Short message data secure transmission method and system related to electric power Beidou terminal

Abstract

The invention discloses a short message data secure transmission method and system relating to an electric power Beidou terminal. The method comprises the steps that the electric power Beidou terminal carries out key derivation; generating an initial vector based on the timestamp; encrypting the Beidou short message data frame based on the key and the initial vector to obtain a ciphertext c; based on the Beidou short message plaintext and the key, calculating an authentication label encrypted by the Beidou short message data frame; the electric power Beidou terminal sends the ciphertext c, the authentication tag and the timestamp to the master station; and the master station carries out decryption according to the received information to complete secure transmission. According to the method, safe short message transmission between the electric power Beidou terminal and the master station is established, transmission of the electric power sensitive data is guaranteed, meanwhile, data leakage caused by malicious eavesdropping when the electric power sensitive data are transmitted by means of a satellite channel is avoided, the safety and stability of terminal positioning are further improved, and the user experience is improved. And safety supervision is effectively provided for operators.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of power Internet of Things, and particularly relates to a short message data secure transmission method and system related to a power Beidou terminal. BACKGROUND

[0002] In recent years, Beidou technology has developed rapidly, and State Grid Corporation of China continues to deepen the application of Beidou system. Through Beidou-3 short message communication technology, the information service function is deeply optimized, the efficient and reliable short message service is empowered for power grid communication demand, the smooth communication in the area without network coverage is realized, and the timeliness and accuracy of important information transmission are ensured.

[0003] The Beidou-3 short message technology can reduce the dependence on traditional communication methods, reduce the construction and maintenance cost of communication facilities in remote or poor signal areas, and reduce the frequency of manual inspection and on-site operation due to the improvement of data transmission efficiency, thereby saving the labor cost.

[0004] However, the Beidou short message terminal transmits data in plaintext, and for the business needs of power marketing, equipment and dispatching fields, the leakage of business information will bring serious safety hazards to national basic power facilities. The present application proposes a short message data secure transmission method related to a power Beidou terminal. SUMMARY

[0005] In view of the deficiencies of the prior art, one of the purposes of the present application is to provide a short message data secure transmission method related to a power Beidou terminal, to establish the short message secure transmission between the power Beidou terminal and the master station, to protect the transmission of power sensitive data, to avoid the data leakage caused by malicious eavesdropping when the power sensitive data is transmitted through the satellite channel, to further improve the safety and stability of terminal positioning, and to effectively provide safety supervision for the operating personnel.

[0006] The second purpose of the present application is to provide a system for realizing the short message data secure transmission method related to the power Beidou terminal.

[0007] The present application provides a short message data secure transmission method related to a power Beidou terminal, comprising the following steps:

[0008] S1. Key derivation by the power Beidou terminal;

[0009] S2. Generating an initial vector based on the timestamp;

[0010] S3. Encrypting the Beidou short message data frame based on the key obtained in step S1 and the initial vector obtained in step S2 to obtain ciphertext c;

[0011] S4. Calculate the authentication tag of the Beidou short message data frame encryption based on the Beidou short message plaintext and the key obtained in step S1;

[0012] S5. The power Beidou terminal sends the ciphertext c, the authentication tag and the timestamp to the master station;

[0013] S6. The master station decrypts according to the received information to complete the secure transmission.

[0014] Step S1 specifically includes the following steps:

[0015] The preset master key , the 16B fixed sequence salt value sa is a fixed value for enhancing the entropy of the key, which is used to derive the encryption key information parameter , the information parameter for deriving the HMAC key , in the extraction stage, a pseudo-random key is generated.

[0016] In the expansion stage, a sub-encryption key KEK with a length of 128 bits is derived from the pseudo-random key PRK through iteration, and first, the counter c=1 is set.

[0017] In the same way, a sub-key KH with a specified length is derived from the pseudo-random key PRK through iteration.

[0018] The pseudo-random key is expressed using the following formula: ; wherein opad is an external padding constant with a length of a block size, ipad is an internal padding constant with a length of a block size, is spliced by bit; KM is a preset master key pre-sent to the message sender and the message receiver, and .

[0019] In the expansion stage, the sub-encryption key KEK is generated based on the pseudo-random key PRK, which is specifically: first, a key block is generated through iteration, which is expressed using the following formula: , wherein c is a single-byte counter; a hash block is generated each time; and is spliced until the total length is greater than or equal to 128 bits, and the first 128 bits are truncated as the sub-encryption key KEK.

[0020] In step S2, the initial vector is generated, which is specifically:

[0021] The Beidou time stamp is input, and the TS is converted into an 8-byte sequence Ta;

[0022] Based on the 8-byte sequence Ta, an initial vector iv is generated, which is expressed using the following formula: ; wherein, Truncate16 takes the first 16 bytes of the hash value; SHA-256 is a one-way hash function, which converts the input message Ta into a 256-bit output value, used for the iv generation of randomization.

[0023] In step S3, the encryption of the Beidou short message data frame is specifically:

[0024] First, a key stream is generated, and the input is encrypted by AES through the key KEK, and the output is a 16-byte ciphertext block, which is represented by the following formula: ; wherein, the counter Counter starts from 0 and increases, generating a key stream S equal in length to the plaintext; AES is an AES encryption operation; is a bitwise XOR operation; is a bitwise concatenation.

[0025] Then, the encryption calculation is performed to obtain the ciphertext c, which is represented by the following formula: ; wherein, P is the plaintext, and .

[0026] In step S4, the authentication tag tag of the encrypted Beidou short message data frame is calculated, which is represented by the following formula: ; wherein, ; opad is an outer padding constant, and ipad is an inner padding constant, is a bitwise concatenation;

[0027] Step S6 includes the following steps:

[0028] Based on the current timestamp and the timestamp before the preset time window, a first candidate vector and a second candidate vector are generated;

[0029] According to the first candidate vector and the second candidate vector, the first candidate plaintext and the second candidate plaintext are decrypted;

[0030] Based on the first candidate plaintext and the second candidate plaintext, the authentication tag is verified;

[0031] If the verification is passed, the decryption is successful, otherwise the decryption is rejected.

[0032] In step S6, the following steps are specifically included:

[0033] Based on the current timestamp and the timestamp before the preset time window , a first candidate vector iv1 and a second candidate vector iv2 are generated, which are represented by the following formula: ; ; wherein, ; is a preset time window;

[0034] decrypting the first candidate plaintext according to the first candidate vector and the second candidate vector and the second candidate plaintext , which is expressed by the following formula: ; wherein, is a candidate vector set, and ; is a candidate plaintext set, and ;

[0035] verifying the authentication tag based on the first candidate plaintext and the second candidate plaintext, which is expressed by the following formula: ; wherein, is a 256-bit key used for calculating an HMAC to ensure message integrity, and ; wherein, byte(1) is a single-byte 0x01;

[0036] If there is an i satisfying the equation, the verification is passed, and the decryption is successful; otherwise, the decryption is rejected.

[0037] The application also provides a system for implementing the method for securely transmitting short message data of a power Beidou terminal, which comprises a key derivation module, an initial vector generation module, a short message data frame encryption module, an authentication tag calculation module, a data transmission module, and a master station decryption module.

[0038] The key derivation module performs key derivation on the power Beidou terminal and uploads data to the initial vector generation module.

[0039] The initial vector generation module generates an initial vector based on a time stamp according to the received data and uploads data to the short message data frame encryption module.

[0040] The short message data frame encryption module encrypts a Beidou short message data frame based on a key and an initial vector according to the received data, obtains ciphertext c, and uploads data to the authentication tag calculation module.

[0041] The authentication tag calculation module calculates an authentication tag for the encryption of the Beidou short message data frame based on a Beidou short message plaintext and a key according to the received data and uploads data to the data transmission module.

[0042] The data transmission module sends ciphertext c, an authentication tag, and a time stamp to the master station according to the received data and uploads data to the master station decryption module.

[0043] The master station decryption module decrypts the received information according to the received data, and completes the secure transmission.

[0044] This invention discloses a method and system for secure short message data transmission of a power Beidou terminal. It establishes secure short message transmission between the power Beidou terminal and the master station, ensuring the transmission of sensitive power data. At the same time, it avoids data leakage caused by malicious eavesdropping when sensitive power data is transmitted via satellite channels, further improving the security and stability of terminal positioning and effectively providing safety supervision for operators. Attached Figure Description

[0045] Figure 1 This is a schematic flowchart of the method of the present invention;

[0046] Figure 2 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0047] This invention provides a method for secure short message data transmission involving a power grid BeiDou terminal, the flowchart of which is shown below. Figure 1 As shown, it includes the following steps:

[0048] S1. The power grid Beidou terminal performs key derivation;

[0049] Step S1 specifically includes the following steps:

[0050] Preset master key The 16B fixed sequence salt value *sa* is a fixed value used to enhance the key entropy and is used to derive encryption key information parameters. Information parameters used to derive HMAC keys During the extraction phase, a pseudo-random key is generated. ;

[0051] During the expansion phase, a 128-bit sub-encryption key KEK is derived iteratively from the pseudo-random key PRK. First, the counter c=1 is set.

[0052] Using the same method, a subkey KH of a specified length is derived iteratively from the pseudo-random key PRK.

[0053] The pseudo-random key Express it using the following formula: Where opad is the outer padding constant with a length equal to the block size, and ipad is the inner padding constant with a length equal to the block size. This is a bit-by-bit concatenation; KM is a preset master key pre-sent to both the message sender and receiver, and .

[0054] In the expansion phase, the sub-encryption key KEK is generated based on the pseudo-random key PRK. Specifically, the key block is first iteratively generated, using the following formula: ,in , c is a single byte counter; a hash block is generated each iteration; the Splicing is performed until the total length is greater than or equal to 128 bits, and the first 128 bits are truncated as a sub-encryption key KEK.

[0055] S2. Based on the timestamp, an initial vector is generated;

[0056] In step S2, the initial vector is generated, specifically:

[0057] The Beidou time service timestamp is input, and the TS is converted into an 8-byte sequence Ta;

[0058] Based on the 8-byte sequence Ta, an initial vector iv is generated, which is expressed by the following formula: ; wherein Truncate16 takes the first 16 bytes of the hash value; SHA-256 is a one-way hash function that converts the input message Ta into a 256-bit output value for the generation of the randomized iv.

[0059] S3. Based on the key obtained in step S1 and the initial vector obtained in step S2, the Beidou short message data frame is encrypted to obtain ciphertext c;

[0060] In step S3, the Beidou short message data frame encryption is specifically:

[0061] First, a key stream is generated, and the input is encrypted by AES through the key KEK, and the output is a 16-byte ciphertext block, which is expressed by the following formula: ; wherein the counter Counter starts from 0 and increments to generate a key stream S equal in length to the plaintext; AES is an AES encryption operation; is a bitwise XOR operation; is a bitwise concatenation.

[0062] Then, the encryption calculation is performed to obtain the ciphertext c, which is expressed by the following formula: ; wherein P is the plaintext, and .

[0063] S4. Based on the Beidou short message plaintext and the key obtained in step S1, an authentication tag for the Beidou short message data frame encryption is calculated;

[0064] In step S4, the calculation of the authentication tag tag for the Beidou short message data frame encryption is expressed by the following formula: ; wherein ; opad is an outer padding constant, and ipad is an inner padding constant, is a bitwise concatenation;

[0065] S5. The power Beidou terminal sends the ciphertext c, the authentication tag, and the timestamp to the master station;

[0066] S6. The primary station decrypts according to the received information, and completes the secure transmission.

[0067] Step S6 includes the following steps:

[0068] generating a first candidate vector and a second candidate vector based on the current timestamp and the timestamp before the preset time window;

[0069] decrypting a first candidate plaintext and a second candidate plaintext according to the first candidate vector and the second candidate vector;

[0070] verifying an authentication tag based on the first candidate plaintext and the second candidate plaintext;

[0071] if the verification is passed, the decryption is successful, otherwise the decryption is rejected.

[0072] In step S6, the following steps are included:

[0073] generating a first candidate vector iv1 and a second candidate vector iv2 based on the current timestamp and the timestamp before the preset time window , which is expressed by the following formula: ; wherein, ; is the preset time window;

[0074] decrypting a first candidate plaintext and a second candidate plaintext according to the first candidate vector and the second candidate vector, which is expressed by the following formula: ; wherein, is a candidate vector set, and ; is a candidate plaintext set, and ;

[0075] verifying an authentication tag based on the first candidate plaintext and the second candidate plaintext, which is expressed by the following formula: ; wherein, is a 256-bit key used for calculating HMAC to ensure message integrity, and ; wherein, byte(1) is a single-byte 0x01;

[0076] if there is an i satisfying the equation, the verification is passed, and the decryption is successful; otherwise, the decryption is rejected.

[0077] The application also provides a system for implementing the method for secure transmission of short message data of a power Beidou terminal, and a structure diagram of the system is as shown in Figure 2As shown, including key derivation module, initial vector generation module, short message data frame encryption module, authentication tag calculation module, data transmission module; master decryption module;

[0078] Key derivation module, power Beidou terminal key derivation, and upload data to the initial vector generation module;

[0079] Initial vector generation module generates initial vector based on the received data, based on timestamp, and uploads data to short message data frame encryption module;

[0080] Short message data frame encryption module encrypts Beidou short message data frame based on key and initial vector according to received data, gets ciphertext c, and uploads data to authentication tag calculation module;

[0081] Authentication tag calculation module calculates the authentication tag of Beidou short message data frame encryption based on Beidou short message plaintext and key according to received data, and uploads data to data transmission module;

[0082] Data transmission module according to the received data, power Beidou terminal will send ciphertext c, authentication tag and timestamp to master station, and upload data to master decryption module;

[0083] Master decryption module according to the received data, master station according to the received information decryption, complete security transmission.

Claims

1. A method for secure short message data transmission involving a power grid BeiDou terminal, characterized in that, Includes the following steps: S1. The power grid Beidou terminal performs key derivation; S2. Generate an initial vector based on the timestamp; S3. Based on the key obtained in step S1 and the initial vector obtained in step S2, encrypt the BeiDou short message data frame to obtain ciphertext c; S4. Based on the BeiDou short message text and the key obtained in step S1, calculate the authentication tag for encrypting the BeiDou short message data frame; S5. The power Beidou terminal sends the encrypted message c, authentication tag, and timestamp to the main station; S6. The main station decrypts the received information to complete secure transmission.

2. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 1, characterized in that, Step S1 specifically includes the following steps: Preset master key The 16B fixed sequence salt value *sa* is a fixed value used to enhance the key entropy and is used to derive encryption key information parameters. Information parameters used to derive HMAC keys During the extraction phase, a pseudo-random key is generated. ; During the expansion phase, a 128-bit sub-encryption key KEK is derived iteratively from the pseudo-random key PRK. First, the counter c=1 is set. Using the same method, a subkey KH of a specified length is derived iteratively from the pseudo-random key PRK.

3. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 2, characterized in that, The pseudo-random key Express it using the following formula: Where opad is the outer padding constant with a length equal to the block size, and ipad is the inner padding constant with a length equal to the block size. This is a bitwise concatenation; KM is the preset master key, and .

4. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 2, characterized in that, In the expansion phase, the sub-encryption key KEK is generated based on the pseudo-random key PRK. Specifically, the key block is first iteratively generated, using the following formula: ,in c is a single-byte counter; Each iteration generates one hash block; Concatenate the bits until the total length is greater than or equal to 128 bits, then truncate the first 128 bits as the sub-encryption key KEK.

5. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 1, characterized in that, In step S2, generating the initial vector specifically involves: Input the BeiDou time stamp TS, and convert TS into an 8-byte sequence Ta; Based on the 8-byte sequence Ta, generate the initial vector iv, expressed using the following formula: Truncate16 takes the first 16 bytes of the hash value; SHA-256 is a one-way hash function.

6. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 1, characterized in that, In step S3, the encryption of the BeiDou short message data frame specifically involves: First, a keystream is generated. Then, the input is encrypted using AES with the key KEK. The output is a 16-byte ciphertext block, represented by the following formula: The counter, Counter, increments from 0 to generate a key stream S of the same length as the plaintext; AES is the AES encryption operation. This is a bitwise XOR operation; This is for stitching by position; Then, encryption calculations are performed to obtain ciphertext c, which is represented by the following formula: Where P is plaintext, and .

7. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 1, characterized in that, In step S4, the calculation of the authentication tag for encrypting the BeiDou short message data frame is expressed using the following formula: ;in, opad is the outer padding constant, and ipad is the inner padding constant. This is for stitching together position by position.

8. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 1, characterized in that, Step S6 includes the following steps: Based on the current timestamp and the timestamps before the preset time window, generate a first candidate vector and a second candidate vector; Decrypt the first candidate plaintext and the second candidate plaintext based on the first candidate vector and the second candidate vector; Verify the authentication label based on the first and second candidate plaintexts; If the verification passes, decryption is successful; otherwise, decryption is rejected.

9. The method for secure short message data transmission involving a power grid BeiDou terminal according to claim 8, characterized in that, Step S6 specifically includes the following steps: Based on the current timestamp and the timestamp before the preset time window Generate the first candidate vector iv1 and the second candidate vector iv2 using the following formula: ; ;in, ; Preset time window; Decrypt the first candidate plaintext based on the first candidate vector and the second candidate vector. With the second candidate plaintext It can be expressed using the following formula: ;in, Let be the set of candidate vectors, and ; Let be the set of candidate plaintexts, and ; Based on the first and second candidate plaintexts, the authentication tag is verified using the following formula: ;in, Let i be the 256-bit key used to calculate HMAC; if there exists an i that satisfies the equation, then the verification passes and decryption is successful; otherwise, decryption is rejected.

10. A system for implementing the short message data secure transmission method for a power grid BeiDou terminal as described in any one of claims 1 to 9, characterized in that, It includes a key derivation module, an initialization vector generation module, a short message data frame encryption module, an authentication tag calculation module, a data transmission module, and a main station decryption module; The key derivation module performs key derivation in the power Beidou terminal and uploads the data to the initial vector generation module; The initial vector generation module generates an initial vector based on the timestamp of the received data and uploads the data to the short message data frame encryption module. The short message data frame encryption module encrypts the BeiDou short message data frame based on the received data, using a key and an initialization vector, to obtain ciphertext c, and then uploads the data to the authentication tag calculation module. The authentication tag calculation module calculates the authentication tag encrypted in the BeiDou short message data frame based on the received data, the BeiDou short message text and key, and uploads the data to the data transmission module. Based on the received data, the power Beidou terminal sends the encrypted text c, authentication tag, and timestamp to the main station, and uploads the data to the main station's decryption module. The main station decryption module decrypts the received data, and the main station decrypts the information received to complete secure transmission.

Images