Power grid network data security management system

Abstract

The invention discloses a power grid network data security management system, and relates to the field of power grid network data security management. The system comprises an acquisition module, a data processing and encryption module, a data storage and decryption module and a background management module, and synchronously records a data source node identifier and a timestamp by acquiring real-time data voltage, current, power and the like of a power grid; the data processing module dynamically determines an encryption rule based on a difference value between original data and a lower limit of a physical constraint interval, generates a core key by combining a timestamp and a node rated parameter, and performs grouping XOR encryption on the data; and meanwhile, embedding a time sequence trend mark, generating final encrypted data after secondary encryption of a key, and transmitting and storing the final encrypted data with a structure of combining the final encrypted data with a node identifier and time. During access, the data is restored through two-factor authentication, permission verification and a reverse decryption process, and the data integrity is ensured by combining physical constraint and time sequence trend verification.

Description

TECHNICAL FIELD

[0001] The application discloses a power grid network data security management system and relates to the field of power grid network data security management. BACKGROUND

[0002] With the rapid development of smart grid, the scale and importance of power grid data are increasing day by day. These data not only contain key power grid information such as substation operation parameters and transmission line state, but also involve massive user power consumption behavior and identity information and other private content.

[0003] However, the current power grid data security management faces multiple challenges. On the one hand, traditional data encryption methods mostly adopt fixed rules, and the encryption logic is single, lacking association with data characteristics such as physical constraints and time sequence changes. The data encryption, storage access and integrity checking links are disconnected, and it is difficult to deal with risks such as data tampering and illegal access. On the other hand, the real-time nature and physical constraints such as voltage range and power threshold of power grid data are not fully considered, and the encryption process may affect the timeliness and usability of data. Therefore, there is an urgent need for a method that combines inherent characteristics of power grid data, dynamic encryption rules and full-process security management to improve the security and reliability of power grid data. SUMMARY

[0004] The present application aims to at least solve one of the technical problems existing in the prior art; To this end, the present application proposes a power grid network data security management system, which specifically comprises the following modules: The acquisition module, the data processing and encryption module, the data storage and decryption module and the background management module; The acquisition module acquires real-time power grid data through a special interface, and the source node identifier, timestamp and rated parameter corresponding to the real-time data, denoted as original data. Here, the source node identifier represents the corresponding device ID; The data processing and encryption module first filters the original data, and identifies the following three types of data through the source node identifier: Public or non-private data includes regional total voltage and public line current. This type of data is not associated with specific users or devices, and leakage does not affect security, so it does not need to be encrypted. For data associated with devices but not involving privacy, such as real-time power of a specific transformer and total power consumption of a transformer area, although leakage does not affect security, it needs to be encrypted to prevent tampering, which is first-level encrypted data. Sensitive data associated with individual users or key devices, including user time-of-use power consumption records, user charging data of charging piles and real-time current and voltage of key hub substations, involves user or core device privacy and needs to be encrypted and stored, which is second-level encrypted data. The data processing module will filter out the first and second encrypted data according to the source node identification corresponding to the original data; Further, the data to be encrypted Yi is matched with the rated parameter Vi, and its physical constraint interval [Ui_min, Ui_max] is generated according to the device type and power grid specification, and the corresponding timestamp Ti. The physical constraint interval here is a reasonable range of the rated parameter floating; Further, Yi, Vi, and Ti are converted to 64-bit binary, and the high bits of less than 64 bits are filled with 0; Further, the 64-bit binary of Yi is split into groups of 8 bytes to obtain the group Group_m, m=1,2,...,last, last is the total number of groups, which is generally 8 groups; If the total length of the binary of Yi is not an integer multiple of 8 bytes, calculate the number of missing bytes n, and the fill value is: n+1 values of n, the first n value is only used as a length fill identifier and does not participate in encryption calculation. When decrypted, the fill byte can be identified and deleted through this identifier; At the same time, a group start bit is embedded in front of each group of data, indicating that the group is the start group, which also does not participate in encryption calculation, but only serves as a grouping basis; Further, calculate the difference D=Yi-Ui_min between Yi and the lower limit of the physical constraint interval, which is in decimal, and convert it to 64-bit binary after calculation; Generate the core key K_core: XOR the 64-bit binary of the timestamp Ti with the 64-bit binary of Vi to obtain the 64-bit binary key K_core; Further, determine the parity according to the binary least significant bit of D. The least significant bit is 0 for even numbers and 1 for odd numbers; If D is even, perform interval XOR: Group_1⊕Group_3=F1_1, Group_2⊕Group_4=F1_2, Group_3⊕Group_5=F1_3, Group_last-1⊕Group_1=F1_last-1, Group_last⊕Group_2=F1_last; If D is odd, perform sequential XOR: Group_1⊕Group_2=F1_1, Group_2⊕Group_3=F1_2, Group_3⊕Group_4=F1_3, Group_last⊕Group_1=F1_last; According to the above rules, Group_m is encrypted, and the final result is: 1+F1_1, 0+F1_2,... 0+F1_last; At the same time, there will be a group of fill values; Furthermore, the time-series trend marker T_trend is embedded. Before embedding T_trend, the system needs to record the original binary value of the highest bit of each group F1_m, forming an "original highest bit lookup table" in the format of "group index + original highest bit value". The lookup table is transmitted along with the encrypted data as additional information. It is used to strip T_trend and restore the original highest bit during decryption to ensure data integrity. Compare the current data Yi with the data Y from the previous time step. t-1 Compare them; if Yi is greater than Y t-1 If the data shows an upward trend, and the binary representation of T_trend is 1, then the highest bit is 1; If Yi is less than Y t-1 The data shows a downward trend, and the binary representation of the marker T_trend is 10 with the highest bit being 0; If Yi equals Y t-1 If the data shows a stable trend, and the binary representation of T_trend is 0, then the highest bit is the inverse of the last bit of that group; After each F1_m group is embedded with T_trend, the format is "the highest bit of the embedded trend marker + the remaining 7 bits of original data", and the overall length is still 8 bytes. The grouping structure is not changed, ensuring compatibility with subsequent encryption processes. Furthermore, the core key K_core is used to perform a bitwise XOR operation on F1_m embedded in T_trend to obtain the final encrypted data Fi; The data processing and encryption module packages the three types of data. Public or non-privacy data is directly transmitted to the data storage and decryption module in the format of "decimal raw data + ID + T". The first and second level encryption data will convert Fi into a hexadecimal string and package it together with the ID, timestamp Ti, and original highest bit lookup table.

[0005] The backend management system allows setting up system administrator accounts, with the system administrator having the highest privileges. The system administrator can add, delete, and modify administrator accounts at all levels. System administrators can set access permission levels, including permissions to query level 1 encrypted data and level 2 encrypted data. Administrators at each level can use data backup, recovery, retrieval and other functions under their respective permissions. To access data for a specific time period, the administrator must first log in to the system using two-factor authentication with a password and a dynamic token, enter the ID and time to be queried, and the system will retrieve the corresponding data packet through the index and perform reverse decryption. The specific steps are as follows: First, the data packet is converted into binary, and then intermediate data is obtained by reverse XORing the core key. Furthermore, the highest bit of the group is restored using the "original highest bit lookup table" and the timing marker is removed; Furthermore, padding bytes are removed based on the start of the group and the padding identifier; Furthermore, the first set of values ​​is estimated based on the physical constraint interval and the data trend of the previous moment; Furthermore, the actual parity of the difference D is determined through closed-loop verification and physical constraint verification, and the decrypted data is converted into decimal. Verification after decryption includes: First, verify that the data is in the correct decimal format; Further, check whether the data is within the physical constraint range, and classify the abnormality according to the degree of deviation: within ±5% is mild abnormality; above ±10% is severe abnormality; the rest is moderate abnormality. Furthermore, compare the data from the previous moment to verify whether the time-series trend markers are consistent; Furthermore, once all verifications are successful, normal data will be presented to the administrator. If only part of the data passes verification or fails verification, an alert will be displayed. At the same time, a detailed log of this access operation must be recorded.

[0006] Compared with the prior art, the beneficial effects of the present invention are: The encryption rules are dynamically selected based on the difference between the original data and the physical constraint interval. The core key is generated by combining the timestamp and the node's rated parameters. This allows the encryption logic to change in real time with data characteristics, time, and node attributes, avoiding the inherent defects of static encryption and significantly improving the anti-cracking capability.

[0007] The encryption process embeds physical constraints and time-series trends of power grid data. During decryption, a dual mechanism of physical constraint verification and time-series trend verification effectively identifies tampered or forged data, ensuring data integrity. Access is handled through two-factor authentication, hierarchical access control, and reverse decryption verification, strictly limiting data access scope to prevent unauthorized operations or illegal acquisition, protecting user privacy and sensitive system information.

[0008] The encryption process balances the real-time nature and physical characteristics of power grid data, avoiding delays caused by excessive encryption, and ensuring that data is securely transmitted and stored while meeting the real-time requirements of the power system. Data acquisition, encryption, storage, access, and backup / recovery functions are modularized, with each stage linked through standardized interfaces, facilitating subsequent function upgrades and adapting to the needs of power grid systems of different sizes. Attached Figure Description

[0009] Figure 1 This is a system module diagram of the method in Embodiment 1 of the present invention; Figure 2 This is a flowchart illustrating the encryption process of the method in Embodiment 1 of the present invention. Detailed Implementation

[0010] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0011] like Figure 1 As shown, the present invention provides a power grid network data security management system; As an embodiment of the present invention, it specifically includes the following modules: The system includes a data acquisition module, a data processing and encryption module, a data storage and decryption module, and a backend management module. The acquisition module collects real-time power grid data through a dedicated interface, along with the source node identifier, timestamp, and rated parameters corresponding to the real-time data, which are recorded as raw data; here, the source node identifier represents the corresponding device ID. The data processing and encryption module first filters the raw data, identifying the following three types of data based on the source node identifier: Public or non-privacy data includes the total voltage of the area and the current of public lines. Such data is not associated with specific users or devices, and its disclosure does not affect security and does not require encryption. For data related to devices but not involving privacy, such as the real-time power of a specific transformer and the total electricity consumption of the distribution area, although leakage does not affect security, it needs to be encrypted to prevent tampering. This is classified as Level 1 encrypted data. Sensitive data associated with individual users or key equipment, including user time-of-use electricity records, user charging data of charging piles, and real-time current and voltage of key hub substations, involve user or core equipment privacy and must be stored in encrypted form; this is secondary encrypted data. The data processing module will filter out the first-level and second-level encrypted data based on the source node identifier corresponding to the original data and encrypt them accordingly. The encryption logic and process are as follows: Step 1: Obtain the data Yi to be encrypted, match it with the rated parameter Vi, and generate its physical constraint range [Ui_min, Ui_max] and the corresponding timestamp Ti according to the equipment type and power grid specifications. The physical constraint range here is a reasonable range for the rated parameter to fluctuate. Step 2: Convert the characters Yi, Vi, and Ti to be encrypted into 64-bit binary, padding with 0s in the high-order bits if the result is less than 64 bits; For example, the decimal number Yi = 220 corresponds to the binary number 00...0011011100; Step 3: Divide the 64-bit binary of Yi into 8-byte groups to obtain Group_m, where m = 1, 2, ..., last, and last is the total number of groups, which is usually 8. If the total binary length of Yi is not a multiple of 8 bytes, calculate the number of missing bytes n, and fill it with n+1 numbers with the value n. The first n value is only used as a length padding identifier and does not participate in the encryption calculation. During decryption, the padding bytes can be identified and deleted through this identifier. For example: If a 10-byte number needs to be padded with 6 bytes, then the padded value is 00000110, repeated 7 times; At the same time, a group start bit is embedded before each group of data. 1 indicates that the group is the start group. It does not participate in the encryption calculation and is only used as the basis for grouping. Step 4: Calculate the difference between Yi and the lower limit of the physical constraint interval, D = Yi - Ui_min. This is in decimal, and after calculation, it is converted to 64-bit binary. Generate the core key K_core: Perform an XOR operation between the 64-bit binary of timestamp Ti and the 64-bit binary of Vi to obtain the 64-bit binary key K_core; Step 5: Determine the parity of D based on its least significant bit. If the least significant bit is 0, the number is even; if the least significant bit is 1, the number is odd. If D is even, perform the interval XOR: Group_1⊕Group_3=F1_1, Group_2⊕Group_4=F1_2, Group_3⊕Group_5=F1_3, Group_last-1⊕Group_1=F1_last-1, Group_last⊕Group_2=F1_last; If D is odd, perform sequential XOR: Group_1⊕Group_2=F1_1, Group_2⊕Group_3=F1_2, Group_3⊕Group_4=F1_3, Group_last⊕Group_1=F1_last; Encrypting Group_m according to the above rules yields the following results: 1+F1_1, 0+F1_2, ..., 0+F1_last; with a padding value in between. Step 6: Embed the time-series trend marker T_trend. Before embedding T_trend, the system needs to record the original binary value of the highest bit of each group F1_m, forming an "original highest bit lookup table" in the format of "group index + original highest bit value". For example, m=1:0 means that the original highest bit of the first group is 0. The lookup table is transmitted along with the encrypted data as additional information. It is used to strip T_trend and restore the original highest bit during decryption to ensure data integrity. Compare the current data Yi with the data Y from the previous time step. t-1 Compare them; if Yi is greater than Y t-1 If the data shows an upward trend, and the binary representation of T_trend is 1, then the highest bit is 1; If Yi is less than Y t-1 The data shows a downward trend, and the binary representation of the marker T_trend is 10 with the highest bit being 0; If Yi equals Y t-1 If the data shows a stable trend, and the binary representation of T_trend is 0, then the highest bit is the inverse of the last bit of that group; After each F1_m group is embedded with T_trend, the format is "the highest bit of the embedded trend marker + the remaining 7 bits of original data", and the overall length is still 8 bytes. The grouping structure is not changed, ensuring compatibility with subsequent encryption processes. Step 7: Perform a bitwise XOR operation on F1_m embedded in T_trend using the core key K_core to obtain the final encrypted data Fi; The data processing and encryption module packages the three types of data. Public or non-privacy data is directly transmitted to the data storage and decryption module in the format of "decimal raw data + ID + T". The first and second level encryption data will convert Fi into a hexadecimal string and package it together with the ID, timestamp Ti, and original highest bit lookup table.

[0012] As a second embodiment of this application, this section will demonstrate the data decryption and verification stage, the specific method of which is as follows: The backend management system allows setting up system administrator accounts, with the system administrator having the highest privileges. The system administrator can add, delete, and modify administrator accounts at all levels. System administrators can set access permission levels, including permissions to query level 1 encrypted data and level 2 encrypted data. Administrators at each level can use data backup, recovery, retrieval and other functions under their respective permissions. To access data for a specific time period, the specific steps are as follows: Step 1: Log in to the system using two-factor authentication with a password and a dynamic token. The system verifies the administrator's level and permission scope. Step 2: After verification, the administrator enters the query criteria, including the device ID to be queried and the corresponding time to be queried; Step 3: Based on the timestamp Ti and device ID index, the system locates the target data packet Y' and extracts the hexadecimal information Fn, ID, Tn, packet start bit, padding identifier, and original highest bit lookup table; Step 4: Obtain Fn by ID, convert it to 64-bit binary, and perform the same operation on timestamp Tn; Calculate the decryption key K_core', perform reverse decryption, including performing a reverse XOR on Fn and embedding the intermediate result Fn' after T_trend; The original highest bit of each group of Fn' is restored by using the "original highest bit lookup table", and the T_trend mark is removed to obtain the intermediate encryption result Fv; Fv is segmented according to the start bit of the group, and the first group is located; the padding bytes are identified and deleted by the padding identifier, and the padding identifier and padding value are deleted; The encrypted group corresponding to Group_1 is found by starting bit 1, and the reconstruction of Group_1 can be achieved by combining the physical constraint interval with Y. t-1 To estimate the trend, here Y t-1 It indicates the temporal trend of the previous moment; Meanwhile, in the process of determining parity, only one of the two rules can pass the closed-loop verification and physical constraint verification. The parity of D corresponding to the rule that passes is the actual value during encryption. Concatenate Group_m', remove the start position, convert to decimal, and obtain the final data; Step 5: The final data will be validated. The final data must be in decimal format to exclude binary remnants, format errors, and other issues; reverse verification using padding markers ensures that padding bytes have been correctly removed; if the format is incorrect, the data is considered corrupted. Verify whether the final data is within its corresponding physical constraint range. If it is, the physical verification is passed. At the same time, the degree of deviation can be classified as follows: mild anomaly is within ±5%; moderate anomaly is within ±5% to 10%; severe anomaly is above ±10%. Perform time-series trend verification on the data: Extract the data from the previous moment before the final data, compare the two, and verify whether they conform to the T_trend flag; Step Six: After all the final data verifications pass, normal data will be presented to the administrator. If only part of the final data passes or verification fails, an alarm will be displayed. At the same time, a detailed log of this access operation must be recorded.

[0013] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A power grid network data security management system, characterized in that, include: The data acquisition module is used to acquire real-time power grid data and corresponding source node identifiers, timestamps, and rated parameters through a dedicated interface, and generate raw data. The data processing and encryption module is used to classify raw data into public data, first-level encrypted data, and second-level encrypted data based on the source node identifier; Perform dynamic encryption on the first and second level encrypted data: Encryption tags are generated based on physical constraint intervals and time-series trends. Core keys are generated by combining rated parameters and timestamps. Grouping XOR rules are selected according to the parity of data differences, and time-series trend tags are embedded. The data storage and decryption module is used to store public data and encrypted data packets. The data packets include an encrypted hexadecimal string, a source node identifier, a timestamp, and a lookup table of the original highest bit. The backend management module is used to control data access through hierarchical permissions and two-factor authentication, perform decryption operations, and verify data integrity.

2. The power grid network data security management system according to claim 1, characterized in that, The data classification rules are as follows: Publicly available data includes the area's total voltage and common line current; Level 1 encrypted data includes real-time power consumption of associated devices, but not data that involves privacy, and total power consumption of the distribution area; Level 2 encrypted data includes user time-of-use electricity records, charging pile data, and real-time parameters of key hub substations.

3. The power grid network data security management system according to claim 1, characterized in that, Dynamic encryption operations include: Convert the data to be encrypted, the rated parameters, and the timestamp into 64-bit binary; Group the data into 8-byte blocks and pad the start bit. For data that is not a multiple of an integer, pad with n+1 bytes of value n, where n is the number of missing bytes. Calculate the difference D between the data and the lower limit of the physical constraint interval, and select the interval XOR or sequential XOR rule according to the parity of D.

4. The power grid network data security management system according to claim 1, characterized in that, The core key is generated by XORing the timestamp binary with the rated parameter binary.

5. A power grid network data security management system according to claim 1, characterized in that, The embedding method for time series trend markers is as follows: If the current data is greater than the previous data, set the highest value to 1; If the value is less than the data from the previous moment, the highest value is set to 0. If they are equal, the highest position is the inverse of the last position; After embedding, the original highest position is retained in the lookup table for decryption and restoration.

6. The power grid network data security management system according to claim 1, characterized in that, Decryption operations include: Intermediate data is obtained by reverse XORing the core key; The highest-order bits of the group are restored using the original highest-order bit lookup table, and the timing markers are removed. Remove padding bytes based on the start of the group and the padding identifier.

7. A power grid network data security management system according to claim 1, characterized in that, Post-decryption verification includes: Verify the correctness of the decimal format of the data; Check whether the data is within the physical constraint range, and classify the anomalies according to the degree of deviation: A range of ±5% is considered mildly abnormal. ±10% or more is considered a severe abnormality; The remainder are moderately abnormal; Compare the data from the previous moment to verify the consistency of the time series trend labeling.

8. A power grid network data security management system according to claim 1, characterized in that, The backend management module supports: System administrators can configure multi-level administrator privileges; Access to encrypted data is controlled based on access levels (Level 1 / Level 2).

9. A power grid network data security management system according to claim 1, characterized in that, Data access requires two-factor authentication using a password and a dynamic token, and operation logs must be recorded.

10. A power grid network data security management system according to claim 6, characterized in that, When restoring groups: Estimate the first set of values ​​based on the physical constraint interval and the data trend of the previous moment; The actual parity of the difference D is determined by closed-loop verification and physical constraint verification.

Images