Hybrid encryption communication method and system suitable for electric power APN internet-of-things private network

Abstract

The invention relates to the technical field of electric power information security, and provides a hybrid encryption communication method and system suitable for an electric power APN Internet of Things private network, and the method comprises the steps: obtaining a session key request initiated by a service platform, carrying out the tunnel packaging and timestamp adding of the session key request, and obtaining a session key request package; performing Hash abstract on a timestamp, a message length field and a tunnel encapsulation length field in the session key request encapsulation packet to obtain session key request integrity message feature information, and adding the session key request integrity message feature information to the encapsulation packet; searching a corresponding session key table according to the service platform identifier, obtaining session key parameters, obtaining a session key request acknowledgement packet according to an SM3 algorithm, and sending the session key request acknowledgement packet to the service platform; and obtaining a message sent by the service platform, decrypting the message according to the session key parameter and the received message and sending the decrypted message to the service host, thereby realizing hybrid encryption of a communication data packet between the user side access point and a network outside the trusted boundary of the power APN Internet of Things private network based on the session key.

Description

Technical Field

[0001] This invention relates to the field of power information security technology, and in particular to a hybrid encrypted communication method and system suitable for power APN IoT private networks. Background Technology

[0002] To enable normal communication between the business platform and the IoT host, tunnel message transmission technology must be used to encrypt message headers, protect data security, and prevent data packet theft. In the power APN IoT private network, the SM7 encryption algorithm is used to protect data packet integrity. However, because the SM7 algorithm key length must be a multiple of 128 bits (16 bytes), the length of the encrypted ciphertext is not fixed. This results in a discrepancy between the length of the decrypted plaintext and the tunnel message length, affecting subsequent message transmission. When the power APN gateway receives a plaintext message from the IoT host, it encrypts and decrypts the plaintext message using the key calculated by the SM7 algorithm. The length of the decrypted plaintext message is inconsistent with the tunnel message length, thus affecting subsequent message transmission.

[0003] To address the aforementioned technical issues, Chinese Patent CN110088496A proposes using the SM3 hash algorithm to calculate the session key sequence number and message sequence number. It then uses the fixed SM7 keys of both communicating parties to decrypt the message body and other data. Specifically, based on the message length calculated through encryption and decryption, the message length is determined. Data at a fixed offset position (10, 14) of the same length is extracted from the message body. A checksum is calculated based on the extracted data and filled into a preset position. The modified message body is then sent to the service host. While the aforementioned documents can decrypt and encrypt messages to ensure communication security, they suffer from the following technical problems: 1. Data integrity protection relies on asymmetric cryptographic algorithms, which are complex, have low processing efficiency, and do not verify the integrity of plaintext messages, thus failing to guarantee data integrity; 2. The use of fixed SM7 keys for keys and key sequence numbers cannot guarantee data security during session communication, posing a risk of using the same key for encryption and decryption; 3. In actual power APN IoT private network service communication, there is a situation where session key requests and verification message sequence numbers are sent interchangeably, and this document does not address this interchange.

[0004] Therefore, to address the problem that the unequal lengths of encrypted and decrypted messages in the tunnel encapsulation affect subsequent message transmission in tunnel-based encrypted communication, a hybrid encryption method and system based on timestamps and key sequence numbers is proposed for use in power APN IoT private networks. Summary of the Invention

[0005] To address the problem of inconsistent encryption and decryption message lengths affecting subsequent message transmission in tunnel-based encrypted communication, this application provides a hybrid encrypted communication method and system suitable for power APN IoT private networks.

[0006] To achieve the above objectives, this application adopts the following technical solution: A hybrid encrypted communication method suitable for power APN IoT private networks includes the following steps: Step S10: Obtain the session key request initiated by the business platform from the private network platform, perform tunnel encapsulation on the session key request, add a timestamp, and obtain the session key request encapsulation package; Step S20: Perform a hash digest on the timestamp, message length, and tunnel encapsulation length fields in the session key request encapsulation packet to obtain the session key request integrity message feature information based on the timestamp and add it to the session key request encapsulation packet; Step S30: Find the corresponding session key table based on the business platform identifier to obtain the session key parameters; Step S40: Using session key parameters and session key request integrity message feature information, calculate the session key request confirmation packet according to the SM3 algorithm and send it to the business platform; Step S50: Obtain the message sent by the service platform from the private network platform, decrypt it according to the session key parameters and the received message, obtain the plaintext message, and then send it to the service host.

[0007] In one embodiment disclosed in this application, in step S10, the session key request includes a service platform identifier, a session key request sequence number, and a session key message encryption key; wherein, the method for generating the session key message encryption key includes the following steps: Step S1: Obtain the session key initialization parameter packet based on the timestamp, and perform a hash digest on the session key initialization parameter packet to obtain the feature information of the session key request confirmation packet based on the timestamp. Step S2: Obtain the power APN IoT private network parameters and the time-stamp-based session key initialization parameter packet feature information, and calculate the message encryption key using the AES symmetric encryption algorithm.

[0008] In one embodiment disclosed in this application, step S1 includes the following sub-steps: Step S11: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S12: Use the SHA256 algorithm to perform a hash digest on the timestamp field, message length field, and tunnel encapsulation length field.

[0009] In one embodiment disclosed in this application, step S2 includes the following sub-steps: Step S21: Obtain the power APN IoT private network parameters, including the IP address and port of the password server, the destination port of the message, the destination IP address of the message, the power APN IoT private network key, and the power APN IoT private network key length. Step S22: Obtain the power APN IoT private network parameters. The obtained power APN IoT private network parameters are encoded using the Base64 algorithm and then encoded into the session key initialization parameter package in text form to obtain the encoded power APN IoT private network parameters. Step S23: Obtain the feature information of the session key initialization parameter packet based on the timestamp, merge the obtained encoded power APN IoT private network parameters and the feature information of the session key initialization parameter packet based on the timestamp, use the power APN IoT private network key as the key, and calculate the message encryption key using the AES symmetric encryption algorithm and 128-bit encryption mode.

[0010] In one embodiment disclosed in this application, step S10 includes the following sub-steps: Step S101: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S102: Combine the timestamp field, message length field, and tunnel encapsulation length field, calculate using the SHA256 algorithm, and then perform a hash digest to obtain the session key request integrity message feature information based on the timestamp. Step S103: The session key request sequence number, session key message encryption key, and timestamp-based session key request integrity message feature information in the session key request are merged and then tunnel-encapsulated for transmission.

[0011] In one embodiment disclosed in this application, step S20 includes the following sub-steps: Step S201: Obtain the timestamp, message length field, and tunnel encapsulation length field from the message header; Step S202: Merge the timestamp, message length field and tunnel encapsulation length field in order, and then calculate the hash digest together with the parameter value of the session key request integrity message feature information calculated in the previous step. Use the SHA256 algorithm to obtain the session key request confirmation packet feature information. Step S203: Obtain the message sequence number from the message header, merge the obtained message sequence number with the session key request confirmation packet feature information calculated in the previous step and use it as the session key confirmation packet message sequence number, and send the session key request confirmation packet message sequence number, session key end identifier, and session key end flag together to the business platform in the power APN IoT private network.

[0012] In one embodiment disclosed in this application, step S30 includes the following sub-steps: Step S301: Find the location of the session key table corresponding to the current business platform from the session key table based on the business platform identifier; Step S302: Obtain the valid session key sequence number based on the valid identifier found in the session key table. Step S303: Using the business platform identifier and valid session key sequence number, the session key table request message feature information is calculated through a hash digest; Step S304: Obtain the session key request sequence number from the session key request, and send the obtained session key request sequence number, session key table request message integrity message feature information, current session key sequence number, validity flag, session key request sequence number, session key end identifier, and session key end flag together to the business platform in the power APN IoT private network.

[0013] In one embodiment disclosed in this application, step S303 includes the following sub-steps: Step S3031: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S3032: Use the SHA256 algorithm to perform a hash digest on the session key table location, timestamp field, message length field, and tunnel encapsulation length field.

[0014] In one embodiment disclosed in this application, the message length field is represented by characters encoded using the Base64 algorithm; the session key request confirmation packet feature information is represented by characters encoded using the Base64 algorithm; the session key request feature information is represented by characters encoded using the Base64 algorithm; and the session key confirmation packet feature information is represented by characters encoded using the Base64 algorithm.

[0015] A hybrid encrypted communication system suitable for power APN IoT private networks includes the following modules: The session key request encapsulation package generation module is used to obtain the session key request initiated by the business platform from the private network platform, perform tunnel encapsulation on the session key request, add a timestamp, and obtain the session key request encapsulation package; The integrity message feature information generation module is used to perform a hash digest on the timestamp, message length field and tunnel encapsulation length field in the session key request encapsulation packet, obtain the session key request integrity message feature information based on the timestamp and add it to the session key request encapsulation packet; The session key parameter acquisition module is used to look up the corresponding session key table based on the business platform identifier and obtain the session key parameters. The Session Key Request Confirmation Packet Generation Module is used to calculate the Session Key Request Confirmation Packet according to the SM3 algorithm using session key parameters and session key request integrity message feature information, and then send it to the business platform. The message decryption module is used to obtain messages sent by the business platform from the private network platform, decrypt them according to the session key parameters and the received messages, and then send the plaintext messages to the business host.

[0016] In one embodiment disclosed in this application, the session key parameter acquisition module includes: The session key initialization parameter packet feature information acquisition submodule is used to obtain the current time as a timestamp field, and to obtain the message length field and tunnel encapsulation length field at the current moment; The session key message encryption key acquisition submodule is used to obtain the power APN IoT private network parameters and the time-stamp-based session key initialization parameter packet feature information, and calculates the message encryption key using the AES symmetric encryption algorithm.

[0017] In one embodiment disclosed in this application, the session key request encapsulation packet generation module includes: The timestamp generation submodule is used to obtain the current time as the timestamp field, and to obtain the message length field and tunnel encapsulation length field at the current moment; The message feature information generation submodule is used to combine the timestamp field, message length field, and tunnel encapsulation length field, calculate the hash digest using the SHA256 algorithm, and obtain the session key request integrity message feature information based on the timestamp. The Session Key Request Encapsulation Submodule is used to merge the Session Key Request Sequence Number, Session Key Message Encryption Key, and Timestamp-based Session Key Request Integrity Message Feature Information in the Session Key Request before tunneling encapsulation and transmission.

[0018] In one embodiment disclosed in this application, the session key request confirmation packet generation module includes: The timestamp acquisition submodule is used to obtain the timestamp, message length field, and tunnel encapsulation length field from the message header; The Session Key Request Confirmation Packet Feature Information Acquisition Submodule is used to merge the timestamp, message length field, and tunnel encapsulation length field in sequence, and then calculate the hash digest together with the parameter value of the Session Key Request Integrity Packet Feature Information to obtain the Session Key Request Confirmation Packet Feature Information.

[0019] Compared with the prior art, the beneficial effects of the present invention are: I. This application enables the switching between plaintext transmission mode and IPSec confidential transmission mode for power APN IoT private network data, allowing private network administrators to select the message encryption mode according to actual needs (such as when transmitting sensitive messages), thereby providing a more flexible and secure means for the transmission of messages for power services.

[0020] Second, this application can achieve seamless switching between plaintext transmission mode and IPSec confidential transmission mode in the power APN IoT private network, ensuring the security of business transmission in the power APN IoT private network and the security of network boundary traffic information in the power APN private network. This is of great significance for maintaining the power APN IoT private network and power services.

[0021] Third, the hybrid encrypted communication method designed in this application meets both industry network security requirements and system requirements. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating the hybrid encrypted communication method applicable to power APN IoT private networks provided in this application; Figure 2 A schematic diagram of the framework of the hybrid encrypted communication system for power APN IoT private network provided in this application. Detailed Implementation

[0024] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0025] The terms “comprising” and “having”, and any variations thereof, used in this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0027] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0028] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0029] Figure 1 A flowchart illustrating the hybrid encrypted communication method for power APN IoT private networks provided in this application. This hybrid encrypted communication method for power APN IoT private networks includes the following steps: Step S10: Obtain the session key request initiated by the business platform from the private network platform, perform tunnel encapsulation on the session key request, add a timestamp, and obtain a session key request encapsulation packet; specifically, the session key request includes the business platform identifier, the session key request sequence number, and the session key message encryption key; wherein, the method for generating the session key message encryption key includes the following steps: Step S1 involves obtaining a timestamp-based session key initialization parameter packet and hashing the packet to obtain the timestamp-based session key request confirmation packet feature information. Step S1 specifically includes the following sub-steps: Step S11: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S12: Use the SHA256 algorithm to perform a hash digest on the timestamp field, message length field, and tunnel encapsulation length field; Step S2 involves obtaining the power APN IoT private network parameters and the timestamp-based session key initialization parameter packet feature information, and calculating the message encryption key using the AES symmetric encryption algorithm. Step S2 specifically includes the following sub-steps: Step S21: Obtain the power APN IoT private network parameters, including the IP address and port of the password server, the destination port of the message, the destination IP address of the message, the power APN IoT private network key, and the power APN IoT private network key length. Step S22: Obtain the power APN IoT private network parameters. The obtained power APN IoT private network parameters are encoded using the Base64 algorithm and then encoded into the session key initialization parameter package in text form to obtain the encoded power APN IoT private network parameters. Step S23: Obtain the feature information of the session key initialization parameter packet based on the timestamp, merge the obtained encoded power APN IoT private network parameters and the feature information of the session key initialization parameter packet based on the timestamp, use the power APN IoT private network key as the key, and calculate the message encryption key using the AES symmetric encryption algorithm and 128-bit encryption mode. Furthermore, step S10 specifically includes the following sub-steps: Step S101: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S102: Combine the timestamp field, message length field, and tunnel encapsulation length field, calculate using the SHA256 algorithm, and then perform a hash digest to obtain the session key request integrity message feature information based on the timestamp. Step S103: Combine the session key request sequence number, session key message encryption key, and timestamp-based session key request integrity message feature information in the session key request and then perform tunnel encapsulation transmission. As a variation of this application, in this hybrid encrypted communication method applicable to power APN IoT private network, the message length field is represented using the ASCII character set; As a variation of this application, in this hybrid encrypted communication method applicable to power APN IoT private network, the session key request confirmation packet feature information is represented by characters encoded using the Base64 algorithm; As a variation of this application, in this hybrid encrypted communication method applicable to power APN IoT private network, the session key request feature information is represented by characters encoded using the Base64 algorithm; As a variation of this application, in this hybrid encrypted communication method applicable to power APN IoT private network, the session key confirmation packet feature information is represented by characters encoded using the Base64 algorithm; Step S20 involves performing a hash digest on the timestamp, message length, and tunnel encapsulation length fields in the session key request encapsulation packet to obtain the session key request integrity message feature information based on the timestamp, and adding it to the session key request encapsulation packet. Step S20 specifically includes the following sub-steps: Step S201: Obtain the timestamp, message length field, and tunnel encapsulation length field from the message header; Step S202: Merge the timestamp, message length field and tunnel encapsulation length field in order, and then calculate the hash digest together with the parameter value of the session key request integrity message feature information calculated in the previous step. Use the SHA256 algorithm to obtain the session key request confirmation packet feature information. Step S203: Obtain the message sequence number from the message header, merge the obtained message sequence number with the session key request confirmation packet feature information calculated in the previous step and use it as the session key confirmation packet message sequence number, and send the session key request confirmation packet message sequence number, session key end identifier, and session key end flag together to the business platform in the power APN IoT private network. Step S30: Look up the corresponding session key table based on the business platform identifier to obtain the session key parameters; this step S30 specifically includes the following sub-steps: Step S301: Find the location of the session key table corresponding to the current business platform from the session key table based on the business platform identifier; Step S302: Obtain the valid session key sequence number based on the valid identifier found in the session key table. Step S303: Using the business platform identifier and valid session key sequence number, the session key table request message feature is calculated through a hash digest; Step S304: Obtain the session key request sequence number from the session key request, and send the obtained session key request sequence number, session key table request message integrity message feature information, current session key sequence number, validity flag, session key request sequence number, session key end identifier, and session key end flag together to the business platform in the power APN IoT private network. Specifically, step S303 includes the following steps: Step S3031: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S3032: Use the SHA256 algorithm to perform a hash digest on the session key table location, timestamp field, message length field, and tunnel encapsulation length field; Step S40 involves using the session key parameters and session key request integrity message feature information to calculate a session key request confirmation packet based on the SM3 algorithm and sending it to the service platform. Step S40 specifically includes the following sub-steps: Step S401: The timestamp, message length field, and tunnel encapsulation length field are obtained from the message header; In step S402, upon receiving a message, the timestamp, message length field, and tunnel encapsulation length field are combined with the session key request integrity message feature information to calculate a hash digest. The session key request feature information is then obtained using the SHA256 algorithm. Step S403: Send the session key request feature information, session key end identifier, and session key end flag together to the business platform; Step S50: Obtain the message sent by the service platform from the private network platform, decrypt it according to the session key parameters and the received message, obtain the plaintext message, and then send it to the service host.

[0030] Figure 2 A schematic diagram of the framework of the hybrid encrypted communication system for power APN IoT private network provided in this application. The hybrid encrypted communication system for power APN IoT private network includes the following modules: The session key request encapsulation packet generation module is used to obtain the session key request initiated by the business platform from the private network platform, perform tunnel encapsulation on the session key request, add a timestamp, and obtain the session key request encapsulation packet; specifically, the session key request encapsulation packet generation module includes: The timestamp generation submodule is used to obtain the current time as the timestamp field, and to obtain the message length field and tunnel encapsulation length field at the current moment; The message feature information generation submodule is used to combine the timestamp field, message length field, and tunnel encapsulation length field, calculate the hash digest using the SHA256 algorithm, and obtain the session key request integrity message feature information based on the timestamp. The Session Key Request Encapsulation Submodule is used to merge the Session Key Request Sequence Number, Session Key Message Encryption Key, and Timestamp-based Session Key Request Integrity Message Feature Information in the Session Key Request before tunneling encapsulation and transmission. The message length field is represented by characters encoded using the Base64 algorithm; the session key request confirmation packet feature information is represented by characters encoded using the Base64 algorithm; the session key request feature information is represented by characters encoded using the Base64 algorithm; the session key confirmation packet feature information is represented by characters encoded using the Base64 algorithm. The integrity message feature information generation module is used to perform a hash digest on the timestamp, message length field and tunnel encapsulation length field in the session key request encapsulation packet, obtain the session key request integrity message feature information based on the timestamp and add it to the session key request encapsulation packet; The session key parameter acquisition module is used to look up the corresponding session key table based on the business platform identifier and obtain the session key parameters; specifically, the session key parameter acquisition module includes: The session key initialization parameter packet feature information acquisition submodule is used to obtain the current time as a timestamp field, and to obtain the message length field and tunnel encapsulation length field at the current moment; The session key message encryption key acquisition submodule is used to obtain the power APN IoT private network parameters and the time-stamp-based session key initialization parameter packet feature information, and calculates the message encryption key using the AES symmetric encryption algorithm; The session key request confirmation packet generation module is used to calculate the session key request confirmation packet according to the SM3 algorithm using session key parameters and session key request integrity message feature information, and then send it to the business platform. This session key request confirmation packet generation module includes: The timestamp acquisition submodule is used to obtain the timestamp, message length field, and tunnel encapsulation length field from the message header; The Session Key Request Confirmation Packet Feature Information Acquisition Submodule is used to merge the timestamp, message length field, and tunnel encapsulation length field in sequence, and then calculate the hash digest together with the parameter value of the Session Key Request Integrity Packet Feature Information to obtain the Session Key Request Confirmation Packet Feature Information. The message decryption module is used to obtain messages sent by the business platform from the private network platform, decrypt them according to the session key parameters and the received messages, and then send the plaintext messages to the business host.

[0031] As can be seen from the above, the hybrid encrypted communication method and system applicable to the power APN IoT private network enables the switching between plaintext transmission mode and IPSec secure transmission mode for power APN IoT private network data. This allows the private network administrator to select the message encryption mode according to actual needs (such as when transmitting sensitive messages), thus providing a more flexible and secure means for message transmission of power services. It also enables seamless switching between plaintext transmission mode and IPSec secure transmission mode for power APN IoT private network data, ensuring the security of service transmission and network boundary traffic information of power APN IoT private network. This is of great significance for maintaining power APN IoT private network and power services.

[0032] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A hybrid encrypted communication method suitable for power APN IoT private networks, characterized in that, It includes the following steps: Step S10: Obtain the session key request initiated by the business platform from the private network platform, perform tunnel encapsulation on the session key request, add a timestamp, and obtain the session key request encapsulation package; Step S20: Perform a hash digest on the timestamp, message length, and tunnel encapsulation length fields in the session key request encapsulation packet to obtain the session key request integrity message feature information based on the timestamp and add it to the session key request encapsulation packet; Step S30: Find the corresponding session key table based on the business platform identifier to obtain the session key parameters; Step S40: Using session key parameters and session key request integrity message feature information, calculate the session key request confirmation packet according to the SM3 algorithm and send it to the business platform; Step S50: Obtain the message sent by the service platform from the private network platform, decrypt it according to the session key parameters and the received message, obtain the plaintext message, and then send it to the service host.

2. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 1, characterized in that, In step S10, the session key request includes a service platform identifier, a session key request sequence number, and a session key message encryption key; wherein, the method for generating the session key message encryption key includes the following steps: Step S1: Obtain the session key initialization parameter packet based on the timestamp, and perform a hash digest on the session key initialization parameter packet to obtain the feature information of the session key request confirmation packet based on the timestamp. Step S2: Obtain the power APN IoT private network parameters and the time-stamp-based session key initialization parameter packet feature information, and calculate the message encryption key using the AES symmetric encryption algorithm.

3. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 2, characterized in that, Step S1 includes the following sub-steps: Step S11: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S12: Use the SHA256 algorithm to perform a hash digest on the timestamp field, message length field, and tunnel encapsulation length field.

4. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 2, characterized in that, Step S2 includes the following sub-steps: Step S21: Obtain the power APN IoT private network parameters, including the IP address and port of the password server, the destination port of the message, the destination IP address of the message, the power APN IoT private network key, and the power APN IoT private network key length. Step S22: Obtain the power APN IoT private network parameters. The obtained power APN IoT private network parameters are encoded using the Base64 algorithm and then encoded into the session key initialization parameter package in text form to obtain the encoded power APN IoT private network parameters. Step S23: Obtain the feature information of the session key initialization parameter packet based on the timestamp, merge the obtained encoded power APN IoT private network parameters and the feature information of the session key initialization parameter packet based on the timestamp, use the power APN IoT private network key as the key, and calculate the message encryption key using the AES symmetric encryption algorithm and 128-bit encryption mode.

5. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 1, characterized in that, Step S10 includes the following sub-steps: Step S101: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S102: Combine the timestamp field, message length field, and tunnel encapsulation length field, calculate using the SHA256 algorithm, and then perform a hash digest to obtain the session key request integrity message feature information based on the timestamp. Step S103: The session key request sequence number, session key message encryption key, and timestamp-based session key request integrity message feature information in the session key request are merged and then tunnel-encapsulated for transmission.

6. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 1, characterized in that, Step S20 includes the following sub-steps: Step S201: Obtain the timestamp, message length field, and tunnel encapsulation length field from the message header; Step S202: Merge the timestamp, message length field and tunnel encapsulation length field in order, and then calculate the hash digest together with the parameter value of the session key request integrity message feature information calculated in the previous step. Use the SHA256 algorithm to obtain the session key request confirmation packet feature information. Step S203: Obtain the message sequence number from the message header, merge the obtained message sequence number with the session key request confirmation packet feature information calculated in the previous step and use it as the session key confirmation packet message sequence number, and send the session key request confirmation packet message sequence number, session key end identifier, and session key end flag together to the business platform in the power APN IoT private network.

7. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 1, characterized in that, Step S30 includes the following sub-steps: Step S301: Find the location of the session key table corresponding to the current business platform from the session key table based on the business platform identifier; Step S302: Obtain the valid session key sequence number based on the valid identifier found in the session key table. Step S303: Using the business platform identifier and valid session key sequence number, the session key table request message feature information is calculated through a hash digest; Step S304: Obtain the session key request sequence number from the session key request, and send the obtained session key request sequence number, session key table request message integrity message feature information, current session key sequence number, validity flag, session key request sequence number, session key end identifier, and session key end flag together to the business platform in the power APN IoT private network.

8. The hybrid encrypted communication method for power APN IoT private network according to claim 7, characterized in that, Step S303 includes the following sub-steps: Step S3031: Obtain the current time as the timestamp field, and obtain the message length field and tunnel encapsulation length field at the current moment; Step S3032: Use the SHA256 algorithm to perform a hash digest on the session key table location, timestamp field, message length field, and tunnel encapsulation length field.

9. The hybrid encrypted communication method applicable to power APN IoT private network according to claim 1, characterized in that, The message length field is represented by characters encoded using the Base64 algorithm; the session key request confirmation packet feature information is represented by characters encoded using the Base64 algorithm; the session key request feature information is represented by characters encoded using the Base64 algorithm; the session key confirmation packet feature information is represented by characters encoded using the Base64 algorithm.

10. A hybrid encrypted communication system suitable for power APN IoT private networks, characterized in that, It includes the following modules: The session key request encapsulation package generation module is used to obtain the session key request initiated by the business platform from the private network platform, perform tunnel encapsulation on the session key request, add a timestamp, and obtain the session key request encapsulation package; The integrity message feature information generation module is used to perform a hash digest on the timestamp, message length field and tunnel encapsulation length field in the session key request encapsulation packet, obtain the session key request integrity message feature information based on the timestamp and add it to the session key request encapsulation packet; The session key parameter acquisition module is used to look up the corresponding session key table based on the business platform identifier and obtain the session key parameters. The Session Key Request Confirmation Packet Generation Module is used to calculate the Session Key Request Confirmation Packet according to the SM3 algorithm using session key parameters and session key request integrity message feature information, and then send it to the business platform. The message decryption module is used to obtain messages sent by the business platform from the private network platform, decrypt them according to the session key parameters and the received messages, and then send the plaintext messages to the business host.

11. The hybrid encrypted communication system for power APN IoT private network according to claim 10, characterized in that, The session key parameter acquisition module includes: The session key initialization parameter packet feature information acquisition submodule is used to obtain the current time as a timestamp field, and to obtain the message length field and tunnel encapsulation length field at the current moment; The session key message encryption key acquisition submodule is used to obtain the power APN IoT private network parameters and the time-stamp-based session key initialization parameter packet feature information, and calculates the message encryption key using the AES symmetric encryption algorithm.

12. The hybrid encrypted communication system for power APN IoT private network according to claim 10, characterized in that, The session key request encapsulation packet generation module includes: The timestamp generation submodule is used to obtain the current time as the timestamp field, and to obtain the message length field and tunnel encapsulation length field at the current moment; The message feature information generation submodule is used to combine the timestamp field, message length field, and tunnel encapsulation length field, calculate the hash digest using the SHA256 algorithm, and obtain the session key request integrity message feature information based on the timestamp. The Session Key Request Encapsulation Submodule is used to merge the Session Key Request Sequence Number, Session Key Message Encryption Key, and Timestamp-based Session Key Request Integrity Message Feature Information in the Session Key Request before tunneling encapsulation and transmission.

13. The hybrid encrypted communication system for power APN IoT private network according to claim 10, characterized in that, The session key request confirmation packet generation module includes: The timestamp acquisition submodule is used to obtain the timestamp, message length field, and tunnel encapsulation length field from the message header; The Session Key Request Confirmation Packet Feature Information Acquisition Submodule is used to merge the timestamp, message length field, and tunnel encapsulation length field in sequence, and then calculate the hash digest together with the parameter value of the Session Key Request Integrity Packet Feature Information to obtain the Session Key Request Confirmation Packet Feature Information.

Images