Distribution network distributed protection terminal encryption communication method, device and equipment and storage medium

Abstract

The invention discloses a power distribution network distributed protection terminal encryption communication method, device and equipment and a storage medium, and is used for solving the technical problem that the real-time performance and reliability of intelligent distributed protection are seriously restricted by an existing encryption communication strategy between protection terminals. The method comprises the following steps: when a sender terminal detects abnormity, acquiring state data; generating a session key, symmetrically encrypting the state data by adopting the session key, and generating an initial ciphertext packet; acquiring real-time topological data of the power distribution network, and generating a topological strategy expression according to the real-time topological data; binding the session key and the topology policy expression to obtain a policy ciphertext; performing secondary encryption on the policy ciphertext to obtain a secondary encrypted policy ciphertext; generating a target ciphertext packet by adopting the secondary encryption strategy ciphertext and the initial ciphertext packet; and sending the target ciphertext packet to the target terminal.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of encrypted communication technology, and in particular to a power distribution network distributed protection terminal encrypted communication method, device, equipment and storage medium. BACKGROUND

[0002] Nowadays, the power distribution network is evolving from the traditional single radiation, single power architecture to the smart distributed network of multi-source complementation and flexible interconnection. As one of the key supporting technologies, smart distributed protection relies on millisecond-level real-time communication to achieve rapid fault positioning and isolation. However, the existing technology has the following problems:

[0003] 1. Security risks caused by unprotected communication between terminals:

[0004] In the typical scenario of smart distributed protection, adjacent switches (such as DTU / FTU terminals in ring network cabinets) need to share sensitive information (data flow up to 100-500 bytes / second) such as fault current, switch state, and action time in real time through peer-to-peer communication networks (such as IEC 61850-9-2 GOOSE protocol). Current industry practice only uses asymmetric encryption for the "manager-main station" link, but the communication between terminals is still in plaintext, which poses the following risks:

[0005] 1) Data leakage: attackers can intercept fault data through man-in-the-middle attacks and analyze the weaknesses of the power grid topology;

[0006] 2) Data tampering: fake fault information (such as artificially increasing short-circuit current values) may cause protection misoperation (such as false tripping);

[0007] 3) Denial of service: injecting a large number of fake messages can block the communication link and delay fault isolation (such as prolonging the power outage time).

[0008] 2. Conflict between timeliness and security:

[0009] One of the core advantages of smart distributed protection is "speed" (fault isolation time ≤ 100 ms, leaving ≤ 20 ms for communication). Under the current premise of plaintext communication between smart distributed protection terminals, if encryption is added between protection terminals, traditional encryption schemes cannot meet this requirement:

[0010] 1) Symmetric encryption (such as AES) is efficient (hardware acceleration can reach Gbps level), but key distribution requires an additional secure channel (such as asymmetric encryption), introducing additional delay;

[0011] 2) Asymmetric encryption (such as RSA) is highly secure, but has high computational complexity (single encryption takes ≈ 5 ms), which cannot meet the millisecond-level timeliness requirement;

[0012] 3) Attribute-based encryption (ABE) supports fine-grained access control, but the policy update and key distribution delay (> 100ms) is far beyond the protection action time requirement.

[0013] 3. Lack of dynamic topology adaptation:

[0014] The distribution network topology changes in real time with the operation mode adjustment (such as line transfer and switch switching), and the adjacent switch relationship (such as the neighbor of S1 changing from S2 to S3) needs to be updated dynamically. The existing encryption scheme uses a static policy (such as a predefined fixed adjacency list), which cannot adapt to topology changes, resulting in:

[0015] Policy failure: After topology adjustment, non-adjacent switches allowed by the original policy may obtain sensitive data;

[0016] Policy redundancy: After topology adjustment, adjacent switches rejected by the original policy cannot obtain necessary information in a timely manner, affecting protection coordination. SUMMARY

[0017] The application provides a power distribution network distributed protection terminal encryption communication method, device, equipment and storage medium, which is used to solve the technical problem that the existing encryption communication policy between protection terminals seriously restricts the real-time performance and reliability of intelligent distributed protection.

[0018] The application provides a power distribution network distributed protection terminal encryption communication method, which comprises:

[0019] When the sender terminal detects an exception, state data is obtained;

[0020] A session key is generated, and the state data is symmetrically encrypted using the session key to generate an initial ciphertext package;

[0021] Real-time topology data of the power distribution network is obtained, and a topology policy expression is generated according to the real-time topology data;

[0022] The session key and the topology policy expression are bound to obtain a policy ciphertext;

[0023] The policy ciphertext is encrypted twice to obtain a twice-encrypted policy ciphertext;

[0024] The twice-encrypted policy ciphertext and the initial ciphertext package are used to generate a target ciphertext package;

[0025] The target ciphertext package is sent to a target terminal.

[0026] Optionally, the step of generating a session key and symmetrically encrypting the state data using the session key to generate an initial ciphertext package comprises:

[0027] A 256-bit random number is generated using a random number generator;

[0028] performing entropy post-processing on the random number to generate a session key;

[0029] symmetrically encrypting the state data using the session key to generate an initial ciphertext package.

[0030] Optionally, the step of obtaining real-time topology data of the power distribution network and generating a topology strategy expression according to the real-time topology data comprises:

[0031] obtaining real-time topology data of the power distribution network;

[0032] determining an adjacent switch of the sender terminal according to the real-time topology data;

[0033] generating a topology strategy expression according to the adjacent switch.

[0034] Optionally, the step of binding the session key and the topology strategy expression to obtain a strategy ciphertext comprises:

[0035] obtaining a switch ID of the adjacent switch and a current coordinated universal time;

[0036] constructing a unique string of the adjacent switch according to the switch ID and the coordinated universal time;

[0037] performing hash processing on the unique string to obtain a hash integer;

[0038] mapping the hash integer onto a preset elliptic curve to obtain a curve point coordinate;

[0039] generating a bilinear group mapping value of the adjacent switch using the curve point coordinate;

[0040] generating an inverse element of the bilinear group mapping value;

[0041] generating a key encapsulation component using the inverse element and the session key;

[0042] obtaining a temporary public key and a sender private key of the sender terminal;

[0043] signing the temporary public key, the key encapsulation component and the topology strategy expression using the sender private key to obtain a digital signature;

[0044] generating a strategy ciphertext using the temporary public key, the key encapsulation component, the topology strategy expression and the digital signature.

[0045] Optionally, the step of performing secondary encryption on the strategy ciphertext to obtain a secondary encryption strategy ciphertext comprises:

[0046] The elliptic curve encryption algorithm is used to encrypt the policy ciphertext twice to generate twice-encrypted policy ciphertext.

[0047] Optionally, the method further comprises:

[0048] When the target terminal receives the target ciphertext package, a target terminal private key is obtained.

[0049] The twice-encrypted policy ciphertext is decrypted using the target terminal private key to obtain policy ciphertext.

[0050] The policy ciphertext is subjected to secondary encapsulation integrity verification.

[0051] If the verification is passed, a topology policy expression is extracted from the policy ciphertext.

[0052] A local ID of the target terminal is obtained, and it is judged whether the local ID is in an allowed list of the topology policy expression.

[0053] If yes, a session key is extracted from the policy ciphertext.

[0054] The initial ciphertext package is decrypted using the session key to obtain the state data.

[0055] The application further provides a power distribution network distributed protection terminal encryption communication device, comprising:

[0056] A state data acquisition module is configured to acquire state data when a sender terminal detects an exception.

[0057] An initial ciphertext package generation module is configured to generate a session key and symmetrically encrypt the state data using the session key to generate an initial ciphertext package.

[0058] A topology policy expression generation module is configured to acquire real-time topology data of a power distribution network and generate a topology policy expression according to the real-time topology data.

[0059] A policy ciphertext generation module is configured to bind the session key and the topology policy expression to obtain policy ciphertext.

[0060] A twice-encryption module is configured to encrypt the policy ciphertext twice to obtain twice-encrypted policy ciphertext.

[0061] A target ciphertext package generation module is configured to generate a target ciphertext package using the twice-encrypted policy ciphertext and the initial ciphertext package.

[0062] A sending module is configured to send the target ciphertext package to a target terminal.

[0063] Optionally, the initial ciphertext package generation module comprises:

[0064] a random number generation submodule configured to generate a 256-bit random number by using a random number generator;

[0065] a session key generation submodule configured to perform entropy post-processing on the random number to generate a session key;

[0066] an initial ciphertext package generation submodule configured to symmetrically encrypt the state data by using the session key to generate an initial ciphertext package.

[0067] The application further provides an electronic device, which comprises a processor and a memory:

[0068] The memory is configured to store program code and transmit the program code to the processor;

[0069] The processor is configured to execute the power distribution network distributed protection terminal encrypted communication method according to the instructions in the program code.

[0070] The application further provides a computer readable storage medium configured to store program code, and the program code is configured to execute the power distribution network distributed protection terminal encrypted communication method.

[0071] As can be seen from the above technical solutions, the application has the following advantages: the application discloses a power distribution network distributed protection terminal encrypted communication method, and specifically discloses the following: obtaining state data when an abnormality is detected by a sending terminal; generating a session key and symmetrically encrypting the state data by using the session key to generate an initial ciphertext package; obtaining real-time topology data of a power distribution network and generating a topology strategy expression according to the real-time topology data; binding the session key and the topology strategy expression to obtain a strategy ciphertext; performing secondary encryption on the strategy ciphertext to obtain a secondary encrypted strategy ciphertext; generating a target ciphertext package by using the secondary encrypted strategy ciphertext and the initial ciphertext package; and sending the target ciphertext package to a target terminal. The application improves the real-time performance and reliability of intelligent distributed protection by means of dynamic topology strategy and three-stage lightweight hybrid encryption. BRIEF DESCRIPTION OF DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor under the premise of the drawings.

[0073] Figure 1 A step flow chart of a power distribution network distributed protection terminal encrypted communication method provided by the application;

[0074] Figure 2 A step flow chart of a power distribution network distributed protection terminal encrypted communication method provided by another embodiment of the present application is provided.

[0075] Figure 3 A structural block diagram of a power distribution network distributed protection terminal encrypted communication device provided by the embodiment of the present application is provided. DETAILED DESCRIPTION

[0076] The embodiment of the present application provides a power distribution network distributed protection terminal encrypted communication method, device, equipment and storage medium, and is used for solving the technical problem that the existing encrypted communication strategy between protection terminals seriously restricts the real-time performance and reliability of intelligent distributed protection.

[0077] In order to make the application purpose, features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the following described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0078] Please refer to Figure 1 , Figure 1 A step flow chart of a power distribution network distributed protection terminal encrypted communication method provided by the embodiment of the present application is provided.

[0079] The power distribution network distributed protection terminal encrypted communication method provided by the present application can specifically include the following steps:

[0080] Step 101, when the sender terminal detects an exception, state data is acquired.

[0081] The core role of the distributed protection terminal is to monitor and control the switch associated with it, so as to realize automatic positioning and isolation of faults.

[0082] In the embodiment of the present application, the protection terminal that sends information to other distributed protection terminals is determined as a sender terminal.

[0083] In the embodiment of the present application, the exception can be a fault (such as current mutation > set value) or a state change (such as switch opening and closing).

[0084] When the sender terminal detects that the corresponding switch has a fault or a state change, the state data of the switch can be acquired, such as whether the switch overflows, whether it refuses to act, etc.

[0085] Step 102, a session key is generated, and the state data is symmetrically encrypted by using the session key to generate an initial ciphertext package;

[0086] A session key is a symmetric encryption key generated temporarily for a specific communication session. It is like a "one-time password book", and the core feature is temporary, independent for each session, and discarded after use.

[0087] After obtaining the state data, a session key can be generated to symmetrically encrypt the state data with the session key to generate an initial ciphertext package.

[0088] In step 103, real-time topology data of the power distribution network is obtained, and a topology strategy expression is generated according to the real-time topology data.

[0089] In the embodiment of the application, the sender terminal can obtain the real-time topology data of the power distribution network, such as the switch fault state, the refusal state, the connection relationship, etc., through the SV protocol of IEC 61850-9-2. Then the local adjacency relationship list (such as the neighbor of terminal S1 = [S2, S5]) is updated. According to the adjacency relationship in the adjacency relationship list, the topology strategy expression of the sender terminal can be sent.

[0090] In step 104, the session key and the topology strategy expression are bound to obtain a strategy ciphertext.

[0091] In the embodiment of the application, after obtaining the topology strategy expression, the session key and the topology strategy expression can be bound to obtain a strategy ciphertext.

[0092] In one example, the CP-ABE-KEM algorithm can be used to bind the session key and the topology strategy expression.

[0093] In step 105, the strategy ciphertext is twice encrypted to obtain a twice encrypted strategy ciphertext.

[0094] In the embodiment of the application, in order to prevent the strategy ciphertext from being directly parsed or tampered, the strategy ciphertext can be twice encrypted to obtain a twice encrypted strategy ciphertext.

[0095] In step 106, a target ciphertext package is generated by using the twice encrypted strategy ciphertext and the initial ciphertext package.

[0096] In step 107, the target ciphertext package is sent to the target terminal.

[0097] In the embodiment of the application, after obtaining the twice encrypted strategy ciphertext, the twice encrypted strategy ciphertext and the initial ciphertext package can be used to generate a target ciphertext package, and the target ciphertext package is sent to the target terminal. The target terminal obtains the encapsulated state data by parsing the target ciphertext package.

[0098] The application improves the real-time performance and reliability of intelligent distributed protection through dynamic topology strategy and three-stage lightweight hybrid encryption.

[0099] Please refer toFigure 2 , Figure 2 A flowchart illustrating the steps of an encrypted communication method for a distributed protection terminal in a power distribution network, as provided in another embodiment of the present invention. Specifically, it may include the following steps:

[0100] Step 201: When the sending terminal detects an anomaly, it acquires status data;

[0101] Step 201 is the same as step 101. For details, please refer to the description of step 101. It will not be repeated here.

[0102] Step 202: Use a random number generator to generate a 256-bit random number;

[0103] Step 203: Perform entropy post-processing on the random number to generate a session key;

[0104] Step 204: Use the session key to symmetrically encrypt the state data to generate the initial ciphertext packet;

[0105] In this embodiment of the invention, the sending terminal can generate a 256-bit random number using a local TRNG true random number generator, and after entropy post-processing, use it as the session key Ksess. Subsequently, when using the AES-256-GCM authentication encryption algorithm, Ksess is directly used as its 256-bit master key.

[0106] Next, the state data is encrypted using the session key. The encryption operation is as follows:

[0107] CTdata=AES-GCM.Enc(Ksess,Data,IV).

[0108] CTdata is the encrypted data, Data is the plaintext data to be encrypted, i.e., the state data, and IV is a 96-bit random initialization vector (unique for each encryption to prevent replay attacks).

[0109] The initial ciphertext packet output is: {CT_data,IV,AuthTag} (total length ≈ original data length + 32 bytes).

[0110] Step 205: Obtain real-time topology data of the distribution network and generate a topology strategy expression based on the real-time topology data;

[0111] In this embodiment of the invention, the sending terminal can obtain real-time topology data of the distribution network, such as switch fault status, failure to operate status, and connection relationships, through the SV protocol of IEC 61850-9-2. Then, it updates its local adjacency list (e.g., the neighbors of terminal S1 are [S2, S5]). Based on the adjacency relationships in the adjacency list, the sending terminal can formulate its topology strategy expression.

[0112] In one example, step 205 can include the following sub-steps:

[0113] S51, acquiring real-time topology data of the power distribution network;

[0114] S52, determining the adjacent switches of the sender terminal according to the real-time topology data;

[0115] S53, generating a topology policy expression according to the adjacent switches.

[0116] In a specific implementation, assuming that the adjacent switches of the sender terminal are S2 and S5, the topology policy expression formed can be Policy = "S2 VS5" (disjunctive normal form, indicating that only S2 or S5 is allowed to decrypt).

[0117] Step 206, binding the session key and the topology policy expression to obtain a policy ciphertext;

[0118] In the embodiment of the application, after the topology policy expression is acquired, the session key and the topology policy expression can be bound to obtain a policy ciphertext.

[0119] In one example, step 206 can include the following sub-steps:

[0120] S60, acquiring the switch ID and the current coordinated universal time of the adjacent switches;

[0121] S61, constructing a unique string of the adjacent switches according to the switch ID and the coordinated universal time;

[0122] S62, performing hash processing on the unique string to obtain a hash integer;

[0123] S63, mapping the hash integer to a preset elliptic curve to obtain a curve point coordinate;

[0124] S64, generating a bilinear group mapping value of the adjacent switches by using the curve point coordinate;

[0125] S65, generating an inverse element of the bilinear group mapping value;

[0126] S66, generating a key encapsulation component by using the inverse element and the session key;

[0127] S67, acquiring a temporary public key and a sender private key of the sender terminal;

[0128] S68, signing the temporary public key, the key encapsulation component and the topology policy expression by using the sender private key to obtain a digital signature;

[0129] S69, generating the policy ciphertext by using the temporary public key, the key encapsulation component, the topology policy expression and the digital signature.

[0130] In a specific implementation, the CP-ABE-KEM algorithm can be used to bind Ksess and the topology policy expression: C0=g s , C i =Ksess·H(Si) -s (s∈Zp).

[0131] Where g is a bilinear group G1 generator (deployed on all terminals); s is a random number (a unique random number is generated each time the topology policy is generated to prevent replay); C0is a temporary public key used to pass the random number s to the recipient who meets the topology policy; C i is a key encapsulation component, each adjacent switch Si corresponds to a C i , only the terminal holding the private key of Si can restore the session key; Zp is a finite field {0, 1, …, } representing a prime number p, all exponent operations and random numbers s are done in this field to ensure that the discrete logarithm problem is valid. Si is the switch ID of the adjacent switch; H(Si) is the bilinear group mapping value of Si, and the specific calculation process of H(Si) is as follows:

[0132] 1. Construct a unique string:

[0133] stri="ID="||Si||",timestamp="||epoch||",domain=cp-abe";

[0134] Where:

[0135] Si is the switch number (such as "S2").

[0136] epoch takes the UTC time of the current hour (to prevent replay).

[0137] Domain is a fixed string to avoid cross-protocol collisions.

[0138] 2. Hash to integer:

[0139] Hash stri using a hash function (such as SHA-256) to get a 256-bit large integer hi, and then mod the curve order p to get an integer ri:

[0140] hi=SHA-256(stri) / / 256 bit large integer;

[0141] ri = hi mod p / / p is the curve order (prime number).

[0142] 3. Hash to curve point:

[0143] The ri is mapped to the curve point coordinate (x, y) on the preset elliptic curve E: y2=x3+ax+b by using the SimplifiedSWU method (only 2 times of square roots are needed for the curve p≡3mod4):

[0144] 1) Select a random byte t=0x00;

[0145] 2) Calculate the X coordinate: x=(ri+t)mod p;

[0146] 3) Calculate the elliptic curve equation: α=x3+a·x+b;

[0147] 4) Judge the quadratic residue: judge whether α is a quadratic residue by Legendre(α / p)=1, if α is a quadratic residue (Legendre(α / p)=1, then y=α^((p+1) / 4)mod p to get the point (x, y), otherwise t++ back to step 2) (1.5 times on average can hit);

[0148] 4, clear the cofactor to get H(Si):

[0149] Map (x, y) to the G1 subgroup, and multiply the point (x, y) by the cofactor to ensure that the result strictly belongs to G1:

[0150] H(Si)=(x,y)·cofactor;

[0151] The G1 cofactor of the BN-256 curve is h=1 (standard parameters), so the H(Si) calculation is simplified to H(Si)=(x,y) (if h>1, need to calculate , get ; verify H(Si)∈G1 by e(H(Si),gT)≠1 (gT is the G T group generator).

[0152] 5, store in Flash:

[0153] When the terminal is powered on, subscribe to the topology change notification (such as connection relationship change) through the MMS service of the IEC 61850-9-2 SV protocol; when detecting topology change (such as switch S5 failure), trigger the topology database update process:

[0154] Reacquire real-time topology data (such as through the SampledValue message of the SV protocol);

[0155] Clear the locally stored old version of the adjacent switch list and the corresponding H(Si);

[0156] For each Si in the new adjacent switch list, recalculate H(Si) according to the H(Si) process;

[0157] Generate policy commitment: Commitment = e(H(S2), gT)s·e(H(S5), gT)s;

[0158] where e is a bilinear pairing operation, gT is a G T group generator; and Commitment is attached to CTpolicy.

[0159] Next, the temporary public key, the key encapsulation component and the topology policy expression are signed using the sender's private key to obtain a digital signature (tamper-proofing):

[0160] The sender uses the ECC private key SK-ECC to calculate a digital signature for (C0, C1, C2, Policy):

[0161] Sig = ECDSA.Sign(SK-ECC, (C0, C2, C5, Policy));

[0162] Output: policy ciphertext CT_policy = (C0, C1,..., C n , H(Policy), Sig).

[0163] Step 207, the policy ciphertext is twice encrypted to obtain a twice-encrypted policy ciphertext;

[0164] In the embodiment of the application, in order to prevent the policy ciphertext from being directly parsed or tampered with, the policy ciphertext can be twice encrypted to obtain a twice-encrypted policy ciphertext.

[0165] In one example, step 207 can specifically be: the policy ciphertext is twice encrypted using an elliptic curve encryption algorithm to generate a twice-encrypted policy ciphertext.

[0166] In a specific implementation, in order to prevent the policy ciphertext CT_policy from being directly parsed or tampered with, the policy ciphertext is twice encrypted using ECC (elliptic curve encryption) (using NIST P-256 curve) to obtain a twice-encrypted policy ciphertext CT_encap (length ≈ 256 bytes), which is specifically as follows:

[0167] CTencap = ECIES.Enc(PK-ECC-B, CT-policy); (length ≈ 256 bytes).

[0168] Step 208, a target ciphertext package is generated using the twice-encrypted policy ciphertext and the initial ciphertext package;

[0169] Step 209, the target ciphertext package is sent to the target terminal.

[0170] In the embodiment of the present application, after the secondary encryption policy ciphertext is obtained, the secondary encryption policy ciphertext and the initial ciphertext package can be used to generate a target ciphertext package, and the target ciphertext package is sent to the target terminal. The target terminal obtains the encapsulated state data by analyzing the target ciphertext package.

[0171] The finally obtained target ciphertext package is {CT_data, IV, AuthTag, CT_encap}.

[0172] In the embodiment of the present application, the real-time topology is perceived to dynamically generate the adjacent switch list, the policy is automatically updated (the topology change is completed within 3 ms to refresh the policy), and the problem of “static policy failure” is solved. The delay of symmetric encryption (AES-GCM) in the embodiment of the present application is ≤0.1 ms, the delay of topology policy encryption is ≤0.3 ms, the delay of ECC secondary encapsulation is ≤0.1 ms, and the total encryption and decryption delay is ≤0.5 ms (the measured value), which meets the “millisecond time limit” requirement. In the embodiment of the present application, symmetric encryption (AES-GCM) provides data confidentiality and integrity (anti-tampering); topology policy encryption (improved CP-ABE-KEM) ensures that only adjacent switches are decrypted (anti-illegal access); ECC secondary encapsulation (NIST P-256 curve) enhances the anti-tampering ability of the policy (anti-policy forgery); and the overall security strength reaches the “high” level of NIST SP 800-57. In the embodiment of the present application, the topology policy encryption only transmits the disjunctive expression of the adjacent switch list (such as “S2∨S5”), and the length of the policy ciphertext is only increased by 32 bytes (original data 128 bytes → encrypted 160 bytes). The bandwidth occupation is basically the same as the plaintext transmission (160 bytes vs. plaintext 128 bytes), and the real-time performance of intelligent distributed protection is not affected. In the embodiment of the present application, all encryption operations are completed locally on the terminal (policy generation, encryption, decryption), and no additional server is required. Only the terminal supports the AES instruction accelerator (ARM, STM32), SHA-3 and other hardware instructions (mainstream industrial-grade chips are built-in), and the deployment cost is low and the maintenance is simple.

[0173] The present application improves the real-time performance and reliability of intelligent distributed protection through dynamic topology policy and three-stage lightweight hybrid encryption.

[0174] Further, in the embodiment of the present application, after the target terminal receives the target ciphertext package, the target ciphertext package can be decrypted to obtain the state data encapsulated therein, and the specific steps include:

[0175] S01, when the target terminal receives the target ciphertext package, obtaining the private key of the target terminal;

[0176] S02, using the private key of the target terminal to decrypt the secondary encryption policy ciphertext to obtain the policy ciphertext;

[0177] S03, second encapsulation integrity verification is performed on the policy ciphertext;

[0178] S04, if the verification is passed, a topology policy expression is extracted from the policy ciphertext;

[0179] S05, a local ID of the target terminal is obtained, and it is judged whether the local ID is in an allowed list of the topology policy expression;

[0180] S06, if yes, a session key is extracted from the policy ciphertext;

[0181] S07, the initial ciphertext package is decrypted by using the session key to obtain state data.

[0182] In the specific implementation, after the target terminal receives the target ciphertext package, the process of decrypting the target ciphertext package to obtain the encapsulated state data is as follows:

[0183] ECC unsealing: the target terminal decrypts the second encrypted policy ciphertext by using a local ECC private key SK-ECC-B to obtain CT_policy: CT_policy=ECIES.Dec(SK-ECC,CTencap), and outputs: CT_policy=(C0,C2,C5,Policy,Sig,Commitment).

[0184] Verification of the integrity of the ECC second encapsulation: C0 (C0=g s ) is extracted from CT_policy, s=log g (C0) is calculated (by solving the discrete logarithm), H(S2) and H(S5) are obtained from the locally stored "adjacent switch H value table", e(H(S2),gT) s and e(H(S5),gT) s are calculated by using the bilinear pair power operation, Commitment′=e(H(S2),gT) s ·e(H(S5),gT) s is calculated; if Commitment′≠Commitment, "the policy ciphertext is tampered with" is returned; otherwise, the verification is passed.

[0185] Topology policy verification: it is checked whether the self is in the allowed list, the policy expression Policy=S2∨S5 (disjunctive normal form) is extracted from CT_policy, and the local ID of the target terminal is obtained; it is checked whether it is in the allowed list of Policy (such as S2∈[S2,S5]); if yes, it is passed, and if not, "ACCESS_DENIED" (policy control) is returned.

[0186] Session key Ksess is recovered: C0=gs (Interim public key) and C2, according to the key encapsulation component logic 2 = Ksess·H(S2) −s , both sides multiply H(S2) s Ksess=C2·H(S2) s , obtain the target terminal local storage adjacent switch S2 bilinear group mapping value H(S2), the recovered session key Ksess, ensure that only authorized terminals can decrypt data.

[0187] Data decryption and integrity verification: use Ksess to decrypt data and verify data integrity. Extract encrypted data, IV and AuthTag from CT_data; use Ksess, IV and CTdata to perform AES-GCM decryption:

[0188] Data=AES-GCM.Dec(Ksess,CT_data,IV,AuthTag);

[0189] Verify AuthTag: Recalculate AuthTag (use Ksess, IV and original data), and compare with AuthTag in CT_data;

[0190] If decryption is successful and AuthTag verification is passed, output the original data; otherwise, return "DECRYPTION_FAILED" (data tampered or key error).

[0191] Please refer to Figure 3 , Figure 3 A structural block diagram of an encryption communication device of a power distribution network distributed protection terminal provided by an embodiment of the application.

[0192] An encryption communication device of a power distribution network distributed protection terminal is provided by an embodiment of the application.

[0193] The state data acquisition module 301 is configured to acquire state data when the sender terminal detects an exception.

[0194] The initial ciphertext package generation module 302 is configured to generate a session key, and symmetrically encrypt the state data by using the session key to generate an initial ciphertext package.

[0195] The topology strategy expression generation module 303 is configured to acquire real-time topology data of the power distribution network, and generate a topology strategy expression according to the real-time topology data.

[0196] The strategy ciphertext generation module 304 is configured to bind the session key and the topology strategy expression to obtain a strategy ciphertext.

[0197] The secondary encryption module 305 is configured to perform secondary encryption on the strategy ciphertext to obtain secondary encrypted strategy ciphertext.

[0198] The target ciphertext package generation module 306 is configured to generate a target ciphertext package by using the secondary encryption strategy ciphertext and the initial ciphertext package.

[0199] The sending module 307 is configured to send the target ciphertext package to the target terminal.

[0200] In the embodiment of the present application, the initial ciphertext package generation module 302 comprises:

[0201] The random number generation sub-module is configured to generate a 256-bit random number by using a random number generator.

[0202] The session key generation sub-module is configured to perform entropy post-processing on the random number to generate a session key.

[0203] The initial ciphertext package generation sub-module is configured to perform symmetric encryption on the state data by using the session key to generate an initial ciphertext package.

[0204] In the embodiment of the present application, the topology strategy expression generation module 303 comprises:

[0205] The real-time topology data acquisition sub-module is configured to acquire real-time topology data of the power distribution network.

[0206] The adjacent switch determination sub-module is configured to determine the adjacent switch of the sender terminal according to the real-time topology data.

[0207] The topology strategy expression generation sub-module is configured to generate a topology strategy expression according to the adjacent switch.

[0208] In the embodiment of the present application, the strategy ciphertext generation module 304 comprises:

[0209] The switch ID and coordinated universal time acquisition sub-module is configured to acquire the switch ID and the current coordinated universal time of the adjacent switch.

[0210] The unique string generation sub-module is configured to construct a unique string of the adjacent switch according to the switch ID and the coordinated universal time.

[0211] The hash integer generation sub-module is configured to perform hash processing on the unique string to obtain a hash integer.

[0212] The curve point coordinate acquisition sub-module is configured to map the hash integer to a preset elliptic curve to obtain a curve point coordinate.

[0213] The bilinear group mapping value generation sub-module is configured to generate a bilinear group mapping value of the adjacent switch by using the curve point coordinate.

[0214] The inverse element generation sub-module is configured to generate an inverse element of the bilinear group mapping value.

[0215] The key encapsulation component generation submodule is configured to generate a key encapsulation component by using an inverse element and a session key;

[0216] The temporary public key and sender private key acquisition submodule is configured to acquire a temporary public key and a sender private key of a sender terminal;

[0217] The signature submodule is configured to sign the temporary public key, the key encapsulation component and the topology policy expression by using the sender private key to obtain a digital signature;

[0218] The policy ciphertext generation submodule is configured to generate a policy ciphertext by using the temporary public key, the key encapsulation component, the topology policy expression and the digital signature.

[0219] In the embodiment of the application, the secondary encryption module 305 comprises:

[0220] The secondary encryption submodule is configured to perform secondary encryption on the policy ciphertext by using an elliptic curve encryption algorithm to generate a secondary encrypted policy ciphertext.

[0221] In the embodiment of the application, the secondary encryption module 305 further comprises:

[0222] The target terminal private key acquisition submodule is configured to acquire a target terminal private key when the target terminal receives the target ciphertext package;

[0223] The secondary encrypted policy ciphertext decryption submodule is configured to decrypt the secondary encrypted policy ciphertext by using the target terminal private key to obtain the policy ciphertext;

[0224] The secondary encapsulation integrity verification submodule is configured to perform secondary encapsulation integrity verification on the policy ciphertext;

[0225] The topology policy expression extraction submodule is configured to extract the topology policy expression from the policy ciphertext if the verification passes;

[0226] The judgment submodule is configured to acquire a local ID of the target terminal and judge whether the local ID is in an allowed list of the topology policy expression;

[0227] The session key extraction submodule is configured to extract the session key from the policy ciphertext if the judgment submodule judges that the local ID is in the allowed list of the topology policy expression;

[0228] The initial ciphertext package decryption submodule is configured to decrypt the initial ciphertext package by using the session key to obtain state data.

[0229] The embodiment of the application further provides an electronic device, which comprises a processor and a memory:

[0230] The memory is configured to store program code and transmit the program code to the processor;

[0231] The processor is configured to execute the power distribution network distributed protection terminal encrypted communication method according to the instructions in the program code.

[0232] The embodiment of the present application also provides a computer readable storage medium, which is used for storing program code, and the program code is used for executing the power distribution network distributed protection terminal encrypted communication method.

[0233] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, and will not be described here.

[0234] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same and similar parts between each embodiment can be referred to each other.

[0235] Those skilled in the art can understand that the embodiments of the present application can be provided as a method, a device or a computer program product. Therefore, the embodiments of the present application can adopt a completely hardware embodiment, a completely software embodiment or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can adopt a computer program product in the form of being implemented on one or more computer usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer usable program codes.

[0236] The embodiments of the present application are described with reference to flowcharts and / or block diagrams according to the method, terminal device (system) and computer program product of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the computer or other programmable data processing terminal device produce a device for realizing the functions specified in the flowcharts and / or block diagrams. Figure 1 The device for realizing the functions specified in one flow or multiple flows and / or blocks. Figure 1 The device for realizing the functions specified in one block or multiple blocks.

[0237] These computer program instructions can also be stored in a computer readable memory capable of guiding the computer or other programmable data processing terminal device to work in a specific way, so that the instructions stored in the computer readable memory produce a product including instruction devices, which realize the functions specified in the flowcharts and / or block diagrams. Figure 1 The device for realizing the functions specified in one flow or multiple flows and / or blocks. Figure 1 The device for realizing the functions specified in one block or multiple blocks.

[0238] These computer program instructions can also be loaded into computer or other programmable data processing devices to cause a series of operational steps to be performed on the computer or other programmable data processing devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable data processing devices provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 Figure 1

[0239] Although the preferred embodiments of the present application have been described, those skilled in the art will understand that there are many modifications and alterations to the described embodiments which fall within the scope of the present application. Accordingly, the appended claims are intended to embrace all such alterations and modifications as fall within the scope of the present application.

[0240] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0241] Finally, it should be noted that in this document, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or terminal device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or terminal device. Without more limitation, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or terminal device including the element.

[0242] The above-described and above-embodied examples are only used to illustrate the technical solutions of the present application, and not to limit the same; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.​​

Claims

1. A method for encrypted communication of distributed protection terminals in a distribution network, characterized in that, include: When the sending terminal detects an anomaly, it acquires status data; Generate a session key, and use the session key to symmetrically encrypt the state data to generate an initial ciphertext packet; Acquire real-time topology data of the distribution network and generate a topology strategy expression based on the real-time topology data; Bind the session key and the topology policy expression to obtain the policy ciphertext; The policy ciphertext is then encrypted a second time to obtain the double-encrypted policy ciphertext. The target ciphertext packet is generated using the aforementioned secondary encryption strategy and the initial ciphertext packet. The target encrypted packet is sent to the target terminal.

2. The method according to claim 1, characterized in that, The step of generating a session key and using the session key to symmetrically encrypt the state data to generate an initial ciphertext packet includes: Use a random number generator to generate 256-bit random numbers; The random number is post-processed with entropy to generate a session key; The state data is symmetrically encrypted using the session key to generate an initial ciphertext packet.

3. The method according to claim 1, characterized in that, The step of acquiring real-time topology data of the distribution network and generating a topology strategy expression based on the real-time topology data includes: Obtain real-time topology data of the power distribution network; The adjacency switch of the sending terminal is determined based on the real-time topology data; Generate a topology strategy expression based on the adjacent switches.

4. The method according to claim 3, characterized in that, The step of binding the session key and the topology policy expression to obtain the policy ciphertext includes: Obtain the switch ID of the adjacent switch and the current coordinated world time; Construct a unique string for the adjacent switch based on the switch ID and the coordinate world; The unique string is hashed to obtain a hash integer; The hash integer is mapped onto a preset elliptic curve to obtain the coordinates of the curve points; The bilinear group mapping value of the adjacent switch is generated using the coordinates of the curve points; Generate the inverse of the bilinear group mapping value; The inverse element and the session key are used to generate a key encapsulation component; Obtain the temporary public key and the sender's private key of the sender's terminal; The sender's private key is used to sign the temporary public key, the key encapsulation component, and the topology policy expression to obtain a digital signature; The temporary public key, the key encapsulation component, the topology policy expression, and the digital signature are used to generate the policy ciphertext.

5. The method according to claim 1, characterized in that, The step of performing secondary encryption on the policy ciphertext to obtain secondary encrypted policy ciphertext includes: The ciphertext of the policy is encrypted a second time using an elliptic curve cryptography algorithm to generate a second-encrypted policy ciphertext.

6. The method according to claim 1, characterized in that, Also includes: When the target terminal receives the target encrypted packet, it obtains the target terminal's private key; The secondary encryption policy ciphertext is decrypted using the target terminal's private key to obtain the policy ciphertext; The policy ciphertext is then encapsulated and its integrity verified a second time. If the verification passes, extract the topology policy expression from the policy ciphertext; Obtain the local ID of the target terminal and determine whether the local ID is in the allowed list of the topology policy expression; If so, extract the session key from the policy ciphertext; The initial ciphertext packet is decrypted using the session key to obtain the state data.

7. An encrypted communication device for a distributed protection terminal in a power distribution network, characterized in that, include: The status data acquisition module is used to acquire status data when the sending terminal detects an anomaly. An initial ciphertext packet generation module is used to generate a session key and symmetrically encrypt the state data using the session key to generate an initial ciphertext packet. The topology strategy expression generation module is used to acquire real-time topology data of the distribution network and generate topology strategy expressions based on the real-time topology data. The policy ciphertext generation module is used to bind the session key and the topology policy expression to obtain the policy ciphertext. A secondary encryption module is used to perform secondary encryption on the policy ciphertext to obtain secondary encrypted policy ciphertext. The target ciphertext packet generation module is used to generate a target ciphertext packet using the ciphertext of the secondary encryption strategy and the initial ciphertext packet; The sending module is used to send the target encrypted packet to the target terminal.

8. The apparatus according to claim 7, characterized in that, The initial ciphertext packet generation module includes: The random number generation submodule is used to generate 256-bit random numbers using a random number generator; The session key generation submodule is used to perform entropy post-processing on the random number to generate a session key; The initial ciphertext packet generation submodule is used to symmetrically encrypt the state data using the session key to generate the initial ciphertext packet.

9. An electronic device, characterized in that, The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the encrypted communication method for distributed protection terminals in a distribution network according to any one of claims 1-6, based on the instructions in the program code.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code, which is used to execute the encrypted communication method for distributed protection terminals in a power distribution network as described in any one of claims 1-6.

Images