Intelligent energy security authentication system and method

Abstract

The invention provides an intelligent energy security authentication system and method, and belongs to the technical field of power grids. Wherein the system is set based on a smart power grid, and a trusted third party is added; the authentication method comprises the following steps: S1, generating a key; s2, encrypting the authentication information; s3, acquiring a secret key; s4, decrypting the authentication information; and S5, sending an instruction. According to the invention, through asymmetric encryption of communication of the master station and the terminal, secure transmission and decryption of an added device identifier are protected, and in combination with the setting of segmented storage of a trusted third party by a private key, the communication security is ensured and the overall security of the smart grid is also improved without significantly increasing system computing resources; and the method is more suitable for a multi-demand power distribution scene.

Description

Technical Field

[0001] This invention relates to the field of power grid technology, and in particular to an intelligent energy security authentication system and method. Background Technology

[0002] With the development of industrial technology and the gradual increase in urbanization rate, the demand for electricity across the country is also increasing daily. At present, the main approach to solving the electricity supply and demand problem is still the "increasing supply and reducing consumption" solution. Among them, increasing supply means using continuously developing new energy technologies to fill the existing power gap and gradually replace traditional fossil fuels; reducing consumption means using computer information technology to upgrade and promote energy efficiency to achieve the goal of energy conservation.

[0003] Furthermore, the measures of increasing power supply and reducing energy consumption are not independent components; they can be combined by upgrading the existing power grid to achieve a synergistic effect. As a result, the market and stakeholders have proposed related concepts such as smart grids.

[0004] Smart grids are intelligent upgrades of traditional power grids, primarily built on efficient two-way communication. The basic approach involves modifying or adding advanced sensing and measurement technologies and equipment to the existing power grid, integrating advanced control methods and corresponding decision support system technologies to achieve the goals of a reliable, efficient, and safe power grid. It can provide electricity that meets user needs, while also being compatible with the access requirements of different new energy sources and allowing for flexible allocation in accordance with actual needs.

[0005] Currently, the development of smart grids is still in its initial stage. The automation rate of urban distribution network feeders in China is insufficient, and it is still in the early stages of pilot projects and initial construction. With increased national investment in smart grid construction, the intelligence rate of distribution networks will reach a new level. However, due to the enhanced interconnectivity, the variety of power distribution terminal equipment, complex network connections, significant protocol differences, and limited equipment resources, problems such as a wide attack surface and difficulties in analyzing equipment behavior arise. This makes the power grid highly vulnerable to attacks during operation, and power grid security is a crucial aspect of national strategic security, directly related to people's livelihoods and national security. Because traditional distribution IoT solutions suffer from outdated network hardware and software configurations and management levels at the edge, a systematic network security framework is needed to meet the growing demands of digitalization.

[0006] Existing smart distribution network systems mainly consist of three parts: smart metering master stations, communication systems, and automated monitoring terminals (smart metering terminals), forming a complete information transmission and processing system to achieve remote management of the distribution network operation. The communication system is the key and core of data transmission. Currently, the communication system is still built on existing communication networks, mainly using fiber optic and power line carrier communication. Although the aforementioned networking technologies are mature and cost-effective, mature technologies also mean that corresponding attack methods are diverse and highly dangerous, thus facing serious security and confidentiality challenges. In particular, conventional data transmission is vulnerable to attacks such as eavesdropping and theft. Especially in wireless network connections, unauthorized users can impersonate legitimate internal terminals anywhere they receive wireless mobile signals and launch attacks on the dedicated network, thus threatening its security.

[0007] Currently, the most common authentication methods on the market can be mainly divided into the following categories:

[0008] 1. Static Encryption Communication: Using a pre-exchanged key, the sender encrypts the transmitted information, and the receiver decrypts it to obtain the corresponding plaintext, thereby authenticating access and issuing further instructions. This technical solution is simple, efficient, low-cost, and consumes few system resources. However, if the key is subsequently cracked using dictionary tools, leaked due to human error, obtained through malware insertion, or intercepted from the initial key, unauthorized users can freely eavesdrop or attack, causing incalculable losses. Therefore, static encryption is rarely used alone for communication in large-scale engineering projects.

[0009] 2. Dynamic Encrypted Communication: The sender encrypts the communication within a specified timeframe using independent or agreed-upon dynamic information. The receiver decrypts the encrypted information to obtain the corresponding plaintext, which is then used for authentication and to issue further instructions. This technical solution is an upgrade from static encrypted communication, increasing the difficulty of key cracking. However, attackers can still combine eavesdropping information with existing encryption methods to reverse-engineer the key, ultimately obtaining it and enabling them to launch an attack.

[0010] 3. Asymmetric Encryption: This method involves generating a public and private key. After exchanging information, the sender encrypts the information using the public key, and the receiver decrypts it using the private key. While this approach effectively solves the problem of easily cracked keys without significantly increasing computational resources, attackers can still obtain the private key by attacking a facility, thus rendering the encryption protection ineffective.

[0011] Based on this, it is also necessary to explore a secure authentication method between the master station and the power terminal that can ensure the security of data communication without significantly increasing the consumption of system computing resources. Summary of the Invention

[0012] To overcome the shortcomings of the existing technology, the present invention provides an intelligent energy safety authentication system and method, the system mainly including an intelligent measurement master station and an intelligent measurement terminal;

[0013] The system also includes a trusted third party, and the intelligent measurement master station communicates encryptedly with both the intelligent measurement terminal and the trusted third party; the intelligent measurement master station is equipped with a device identifier decryption module, and the intelligent measurement terminal is equipped with a device identifier encryption module;

[0014] The intelligent measurement master station is also connected to the intelligent power distribution network; the intelligent power distribution network is connected to the new energy access point;

[0015] The intelligent measurement terminal is equipped with a time-of-use electricity price setting module; the time-of-use electricity price setting module is equipped with a human-machine interface for displaying time-of-use electricity prices and receiving user electricity consumption plan parameter setting information;

[0016] The intelligent measurement terminal is also equipped with a dedicated transformer fee control module; the dedicated transformer fee control module is equipped with an alarm unit and a smart meter, used to remind users to pay fees and handle remote power rationing.

[0017] On the other hand, the present invention also provides an encrypted communication authentication method based on an intelligent energy security authentication system, wherein the communication authentication steps include:

[0018] S1. The intelligent measurement master station generates a first key, including a first public key and a first private key; the intelligent measurement master station distributes the first public key to the intelligent measurement terminal and segments the first private key, including a first-level private key and a second-level private key; the intelligent measurement master station only stores the first-level private key and sends the second-level private key to a trusted third party for storage;

[0019] S2. The intelligent measurement terminal is the sender, and the device identification encryption module obtains the authentication ciphertext by encrypting the first public key and the identifier of the requesting access device.

[0020] S3. The intelligent measurement master station is the receiver. After receiving the authentication ciphertext, it sends a key request to the trusted third party. The trusted third party sends the secondary private key to the intelligent measurement master station.

[0021] S4. After the intelligent measurement master station receives the secondary private key, the device identification decryption module combines the secondary private key with the primary private key stored in the station to form the first private key, and then decrypts the authentication ciphertext using the first private key to obtain plaintext containing authentication information.

[0022] S5. The intelligent measurement master station compares the authentication information and the filing information in the plaintext. If the information matches, the authentication result is confirmed, and a power distribution command is sent to the intelligent measurement terminal.

[0023] Preferably, before step S1, the trusted third party generates a second key, including a second public key and a second private key, and sends the second public key to the intelligent measurement master station;

[0024] In step S1, the intelligent measurement master station encrypts the secondary private key using the second public key and then sends it to the trusted third party; after receiving the ciphertext, the trusted third party decrypts it using the stored second private key to obtain the secondary private key and stores it.

[0025] Preferably, in step S3, the trusted third party encrypts the secondary private key and sends it to the intelligent measurement master station.

[0026] Preferably, the secondary private key encryption method is a timestamp-based dynamic encryption, and the steps include:

[0027] S31. The trusted third party performs an XOR operation between the string of the secondary private key and the string of the timestamp, and sends the encrypted string with the timestamp added to it to the intelligent measurement master station.

[0028] S32. After receiving the encrypted information, the intelligent measurement master station obtains the secondary private key by XOR decrypting the timestamp. 。

[0029] Preferably, in step S31, a time period estimated or predetermined by the intelligent measurement master station is added before the timestamp is encrypted.

[0030] In step S32, before performing the decryption operation, the intelligent measurement master station adds the time period to the timestamp and then performs XOR decryption.

[0031] Preferably, in step S4, after the intelligent measurement master station completes the plaintext decryption, it destroys the temporarily stored private key and the secondary private key.

[0032] Preferably, the private key and the secondary private key are destroyed by deletion and by overwriting the storage area with invalid information.

[0033] Preferably, in step S5, the registration information is the request access device identifier of the intelligent measurement master station that has been uploaded in advance.

[0034] The present invention employs the above-mentioned intelligent energy safety authentication system and method, which, compared with the prior art, has the following beneficial effects:

[0035] This invention protects the secure transmission and decryption of the device identifier by using asymmetric encryption for communication between the master station and the terminal. Combined with the setting of storing the private key in segments by a trusted third party, it ensures communication security and improves the overall security of the smart grid without significantly increasing the system's computing resources, making it more adaptable to multi-demand power distribution scenarios. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a system diagram in a specific embodiment of the present invention;

[0038] Figure 2 This is a flowchart of a method in a specific embodiment of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] like Figure 1 As shown, this invention provides an intelligent energy safety authentication system, including an intelligent measurement master station and intelligent measurement terminals. It also includes a trusted third party. The intelligent measurement master station has bidirectional encrypted communication and power supply connections with multiple terminals, including intelligent measurement terminals 1 to n, and a bidirectional encrypted communication connection with the trusted third party. The trusted third party is a crucial link in the encrypted communication and can specifically be an entity trusted by both communicating parties, such as a certificate management authority.

[0041] The intelligent measurement master station is also equipped with a device identification decryption module, and the corresponding intelligent measurement terminal is equipped with a device identification encryption module.

[0042] The intelligent measurement master station is also connected to the intelligent distribution network. As a key national construction system, the intelligent distribution network belongs to the existing power grid. It is connected to the newly added new energy access points 1 to m, thereby connecting the new energy to the overall power grid.

[0043] The intelligent metering terminals are sequentially connected to various electrical devices, as shown in the figure. Intelligent metering terminal 1 connects to user devices 1 through 2. Furthermore, each intelligent metering terminal is equipped with a time-of-use pricing module, specifically a human-computer interaction interface including a display and input devices (keyboard, mouse, buttons, touchscreen, or one or more combinations thereof). This interface displays the time-of-use pricing and receives user electricity plan parameter settings. The system allows users to set flexible electricity consumption strategies and parameters based on time-of-use pricing according to their actual needs, adapting to electricity demand at different times and achieving efficient utilization and rational allocation of electrical energy.

[0044] The intelligent metering terminal also includes a dedicated transformer fee control module, which is equipped with an alarm unit and a smart meter. The alarm unit includes an audible and visual alarm, which can be triggered under preset conditions to remind users to pay their bills. Furthermore, it can remotely disconnect the power supply via the smart meter to limit power in case of arrears or when the arrears reach a preset amount.

[0045] On the other hand, the present invention also provides a communication method based on the above system, combined with Figure 2 The steps described include:

[0046] First, based on asymmetric encryption logic, a trusted third party generates a second key, including a second public key and a second private key. The second public key is sent to the intelligent measurement master station, and the second private key is stored by the third party to achieve the prerequisite for encrypted communication.

[0047] S1. The communication system of the intelligent measurement master station generates a first key, including a first public key and a first private key, and distributes the first public key to each intelligent measurement terminal for storage; then, the intelligent measurement master station segments the first private key; for example, the first private key string is: [A0; A1; A2...A...]. w The private key is divided into segments: [A0; A1; A2...A...]. p ] and secondary private key [A p+1 ...A w The intelligent measurement master station only stores the first-level private key [A0; A1; A2...A...]. p ], and the secondary private key [A p+1 ...A w Send to a trusted third-party storage.

[0048] Preferably, before sending, the intelligent measurement master station uses the second public key to verify the secondary private key [A]. p+1 ...A w The encrypted secondary private key is then sent to a trusted third party; the trusted third party receives the encrypted secondary private key and decrypts it using the stored secondary private key to obtain the secondary private key [A]. p+1 ...A w ], and store.

[0049] S2. The intelligent measurement terminal 1 is the sender. The device identification encryption module calculates the authentication ciphertext based on the first public key and the identifier of the device 1 requesting access, and then sends the authentication ciphertext to the intelligent measurement master station.

[0050] S3. The intelligent measurement master station, as the receiver, sends a key request to a trusted third party after receiving the authentication ciphertext. The trusted third party then sends the secondary private key to the intelligent measurement master station. Preferably, the trusted third party encrypts the secondary private key and sends it to the intelligent measurement master station. The steps include:

[0051] S31, A trusted third party will transfer the secondary private key [A] p+1 ...A w Perform an XOR operation between the string [YYYY-MM-DDTHH:mm:ss+TIMEZONE] and the timestamp string [YYYY-MM-DDTHH:mm:ss+TIMEZONE].

[0052] [A p+1 ...A w ]⊕[YYYY-MM-DDTHH:mm:ss+TIMEZONE]=[X d ...X g ]

[0053] In this string, YYYY-MM-DD represents year, month, and day; T appears in the string to indicate the beginning of the time element; HH:mm:ss represents hours, minutes, and seconds; and TIMEZONE represents the time zone.

[0054] Obtain the encrypted string [X] d ...X g The encrypted string is then packaged with the aforementioned timestamp and sent to the intelligent measurement main station. However, as mentioned earlier, this dynamic encryption method is relatively easy to crack once intercepted. Therefore, to further increase the difficulty of cracking, a pre-agreed time period can be added to the time string before the XOR operation, such as a fixed increment of 5 hours, to obtain a new timestamp string [YYYY-MM-DDTH1H2:mm:ss+TIMEZONE], where (H1H2 automatically carries over if it exceeds 24 hours, and so on). The new time is then used for the XOR operation.

[0055] [A p+1 ...A w ]⊕[YYYY-MM-DDTH1H2:mm:ss+TIMEZONE]=[Q d ...Q g ]

[0056] Obtain the encrypted string [Q] d ...Q g The encrypted string is then packaged with the original timestamp and sent to the smart measurement main station.

[0057] S32, Intelligent Measurement Master Station Receives Encrypted String [Q] d ...Q g Afterwards, the timestamp used for encryption [YYYY-MM-DDTH1H2:mm:ss+TIMEZONE] is obtained by decrypting using the timestamp and the pre-agreed time period. This timestamp is then XORed to obtain the actual secondary private key [A]. p+1 ...A w ]; In this scenario, assuming an attacker intercepts the data, they will first attempt to crack the conventional dynamic encryption. Without knowing about the pre-agreed timeframe, they will obtain a "fake secondary private key [Fail]". d ...Fail q This, in turn, affects the overall attack efficiency, providing the defender with an opportunity to discover the problem and buy valuable time.

[0058] S4, Intelligent Measurement Master Station Receives Secondary Private Key [A] p+1 ...A w After that, the device identification decryption module will decrypt the secondary private key [A]. p+1 ...A w [A0; A1; A2...A1] and the primary private key stored within the site. p The combination forms the first private key [A0; A1; A2...A...]. w Then, using the first private key [A0; A1; A2...A...] w The authentication ciphertext is decrypted to obtain the plaintext containing the authentication information. The purpose of this is to distribute the important private key, thereby greatly increasing the difficulty for attackers. The previous method was to store and protect the private key separately, but once the storage location is attacked and stolen, the entire encryption will fail, and attackers can eavesdrop without hindrance. At the same time, intercepting or stealing the public key is relatively simple, and the public key can generally be derived from the private key, allowing attackers to send false information or instructions to launch attacks. Although segmented distributed storage increases one or more communications, it significantly increases the difficulty of attacks. It is difficult for attackers to obtain the complete private key at once. When signs of an attack are detected, the defender can change the private key in time. Correspondingly, in other embodiments, multiple trusted third parties can be added, and the secondary private key can be stored in multiple segments. It is even possible to set up several "pseudo-trusted third parties" and transmit encrypted information in the same way as other trusted third parties, but the transmitted information is invalid, thereby confusing attackers. The specific settings and methods are not described or limited in this embodiment and can be flexibly set according to the system's computing resources.

[0059] Preferably, in this step, after the intelligent measurement master station completes the plaintext decryption, it destroys the temporarily stored first private key [A0; A1; A2...A...]. w ] and secondary private key [A p+1 ...Aw The first and second private keys are destroyed by deletion, and the storage area is overwritten with invalid information so that the private keys cannot be obtained through data recovery.

[0060] S5. The intelligent measurement master station compares the plaintext authentication information with the registration information. If the information matches, it identifies the device 1 requesting access as a secure device. The system then confirms the authentication result and sends a power distribution command to the intelligent measurement terminal.

[0061] Preferably, the registration information is the identifier of the requesting access device that is pre-uploaded to the intelligent measurement master station through other channels. This embodiment does not impose specific restrictions on the uploading method or means.

[0062] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An intelligent energy security authentication system, comprising an intelligent measurement master station and an intelligent measurement terminal; characterized in that Further comprising a trusted third party, the intelligent measurement master station respectively communicates with the intelligent measurement terminal and the trusted third party in an encrypted manner; the intelligent measurement master station is provided with a device identification decryption module, and the intelligent measurement terminal is provided with a device identification encryption module; The intelligent measurement master station is further connected with an intelligent power distribution network; the intelligent power distribution network is connected with a new energy access point; The intelligent measurement terminal is provided with a time-of-use electricity price setting module; the time-of-use electricity price setting module is provided with a human-computer interaction interface, which is used for realizing time-of-use electricity price and receiving user electricity plan parameter setting information; The intelligent measurement terminal is further provided with a dedicated transformer fee control module; the dedicated transformer fee control module is provided with an alarm unit and a smart meter, which are used for reminding a user to pay fees and remotely limiting power consumption.

2. The intelligent energy security authentication system communication method of claim 1, wherein, The communication authentication steps comprise: S1. The intelligent measurement master station generates a first key, including a first public key and a first private key; the intelligent measurement master station sends the first public key to the intelligent measurement terminal, and segments the first private key, including a first-level private key and a second-level private key; the intelligent measurement master station only stores the first-level private key, and sends the second-level private key to the trusted third party for storage; S2. The intelligent measurement terminal is a sender, and the device identification encryption module calculates an authentication ciphertext according to the first public key and the identification of a device requesting access; S3. The intelligent measurement master station is a receiver, and sends a key request to the trusted third party after receiving the authentication ciphertext; the trusted third party sends the second-level private key to the intelligent measurement master station; S4. After receiving the second-level private key, the device identification decryption module of the intelligent measurement master station combines the second-level private key with the first-level private key stored in the station to form the first private key, and then decrypts the authentication ciphertext by using the first private key to obtain plaintext containing authentication information; S5. The intelligent measurement master station compares the authentication information in the plaintext with the recorded information, and confirms the authentication result if the information is consistent, and sends a power distribution instruction to the intelligent measurement terminal.

3. The intelligent energy security authentication system communication method of claim 2, wherein, Before S1, the trusted third party generates a second key, including a second public key and a second private key, and sends the second public key to the intelligent measurement master station; In S1, the intelligent measurement master station encrypts the second-level private key by using the second public key, and then sends it to the trusted third party; the trusted third party decrypts the ciphertext by using the stored second private key to obtain the second-level private key, and stores it.

4. The intelligent energy security authentication system communication method of claim 2, wherein, In S3, the trusted third party encrypts the second-level private key and sends it to the intelligent measurement master station.

5. The intelligent energy security authentication system communication method of claim 4, wherein, The encryption method of the second-level private key is dynamic encryption based on a timestamp, and the steps comprise: S31. The trusted third party performs an exclusive OR operation on the string of the second-level private key and the string of the timestamp, and sends the encrypted string and the timestamp to the intelligent measurement master station; S32, the intelligent measurement master station receives the encrypted information, and obtains the secondary private key through the timestamp XOR decryption 。 6. The intelligent energy security authentication system communication method according to claim 5, characterized in that: In S31, the timestamp is added with a time period determined or predetermined by the intelligent measurement master station before the encryption operation. In the S32, the smart measurement master station adds the time period to the timestamp before performing the decryption operation, and then performs the XOR decryption.

7. The intelligent energy security authentication system communication method of claim 2, wherein, In the S4, the smart measurement master station destroys the temporarily stored private key and secondary private key after completing the plaintext decryption.

8. The intelligent energy security authentication system communication method of claim 7, wherein, The private key and the secondary private key are deleted and the storage area is covered by invalid information.

9. The intelligent energy security authentication system communication method of claim 2, wherein, In the S5, the record information is the request access equipment identifier of the smart measurement master station pre-uploaded.

Images