initial solution set;

[0111] The second operation module is used to explore adjacent solutions. If an adjacent solution is greater than the current solution, the adjacent solution is added to the path probability table.

[0112] The third operation module is used to repeatedly execute the second operation module until the initial solution set has been traversed, and the solution with the highest probability in the path probability table is taken as the target transmission path.

[0113] In one implementation, a path probability table is set up, and the optimized path set is used as the initial solution set for random selection and neighboring solution exploration, gradually filtering out better paths from multiple candidate paths. In the initial stage, randomly selecting the current solution avoids the algorithm getting trapped in local optima, increasing the randomness and diversity of path selection. By exploring neighboring solutions and adding them to the path probability table, the algorithm can progressively evaluate and record the performance of different paths, thereby finding the optimal path globally. This effectively avoids the under-optimization problem caused by premature path determination in traditional methods, ensuring that the finally selected path is the optimal solution after sufficient comparison and evaluation globally, thus improving the global optimization capability of path selection and enhancing the efficiency and reliability of data transmission.

[0114] In one implementation, during path selection, the algorithm dynamically adapts to changes in the network environment by continuously exploring neighboring solutions and updating the path probability table. Node states and link quality in the network may change over time, and traditional static path selection methods may fail to adapt to these changes in a timely manner, leading to performance degradation. The aforementioned method, through continuous exploration and updating, can reflect the current state and performance of the path in real time, thereby dynamically adjusting the path selection. By using the solution with the highest probability in the path probability table as the target transmission path, the algorithm can flexibly select the most suitable path based on different network conditions and transmission requirements, enabling path selection to better cope with complex network environments and improve the stability and efficiency of data transmission.

[0115] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A security protection system for critical data transmission and storage in thermal power plants, characterized in that, The system includes: The data preprocessing module is used to acquire raw data from the thermal power plant and preprocess the raw data to obtain key data. The first encryption module is used to obtain a first key and a second key, and to perform asymmetric encryption on the key data according to the first key to obtain the first ciphertext. The second encryption module is used to perform symmetric encryption on the first ciphertext according to the second key to obtain the second ciphertext, and to divide the second ciphertext into a ciphertext block set; The target determination module is used to filter the ciphertext blocks in the ciphertext block set to obtain a target ciphertext block set, and determine the optimization target based on the target ciphertext block set; The data transmission module is used to determine the target transmission path according to the optimization objective, and the target ciphertext set is transmitted through the target transmission path.

2. The critical data transmission and storage security protection system for thermal power plants according to claim 1, characterized in that, The data preprocessing module is also used to: sequentially fill missing data, remove abnormal data, and deduplicate duplicate data to obtain key data from the original data.

3. The critical data transmission and storage security protection system for thermal power plants according to claim 1, characterized in that, The first encryption module includes: The parameter determination module is used to determine basic operating parameters and generate a key population based on the basic operating parameters. The basic operating parameters include: population size, maximum number of iterations, exploration factor, utilization factor, and key search range. The key population contains multiple individuals, and each individual contains an ECC public key candidate value and an AES secret key candidate value. The probability ratio calculation module is used to calculate the probability ratio using the probability ratio formula. If the probability ratio is not less than the probability ratio threshold, an update operation is performed on the key population using a first preset algorithm. The key update module is used to perform an update operation on the key population using a second preset algorithm if the probability ratio is less than the probability ratio threshold. The key output module is used to calculate the fitness of each individual in the key population until a preset condition is met, and to select the individual with the highest fitness value as the optimal individual, and to determine the first key and the second key based on the optimal individual.

4. A security protection system for critical data transmission and storage in a thermal power plant according to claim 3, characterized in that, The probability ratio calculation module is further configured to randomly select α individuals and β individuals from the key population, and update the target individual using a first update formula; the target individual is any one of the key populations. First updated formula: X i,j+1 =X i,j +A×(X α,j -X β ,j)+rand×(X best,j -X i,j ); Among them, X i,j+1 Let X be the key value of the i-th individual in the (j+1)-th iteration. i,j Let X be the key value of the i-th individual in the j-th iteration, A be the exploration factor, and X be the key value of the i-th individual in the j-th iteration. α,j Let X be the key value of individual α in the j-th iteration. β ,j is the key value of individual β in the j-th iteration, rand is a random number taking values ​​in [0,1], X best,j This is the key value with the highest fitness in the j-th iteration.

5. A security protection system for critical data transmission and storage in a thermal power plant according to claim 3, characterized in that, The key update module is further configured to randomly select a local population from the key population, update the local population using a preset algorithm to obtain a target local population, determine the local optimal individual based on the target local population, and update the target individual using a second update formula; the target individual is any one of the key populations. Second updated formula: X i,j+1 =X P-best,j +B×rand×(X best,j -X i,j ); Among them, X i,j+1 Let X be the key value of the i-th individual in the (j+1)-th iteration. i,j Let X be the key value of the i-th individual in the j-th iteration. P-best,j Let B be the key value with the highest fitness among the local individuals in the j-th iteration, B be the utilization factor, and rand be a random number taking values ​​in [0,1].

6. A security protection system for critical data transmission and storage in a thermal power plant according to claim 1, characterized in that, The first encryption module includes: The key data processing module is used to obtain elliptic curve parameters, randomly generate a private key, and perform hash processing on the key data to obtain a hash value. The ciphertext encryption module is used to map the plaintext points according to the elliptic curve parameters and the hash value, and encrypt the plaintext points with the first key to obtain the first ciphertext.

7. A security protection system for critical data transmission and storage in a thermal power plant according to claim 1, characterized in that, The second encryption module includes: The key expansion module is used to expand the key based on the second key to obtain a key group, and to group the first ciphertext into multiple plaintext blocks; the key group contains multiple round keys. The key encryption module is used to perform an XOR operation between the target plaintext block and the round key to obtain a first encrypted ciphertext, and to perform an encryption operation on the first encrypted ciphertext to obtain a second encrypted ciphertext; the target plaintext block is any one of a plurality of plaintext blocks; the encryption operation includes: byte substitution, row shifting, column mixing, and round key addition; The final encryption module is used to sequentially perform byte substitution, row shifting and round key addition on the second encrypted ciphertext to obtain the third encrypted ciphertext, and concatenate the third encrypted ciphertext corresponding to each plaintext block to obtain the second ciphertext.

8. A security protection system for critical data transmission and storage in a thermal power plant according to claim 1, characterized in that, The second encryption module also includes: The ciphertext segmentation module is used to segment the second ciphertext into a data block set according to a preset length, and add tags to each data block in the data block set to obtain a ciphertext block set; The target determination module includes: The duplicate detection module is used to determine a ciphertext block as a duplicate ciphertext block if there are ciphertext blocks with the same label in the ciphertext block set, and to remove all duplicate ciphertext blocks in the ciphertext block set to obtain a deduplicated ciphertext block set. The similarity calculation module is used to convert each ciphertext block in the deduplicated ciphertext block set into a numerical vector set according to a preset rule, and to calculate the similarity of each numerical vector in the numerical vector set to obtain multiple similarities; there is a one-to-one correspondence between the ciphertext block and the numerical vector. The second duplicate detection module is used to determine the ciphertext block as a duplicate ciphertext block if the similarity is greater than the similarity threshold, generate a reference address for each duplicate ciphertext block, and combine the ciphertext block with the reference address to obtain the target ciphertext block set if the similarity is not greater than the similarity threshold.

9. A security protection system for critical data transmission and storage in a thermal power plant according to claim 1, characterized in that, The data transmission module includes: The broadcast module is used to acquire a set of transmission nodes and broadcast path request packets to each transmission node in the set of transmission nodes, so that the transmission nodes can determine whether the relay conditions are met based on the path request packets. The path determination module is used to send the path request packet to the next transmission node if the relay condition is met, until the terminal receives the path request packet, records the transmission path, calculates the path probability based on the transmission path, and combines each transmission path and each path probability to obtain the path optimization set.

10. A security protection system for critical data transmission and storage in a thermal power plant according to claim 9, characterized in that, The system also includes: The first operation module is used to set a path probability table, use the path optimization set as an initial solution set, and randomly select the current solution from the initial solution set; The second operation module is used to explore adjacent solutions. If an adjacent solution is greater than the current solution, the adjacent solution is added to the path probability table. The third operation module is used to repeatedly execute the second operation module until the initial solution set has been traversed, and the solution with the highest probability in the path probability table is taken as the target transmission path.

Images