System backup and restoration method for new energy centralized control project based on Kyber-AES algorithm

Abstract

The invention provides a system backup and restoration method for a new energy centralized control project based on a Kyber-AES algorithm, and relates to the field of new energy centralized control systems, and the method comprises the steps: determining a backup mode based on the state of a timer in a server, and when the backup mode is automatic backup, generating a check mode of a check code based on a symmetric encryption algorithm of lattice cryptography in combination with BLAKE2; automatically backing up the file to be backed up to obtain a backup result; when the backup mode is manual backup, performing means backup on the file to be backed up by adopting a manual operation mode to obtain a backup result; and performing backup file restoration on the backup result according to the backup result, a symmetric encryption algorithm based on lattice cryptography and a check mode of generating a check code in combination with BLAKE2 so as to complete system restoration after system software upgrading fails. According to the invention, through the backup and restoration service based on the service mode, the software upgrade package can be distributed to each node and forms a record.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of new energy integrated control systems, in particular, to a Kyber-AES algorithm-based new energy integrated control project system backup and restoration method. BACKGROUND

[0002] A new energy integrated control system is a system for centralized monitoring and management of various new energy power generation equipment, aiming to improve the efficiency, reliability and economy of new energy power generation. It is commonly used in wind farms, photovoltaic power stations, energy storage systems and other scenarios, and can realize unified management and optimal control of various new energy equipment. New energy integrated control system is an important technical support in the field of new energy power generation, which can effectively improve the efficiency and reliability of new energy power generation, reduce operation and maintenance cost, and promote the large-scale application of new energy.

[0003] In actual application, in order to ensure the continuity of business and the stability of system, it is necessary to regularly backup the system software to prevent data loss caused by hardware failure, software error, human error or natural disaster. When the system crashes or files are damaged due to update failure, configuration error or virus attack, fast recovery of backup can minimize downtime and ensure business continuity.

[0004] At present, most new energy integrated control systems still use manual backup and restoration operation, which may be simple and direct in some scenarios, but has many shortcomings: manual operation is prone to incomplete backup or restoration failure due to human negligence; important system files, configuration files or databases are missed, resulting in system failure after restoration; manual backup requires human intervention, and the operation process is tedious in the case of large data volume or complex system; manual backup lacks log recording and auditing function, making it difficult to track the history of backup and restoration operation; manual backup lacks encryption and protection, which poses a security risk.

[0005] In view of the problems in the related art, no effective solution has been proposed so far. SUMMARY

[0006] Therefore, the present application provides a Kyber-AES algorithm-based new energy integrated control project system backup and restoration method to solve the above-mentioned problems.

[0007] In order to solve the above problems, the specific technical scheme adopted by the present application is as follows:

[0008] A Kyber-AES algorithm-based new energy integrated control project system backup and restoration method, comprising:

[0009] S1, acquire the backup task request of the service end, and determine the backup mode based on the state of the timer in the service end, the backup mode including automatic backup and manual backup;

[0010] S2, when the backup mode is automatic backup, the file to be backed up is automatically backed up based on the symmetric encryption algorithm of lattice cryptography and the verification mode of generating the verification code by combining BLAKE2, to obtain the backup result;

[0011] S3, when the backup mode is manual backup, the file to be backed up is manually backed up based on manual operation, to obtain the backup result;

[0012] S4, according to the backup result, the backup file is restored based on the symmetric encryption algorithm of lattice cryptography and the verification mode of generating the verification code by combining BLAKE2, to complete the system restoration after the system software upgrade fails.

[0013] Preferably, the backup task request of the service end is acquired, and the backup mode is determined based on the state of the timer in the service end, including:

[0014] S11, the service end sends a backup request of a single or multiple files to the agent end;

[0015] S12, the agent end receives the backup request sent by the service end, and acquires the state of the preset timer in the service end;

[0016] S13, if the state of the preset timer is started, it is determined that the backup task adopts the automatic backup mode, and if the state of the preset timer is closed, it is determined that the backup task adopts the manual backup mode.

[0017] Preferably, when the backup mode is automatic backup, the file to be backed up is automatically backed up based on the symmetric encryption algorithm of lattice cryptography and the verification mode of generating the verification code by combining BLAKE2, to obtain the backup result, including:

[0018] S21, based on the symmetric encryption algorithm, the agent end generates a random encryption standard key, and uses the random encryption standard key to encrypt and compress the file to be backed up, to obtain encrypted and compressed data;

[0019] S22, the Kyber algorithm is used to encapsulate the random encryption standard key, to obtain the encapsulated random encryption standard key;

[0020] S23, based on the encrypted and compressed data, the BLAKE2 algorithm is used to generate a backup verification code;

[0021] S24, the agent end sends the encrypted and compressed data, the encapsulated random encryption standard key and the backup verification code to the service end by data transmission.

[0022] S25, the server checks the received encrypted compressed data, encapsulated random encryption standard key and backup check code, if the check is successful, the agent end backup file is deleted, if the check fails, return to S24.

[0023] Preferably, based on the symmetric encryption algorithm, the agent end generates a random encryption standard key, and encrypts and compresses the file to be backed up using the random encryption standard key to obtain encrypted compressed data, including:

[0024] S211, for the file to be backed up, using a pre-set system command, the data compression processing is carried out, and the recycling function is used to judge whether the compression is successful, if successful, the compressed data is obtained, otherwise, the compression processing is carried out again for the file to be backed up;

[0025] S212, based on the symmetric encryption algorithm, a backup random encryption standard key of a preset byte number is created;

[0026] S213, the compressed data is encrypted using the backup random encryption standard key to obtain encrypted compressed data.

[0027] Preferably, the Kyber algorithm is used to encapsulate the random encryption standard key to obtain the encapsulated backup random encryption standard key, including:

[0028] S221, initialize the Kyber algorithm, and generate a backup encapsulation key using the Kyber algorithm, the backup encapsulation key including an encapsulation public key and an encapsulation private key;

[0029] S222, the random encryption standard key is encapsulated using the encapsulation public key in the backup encapsulation key to obtain the encapsulated backup random encryption standard key.

[0030] Preferably, based on the encrypted compressed data, the BLAKE2 algorithm is used to generate a backup check code, including:

[0031] S231, initialize the hash state of the BLAKE2 algorithm, and read the data block in the encrypted compressed data to the preset buffer;

[0032] S232, based on the BLAKE2 update function, the data block in the buffer is hashed calculated, and all data blocks are processed in a loop until the encrypted compressed data is read;

[0033] S233, based on the BLAKE2 final function, the hash value is calculated and the final backup check code is generated according to the calculation result.

[0034] Preferably, the server checks the received encrypted compressed data, encapsulated backup random encryption standard key and backup check code, including the following steps:

[0035] S241, the server receives the encrypted compressed data, encapsulated random encryption standard key and backup check code, and performs the encapsulated backup random encryption standard key processing;

[0036] S242, using the backup random encryption standard key processed by the encapsulation, the encrypted compressed data is decrypted to obtain the decompressed data;

[0037] S243, the server uses BLAKE2 algorithm to calculate the check code of the decompressed data;

[0038] S244, the check code is compared with the backup check code, if the check is the same, it means that the check is successful, otherwise, the check fails.

[0039] Preferably, when the backup mode is manual backup, the backup result is obtained by manually backing up the file to be backed up based on the manual operation mode, including:

[0040] S31, when the backup mode is manual backup, start the backup and recovery client, and authenticate the user through the permission management system in the new energy centralized control system, if the authentication is passed, execute S32, otherwise, refuse manual backup;

[0041] S32, determine the file to be backed up and the computer to be backed up;

[0042] S33, use the computer to backup the file to be backed up, and write the backup operation content and the backup result into the audit log after the backup is completed.

[0043] Preferably, according to the backup result, the backup file is restored based on the symmetric encryption algorithm of lattice cryptography and the check code generated by BLAKE2, including:

[0044] S41, the client starts the server, and the server authenticates the user through the permission service of the new energy centralized control system, if the authentication is passed, the system is upgraded, otherwise, the system is refused to upgrade;

[0045] S42, verify the running condition of the system after upgrading, if the running is abnormal, use the backup result, based on the symmetric encryption algorithm of lattice cryptography and the check code generated by BLAKE2, to restore the backup file; if the running is normal, no backup file restoration is needed.

[0046] Preferably, the execution system upgrade includes:

[0047] Obtain the system software packages and verification files that need to be upgraded, and determine the machine nodes that need to be upgraded and the upgrade order;

[0048] The client sends the system software upgrade package and verification file that need to be upgraded to the server.

[0049] The client sends an upgrade request and the name of the system software to be upgraded to the agent of the machine node that needs to be upgraded;

[0050] Based on the upgrade request and the name of the system software to be upgraded, the agent downloads the system software package and verification file to be upgraded from the server, verifies the system software package using the verification file, and then performs the system upgrade after verification.

[0051] Preferably, the process of obtaining the system software package and verification file to be upgraded includes:

[0052] Based on the system software package that needs to be upgraded, a system upgrade verification code is generated using the BLAKE2 algorithm.

[0053] Use the system upgrade verification code as the verification file and establish a matching relationship with the system software package that needs to be upgraded.

[0054] Preferably, after the agent downloads the system software package and verification file to be upgraded from the server, it includes:

[0055] Based on the system software package that needs to be upgraded after downloading, the BLAKE2 algorithm is used to generate a system upgrade verification code.

[0056] The system upgrade verification code is used as the verification file for comparison with the verification file.

[0057] Preferably, if the upgraded verification system malfunctions, the backup file is restored using the backup results, based on a symmetric encryption algorithm using lattice cryptography and combined with the BLAKE2 checksum generation verification method.

[0058] Obtain the machine node that needs to be restored, and send a file restoration request to the server through the agent;

[0059] After receiving the request, the server retrieves the restore file to be restored from the backup results;

[0060] A symmetric encryption algorithm is used to generate a standard key for restoring random encryption, and this standard key is then used to encrypt the file to be restored, resulting in encrypted restored data.

[0061] For encrypted data recovery, the BLAKE2 algorithm is used to generate a recovery verification code;

[0062] A symmetric encryption algorithm based on lattice cryptography is used to decapsulate the random encryption standard key to obtain the decapsulated random encryption standard key.

[0063] The server sends the encrypted and restored data, the restoration verification code, and the encapsulated restoration random encryption standard key to the agent.

[0064] The agent uses the Kyber-AES algorithm to deseal the encapsulated restored random encryption standard key, obtains the restored random encryption standard key, and uses the restored random encryption standard key to decrypt the encrypted restored data to obtain the restored file;

[0065] The BLAKE2 algorithm is used to calculate the restoration check code of the restored file and verify it with the restoration check code. If the verification is successful, the restored file is decompressed and a system restore is performed. If the verification fails, the system restore is rejected.

[0066] The beneficial effects of this invention are as follows:

[0067] This invention utilizes the NIST-standardized post-quantum cryptography algorithm Kyber to significantly improve the long-term security of the system while maintaining its high efficiency, particularly its ability to resist future quantum computing attacks. The scheme employs a layered encryption architecture, combining the asymmetric properties of Kyber with the efficiency of AES, achieving an optimal balance between security and performance. This layered encryption architecture balances security and performance, enabling quantum-secure backup data transmission and storage. The method is customized to the specific needs of new energy monitoring systems, exhibiting better adaptability and fit compared to third-party tools. Furthermore, through a service-based backup and restore service, software upgrade packages can be distributed to various nodes and recorded. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0069] Figure 1 This is a flowchart of a system backup and restore method for a new energy centralized control project based on the Kyber-AES algorithm according to an embodiment of the present invention;

[0070] Figure 2This is a schematic diagram of a backup and restore service system in a system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to an embodiment of the present invention.

[0071] Figure 3 This is a schematic diagram of the backup process based on the Kyber-AES algorithm in a system backup and restore method for a new energy centralized control project according to an embodiment of the present invention.

[0072] Figure 4 This is a schematic diagram of the restoration process based on the Kyber-AES algorithm in a system backup and restoration method for a new energy centralized control project according to an embodiment of the present invention.

[0073] Figure 5 This is a schematic diagram of the backup and restore operation based on the Kyber-AES encryption algorithm in a system backup and restore method for a new energy centralized control project according to an embodiment of the present invention. Detailed Implementation

[0074] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0075] According to an embodiment of the present invention, a system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm is provided.

[0076] It should be further noted that this invention implements a backup and restore service based on the CrystalKyber+AES256 algorithm, abbreviated as Kyber-AES algorithm (a symmetric encryption algorithm based on lattice cryptography). This service includes a backup and restore service and a backup and restore proxy, such as... Figure 2 As shown. The backup and restore service runs on the backup and restore server. To improve system reliability, two machines are deployed and run in a primary / standby configuration. The backup and restore agent runs on each machine node that needs to perform backup and restore operations, such as... Figure 5 As shown.

[0077] The backup and restore service includes the following modules: transmission module, storage module, security module, scheduling module, and audit log module.

[0078] The transmission module is used to receive backup files of the client's operating environment and various data. Network data transmission uses Kyber-AES encryption and decryption, and flow control is enabled during the transmission process to ensure that the transmission process will not impact the network environment of the existing system.

[0079] The storage module stores received backup files. If a backup and restore service backup machine exists, a copy of the received files will also be saved on the backup machine. All backup files and software upgrade packages are stored on the server node where the backup and restore service resides, facilitating unified maintenance and management.

[0080] The security module is used for role and access control, ensuring users have the necessary permissions to perform backups and restores by checking roles and corresponding permissions. The security service also manages the keys used in the backup and restore process and their lifecycle, including the entire lifecycle management of key generation, storage, distribution, updating, and destruction.

[0081] The self-backup module is used to handle scheduled backup tasks, which are usually scheduled during periods of low system load.

[0082] The audit monitoring module is used to record all access operations, which facilitates auditing and anomaly detection.

[0083] In addition, the backup and restore agent includes the following modules: transfer module, backup module, restore module, and audit module.

[0084] The transmission module is used to receive backup files of the client's operating environment and various data. The transmission process is encrypted using the Kyber-AES algorithm and uses flow control to ensure that the transmission process will not impact the network environment of the existing system. At the same time, the transmission process supports the function of resuming interrupted transmission.

[0085] The backup module is used to generate compressed and Kyber-AES encrypted full database backup files, incremental database backup files, system software backup files, and corresponding verification files.

[0086] The restore module is used to verify, decrypt, decompress, and restore database full backup files, database incremental backup files, and system software backup files.

[0087] The audit module is used to record all local backup, restore, and upgrade operations.

[0088] It should be understood that Crystal-Kyber is a lattice-based encryption algorithm selected by NIST (National Institute of Standards and Technology) as one of the post-quantum cryptography standards, hereinafter referred to as Kyber. The AES algorithm (symmetric encryption algorithm) is a standard released by NIST in 2001 to replace the older DES (Data Encryption Standard) algorithm. AES uses symmetric encryption, meaning that encryption and decryption use the same key. It encrypts plaintext in fixed-length blocks (128 bits). AES supports three key lengths: 128 bits, 192 bits, and 256 bits, referred to as AES-128, AES-192, and AES-256, respectively. In this scheme, Kyber is used for key encapsulation during backup and restore, and then the AES symmetric algorithm is used for file encryption and decryption.

[0089] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments, such as... Figure 1 As shown, the system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to an embodiment of the present invention includes:

[0090] S1. Obtain the backup task request from the server and determine the backup method based on the state of the timer in the server. The backup method includes automatic backup and manual backup.

[0091] In a preferred embodiment, obtaining the backup task request from the server and determining the backup method based on the state of the timer in the server includes:

[0092] S11. Send backup requests for one or more files to the agent through the server;

[0093] S12. The agent receives the backup request sent by the server and obtains the status of the preset timer in the server.

[0094] S13. If the preset timer is in the "started" state, the backup task is determined to use the automatic backup method. If the preset timer is in the "off" state, the backup task is determined to use the manual backup method.

[0095] Specifically, the files that need to be backed up can be database log files, application files, or other data files.

[0096] The transaction log is a crucial component of a database management system. It records all modification operations performed on the database (such as inserts, updates, and deletes) and transaction-related information (such as the start, commit, or rollback of a transaction). The principle behind using the transaction log for database restoration is primarily based on the following points:

[0097] (1) Record all modification operations:

[0098] 1. The transaction log records all changes made to the database by each transaction. These records are detailed enough to be used for redo or undo operations.

[0099] 2. When updating a row of data, the log will not only record the new value after the update, but may also record the old value before the update (for rollback).

[0100] (2) Ensure durability and atomicity:

[0101] Once a transaction is committed, its modifications to the database are permanent and will not be lost even in the event of a system failure (such as a power outage). The transaction log ensures this through a "write-ahead" mechanism: before writing modifications to data pages to disk, the corresponding log record must first be written to disk. This way, even if data pages are not written in a timely manner, the system can recover from the log; a transaction either completes entirely or fails entirely. If a transaction fails midway, the system can use the information in the transaction log to roll back (undo) the parts of the transaction that have already been executed.

[0102] (3) When the database restarts after a failure (such as a crash), the database management system will enter recovery mode and perform the following operations using the transaction log:

[0103] 1. Redo: Re-execute all committed operations that have not yet been written to the data files. These operations are marked as committed in the log, but may not have been written to disk due to caching or other reasons.

[0104] 2. Undo: Rolls back all uncommitted transactions. These transactions have no commit record in the log, so their modifications to the database need to be reversed to maintain database consistency.

[0105] (4) In addition to crash recovery, the transaction log also supports recovery to a specific point in time: if there is a complete database backup and all subsequent transaction logs, the database can be restored to any point in time after the backup.

[0106] Transaction logs are one of the core mechanisms for ensuring the reliability and consistency of a database under concurrent operations and failure scenarios. By recording all modification operations, it ensures the database's recovery capability after a failure and supports flexible point-in-time recovery.

[0107] S2. When the backup method is automatic backup, the file to be backed up is automatically backed up based on the symmetric encryption algorithm of lattice cryptography and the verification method of generating checksums using BLAKE2, and the backup result is obtained.

[0108] In a preferred embodiment, when the backup method is automatic backup, the file to be backed up is automatically backed up using a symmetric encryption algorithm based on lattice cryptography and a verification method that uses BLAKE2 to generate a checksum. The backup result includes:

[0109] S21. Based on the symmetric encryption algorithm, the agent generates a random encryption standard key and uses the random encryption standard key to encrypt and compress the file to be backed up to obtain encrypted and compressed data.

[0110] In a preferred embodiment, based on a symmetric encryption algorithm, the proxy generates a random encryption standard key and uses this key to encrypt and compress the file to be backed up, resulting in encrypted and compressed data including:

[0111] S211. For the file to be backed up, use the pre-set system command to perform data compression processing, and use the recycling function to determine whether the compression is successful. If successful, the compressed data is obtained; otherwise, the file to be backed up is compressed again.

[0112] S212. Based on the symmetric encryption algorithm, create a backup random encryption standard key with a preset number of bytes;

[0113] S213. Encrypt the compressed data using the backup random encryption standard key to obtain encrypted compressed data.

[0114] S22. The Kyber algorithm is used to encapsulate the random encryption standard key to obtain the encapsulated random encryption standard key.

[0115] In a preferred embodiment, the Kyber algorithm is used to encapsulate the random encryption standard key, resulting in the encapsulated key comprising:

[0116] S221. Initialize the Kyber algorithm and use the Kyber algorithm to generate a backup encapsulation key, wherein the backup encapsulation key includes an encapsulation public key and an encapsulation private key;

[0117] S222. Use the encapsulation public key in the backup encapsulation key to encapsulate the random encryption standard key to obtain the encapsulated backup random encryption standard key.

[0118] S23. Based on encrypted compressed data, generate a backup verification code using the BLAKE2 algorithm;

[0119] As a preferred embodiment, the step of generating a backup verification code based on encrypted compressed data using the BLAKE2 algorithm includes:

[0120] S231. Initialize the hash state of the BLAKE2 algorithm and read data blocks from the encrypted compressed data into a preset buffer;

[0121] S232. Based on the BLAKE2 update function, perform hash calculation on the data blocks in the buffer, and process all data blocks in a loop until the encrypted and compressed data is read.

[0122] S233. Based on the BLAKE2 final function, perform hash value calculation and generate the final backup verification code according to the calculation result.

[0123] S24. The agent sends the encrypted and compressed data, the encapsulated random encryption standard key, and the backup verification code to the server via data transmission.

[0124] In a preferred embodiment, the server verifies the received encrypted compressed data, the encapsulated backup random encryption standard key, and the backup verification code by including the following steps:

[0125] S241. After receiving the encrypted compressed data, the encapsulated random encryption standard key, and the backup verification code, the server decapsulates the encapsulated backup random encryption standard key.

[0126] S242. Using the backup random encryption standard key of the decryption process, the encrypted compressed data is decrypted to obtain the decompressed data.

[0127] S243. The server uses the BLAKE2 algorithm to calculate the verification code of the decompressed data;

[0128] S244. Verify the verification code with the backup verification code. If they match, the verification is successful; otherwise, the verification fails.

[0129] S25. The server verifies the received encrypted compressed data, the encapsulated random encryption standard key, and the backup verification code. If the verification is successful, the backup file on the agent side is deleted. If the verification fails, the server returns to S24.

[0130] Specifically, such as Figure 3 As shown, backup file encryption includes encryption of both the backup file and the verification file: the file or data is compressed and then encrypted using Kyber-AES; the verification file uses BLAKE2 to generate a checksum and is then encrypted again using Kyber-AES. BLAKE2 is a high-speed, secure hash algorithm that is faster than MD5, SHA-1, and SHA-2, has high adaptability and resistance to attacks, and supports multi-threaded parallel computation. During the restoration operation, the file to be restored must be checked against the verification file. If the verification fails, the restoration is abandoned and an exception record is added.

[0131] Automatic scheduled backup service is used to periodically back up the configured nodes, ensuring data security, business continuity, cost savings, efficiency improvement, and system recoverability and high reliability.

[0132] Furthermore, the database transaction log compression / decompression utilizes the tar system command, a built-in feature of Linux. The project code uses the popen system call to execute a tar-based compression / decompression command and interact with it via input / output. After execution, a call to pclose is used to determine if the compression / decompression operation was successful.

[0133] The `popen` system is a function in the C standard library used to execute and communicate with external commands within a program. It creates a pipe, starts a new process, and returns a file pointer, allowing the program to interact with external commands as if manipulating a file. `pclose` is used to reclaim child process resources and obtain the child process's exit status; `pclose()` is a key function paired with `popen()`, used to properly close the process pipe created by `popen()` and reclaim system resources.

[0134] For example:

[0135] Example 1: Compress directory dir1 and file file1, and name the compressed file zipfile.tar.xz;

[0136] Tar Jcvf zipfile.tar.xz dir1 file1;

[0137] Example 2: Decompress a file into the directory dir2, and name the compressed file zipfile.tar.xz;

[0138] Tar Jxvf zipfile.tar.xz -C dir2;

[0139] This invention uses the Kyber-AES algorithm for file backup and restoration. Below are the backup / restore steps based on Kyber-AES and the C / C++ implementation functions:

[0140] / / Kyber-AES encryption function

[0141] / / Kyber key encapsulation + AES file encryption

[0142] void kyber_encrypt_file(const vector<uint8_t> & plaintext,

[0143] const vector<uint8_t>& public_key,

[0144] vector<uint8_t>& ciphertext,

[0145] vector<uint8_t>& encapsulated_key) {

[0146] / / Generate a random AES key

[0147] vector<uint8_t> aes_key(32);

[0148] RAND_bytes(aes_key.data(), 32);

[0149] / / AES encrypt the file data

[0150] auto encrypted_data = aes_encrypt(plaintext, aes_key);

[0151] / / Kyber encapsulate the AES key

[0152] OQS_KEM* kem = OQS_KEM_new(OQS_KEM_alg_kyber_768);

[0153] encapsulated_key.resize(kem->length_ciphertext);

[0154] vector<uint8_t> shared_secret(kem->length_shared_secret);

[0155] OQS_STATUS rc = OQS_KEM_encaps(kem, encapsulated_key.data(),

[0156] shared_secret.data(), public_key.data());

[0157] if (rc != OQS_SUCCESS) {

[0158] throw runtime_error("Kyber encaps failed");

[0159] }

[0160] / / Combined output: Encapsulation key + Encrypted data

[0161] ciphertext = encapsulated_key;

[0162] ciphertext.insert(ciphertext.end(), encrypted_data.begin(),encrypted_data.end());

[0163] OQS_KEM_free(kem);

[0164] }

[0165] Additionally, the implementation function for Kyber-AES file decryption:

[0166] / / Kyber key decapsulation + AES file decryption

[0167] vector<uint8_t> kyber_decrypt_file(const vector<uint8_t> & ciphertext,

[0168] const vector<uint8_t> & private_key){

[0169] OQS_KEM* kem = OQS_KEM_new(OQS_KEM_alg_kyber_768);

[0170] / / Separate the encapsulation key and encrypted data

[0171] vector<uint8_t> encapsulated_key(ciphertext.begin(),

[0172] ciphertext.begin() + kem->length_ciphertext);

[0173] vector<uint8_t> encrypted_data(ciphertext.begin() + kem->length_ciphertext,

[0174] ciphertext.end());

[0175] / / Kyber decapsulates and obtains the AES key

[0176] vector<uint8_t> shared_secret(kem->length_shared_secret);

[0177] OQS_STATUS rc = OQS_KEM_decaps(kem, shared_secret.data(),

[0178] encapsulated_key.data(), private_key.data());

[0179] if (rc != OQS_SUCCESS) {

[0180] throw runtime_error("Kyber decaps failed");

[0181] }

[0182] / / AES decryption of file data

[0183] auto plaintext = aes_decrypt(encrypted_data, shared_secret);

[0184] OQS_KEM_free(kem);

[0185] return plaintext;

[0186] }

[0187] Specifically, the server-side automatic backup module uses a timer to check whether to start a scheduled backup task. Once started, it first performs an incremental backup of the database. The server first sends an incremental backup request to the database server's proxy. Upon receiving the request, the proxy compresses the database transaction logs and encrypts them using the Kyber-AES algorithm. It then generates a checksum file based on BLAKE2 and encrypts it as well. The checksum file includes the backup time. After the database transaction log backup and checksum files are prepared, the proxy sends them to the server via a transmission module. Upon receiving the database log backup and checksum files, the server calculates the BLAKE2 checksum of the database log backup file and compares it with the checksum in the checksum file.

[0188] If the database log file verification is successful, the agent is notified of a successful backup operation. The agent deletes the corresponding backup file and verification code file, records the operation log, and ends the backup operation. If the database log file verification fails, the agent is notified of a failed backup operation and the file is repeatedly sent to the server for verification. After the set number of retries is exceeded, the backup operation is abandoned and the operation log is recorded. After the incremental database backup is completed, the system software backup begins. The server can preset the content to be included in the system software backup, such as executable programs, dynamic libraries, runtime configuration parameters, and various data. The server sends a system software backup request to the agent. The agent compresses and encrypts the corresponding backup file for the system software and generates an encrypted verification file with a timestamp. After preparation, the agent sends the file to the server through the transmission module. The server receives the system software backup request. After backing up and verifying the database log file, the server calculates the verification code in the backup file and checks it against the verification code in the verification file. If the database log file verification is successful, the server notifies the agent that the backup operation is successful, deletes the corresponding backup file and verification code file, records the operation log, and ends the backup operation. If the database log file verification fails, the server notifies the agent that the backup operation has failed. The server then retryes the process of receiving the system software backup file and verification file, deleting the corresponding backup file and verification code file, recording the operation log, ending the backup operation, and recording the operation log. After the number of retries exceeds the set number, the server abandons the backup operation. This process continues until all nodes that are scheduled for backup are completed. Finally, the server ends the scheduled task and writes the entire result of the operation to the audit log.

[0189] Furthermore, compared to traditional MD5 checksums, the BLAKE2-based checksum method offers higher efficiency and better collision resistance. The specific implementation function is as follows:

[0190] int blake2_sum(const std::string filename,uint8 * hash)

[0191] {

[0192] FILE *file = fopen(filename.c_str(), "rb");

[0193] if (!file) {

[0194] perror("Unable to open file");

[0195] return 1;

[0196] }

[0197] / / Initialize the BLAKE2b context

[0198] blake2b_state S;

[0199] uint8_t hash[BLAKE2B_OUTBYTES] = {0};

[0200] if (blake2b_init(&S, sizeof(hash)) {

[0201] fprintf(stderr, "Error: BLAKE2b initialization failed\n");

[0202] fclose(file);

[0203] return 2;

[0204] }

[0205] / / Process file content

[0206] uint8_t buffer[CHUNK_SIZE];

[0207] size_t bytes_read;

[0208] while ((bytes_read = fread(buffer, 1, sizeof(buffer), file)) > 0){

[0209] if (blake2b_update(&S, buffer, bytes_read)) {

[0210] fprintf(stderr, "Error: BLAKE2b update failed\n");

[0211] fclose(file);

[0212] return 1;

[0213] }

[0214] }

[0215] / / Complete hash calculation

[0216] if (blake2b_final(&S, hash, sizeof(hash))) {

[0217] fprintf(stderr, "Error: BLAKE2b final calculation failed / n");

[0218] fclose(file);

[0219] return 1;

[0220] }

[0221] fclose(file);

[0222] return 0;

[0223] }

[0224] Specifically, for two files A.txt and B.txt, the function blake2_sum calculates the hash value of A.txt and B.txt respectively. This hash value is an array. If the contents of the two files are identical, then the contents of their corresponding hash value arrays should be completely identical. If the calculated hash values ​​are identical, then the contents of the two files can be considered identical; otherwise, the contents of the two files are inconsistent. The specific implementation function is as follows:

[0225] bool blake2_is_same(const std::string & filename1,const std::string &filename2)

[0226] {

[0227] uint8 hash1[BLAKE2B_OUTBYTES] = {0}

[0228] uint8 hash2[BLAKE2B_OUTBYTES] = {0}

[0229] blake2_sum(filename1, hash1);

[0230] blake2_sum(filename2,hash2);

[0231] for(int i ==0 ; i < BLAKE2B_OUTBYTES; i++)

[0232] {

[0233] if (hash1[i] != hash[i]) {

[0234] return false;

[0235] }

[0236] }

[0237] return true;

[0238] }

[0239] …

[0240] if(blake2_is_same("A.txt","B.txt"))

[0241] fprintf(stderr, "File content is consistent\n");

[0242] else

[0243] fprintf(stderr, "File content is inconsistent\n").

[0244] S3. When the backup method is manual backup, the backup results are obtained by performing manual backup on the files to be backed up.

[0245] In a preferred embodiment, when the backup method is manual backup, the backup is performed on the files to be backed up using manual operation, and the backup result includes:

[0246] S31. When the backup method is manual backup, start the backup and restore client and verify the user's identity through the permission management system in the new energy centralized control system. If the verification is successful, execute S32; otherwise, reject manual backup.

[0247] S32. Determine the files that need to be backed up and the computer to be backed up;

[0248] S33. Use a computer to back up the files that need to be backed up, and write the backup operation content and backup results into the audit log after the backup is completed.

[0249] It should be noted that in addition to automatic backup, manual backup is required in some cases. For example, before upgrading the system, it is necessary to back up the current program and data of the system so that the environment before the upgrade can be quickly restored if the system upgrade fails.

[0250] Specifically, the process begins by launching the backup and restore client tool and authenticating user identity through the access control system in the new energy centralized control system; then, the content to be backed up is selected: a full database backup, an incremental database backup, or a system software runtime environment backup. To ensure minimal disk space usage, the full database backup function can only be performed manually; the computer to be backed up is selected; the software or data backup process begins; and after the backup is complete, the operation details and results are written to the audit log.

[0251] S4. Based on the backup results, use a symmetric encryption algorithm based on lattice cryptography and a verification method that uses BLAKE2 to generate a checksum to restore the backup file, so as to complete the system restore after the system software upgrade fails.

[0252] Specifically, system software upgrades replace some executable programs, dynamic libraries, and other data in the system, while backup and restore operate on all executable programs, dynamic libraries, and data in the system. During an upgrade, the client tool sends the system software upgrade package and verification file to the backup and restore server. The backup and restore client tool sends an upgrade request and the name of the system package to be upgraded to the backup and restore agent on the node requiring the upgrade. The agent generates an encrypted compressed file of the current runtime environment and an encrypted verification file, and sends both files to the backup and restore server. The intermediate operations and results are transmitted to the client via the transmission module and displayed on the client. The agent downloads the specified system software upgrade package and the corresponding verification file from the backup and restore server. The agent verifies the system software upgrade package using the verification file, using the same verification method as the backup / restore method described above. After verification, the system software upgrade is performed. This upgrade and restore operation is repeated for each machine node until all nodes have been upgraded. The system operation of the upgraded machine nodes is verified; if any abnormalities are found, the system is restored to its state before the upgrade based on the previous backup file. If multiple machine nodes in the system experience abnormalities after this upgrade, the software upgrade package is considered problematic and marked as an abnormal software upgrade package using client tools to prevent it from being used in the next upgrade or restore.

[0253] It should be noted that when restoring backup files, the backup and restore client tool is launched and user authentication is completed; the machine node to be restored is selected; the backup record is retrieved from the server. If the selected machine node is a database server, the backup record will contain database backup information; the machine node to be restored is selected, and the backup and restore client tool sends a restore request and the corresponding backup content to the backup and restore agent on the machine node; the agent retrieves the backup file and verification file from the server; after successful file retrieval, the backup file is verified according to the file verification code to prevent inconsistencies between the file and the server file due to transmission. After successful verification, the system software or database restoration operation begins; after the restoration operation is completed, the backup and restore client is notified that the restoration operation is finished, and the operation is written to the audit log; the backup and restore client tool receives and displays the operation steps and results of the restoration process from the agent.

[0254] As a preferred implementation, the step of restoring the backup file based on the backup result using a symmetric encryption algorithm based on lattice cryptography and a verification method that combines BLAKE2 to generate a checksum, in order to complete the system restore after a system software upgrade failure, includes:

[0255] S41. Start the server using the client. The server uses the built-in permission service of the new energy centralized control system to verify user identity. If the verification is successful, the system upgrade will be executed; otherwise, the system upgrade will be rejected.

[0256] S42. Verify the operation of the upgraded system. If the system is not running properly, restore the backup file using the backup results, based on the symmetric encryption algorithm of lattice cryptography and the verification method of generating checksums using BLAKE2. If the system is running normally, there is no need to restore the backup file.

[0257] In a preferred embodiment, the execution system upgrade includes:

[0258] Obtain the system software packages and verification files that need to be upgraded, and determine the machine nodes that need to be upgraded and the upgrade order;

[0259] The client sends the system software upgrade package and verification file that need to be upgraded to the server.

[0260] The client sends an upgrade request and the name of the system software to be upgraded to the agent of the machine node that needs to be upgraded;

[0261] Based on the upgrade request and the name of the system software to be upgraded, the agent downloads the system software package and verification file to be upgraded from the server, verifies the system software package using the verification file, and then performs the system upgrade after verification.

[0262] In a preferred embodiment, the process of obtaining the system software package and verification file to be upgraded includes:

[0263] Based on the system software package that needs to be upgraded, a system upgrade verification code is generated using the BLAKE2 algorithm.

[0264] Use the system upgrade verification code as the verification file and establish a matching relationship with the system software package that needs to be upgraded.

[0265] In a preferred embodiment, after the agent downloads the system software package and verification file to be upgraded from the server, it includes:

[0266] Based on the system software package that needs to be upgraded after downloading, the BLAKE2 algorithm is used to generate a system upgrade verification code.

[0267] The system upgrade verification code is used as the verification file for comparison with the verification file.

[0268] In a preferred embodiment, if the upgraded verification system malfunctions, the backup file is restored using the backup results, based on a symmetric encryption algorithm using lattice cryptography and combined with the BLAKE2 checksum generation verification method.

[0269] Obtain the machine node that needs to be restored, and send a file restoration request to the server through the agent;

[0270] After receiving the request, the server retrieves the restore file to be restored from the backup results;

[0271] A symmetric encryption algorithm is used to generate a standard key for restoring random encryption, and this standard key is then used to encrypt the file to be restored, resulting in encrypted restored data.

[0272] For encrypted data recovery, the BLAKE2 algorithm is used to generate a recovery verification code;

[0273] A symmetric encryption algorithm based on lattice cryptography is used to decapsulate the random encryption standard key to obtain the decapsulated random encryption standard key.

[0274] The server sends the encrypted and restored data, the restoration verification code, and the encapsulated restoration random encryption standard key to the agent.

[0275] The agent uses the Kyber-AES algorithm to deseal the encapsulated restored random encryption standard key, obtains the restored random encryption standard key, and uses the restored random encryption standard key to decrypt the encrypted restored data to obtain the restored file;

[0276] The BLAKE2 algorithm is used to calculate the restoration check code of the restored file and verify it with the restoration check code. If the verification is successful, the restored file is decompressed and a system restore is performed. If the verification fails, the system restore is rejected.

[0277] Specifically, such as Figure 4 As shown, the restoration process is as follows: The proxy sends a file restoration request to the server. Upon receiving the request, the server retrieves the specified file to be restored. The server generates a random AES key. The server encrypts the file to be restored using AES. The server encapsulates the AES key using Kyber. The server generates a BLAKE2 checksum for the encrypted file to be restored. The server sends the encapsulation key, encrypted data, and checksum to the proxy. The proxy decapsulates the data using Kyber to obtain the AES key. The proxy decrypts the data using the AES key to obtain the compressed file content and checksum. The proxy calculates the BLAKE2 checksum of the decrypted compressed data and compares it with the received checksum. If the verification is successful, the file is decompressed and restored.

[0278] In summary, by utilizing the technical solutions described above, this invention, through the NIST-standardized post-quantum cryptography algorithm Kyber, significantly improves the long-term security of the system while maintaining its high efficiency, particularly its ability to resist future quantum computing attacks. The solution employs a layered encryption architecture, combining the asymmetric characteristics of Kyber with the high efficiency of AES, achieving an optimal balance between security and performance. This layered encryption architecture balances security and performance, enabling quantum-secure backup data transmission and storage. This method is customized to the specific needs of new energy monitoring systems, exhibiting better adaptability and fit compared to third-party tools. Furthermore, through a service-based backup and restore service, software upgrade packages can be distributed to various nodes and recorded.

[0279] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0280] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm, characterized in that, include: S1. Obtain the backup task request from the server and determine the backup method based on the state of the timer in the server. The backup method includes automatic backup and manual backup. S2. When the backup method is automatic backup, the file to be backed up is automatically backed up based on the symmetric encryption algorithm of lattice cryptography and the verification method of generating checksums using BLAKE2, and the backup result is obtained. S3. When the backup method is manual backup, the backup results are obtained by performing manual backup on the files to be backed up. S4. Based on the backup results, use a symmetric encryption algorithm based on lattice cryptography and a verification method that uses BLAKE2 to generate a checksum to restore the backup file, so as to complete the system restore after the system software upgrade fails.

2. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 1, characterized in that, The process of obtaining the backup task request from the server and determining the backup method based on the state of the timer in the server includes: S11. Send backup requests for one or more files to the agent through the server; S12. The agent receives the backup request sent by the server and obtains the status of the preset timer in the server. S13. If the preset timer is in the "started" state, the backup task is determined to use the automatic backup method. If the preset timer is in the "off" state, the backup task is determined to use the manual backup method.

3. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 1, characterized in that, When the backup method is automatic backup, a symmetric encryption algorithm based on lattice cryptography, combined with the BLAKE2 checksum generation verification method, is used to automatically back up the files to be backed up, and the backup results include: S21. Based on the symmetric encryption algorithm, the agent generates a random encryption standard key and uses the random encryption standard key to encrypt and compress the file to be backed up to obtain encrypted and compressed data. S22. The Kyber algorithm is used to encapsulate the random encryption standard key to obtain the encapsulated random encryption standard key. S23. Based on encrypted compressed data, generate a backup verification code using the BLAKE2 algorithm; S24. The agent sends the encrypted and compressed data, the encapsulated random encryption standard key, and the backup verification code to the server via data transmission. S25. The server verifies the received encrypted compressed data, the encapsulated random encryption standard key, and the backup verification code. If the verification is successful, the backup file on the agent side is deleted. If the verification fails, the server returns to S24.

4. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 3, characterized in that, The method involves using a symmetric encryption algorithm to generate a random encryption standard key on the proxy side. This random encryption standard key is then used to encrypt and compress the files to be backed up, resulting in encrypted and compressed data, including: S211. For the file to be backed up, use the pre-set system command to perform data compression processing, and use the recycling function to determine whether the compression is successful. If successful, the compressed data is obtained; otherwise, the file to be backed up is compressed again. S212. Based on the symmetric encryption algorithm, create a backup random encryption standard key with a preset number of bytes; S213. Encrypt the compressed data using the backup random encryption standard key to obtain encrypted compressed data.

5. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 3, characterized in that, The Kyber algorithm is used to encapsulate the random encryption standard key, resulting in the following encapsulated key: S221. Initialize the Kyber algorithm and use the Kyber algorithm to generate a backup encapsulation key, wherein the backup encapsulation key includes an encapsulation public key and an encapsulation private key; S222. Use the encapsulation public key in the backup encapsulation key to encapsulate the random encryption standard key to obtain the encapsulated backup random encryption standard key.

6. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 3, characterized in that, The process of generating a backup verification code based on encrypted compressed data using the BLAKE2 algorithm includes: S231. Initialize the hash state of the BLAKE2 algorithm and read data blocks from the encrypted compressed data into a preset buffer; S232. Based on the BLAKE2 update function, perform hash calculation on the data blocks in the buffer, and process all data blocks in a loop until the encrypted and compressed data is read. S233. Based on the BLAKE2 final function, perform hash value calculation and generate the final backup verification code according to the calculation result.

7. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 3, characterized in that, The server verifies the received encrypted compressed data, the encapsulated backup random encryption standard key, and the backup verification code by including the following steps: S241. After receiving the encrypted compressed data, the encapsulated random encryption standard key, and the backup verification code, the server decapsulates the encapsulated backup random encryption standard key. S242. Using the backup random encryption standard key of the decryption process, the encrypted compressed data is decrypted to obtain the decompressed data. S243. The server uses the BLAKE2 algorithm to calculate the verification code of the decompressed data; S244. Verify the verification code with the backup verification code. If they match, the verification is successful; otherwise, the verification fails.

8. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 1, characterized in that, When the backup method is manual backup, the backup of the files to be backed up is performed manually, and the backup results include: S31. When the backup method is manual backup, start the backup and restore client and verify the user's identity through the permission management system in the new energy centralized control system. If the verification is successful, execute S32; otherwise, reject manual backup. S32. Determine the files that need to be backed up and the computer to be backed up; S33. Use a computer to back up the files that need to be backed up, and write the backup operation content and backup results into the audit log after the backup is completed.

9. A system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 1, characterized in that, The process of restoring the backup file based on the backup results using a symmetric encryption algorithm based on lattice cryptography and a verification method that uses BLAKE2 to generate a checksum, in order to complete the system restore after a system software upgrade failure, includes: S41. Start the server using the client. The server uses the built-in permission service of the new energy centralized control system to verify user identity. If the verification is successful, the system upgrade will be executed; otherwise, the system upgrade will be rejected. S42. Verify the operation of the upgraded system. If the operation is abnormal, use the backup results, based on the symmetric encryption algorithm of lattice cryptography, and combined with the verification method of generating checksums using BLAKE2, to restore the backup file. If the operation is normal, there is no need to restore the backup file.

10. A system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 9, characterized in that, The execution system upgrade includes: Obtain the system software packages and verification files that need to be upgraded, and determine the machine nodes that need to be upgraded and the upgrade order; The client sends the system software upgrade package and verification file that need to be upgraded to the server. The client sends an upgrade request and the name of the system software to be upgraded to the agent of the machine node that needs to be upgraded; Based on the upgrade request and the name of the system software to be upgraded, the agent downloads the system software package and verification file to be upgraded from the server, verifies the system software package using the verification file, and performs the system upgrade after verification.

11. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 10, characterized in that, Before obtaining the system software package and verification file that need to be upgraded, the following steps are included: Based on the system software package that needs to be upgraded, a system upgrade verification code is generated using the BLAKE2 algorithm. Use the system upgrade verification code as the verification file and establish a matching relationship with the system software package that needs to be upgraded.

12. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 10, characterized in that, After the agent downloads the system software package and verification file that need to be upgraded from the server, it includes: Based on the system software package that needs to be upgraded after downloading, the BLAKE2 algorithm is used to generate a system upgrade verification code. The system upgrade verification code is used as the verification file for comparison with the verification file.

13. The system backup and restore method for a new energy centralized control project using the Kyber-AES algorithm according to claim 10, characterized in that, If the upgraded verification system malfunctions, the backup results are used to restore the backup file using a symmetric encryption algorithm based on lattice cryptography and a verification method that generates checksums using BLAKE2. Obtain the machine node that needs to be restored, and send a file restoration request to the server through the agent; After receiving the request, the server retrieves the restore file to be restored from the backup results; A symmetric encryption algorithm is used to generate a standard key for restoring random encryption, and this standard key is then used to encrypt the file to be restored, resulting in encrypted restored data. For encrypted data recovery, the BLAKE2 algorithm is used to generate a recovery verification code; A symmetric encryption algorithm based on lattice cryptography is used to decapsulate the random encryption standard key to obtain the decapsulated random encryption standard key. The server sends the encrypted and restored data, the restoration verification code, and the encapsulated restoration random encryption standard key to the agent. The agent uses the Kyber-AES algorithm to deseal the encapsulated restored random encryption standard key, obtains the restored random encryption standard key, and uses the restored random encryption standard key to decrypt the encrypted restored data to obtain the restored file; The BLAKE2 algorithm is used to calculate the restoration check code of the restored file and verify it with the restoration check code. If the verification is successful, the restored file is decompressed and a system restore is performed. If the verification fails, the system restore is rejected.

Images