Power grid passing equipment safety management method based on edge calculation

Abstract

The invention relates to the technical field of data safety management, in particular to a power grid passing equipment safety management method based on edge computing, which comprises the following steps of: acquiring a voltage monitoring value, a current monitoring value and a circuit breaker state, constructing a power grid physical state identification character string based on value overrun or overhaul grounding, dynamic environment attribute elements are generated by utilizing a Hash algorithm and elliptic curve encryption mapping, an identity attribute private key and the environment elements are combined to construct a complete decryption key set, decryption mapping is executed on an access control strategy ciphertext by utilizing a bilinear pairing function, and the difference between a mapping output value and a reference target value is calculated; and generating a relay driving high-level signal based on zero difference. According to the method, the physical state is converted into the dynamic environment attribute element, the complete decryption key is constructed in combination with the identity attribute private key, environment safety verification is forcibly fused in the bottom layer encryption logic, and the risk of entering the electrified area by mistake in the high-risk state is completely eradicated.

Description

Technical Field

[0001] This invention relates to the field of data security management technology, and in particular to a method for security management of power grid access equipment based on edge computing. Background Technology

[0002] Data security management technology refers to the technical field of protecting and monitoring data flow, storage permissions, and equipment status within a system using computer hardware and software architecture. Traditional security management methods for power grid access equipment involve connecting hardware devices such as access control gates and identification terminals deployed in substations or office areas to a server in a back-end central computer room via communication cables. The front-end devices are only responsible for collecting personnel ID card numbers or biometric images and transmitting them to the server. The server retrieves a locally stored whitelist database for matching and verification, and upon successful verification, sends a relay closing signal to the front-end devices to open the door lock.

[0003] Existing power grid access equipment relies on backend servers to retrieve static whitelists for single-dimensional identity matching. This centralized verification model deprives front-end equipment of its ability to perceive the physical environment of the power grid. When substations are in high-risk conditions such as drastic fluctuations in voltage and current or circuit breakers are under maintenance grounding, the system issues relay closing commands based solely on identity legitimacy. This can lead to maintenance personnel accidentally entering live areas in unsafe environments, causing electric shock accidents. Furthermore, the over-reliance on communication links makes it impossible to implement effective localized safety assessment and emergency blocking when the network is interrupted. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a method for safety management of power grid access equipment based on edge computing.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a method for safety management of power grid access equipment based on edge computing, comprising the following steps: S1: Collect voltage monitoring values, current monitoring values ​​and circuit breaker open / closed status, compare the voltage monitoring values ​​with a preset voltage safety threshold, compare the current monitoring values ​​with a preset current safety threshold, and construct a power grid physical status identifier string based on the voltage monitoring values ​​exceeding the preset voltage safety threshold, the current monitoring values ​​exceeding the preset current safety threshold, or the circuit breaker open / closed status being a maintenance ground. S2: Call the secure hash algorithm to perform a one-way hash operation on the power grid physical state identifier string to generate a hash digest, convert the hash digest into elliptic curve group coordinate point values ​​through the elliptic curve cryptographic mapping rule, and construct dynamic environmental attribute elements based on the coordinate point values; S3: Obtain the identity attribute private key component and the access control policy ciphertext, combine the identity attribute private key component with the dynamic environment attribute element to construct a complete decryption key set, and use the bilinear pairing function to perform a decryption mapping operation on the complete decryption key set and the access control policy ciphertext to generate a bilinear mapping output value. S4: Calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and generate a relay drive high-level signal based on the fact that the numerical difference is zero.

[0006] As a further aspect of the present invention, the power grid physical status identifier string includes an abnormal status code representing voltage or current exceeding limits and a maintenance status code representing circuit breaker grounding; the dynamic environment attribute elements are specifically the abscissa component and ordinate component on the elliptic curve finite field; the complete decryption key set includes the identity attribute private key component and the dynamic environment attribute elements; the bilinear mapping output value specifically refers to the element value in the target multiplication group; and the relay drive high-level signal specifically refers to the DC voltage signal used to conduct the access control lock circuit.

[0007] As a further aspect of the present invention, step S1 specifically comprises: S11: Real-time acquisition of analog signals through voltage transformers and current transformers deployed at key nodes of power grid equipment, obtaining voltage monitoring values ​​and current monitoring values ​​after analog-to-digital conversion, and simultaneously detecting the opening and closing logic of circuit breaker auxiliary contacts to obtain the circuit breaker's open and closed status. S12: Retrieve the preset voltage safety threshold and preset current safety threshold from the local safety storage area, compare the voltage monitoring value with the preset voltage safety threshold, and compare the current monitoring value with the preset current safety threshold to determine whether the current power grid operating parameters are in the over-limit range. S13: When the judgment result shows that there is an over-limit situation or the circuit breaker's open / closed state indicates a ground connection, extract the corresponding fault type code or maintenance mode code, and concatenate and combine them according to the predefined timestamp sequence and separator rules to generate a power grid physical state identifier string with unique spatiotemporal characteristics.

[0008] As a further aspect of the present invention, step S2 specifically comprises: S21: Input the power grid physical state identifier string into the SHA-256 secure hash algorithm module, perform multiple iterations of compression mapping operation, and generate a binary sequence of fixed length 256 bits as a hash digest; S22: Divide the hash digest into high-order byte segments and low-order byte segments, and use the large integer modulo operation rule to map the byte segments to the integer range of the elliptic curve base domain to obtain candidate horizontal coordinate values; S23: Substitute the candidate horizontal coordinate values ​​into the preset Weierstrass elliptic curve equation, solve for the corresponding vertical coordinate values, verify whether the point is located on the curve, and after verification, combine the horizontal and vertical coordinates to confirm the coordinate point values ​​of the elliptic curve group, and then encapsulate and generate dynamic environment attribute elements.

[0009] As a further aspect of the present invention, step S3 specifically comprises: S31: Verify the operator's identity credentials through the encrypted communication channel, obtain the private key component of the identity attribute bound to the user's permissions from the key management center, and download the ciphertext of the access control policy to be decrypted from the edge gateway cache; S32: Using the matrix structure of the linear secret sharing scheme, the dynamic environment attribute elements are embedded as environment feature attributes into the decryption polynomial, and mathematically aggregated and recombined with the identity attribute private key components to construct a complete decryption key set including user identity features and current physical environment features; S33: Call the bilinear pairing function based on Tate pairing or Weil pairing to map the complete decryption key set to the source group where the access control policy ciphertext is located, perform bilinear mapping operation to eliminate the random number mask in the ciphertext, and thus calculate the bilinear mapping output value in the target group.

[0010] As a further aspect of the present invention, step S4 specifically comprises: S41: Read the bilinear mapping output value stored in the protected area of ​​the security chip, and simultaneously load the pre-negotiated preset decryption benchmark target value, wherein the preset decryption benchmark target value is used to characterize the legitimate session key or the verification identifier of the target; S42: Perform subtraction or division operations on a finite field, calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and perform zero value verification on the operation result; S43: When the verification result confirms that the numerical difference is strictly zero, a logic high-level command is sent to the relay drive circuit of the access controller to trigger the relay coil to close, thereby generating a relay drive high-level signal for unlocking the physical access control.

[0011] As a further aspect of the present invention, the process of generating the power grid physical state identifier string with unique spatiotemporal characteristics in step S13 includes: Obtain the current system time in milliseconds and the unique device identifier of the edge computing node; According to the preset coding mapping table, voltage over-limit events are mapped to the first abnormal code, current over-limit events are mapped to the second abnormal code, and circuit breaker grounding events are mapped to the last maintenance code. The millisecond-level timestamp, the device's unique identifier, the first abnormal code, the second abnormal code, and the last maintenance code are sequentially concatenated using the target's separator to generate the power grid physical status identifier string.

[0012] As a further aspect of the present invention, the process of mapping the byte segment to the integer range of the elliptic curve base domain using the large integer modulo arithmetic rule in step S22 to obtain candidate abscissa values ​​is performed according to the following mapping formula: ; in, Represents the candidate x-axis value, The hash digest after splitting is the first The value of a byte segment, This represents the preset weighting coefficient base, and the total number of segments. This represents a random salt value used to avoid hash collisions. It represents the prime order of the elliptic curve base field.

[0013] As a further aspect of the present invention, the process of generating a bilinear mapping output value by performing a decryption mapping operation on the complete decryption key set and the access control policy ciphertext using the bilinear pairing function in step S33 is performed according to the following pairing formula: ; in, Represents the output value of the bilinear mapping. Represents the bilinear pairing function. This represents the policy component within the encrypted access control policy. This represents the private key component representing the identity attribute in the complete decryption key set. This represents the ciphertext components that are associated with the environment within the ciphertext. This represents the key component corresponding to the dynamic environment attribute element. and These represent the auxiliary ciphertext and the base key used to eliminate randomization factors, respectively.

[0014] As a further aspect of the present invention, the process of sending a logic high-level command to the relay drive circuit of the access controller in step S43 includes: A control voltage of 3.3V or 5V is output through the GPIO port of the microcontroller, and the control voltage is applied to the base of the driving transistor after being isolated by an optocoupler. The driving transistor is controlled to enter a saturated conduction state, which energizes the relay coil connected in the collector circuit, thereby closing the normally open contact. By using closed contacts to connect an external 12V or 24V power supply circuit, the electromagnetic lock continuously outputs a high-level relay drive signal until a reset command is received.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by collecting power grid physical data such as the circuit breaker's open / closed status, voltage, and current, and comparing them with a safety threshold, the physical state is transformed into dynamic environmental attribute elements using a hash algorithm and elliptic curve mapping. A complete decryption key containing physical environment characteristics is constructed by combining the identity attribute private key. The access control policy ciphertext is decrypted using a bilinear pairing function. A drive signal is generated only when the physical state meets the security conditions and the bilinear mapping output value is consistent with the benchmark. Environmental security verification is forcibly integrated into the underlying encryption logic to prevent the risk of accidental entry into energized areas due to a single identity verification in high-risk situations. Attached Figure Description

[0016] Figure 1 This is a flowchart of the power grid equipment security management method based on edge computing of the present invention; Figure 2 Flowchart for constructing the power grid physical state identifier string of this invention; Figure 3 This is a flowchart illustrating the generation process of dynamic environment attribute elements in this invention. Figure 4 This is a flowchart of the bilinear pairing decryption operation of the present invention; Figure 5 This is a flowchart of the relay drive signal generation and control process of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the software-based technical solution is described in detail below with reference to system architecture diagrams and embodiments. It should be understood that the specific embodiments described herein are only for explaining the technical solutions of this invention and do not constitute a limitation on the scope of protection.

[0018] In the description of this invention, the system architecture relationships or data processing flows indicated by terms such as "layer," "module," "interface," "data flow," "client," and "server" are all defined based on the architecture diagram or flowchart corresponding to the embodiments. This way of describing is only used to clearly illustrate the logical relationships between the elements in the technical solution, and not to limit the physical deployment form. The term "multiple" includes two or more technical units, including but not limited to multiple data nodes, processing threads, service instances, or functional components and other scalable elements. The specific number is determined according to the actual business scenario and needs to be specifically specified.

[0019] Please see Figure 1 and Figure 2This invention provides a technical solution: a method for safety management of power grid access equipment based on edge computing, comprising the following steps: S1: Collect voltage monitoring values, current monitoring values ​​and circuit breaker open / close status, compare voltage monitoring values ​​with preset voltage safety thresholds, compare current monitoring values ​​with preset current safety thresholds, and construct a power grid physical status identifier string for maintenance grounding based on voltage monitoring values ​​exceeding preset voltage safety thresholds, current monitoring values ​​exceeding preset current safety thresholds, or circuit breaker open / close status. The power grid physical status identification string includes an abnormal status code indicating voltage or current exceeding limits and a maintenance status code indicating circuit breaker grounding. The specific steps of S1 are as follows: S11: Real-time acquisition of analog signals through voltage transformers and current transformers deployed at key nodes of power grid equipment, obtaining voltage monitoring values ​​and current monitoring values ​​after analog-to-digital conversion, and simultaneously detecting the opening and closing logic of circuit breaker auxiliary contacts to obtain the circuit breaker's open and closed status. S12: Retrieve the preset voltage safety threshold and preset current safety threshold from the local safety storage area, compare the voltage monitoring value with the preset voltage safety threshold, and compare the current monitoring value with the preset current safety threshold to determine whether the current power grid operating parameters are in the over-limit range. S13: When the judgment result shows that there is an over-limit situation or the circuit breaker opening and closing status indicates grounding connection, extract the corresponding fault type code or maintenance mode code, and combine them according to the predefined timestamp sequence and separator rules to generate a power grid physical status identifier string with unique spatiotemporal characteristics. The process of generating a unique spatiotemporal identifier string for the power grid physical state in S13 includes: Obtain the current system time in milliseconds and the unique device identifier of the edge computing node; According to the preset coding mapping table, voltage over-limit events are mapped to the first abnormal code, current over-limit events are mapped to the second abnormal code, and circuit breaker grounding events are mapped to the last maintenance code. The millisecond-level timestamp, the device's unique identifier, the first abnormal code, the second abnormal code, and the last maintenance code are sequentially concatenated using the target's separator to generate a power grid physical status identifier string.

[0020] By real-time acquisition of analog signals through voltage and current transformers deployed at key nodes of power grid equipment, the voltage and current monitoring values ​​are obtained after analog-to-digital conversion. The opening and closing logic of the circuit breaker auxiliary contacts is also detected simultaneously to obtain the circuit breaker's open and closed status. The preset voltage safety threshold and preset current safety threshold are retrieved from the local safety storage area. The voltage monitoring value is compared with the preset voltage safety threshold, and the current monitoring value is compared with the preset current safety threshold to determine whether the current power grid operating parameters are in the over-limit range. When the judgment result shows that there is an over-limit situation or the circuit breaker open / closed status indicates a ground connection, the corresponding fault type code or maintenance mode code is extracted, and it is spliced ​​and combined according to the predefined timestamp sequence and separator rules to generate a power grid physical status identifier string with unique spatiotemporal characteristics.

[0021] In the specific operational scenario of the substation edge computing node, the system first activates the electromagnetic voltage transformer and protective current transformer deployed on the 10kV bus side. The data acquisition module discretizes the analog voltage and current signals at a sampling frequency of 2kHz. A 16-bit resolution chip is used for the analog-to-digital converter to convert the acquired analog signals into digital quantities and transmit them to the DSP processor of the edge gateway. The processor performs root mean square (RMS) calculation on the sampled data within one power frequency cycle. The calculation formula is: .

[0022] in, Represents the root mean square value of voltage or current. This represents the total number of sampling points within one power frequency cycle. Representing the The instantaneous values ​​of each sampling point This represents the summation operator.

[0023] At the current moment, the system calculates the voltage monitoring value to be 10.85kV and the current monitoring value to be 420A. Simultaneously, by scanning the level of the circuit breaker's auxiliary contacts using the GPIO port, a low-level input pin is detected. After debouncing, this is confirmed as a "circuit breaker closed" state, i.e., a non-maintenance grounding state.

[0024] The system then retrieves the preset threshold parameters from the local encrypted EEPROM storage area. For the 10kV voltage level, based on the power quality supply voltage allowable deviation standard, the upper limit of the preset voltage safety threshold is set to 10.7kV. For load characteristics, based on the load curve analysis over the previous 7 days, the preset current safety threshold is set to 600A. The processor executes the numerical comparison logic: comparing the voltage monitoring value of 10.85kV with the upper limit of the preset voltage safety threshold of 10.7kV, the result is determined to be 10.85kV greater than 10.7kV, constituting a "voltage limit violation" event; comparing the current monitoring value of 420A with the preset current safety threshold of 600A, the result is determined to be 420A less than 600A, constituting a "normal current" state. Regarding the circuit breaker status, since no grounding switch closing signal was detected, it is determined to be in a "non-grounded" state.

[0025] Based on the above judgment results, the system calls the preset encoding mapping table for character extraction. For voltage over-limit events, the mapping table specifies the first abnormal code as OV; for normal current events, the mapping table specifies the second abnormal code as CN; for non-grounded states, the mapping table specifies the last maintenance code as NG. Subsequently, the system calls the string concatenation function to obtain the current system millisecond-level timestamp 1733121000123, using the vertical bar symbol | as the separator. The processor loads the above data segments into the memory buffer in the order of "timestamp|device ID|voltage code|current code|circuit breaker code", constructing the final power grid physical state identifier string as: 1733121000123|EDGE-NODE-A7X|OV|CN|NG. This string contains the physical environment characteristics of this spatial node at this moment, serving as the data basis for subsequent dynamic key generation.

[0026] Table 1 lists the parameter settings and data collection comparisons involved in this step;

[0027] As shown in Table 1, by comparing the actual monitored values ​​with the preset safety threshold, the system accurately identified the abnormal voltage state and, in conjunction with the device ID and timestamp, completed the structured assembly of the physical status identifier string.

[0028] Please see Figure 1 and Figure 3 S2: Call the secure hash algorithm to perform a one-way hash operation on the power grid physical state identifier string to generate a hash digest. Convert the hash digest into elliptic curve group coordinate point values ​​through elliptic curve cryptography mapping rules. Construct dynamic environmental attribute elements based on the coordinate point values. The dynamic environment attribute elements are specifically the horizontal and vertical coordinate components on the finite field of the elliptic curve. The specific steps of S2 are as follows: S21: Input the power grid physical state identifier string into the SHA-256 secure hash algorithm module, perform multiple iterations of compression mapping operation, and generate a fixed-length 256-bit binary sequence as a hash digest; S22: Divide the hash digest into high-order byte segments and low-order byte segments, and use the large integer modulo operation rule to map the byte segments to the integer range of the elliptic curve base domain to obtain candidate x-coordinate values; The process of S22, which uses the large integer modulo arithmetic rule to map the byte segment to the integer range of the elliptic curve base domain to obtain candidate x-coordinate values, is performed according to the following mapping formula: ; in, Represents the candidate x-axis value, The hash digest after splitting is the first The value of a byte segment, This represents the preset weighting coefficient base. Represents the total number of segments. This represents a random salt value used to avoid hash collisions. The prime order representing the base field of the elliptic curve; S23: Substitute the candidate x-coordinate values ​​into the preset Weierstrass elliptic curve equation, solve for the corresponding y-coordinate values, verify whether the point is located on the curve, and after verification, confirm the x and y coordinates as the coordinate points of the elliptic curve group, and then encapsulate and generate dynamic environment attribute elements.

[0029] The power grid physical state identifier string is input into the SHA-256 secure hash algorithm module, and multiple iterations of compression mapping operations are performed to generate a fixed-length 256-bit binary sequence as a hash digest. The hash digest is divided into high-order byte segments and low-order byte segments. The byte segments are mapped to the integer range of the elliptic curve base field using the large integer modulo operation rule to obtain the candidate x-coordinate values. Substitute the candidate x-coordinate values ​​into the preset Weierstrass elliptic curve equation to solve for the corresponding y-coordinate values. Verify whether the point is located on the curve. After verification, combine the x and y coordinates to confirm the coordinate point values ​​of the elliptic curve group, and then encapsulate and generate dynamic environment attribute elements.

[0030] The aforementioned SHA-256 secure hash algorithm module refers to a cryptographic hash function that accepts input data of arbitrary length and outputs a hash value of fixed length 256 bits (i.e., 32 bytes). This algorithm belongs to the SHA-2 series of standards and is widely used in digital signatures and integrity verification.

[0031] The processor reads the power grid physical status identifier string 1733121000123|EDGE-NODE-A7X|OV|CN|NG generated in step S1, converts it into a UTF-8 encoded byte stream, and inputs it to the SHA-256 module in the hardware encryption acceleration engine. The module internally performs 64 rounds of compression loops, outputting a 256-bit hash digest. To map this digest to coordinates on an elliptic curve, the system first performs segmentation. The total number of segments is set to 4, i.e., each segment is 64 bits (8 bytes). The system sequentially extracts 4 byte segments and converts them into large decimal integers. For example, the first segment of data is converted to a decimal value of... .

[0032] Next, the system calculates the candidate x-coordinate values ​​according to the rules of large integer modulo arithmetic. The weighting coefficient base is then set. The value is 256, and the random salt value is... The value is set to 12345, obtained using a true random number generator. The prime order of the elliptic curve base area. Prime numbers defined by the secp256r1 standard are selected. The mapping formula execution process is as follows: .

[0033] in, Represents the candidate x-axis value, Represents the summation operator. The hash digest after splitting is the first The decimal integer value of a byte segment This represents the preset weighting coefficient base. Represents the segment number. This represents a random salt value used to avoid hash collisions. The prime order representing the base field of the elliptic curve. Represents modular arithmetic.

[0034] Through the weighted summation and modulo operation described above, the linearly arranged hash bitstream is mapped to the domain of an elliptic curve. The calculation assumes the summation result is... The candidate x-coordinate values ​​calculated by the system The value is 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296.

[0035] The system then verifies whether the x-axis corresponds to a valid point on the curve. The candidate x-axis values ​​are then... Substituting into the Weierstrass equation For the secp256r1 curve, the parameters... and is a standard constant. The system calculates the values ​​on the right side of the equation and its Legendre sign to determine whether it is modulo. The quadratic residue. In this embodiment, the congruence equation is solved using the Tonelli-Shanks algorithm, yielding two solutions, and the smaller positive integer solution is selected as the ordinate value. Assuming the verification passes, the ordinate value is calculated. The value is 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5. Ultimately, the system encapsulates the combination of the x and y coordinates into a dynamic environment attribute element, which is the elliptic curve group. A point on it, used for subsequent pairing operations.

[0036] Please see Figure 1 and Figure 4 S3: Obtain the identity attribute private key component and access control policy ciphertext, combine the identity attribute private key component and dynamic environment attribute elements to construct a complete decryption key set, and use the bilinear pairing function to perform decryption mapping operation on the complete decryption key set and access control policy ciphertext to generate a bilinear mapping output value. The complete decryption key set includes the identity attribute private key component, dynamic environment attribute elements, and the bilinear mapping output value specifically refers to the element value in the target multiplicative group; The specific steps for S3 are as follows: S31: Verify the operator's identity credentials through the encrypted communication channel, obtain the private key component of the identity attribute bound to the user's permissions from the key management center, and download the ciphertext of the access control policy to be decrypted from the edge gateway cache; S32: Utilizing the matrix structure of the linear secret sharing scheme, dynamic environment attribute elements are embedded as environment feature attributes into the decryption polynomial, and mathematically aggregated and recombined with the identity attribute private key components to construct a complete decryption key set including user identity features and current physical environment features. S33: Call the bilinear pairing function based on Tate pairing or Weil pairing to map the complete decryption key set to the source group where the access control policy ciphertext is located, perform bilinear mapping operation to eliminate the random number mask in the ciphertext, and thus calculate the bilinear mapping output value in the target group. S33's process of using a bilinear pairing function to perform a decryption mapping operation on the complete decryption key set and access control policy ciphertext to generate a bilinear mapping output value is performed according to the following pairing formula: ; in, Represents the output value of the bilinear mapping. Represents the bilinear pairing function. This represents the policy component within the encrypted access control policy. This represents the private key component representing the identity attribute in the complete decryption key set. This represents the ciphertext components that are associated with the environment within the ciphertext. This represents the key component corresponding to the dynamic environment attribute element. and These represent the auxiliary ciphertext and the base key used to eliminate randomization factors, respectively.

[0037] The operator's identity credentials are verified through an encrypted communication channel, the private key component of the identity attribute bound to the user's permissions is obtained from the key management center, and the ciphertext of the access control policy to be decrypted is downloaded from the edge gateway cache. By utilizing the matrix structure of the linear secret sharing scheme, dynamic environment attribute elements are embedded as environment feature attributes into the decryption polynomial, and then mathematically aggregated and recombined with the identity attribute private key components to construct a complete decryption key set that includes user identity features and current physical environment features. The bilinear pairing function based on Tate pairing or Weil pairing is called to map the complete decryption key set to the source group where the access control policy ciphertext is located. The bilinear mapping operation is performed to eliminate the random number mask in the ciphertext, thereby calculating the bilinear mapping output value in the target group.

[0038] The aforementioned bilinear pairing function refers to a specific mathematical mapping relationship established between two cyclic groups. It has non-degeneracy and bilinearity, and can transform the discrete logarithm problem on elliptic curve groups into a problem on multiplicative groups. It is often used in identity-based encryption schemes.

[0039] The operator swipes their card at the access control card reader, and the system sends their identity credentials to the key management center via a TLS 1.3 encrypted channel. After successful verification by the key management center, it issues a private key component containing the user's identity attributes. This private key component is generated based on an attribute-based encryption scheme and includes the user's role attributes. Simultaneously, the edge gateway obtains the current access control policy ciphertext, which includes the policy component, the environment-related ciphertext component, and randomized auxiliary ciphertext.

[0040] During the decryption phase, the system combines the dynamic environment attribute elements generated in step S2 with the identity attribute private key components to construct a complete decryption key set. The system uses bilinear pairing for the operation, and the pairing formula is as follows: .

[0041] in, Represents the output value of the bilinear mapping. Represents the bilinear pairing function. This represents the policy component within the encrypted access control policy. This represents the private key component representing the identity attribute in the complete decryption key set. This represents the ciphertext components that are associated with the environment within the ciphertext. This represents the key component corresponding to the dynamic environment attribute element. This represents the auxiliary ciphertext used to eliminate the randomization factor. The base key is represented by the multiplication and division operations in the formula, which represent group operations on the target group.

[0042] By utilizing the properties of bilinear mapping, the exponential terms in the numerator and denominator can cancel each other out or recombine only when the user's identity attribute private key and the current dynamic environment attribute elements simultaneously satisfy the access policy tree set by the ciphertext, thereby restoring the uniquely determined target group elements.

[0043] To illustrate the computation process, we will map the elements of the target group to large integers. (Setting...) The calculation result mapping value is , The calculation result mapping value is , The calculation result mapping value is The computation process involves performing multiplication and modular inverse operations over a finite field. The final bilinear mapping output value is calculated using an FPGA accelerator card. This is a 3072-bit integer with a hexadecimal prefix of 0x4A2F... This value will only equal the preset decryption baseline target value if the "identity is valid" and the "environment matches".

[0044] Please see Figure 1 and Figure 5 S4: Calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and generate a relay drive high-level signal based on the fact that the numerical difference is zero; The high-level signal for relay drive specifically refers to the DC voltage signal used to activate the access control lock circuit; The specific steps for S4 are as follows: S41: Read the bilinear mapping output value stored in the protected area of ​​the security chip, and simultaneously load the pre-negotiated preset decryption benchmark target value, wherein the preset decryption benchmark target value is used to characterize the legitimate session key or the verification identifier of the target; S42: Perform subtraction or division operations on a finite field, calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and perform zero value verification on the operation result; S43: When the verification result confirms that the numerical difference is strictly zero, a logic high-level command is sent to the relay drive circuit of the access controller to trigger the relay coil to close, thereby generating a relay drive high-level signal for unlocking the physical access control. The process by which S43 sends a logic high-level command to the relay drive circuit of the access control controller includes: The microcontroller outputs a 3.3V or 5V control voltage through its GPIO port. This control voltage is then isolated by an optocoupler and applied to the base of the driving transistor. The control drive transistor enters the saturation conduction state, which energizes the relay coil connected in the collector circuit, thereby closing the normally open contact. By using closed contacts to connect an external 12V or 24V power supply circuit, a high-level relay drive signal is continuously output to the electromagnetic lock until a reset command is received.

[0045] Read the bilinear mapping output value stored in the protected area of ​​the security chip, and simultaneously load the pre-negotiated preset decryption benchmark target value, where the preset decryption benchmark target value is used to characterize the legitimate session key or the verification identifier of the target; Perform subtraction or division operations on a finite field, calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and perform zero value verification on the operation result; When the verification result confirms that the numerical difference is strictly zero, a logic high-level command is sent to the relay drive circuit of the access control controller to trigger the relay coil to close, thereby generating a relay drive high-level signal for unlocking the physical access control.

[0046] The microcontroller reads the bilinear mapping output value calculated in step S3 from the secure RAM. Simultaneously, the microcontroller loads a preset decryption baseline target value from the hardware-protected TrustZone area. This baseline value is a random secret value selected by the sender during the encryption phase and hidden in the ciphertext using a secret-sharing method.

[0047] The microcontroller performs a numerical difference verification operation. Since both the bilinear mapping output value and the preset decryption benchmark target value are large integers, the processor calls the large number arithmetic library to perform subtraction to calculate the numerical difference. In the actual example, the bilinear mapping output value and the preset decryption benchmark target value are the same, resulting in a value of 0. The system performs a zero-bit check on the calculation result; if all bits are 0, the verification passes. This result indicates that the current operation request fully complies with the access policy of "specific personnel under specific physical power grid conditions," verifying the legality and timeliness of the request.

[0048] After successful verification, the microcontroller pulls the GPIO1.0 pin high to 3.3V. This signal is connected to the anode of the optocoupler's input, driving the internal LED to conduct and saturating the output phototransistor, achieving electrical isolation between the control and drive sides. The optocoupler output is connected to the base of the driving phototransistor, causing it to enter saturation. The relay coil connected in series with the phototransistor's collector is then energized, with a coil current of approximately 30mA. The electromagnetic force overcomes the spring resistance, closing the normally open contact. The closed relay contact connects the power supply circuit of the external electromagnetic lock, outputting a 12V drive current to the lock. At this point, the physical access control unlocks, allowing maintenance personnel to enter the high-voltage room for repairs. If the verification fails, the microcontroller keeps the GPIO low, the relay does not activate, the access control remains locked, and an unauthorized access log is recorded.

[0049] Table 2 summarizes the signal conversion logic and electrical parameters in this step; As shown in Table 2, the system accurately converts from zero-value verification in the digital domain to voltage drive in the analog domain, completing the entire process from algorithm verification to physical execution.

[0050] The above embodiments illustrate preferred embodiments of the present invention. Any equivalent adjustments to the technical solution based on software engineering methods are within the scope of protection, including but not limited to: implementing algorithm logic using different programming languages, refactoring functional modules into services, adjusting data interaction protocols, and optimizing resource scheduling strategies. Any implementation scheme derived from reasonable modifications to the data processing flow, service call chain, or system architecture layer without departing from the core technology of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A method for safety management of power grid access equipment based on edge computing, characterized in that, Includes the following steps: S1: Collect voltage monitoring values, current monitoring values ​​and circuit breaker open / closed status, compare the voltage monitoring values ​​with a preset voltage safety threshold, compare the current monitoring values ​​with a preset current safety threshold, and construct a power grid physical status identifier string based on the voltage monitoring values ​​exceeding the preset voltage safety threshold, the current monitoring values ​​exceeding the preset current safety threshold, or the circuit breaker open / closed status being a maintenance ground. S2: Call the secure hash algorithm to perform a one-way hash operation on the power grid physical state identifier string to generate a hash digest, convert the hash digest into elliptic curve group coordinate point values ​​through the elliptic curve cryptographic mapping rule, and construct dynamic environmental attribute elements based on the coordinate point values; S3: Obtain the identity attribute private key component and the access control policy ciphertext, combine the identity attribute private key component with the dynamic environment attribute element to construct a complete decryption key set, and use the bilinear pairing function to perform a decryption mapping operation on the complete decryption key set and the access control policy ciphertext to generate a bilinear mapping output value. S4: Calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and generate a relay drive high-level signal based on the fact that the numerical difference is zero.

2. The method for safety management of power grid access equipment based on edge computing according to claim 1, characterized in that, The power grid physical status identifier string includes an abnormal status code representing voltage or current exceeding limits and a maintenance status code representing circuit breaker grounding. The dynamic environment attribute elements are specifically the horizontal and vertical coordinate components on the elliptic curve finite field. The complete decryption key set includes the identity attribute private key component and the dynamic environment attribute elements. The bilinear mapping output value specifically refers to the element value in the target multiplication group. The relay drive high-level signal specifically refers to the DC voltage signal used to conduct the access control lock circuit.

3. The method for safety management of power grid access equipment based on edge computing according to claim 2, characterized in that, The specific steps of S1 are as follows: S11: Real-time acquisition of analog signals through voltage transformers and current transformers deployed at key nodes of power grid equipment, obtaining voltage monitoring values ​​and current monitoring values ​​after analog-to-digital conversion, and simultaneously detecting the opening and closing logic of circuit breaker auxiliary contacts to obtain the circuit breaker's open and closed status. S12: Retrieve the preset voltage safety threshold and preset current safety threshold from the local safety storage area, compare the voltage monitoring value with the preset voltage safety threshold, and compare the current monitoring value with the preset current safety threshold to determine whether the current power grid operating parameters are in the over-limit range. S13: When the judgment result shows that there is an over-limit situation or the circuit breaker's open / closed state indicates a ground connection, extract the corresponding fault type code or maintenance mode code, and concatenate and combine them according to the predefined timestamp sequence and separator rules to generate a power grid physical state identifier string with unique spatiotemporal characteristics.

4. The method for safety management of power grid access equipment based on edge computing according to claim 3, characterized in that, The specific steps of S2 are as follows: S21: Input the power grid physical state identifier string into the SHA-256 secure hash algorithm module, perform multiple iterations of compression mapping operation, and generate a binary sequence of fixed length 256 bits as a hash digest; S22: Divide the hash digest into high-order byte segments and low-order byte segments, and use the large integer modulo operation rule to map the byte segments to the integer range of the elliptic curve base domain to obtain candidate horizontal coordinate values; S23: Substitute the candidate horizontal coordinate values ​​into the preset Weierstrass elliptic curve equation, solve for the corresponding vertical coordinate values, verify whether the point is located on the curve, and after verification, combine the horizontal and vertical coordinates to confirm the coordinate point values ​​of the elliptic curve group, and then encapsulate and generate dynamic environment attribute elements.

5. The method for safety management of power grid access equipment based on edge computing according to claim 4, characterized in that, The specific steps of S3 are as follows: S31: Verify the operator's identity credentials through the encrypted communication channel, obtain the private key component of the identity attribute bound to the user's permissions from the key management center, and download the ciphertext of the access control policy to be decrypted from the edge gateway cache; S32: Using the matrix structure of the linear secret sharing scheme, the dynamic environment attribute elements are embedded as environment feature attributes into the decryption polynomial, and mathematically aggregated and recombined with the identity attribute private key components to construct a complete decryption key set including user identity features and current physical environment features; S33: Call the bilinear pairing function based on Tate pairing or Weil pairing to map the complete decryption key set to the source group where the access control policy ciphertext is located, perform bilinear mapping operation to eliminate the random number mask in the ciphertext, and thus calculate the bilinear mapping output value in the target group.

6. The method for safety management of power grid access equipment based on edge computing according to claim 5, characterized in that, The specific steps of S4 are as follows: S41: Read the bilinear mapping output value stored in the protected area of ​​the security chip, and simultaneously load the pre-negotiated preset decryption benchmark target value, wherein the preset decryption benchmark target value is used to characterize the legitimate session key or the verification identifier of the target; S42: Perform subtraction or division operations on a finite field, calculate the numerical difference between the bilinear mapping output value and the preset decryption benchmark target value, and perform zero value verification on the operation result; S43: When the verification result confirms that the numerical difference is strictly zero, a logic high-level command is sent to the relay drive circuit of the access controller to trigger the relay coil to close, thereby generating a relay drive high-level signal for unlocking the physical access control.

7. The method for safety management of power grid access equipment based on edge computing according to claim 6, characterized in that, The process of generating the power grid physical state identifier string with unique spatiotemporal characteristics as described in S13 includes: Obtain the current system time in milliseconds and the unique device identifier of the edge computing node; According to the preset coding mapping table, voltage over-limit events are mapped to the first abnormal code, current over-limit events are mapped to the second abnormal code, and circuit breaker grounding events are mapped to the last maintenance code. The millisecond-level timestamp, the device's unique identifier, the first abnormal code, the second abnormal code, and the last maintenance code are sequentially concatenated using the target's separator to generate the power grid physical status identifier string.

8. The method for safety management of power grid access equipment based on edge computing according to claim 7, characterized in that, The process described in S22, which maps the byte segment to the integer range of the elliptic curve base domain using the large integer modulo arithmetic rule to obtain candidate abscissa values, is performed according to the following mapping formula: ； in, Represents the candidate x-axis value, The hash digest after splitting is the first The value of a byte segment, This represents the preset weighting coefficient base. Represents the total number of segments. This represents a random salt value used to avoid hash collisions. It represents the prime order of the elliptic curve base field.

9. The method for safety management of power grid access equipment based on edge computing according to claim 8, characterized in that, The process described in S33, which uses a bilinear pairing function to perform a decryption mapping operation on the complete decryption key set and the access control policy ciphertext to generate a bilinear mapping output value, is performed according to the following pairing formula: ； in, Represents the output value of the bilinear mapping. Represents the bilinear pairing function. This represents the policy component within the encrypted access control policy. This represents the private key component representing the identity attribute in the complete decryption key set. This represents the ciphertext components that are associated with the environment within the ciphertext. This represents the key component corresponding to the dynamic environment attribute element. and These represent the auxiliary ciphertext and the base key used to eliminate randomization factors, respectively.

10. The method for safety management of power grid access equipment based on edge computing according to claim 9, characterized in that, The process of sending a logic high-level command to the relay drive circuit of the access controller as described in S43 includes: A control voltage of 3.3V or 5V is output through the GPIO port of the microcontroller, and the control voltage is applied to the base of the driving transistor after being isolated by an optocoupler. The driving transistor is controlled to enter a saturated conduction state, which energizes the relay coil connected in the collector circuit, thereby closing the normally open contact. By using closed contacts to connect an external 12V or 24V power supply circuit, the electromagnetic lock continuously outputs a high-level relay drive signal until a reset command is received.

Images