Power grid video monitoring system data transmission method and device based on quantum cryptography resisting technology, electronic equipment and storage medium

Abstract

The invention discloses a power grid video monitoring system data transmission method and device based on an anti-quantum cryptography technology, electronic equipment and a storage medium, and belongs to the technical field of data encryption, and the method comprises the steps: matching an anti-quantum signature public key corresponding to an equipment terminal, and carrying out the signature verification of a connection request; when the connection request signature verification is passed, matching an anti-quantum handshake protocol public key corresponding to the equipment terminal, and generating a corresponding ciphertext and a temporary symmetric session key according to the anti-quantum handshake protocol public key and the random message; sending the ciphertext to the equipment terminal, and deriving the temporary symmetric session key to obtain a corresponding data encryption key and a message authentication key when the equipment terminal is successfully unpacked; the handshake confirmation information sent by the equipment terminal is decrypted and subjected to integrity verification, and data transmission is performed after the integrity verification is passed, so that the problem that data transmission in the prior art is lack of a bidirectional identity authentication link can be solved.

Description

A data transmission method, device, electronic equipment, and storage medium for a power grid video surveillance system based on quantum cryptography resistance technology. Technical Field

[0001] This invention relates to the field of data encryption technology, and in particular to a data transmission method, apparatus, electronic device and storage medium for a power grid video surveillance system based on quantum cryptography. Background Technology

[0002] Existing video surveillance systems in power transmission and distribution areas typically employ a centralized monitoring architecture. Front-end surveillance cameras connect to the system via a dedicated APN channel, transmitting image and video streams to the back-end system's monitoring platform or video management server. These systems generally adopt a plug-and-play approach after data entry, with the system pre-entering the terminal device's unique identifier ID and APN card serial number. Once powered on, the device can access the system via a dedicated channel for data transmission and is automatically identified and registered online.

[0003] However, in this model, device registration relies solely on manually entered ledger information for confirmation, lacking a two-way identity authentication process. The terminal device's authentication capability against the system is weak, making it unable to effectively prevent fake base stations or man-in-the-middle attacks from masquerading as legitimate platforms and tricking the terminal into uploading data or executing control commands. On the other hand, once attackers obtain the device's ledger and access parameters, they can clone the legitimate terminal's identity to access the system and upload malicious video streams or alarms. Summary of the Invention

[0004] This invention provides a data transmission method, device, electronic device, and storage medium for a power grid video monitoring system based on quantum cryptography, which can solve the problem of the lack of two-way authentication in data transmission in the prior art.

[0005] To address the aforementioned technical problems, this invention provides a data transmission method for a power grid video surveillance system based on quantum-resistant cryptography, comprising: receiving a connection request sent by a device terminal; wherein the connection request includes: a unique device identifier, a random number, a timestamp, and a signature; wherein the signature is generated by the terminal device performing a quantum-resistant signature on the unique device identifier, the random number, and the timestamp using its own preset quantum-resistant signature private key; matching the unique device identifier with the corresponding quantum-resistant signature public key of the device terminal, and verifying the connection request signature using the quantum-resistant signature public key; when the connection request signature verification passes, matching the unique device identifier with the corresponding quantum-resistant signature public key of the device terminal. The device terminal uses a public key for a quantum-resistant handshake protocol and generates a random message. Based on the public key and the random message, it generates corresponding ciphertext and a temporary symmetric session key. The ciphertext is sent to the device terminal, which decrypts it and sends a handshake confirmation message upon successful decryption. Upon receiving the confirmation message, the device terminal derives a corresponding data encryption key and message authentication key from the temporary symmetric session key. Based on these keys, the device terminal decrypts and verifies the integrity of the handshake confirmation message. After successful integrity verification, a communication channel is established with the device terminal, and data is transmitted through this channel.

[0006] As a preferred embodiment, the signature generation includes: concatenating the device's unique identifier, a random number, and a timestamp to obtain a message to be signed; processing the message to be signed according to a preset quantum-resistant hash function to obtain a corresponding message digest; randomly sampling a mask vector and calculating the high-order feature vector corresponding to the mask vector; concatenating the message digest and the high-order feature vector, and processing the concatenated data according to the quantum-resistant hash function to obtain a corresponding original challenge value; generating a corresponding candidate signature vector according to a preset quantum-resistant signature private key and the original challenge value; and encapsulating the candidate signature vector and the original challenge value when the norm of the candidate signature vector is not greater than a preset norm threshold to obtain a corresponding signature.

[0007] As a preferred embodiment, the signature verification of the connection request based on the quantum-resistant signature public key includes: when the coefficient of the candidate signature vector in the signature does not exceed a preset coefficient threshold, performing a reconstruction calculation on the candidate signature vector and the original challenge value in the signature based on the quantum-resistant signature public key to obtain a reconstructed high-order feature vector; processing the reconstructed high-order feature vector according to the quantum-resistant hash function to obtain a reconstructed message digest; concatenating the reconstructed high-order feature vector and the message digest, and processing the concatenated reconstructed data according to the quantum-resistant hash function to obtain a new challenge value; comparing the new challenge value with the original challenge value in the signature, and if the new challenge value matches the original challenge value, the connection request signature verification passes; otherwise, it fails.

[0008] As a preferred embodiment, the step of generating corresponding ciphertext and a temporary symmetric session key based on the quantum-resistant handshake protocol public key and the random message includes: concatenating the random message with the quantum-resistant handshake protocol public key, performing a hash calculation on the concatenated data, and splitting the hash calculation result into a corresponding shared key root and a random factor; calculating the corresponding ciphertext component based on the random message and the random factor, and generating the corresponding original ciphertext based on the ciphertext component; and concatenating the shared key root and the original ciphertext and performing a hash calculation to obtain a corresponding temporary symmetric session key.

[0009] As a preferred embodiment, the decryption of the ciphertext includes: performing decryption calculations on the original ciphertext according to a preset anti-quantum handshake protocol private key to obtain a corresponding intermediate polynomial, and reversing the intermediate polynomial to obtain a reconstructed random message; concatenating the reconstructed random message with the anti-quantum handshake protocol public key, and performing hash calculations on the concatenated reconstructed data, splitting the hash calculation result into a new shared key root and a random factor; generating a new ciphertext based on the new random factor and the reconstructed random message, and comparing the new ciphertext with the original ciphertext byte by byte; if the new ciphertext matches the original ciphertext, the ciphertext decryption is successful; otherwise, the ciphertext decryption fails.

[0010] As a preferred embodiment, the generation of the handshake confirmation information includes: generating a confirmation message after successful decryption of the ciphertext, and encrypting the confirmation message according to the data encryption key and a preset encryption algorithm; encrypting the encrypted confirmation message again according to the message authentication key and the encryption algorithm to obtain a verification tag, and then using the encrypted confirmation message and the verification tag as the handshake confirmation information.

[0011] As a preferred embodiment, the step of decrypting and verifying the integrity of the handshake confirmation information based on the data encryption key and the message authentication key includes: decrypting the verification tag in the handshake confirmation information based on the message authentication key; when the decryption result is consistent with the encrypted confirmation message in the handshake confirmation information, decrypting the decryption result again based on the data encryption key to obtain the corresponding plaintext, and determining whether the status word in the plaintext conforms to a preset protocol. If it does, the integrity verification is passed; otherwise, it fails.

[0012] Based on the above embodiments, another embodiment of the present invention provides a data transmission device for a power grid video surveillance system based on quantum-resistant cryptography, comprising: a request receiving module, a signature verification module, a ciphertext generation module, a ciphertext decryption module, a key derivation module, and a data transmission module; the request receiving module is used to receive a connection request sent by a device terminal; wherein, the connection request includes: a device unique identifier, a random number, a timestamp, and a signature; wherein, the signature is generated by the terminal device performing a quantum-resistant signature on the device unique identifier, the random number, and the timestamp according to its own preset quantum-resistant signature private key; the signature verification module is used to match the device unique identifier with the quantum-resistant signature public key corresponding to the device terminal, and perform signature verification on the connection request according to the quantum-resistant signature public key; the ciphertext generation module is used to receive the connection request... When signature verification is successful, the device's unique identifier is used to match the quantum-resistant handshake protocol public key corresponding to the device terminal, and a random message is generated. Based on the quantum-resistant handshake protocol public key and the random message, corresponding ciphertext and a temporary symmetric session key are generated. The ciphertext decryption module sends the ciphertext to the device terminal so that the device terminal can decrypt the ciphertext and, upon successful decryption, sends back handshake confirmation information. The key derivation module, upon receiving the handshake confirmation information, derives the temporary symmetric session key to obtain the corresponding data encryption key and message authentication key. The data transmission module decrypts and verifies the integrity of the handshake confirmation information based on the data encryption key and message authentication key, and, after successful integrity verification, establishes a communication channel with the device terminal to transmit data through the communication channel.

[0013] Based on the above embodiments, another embodiment of the present invention provides an electronic device, the device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the data transmission method of the power grid video monitoring system based on quantum cryptography technology described in the above embodiments of the invention.

[0014] Based on the above embodiments, another embodiment of the present invention provides a storage medium, the storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the storage medium is located to execute the data transmission method of the power grid video monitoring system based on anti-quantum cryptography technology described in the above embodiments of the invention.

[0015] Compared to existing technologies, the embodiments of the present invention have the following beneficial effects: The present invention provides a data transmission method for a power grid video monitoring system based on quantum-resistant cryptography. When a device terminal initiates a connection request, the system platform first performs a first-layer authentication on the device terminal. Based on the device's unique identifier, it matches the quantum-resistant signature public key corresponding to the device terminal and verifies the connection request signature using the quantum-resistant signature public key. When the connection request signature verification passes, i.e., the first-layer authentication is completed, the system platform then matches the quantum-resistant handshake protocol public key corresponding to the device terminal based on the device's unique identifier and generates a random message. Based on the quantum-resistant handshake protocol public key and the random message, a corresponding ciphertext is generated and sent to the device terminal. The device terminal then performs a second-layer authentication on the system platform, i.e., decrypts the ciphertext. When the device terminal successfully decrypts the ciphertext, the system platform's second-layer authentication passes, and the temporary symmetric session key is derived to obtain the corresponding data encryption key and message authentication key. Finally, based on the data encryption key and message authentication key, the device terminal and the system platform perform a two-way handshake confirmation. After the integrity verification of the handshake confirmation passes, the two-way authentication between the two parties is completed, and the system platform and the device terminal establish a communication channel for data transmission. Therefore, this invention enables two-way identity authentication between data communication parties, preventing situations where fake base stations or man-in-the-middle attacks impersonate legitimate platforms to trick device terminals into uploading data, or where attackers clone legitimate device terminal identities to access the platform system, thus ensuring data security during data transmission. Attached Figure Description

[0016] Figure 1 is a flowchart illustrating a data transmission method for a power grid video monitoring system based on quantum cryptography according to an embodiment of the present invention; Figure 2 is a structural schematic diagram illustrating a data transmission device for a power grid video monitoring system based on quantum cryptography according to an embodiment of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0019] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0020] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0021] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0022] In the description of the embodiments of this application, the terms "multiple" and "several" refer to two or more (including two), similarly, "multiple groups" refer to two or more (including two groups), and "multiple pieces" refer to two or more (including two pieces).

[0023] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0024] Example 1, referring to Figure 1, addresses the lack of two-way authentication in data transmission in existing technologies. This invention provides a flowchart of a data transmission method for a power grid video monitoring system based on quantum-resistant cryptography. It offers a quantum-resistant handshake protocol and a seamless renewal mechanism to solve problems of identity forgery, data eavesdropping, and quantum computing threats in existing technologies, while minimizing impact on real-time video streaming. The method includes the following specific steps: S1, Receiving a connection request sent by a device terminal; wherein the connection request includes: a unique device identifier, a random number, a timestamp, and a signature; wherein the signature is generated by the terminal device using its preset quantum-resistant signature private key to perform a quantum-resistant signature on the unique device identifier, random number, and timestamp; preferably... The signature generation includes: concatenating the device's unique identifier, a random number, and a timestamp to obtain a message to be signed; processing the message to be signed according to a preset quantum-resistant hash function to obtain a corresponding message digest; randomly sampling a mask vector and calculating the high-order feature vector corresponding to the mask vector; concatenating the message digest and the high-order feature vector, and processing the concatenated data according to the quantum-resistant hash function to obtain a corresponding original challenge value; generating a corresponding candidate signature vector according to a preset quantum-resistant signature private key and the original challenge value; and encapsulating the candidate signature vector and the original challenge value when the norm of the candidate signature vector is not greater than a preset norm threshold to obtain a corresponding signature.

[0025] In a preferred embodiment, the power grid video monitoring system architecture of the present invention includes: 1. Device terminals such as cameras and cloud nodes: with built-in security chips or TEE trusted execution environments for securely storing quantum-resistant private keys and performing cryptographic operations.

[0026] 2. Video system platform: Includes a PKI public key management module and an identity authentication server, used to store the public keys and ledger information of terminals, and to initiate and verify handshake protocols.

[0027] Before the initial deployment of the device terminals, security is pre-configured. A two-way quantum public-private key pair is generated for each terminal on the video system platform. One pair is used for the signature key: the private key... Public key A pair used for subsequent handshake protocols: private key Public key By using out-of-band physical security, the two private keys are... , and the unique identifier of the device terminal The binding and secure burning of the two public keys into the device's security chip prevents plaintext reading after writing. , and The information is associated and stored in the ledger database of the video system platform.

[0028] In another preferred embodiment, during quantum-resistant handshake and secure data transmission, a first-stage quantum-resistant authentication of the device terminal identity is performed. When a device terminal such as a camera is powered on or needs to connect, it initiates a connection request to the system platform, the request containing its unique device identifier. The system requires: a random number N1 (to prevent replay attacks), a current timestamp Time, and a signature Sig. The signature Sig is a quantum-resistant signature private key stored in the device's security chip. , for those containing The information from N1 is used to generate a CRYSTALS-Dilithium quantum-resistant signature. The terminal then... The N1, Time, and signature Sig are packaged and sent to the system platform.

[0029] Specifically, the signature generation steps are as follows: (1) Preprocessing: The terminal generates its own unique identifier The message M to be signed is obtained by concatenating the random number N1 and the current timestamp Time. Then, M is preprocessed by the quantum-resistant hash function SHAKE-256. M is used as a byte stream input to the algorithm SHAKE-256. After internal permutation using Keccak

[512] , a 64-byte fixed-length, uniformly distributed message digest μ is output.

[0030] (2) Sampling calculation: The terminal randomly samples a mask vector y to ensure the nondeterminism and leakage resistance of the signature process. Then, the high-order feature vector corresponding to the mask vector is calculated. , where A is the common coefficient matrix preset by the algorithm (generated by the seed, not random). is the security parameter preset by the CRYSTALS-Dilithium algorithm, which is a given constant of 95232 (with different values ​​depending on the security level). The Highbits function is a truncation operation that truncates the high-order bits of the value and discards the low-order bits, making the signature tolerant to minor noise while maintaining the security of the structure.

[0031] (3) Challenge value calculation: Combine μ obtained in (1) with μ in (2) Perform byte-level concatenation, then input the concatenated content into the hash function SHAKE-256 again, and the output c is the challenge value for this signature.

[0032] (4) Generate candidate signature vectors: Calculate candidate signature vectors ,in It is a quantum-resistant signature private key The secret vector 1 (where, It is a set of polynomial vectors, composed of secret vectors. and secret error vector The former is part of the generated public key and directly participates in the calculation during signing; the latter is added as "noise" when the public key is generated, which is negligible in this invention. (5) Reject sampling: Before sending the signature vector generated in (4), the terminal also needs to check whether the norm of z exceeds the preset threshold. If it does, it returns to (2) to sample y and recalculate (the result is too large, indicating that z is controlled by the private key). The impact is too great; attackers can use statistical analysis based on a large number of z-values ​​to reverse-engineer the data. ).

[0033] (6) Generate signature: After rejecting sampling, the terminal will generate a signature. Encapsulated as a binary tuple, and using hardware-accelerated polynomial number theory transformation (NTT), the computational power consumption of the camera terminal is reduced, enabling fast signature.

[0034] S2. Match the quantum-resistant signature public key corresponding to the device terminal according to the device's unique identifier, and verify the connection request using the quantum-resistant signature public key. Preferably, the verification of the connection request using the quantum-resistant signature public key includes: when the coefficient of the candidate signature vector in the signature does not exceed a preset coefficient threshold, performing a reconstruction calculation on the candidate signature vector and the original challenge value in the signature using the quantum-resistant signature public key to obtain a reconstructed high-order feature vector; processing the reconstructed high-order feature vector using the quantum-resistant hash function to obtain a reconstructed message digest; concatenating the reconstructed high-order feature vector and the message digest, and processing the concatenated reconstructed data using the quantum-resistant hash function to obtain a new challenge value; comparing the new challenge value with the original challenge value in the signature, and if the new challenge value matches the original challenge value, the connection request signature verification passes; otherwise, it fails.

[0035] In a preferred embodiment, after receiving a connection request, the system platform first determines... Retrieve the quantum-resistant signature public key corresponding to the device terminal from the ledger database. Platform usage For Sig and the original message ( Verification is performed for N1: ① If the verification fails, it proves that the signature is invalid or the terminal identity has been forged. The platform refuses to connect and records the security event; ② If the verification passes, it proves that the terminal is a legitimate device holding the corresponding private key and proceeds to session key negotiation.

[0036] Specifically, the signature authentication steps are as follows: based on the signature sent by the terminal... Obtaining a quantum-resistant signature public key The public key contains a polynomial matrix A (which is consistent with the matrix used in the signing step and is a preset matrix in the CRYSTALS-Dilithium signature algorithm) and a vector. ,in This is the high-order part of the public key feature vector. The platform uses the same SHAKE-256 hash algorithm as the terminal to process the received original message. Calculate N1 and Time, and regenerate the summary. .

[0037] The signature data Sig received by the platform includes a challenge value c and a candidate signature vector z. The verification process is divided into three key steps: (1) Norm initial screening, checking whether each coefficient of the candidate signature vector z is within the specified threshold range. If they are all within the range, the next step of verification is carried out. If any are outside the range, the verification is judged to be unsuccessful; (2) Reconstructing high-order feature vectors The platform utilizes public key vectors Perform a reconstruction calculation using the received signatures z and c, first calculating... Rebuild ; among them, here In this context, d is a fixed parameter preset by the algorithm, with a value of 13. In the calculation formula Consistent with terminal signatures, both use preset values. Mathematically, The result is extremely close to the terminal calculation of Ay, as long as the deviation is within ± Within this range, the high-bit truncation function HighBits can accurately reconstruct the data. (3) The message digest that the platform will reconstruct and the reconstructed high-order eigenvectors Following the byte-level concatenation rules in S2-S3, the values ​​are combined again and input into the hash function SHAKE-256 to calculate the challenge value. The next step is to determine c and... Check if they are equal. If they are equal, the verification passes; if they are not equal, the verification fails.

[0038] S3. When the connection request signature verification passes, match the anti-quantum handshake protocol public key corresponding to the device terminal according to the device's unique identifier, and generate a random message. Generate corresponding ciphertext and a temporary symmetric session key according to the anti-quantum handshake protocol public key and the random message. Preferably, generating corresponding ciphertext and a temporary symmetric session key according to the anti-quantum handshake protocol public key and the random message includes: concatenating the random message and the anti-quantum handshake protocol public key, performing a hash calculation on the concatenated data, and splitting the hash calculation result into a corresponding shared key root and a random factor; calculating the corresponding ciphertext component according to the random message and the random factor, and generating the corresponding original ciphertext according to the ciphertext component; concatenating the shared key root and the original ciphertext and performing a hash calculation to obtain a corresponding temporary symmetric session key.

[0039] In a preferred embodiment, after the connection request signature verification is successful, a second phase of KEM quantum-resistant session key negotiation is performed. The platform operates similarly to the signature verification process described above, based on the key sent by the terminal. Obtain the public key of the quantum-resistant handshake protocol (The key used for the handshake protocol), the public key in the Kyber KEM algorithm also contains two polynomial matrices. sum vector Then, based on the anti-quantum handshake protocol public key and a random message, the corresponding ciphertext and temporary symmetric session key are generated. Specifically, the following steps are included: (1) First, the anti-quantum handshake protocol public key is used to generate the corresponding ciphertext and temporary symmetric session key. The platform processes the data, generating a 32-byte random message m, and then combines m with the public key of the quantum-resistant handshake protocol. The first and last bytes are concatenated for binding. Then, the quantum-resistant hash function SHA3-512 is used to hash the concatenated 64-byte data, outputting a result of equal length 64 bytes. The first 32 bytes, the most significant bits, are used as the shared key root K (used for generation). The last 32 bytes are used as a random factor r (used to generate C).

[0040] (2) Calculate C, which is a binary tuple composed of ciphertext components u and v, using m and r from (1): , ,in , These are added noise perturbation terms used to resist reverse calculations. It involves encoding m (which can be understood as amplifying the 256-bit m; before encoding, each bit of m is either 0 or 1, and after encoding, each bit is mapped to 0 and 1). That is, half of the modulus q. Generally, the modulus of quantum encryption is set to an integer greater than 2048. Therefore, through encoding, it can expand non-zero (either 0 or 1) to... The spacing mentioned above ensures that, even in the face of quantum interference, the impact on subsequent key recovery is greatly reduced in the dedicated power APN channel. After obtaining u and v, the platform encapsulates and generates C. The platform then sends the encrypted text C to the terminal.

[0041] (3) While sending the ciphertext, the platform will perform a SHAKE-256 hash calculation based on the shared key root K and the ciphertext C concatenated in (1), i.e. Here It is stored locally on the platform and is not sent to the APN channel. The terminal needs to decrypt the consistent data from the ciphertext C. This enables "zero-transmission" negotiation of session keys.

[0042] S4. The ciphertext is sent to the device terminal so that the device terminal can decrypt the ciphertext and send back handshake confirmation information when decryption is successful; preferably, the decryption of the ciphertext includes: performing decryption calculation on the original ciphertext according to the preset anti-quantum handshake protocol private key to obtain a corresponding intermediate polynomial, and performing reverse reconstruction on the intermediate polynomial to obtain a reconstructed random message; concatenating the reconstructed random message with the anti-quantum handshake protocol public key, and performing hash calculation on the concatenated reconstructed data, splitting the hash calculation result into a new shared key root and a random factor; generating a new ciphertext according to the new random factor and the reconstructed random message, and comparing the new ciphertext with the original ciphertext byte by byte. When the new ciphertext and the original ciphertext match, the ciphertext decryption is successful; otherwise, the ciphertext decryption fails.

[0043] In a preferred embodiment, the system platform sends the ciphertext to the device terminal. After receiving the ciphertext C, the device terminal calls the quantum-resistant KEM private key stored in its security chip. The Kyber KEM decryption algorithm is then applied to the ciphertext C. If decryption is successful, the terminal will be restored to a state completely consistent with the system platform. If decryption fails, it indicates that ciphertext C has been tampered with during transmission or has an incorrect source, and the terminal abandons the connection. The session key negotiation process here ensures... Transmission is always protected by quantum-resistant encryption. Even if the APN channel is eavesdropped on, a malicious terminal impersonates the system, or the attacker possesses quantum computing capabilities, the attacker will not be able to recover the data from the ciphertext C. .

[0044] Decrypting ciphertext C is essentially the reverse process of encrypting C. The terminal side uses the handshake private key in the security chip. , for ciphertext Calculations were performed to obtain results consistent with the platform. The specific steps for decrypting ciphertext C are as follows: (1) Here Using private key vector Simplify, in generation , When using this public / private key pair, the public key... ,in , Corresponding public key The vector and polynomial matrix (see the key encapsulation section above). Calculate the intermediate polynomial. ,because , , Substitute together to get ;here The operation is noise-free. , , On the one hand, noise itself is a tiny disturbance of a small value, and when added to it... The random message m is amplified and encoded, so it can be ignored here. The terminal then reconstructs the random message m' based on each coefficient in w. If the coefficients are close... The bit is then determined to be 1; if it is close to 0, it is determined to be 0. Finally, the terminal recovers the original 32-byte random message m'.

[0045] (2) The terminal will then perform the same operation as the platform KEM encapsulation, obtain K' and r' from m', and then obtain C'. Finally, check whether the calculated C' is consistent with the received ciphertext C. If they are consistent, it means that the ciphertext has not been tampered with during transmission and the sender has a legitimate public key; if they are inconsistent, it means that the ciphertext is illegally constructed.

[0046] (3) After verification, the terminal will perform a SHAKE-256 hash calculation consistent with the platform to obtain... At this point, the terminal has also generated [something] locally. The two parties completed key synchronization without transmitting the session key.

[0047] S5. Upon receiving the feedback handshake confirmation information, the temporary symmetric session key is derived to obtain the corresponding data encryption key and message authentication key; in a preferred embodiment, after successful terminal decryption, the device terminal and the system platform share the same... To separate encryption and integrity verification, both parties use a standard Key Derivation Function (KDF) for encryption and integrity verification. Derivation is performed to generate two independent data encryption keys. Message authentication key (Both key systems and terminals hold this key).

[0048] Specifically, the KDF derivation operation here is essentially a hash mapping, which transforms the initial session key... This invention derives two subkeys with different functions to separate key uses and enhance security. It employs the SHAKE-256 implementation, namely: ; ; where info1 and info2 are context labels preset by the platform and terminal (specified in the communication protocol, a piece of text, such as “POWER_VIDEO_DATA” and “OWER_VIDEO_MAC”), which use the characteristics of hashing to map the same original key to two unrelated linear spaces.

[0049] S6. Decrypt and verify the integrity of the handshake confirmation information according to the data encryption key and message authentication key, and establish a communication channel with the device terminal after the integrity verification is passed, and transmit data according to the communication channel.

[0050] Preferably, the generation of the handshake confirmation information includes: after successful decryption of the encrypted message, generating a confirmation message and encrypting the confirmation message according to the data encryption key and a preset encryption algorithm; encrypting the encrypted confirmation message again according to the message authentication key and the encryption algorithm to obtain a verification tag, and then using the encrypted confirmation message and the verification tag as the handshake confirmation information.

[0051] Preferably, the step of decrypting and verifying the integrity of the handshake confirmation information based on the data encryption key and the message authentication key includes: decrypting the verification tag in the handshake confirmation information based on the message authentication key; when the decryption result is consistent with the encrypted confirmation message in the handshake confirmation information, decrypting the decryption result again based on the data encryption key to obtain the corresponding plaintext, and determining whether the status word in the plaintext conforms to a preset protocol. If it does, the integrity verification is passed; otherwise, it fails.

[0052] In a preferred embodiment, after deriving the data encryption key and message authentication key, the device terminal uses... and An encrypted "handshake complete" confirmation message is sent to the system platform, which then decrypts and verifies its integrity. Once integrity verification is successful, both parties establish a quantum-resistant encrypted link on the APN dedicated channel. All video streams and control commands use this encrypted link. and Protect it.

[0053] Specifically, after the KEM quantum-resistant session key negotiation is completed, it has been confirmed that the device terminal and the platform have the same... And derive two identical subkeys, which can be directly used with AES symmetric encryption for subsequent handshake confirmation and link activation. The decryption and verification process is as follows: (1) Similar to S1, the terminal constructs a new confirmation message. : ; where State is the status word, defined by the communication protocol, and used for platform verification; (2) use The AES symmetric encryption algorithm is used to... Encrypt and generate ciphertext. (3) Use The ciphertext is encrypted using the AES symmetric encryption algorithm. Encryption is performed to obtain a verification tag. (4) Combine the messages ( , It is sent to the platform side via the APN channel.

[0054] After receiving the message, the platform executes the reverse verification logic: (1) using right Decrypt the message; if the result matches the ciphertext in the combined message... If inconsistent, the key negotiation is deemed to have failed or been tampered with by a middleman, and the connection is severed; (2) After verification, use right Decrypt and restore the plaintext. .examine Check if the State word in the protocol conforms to the protocol. If the check is correct, the handshake protocol is completed.

[0055] In another preferred embodiment, during data communication between the system platform and the device terminal, in addition to ensuring communication security, it is also necessary to ensure that the power monitoring will not affect the continuity of the video stream due to key expiration in practical applications. Therefore, the present invention can also provide a seamless renewal method: 1. Renewal trigger: The system platform and the terminal jointly maintain the validity period of the session key (e.g., based on time, such as 24 hours, or based on data volume, such as 1GB); 2. Background negotiation: The old session key at time T... Before the expiration date, the system platform will use the currently encrypted channel (by...) (Protected) Inside, re-initiate the above S4; 3. Generate a new key: The system platform generates a new key for the next cycle T+1. The encrypted text was generated after encapsulation using Kyber KEM. 4. Seamless switching: The terminal is unblocked and sent to the terminal. Each side derived and Both parties agree on a switching point (e.g., the next video I-frame or a specific timestamp) to synchronously switch from using... Switching to using derived keys The derived key; the entire key update process is completed in the background encrypted channel, which is completely transparent to the upper-layer video streaming service, without any awareness or interruption, while ensuring the regular replacement of the session key, which greatly enhances the security of the system.

[0056] Therefore, this invention provides a data transmission method for a power grid video monitoring system based on quantum-resistant cryptography. The invention achieves the following beneficial effects: (1) Quantum-resistant security: This invention uses quantum-resistant encryption and Kyber KEM negotiation session keys to replace traditional encryption algorithms that are easily breached by quantum computing; (2) Strong two-way authentication: The Dilithium digital signature algorithm is used to authenticate the terminal's connection request, effectively preventing malicious third-party cloned device IDs from being impersonated as legitimate terminals to access the system; (3) Balancing security and high service availability: Session keys... It is set to short-term validity to ensure that even if a session key is accidentally leaked, it cannot be used to decrypt data from previous or subsequent sessions. Meanwhile, the seamless renewal mechanism allows for quantum-resistant key updates without interrupting video streaming or other services.

[0057] Example 2: Referring to Figure 2, which is a schematic diagram of a data transmission device for a power grid video monitoring system based on quantum-resistant cryptography, according to an embodiment of the present invention, the device includes: a request receiving module, a signature verification module, a ciphertext generation module, a ciphertext decryption module, a key derivation module, and a data transmission module. The request receiving module is used to receive connection requests sent by device terminals. The connection request includes: a unique device identifier, a random number, a timestamp, and a signature. The signature is generated by the terminal device using its preset quantum-resistant signature private key to perform a quantum-resistant signature on the unique device identifier, the random number, and the timestamp. The signature verification module is used to match the unique device identifier with the corresponding quantum-resistant signature public key of the device terminal, and to perform signature verification on the connection request using the quantum-resistant signature public key. The ciphertext generation module is used to... When the connection request signature verification passes, the system matches the quantum-resistant handshake protocol public key corresponding to the device terminal with the device's unique identifier and generates a random message. Based on the quantum-resistant handshake protocol public key and the random message, it generates corresponding ciphertext and a temporary symmetric session key. The ciphertext decryption module sends the ciphertext to the device terminal for decryption and sends a handshake confirmation message upon successful decryption. The key derivation module, upon receiving the handshake confirmation message, derives the corresponding data encryption key and message authentication key from the temporary symmetric session key. The data transmission module decrypts and verifies the integrity of the handshake confirmation message using the data encryption key and message authentication key. After successful integrity verification, it establishes a communication channel with the device terminal and transmits data through the communication channel.

[0058] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0059] Those skilled in the art will clearly understand that, for convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0060] Accordingly, this embodiment of the invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the data transmission method of the power grid video monitoring system based on quantum cryptography technology described in the above embodiments of the invention.

[0061] The electronic device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The device may include, but is not limited to, a processor and a memory.

[0062] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the device, connecting various parts of the device via various interfaces and lines.

[0063] Accordingly, in Embodiment 4, this invention provides a storage medium comprising a stored computer program, wherein the computer program, when running, controls the device containing the storage medium to execute the data transmission method for a power grid video monitoring system based on quantum cryptography described in the above embodiments.

[0064] The memory can be used to store the computer program. The processor implements various functions of the device by running or executing the computer program stored in the memory and calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0065] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When executed by a processor, the computer program can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0066] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A data transmission method for a power grid video monitoring system based on quantum cryptography resistance technology, characterized in that, include: The system receives a connection request sent by a device terminal; wherein the connection request includes: a unique device identifier, a random number, a timestamp, and a signature; wherein the signature is generated by the terminal device performing a quantum-resistant signature on the unique device identifier, the random number, and the timestamp using its own preset quantum-resistant signature private key; based on the unique device identifier, the system matches the quantum-resistant signature public key corresponding to the device terminal, and verifies the connection request signature using the quantum-resistant signature public key; when the connection request signature verification passes, the system matches the unique device identifier with the quantum-resistant handshake protocol public key corresponding to the device terminal, and generates a random message. The system generates corresponding ciphertext and a temporary symmetric session key based on the quantum-resistant handshake protocol public key and a random message; sends the ciphertext to the device terminal so that the device terminal can decrypt the ciphertext and, upon successful decryption, sends back handshake confirmation information; upon receiving the handshake confirmation information, it derives the corresponding data encryption key and message authentication key from the temporary symmetric session key; decrypts and verifies the integrity of the handshake confirmation information based on the data encryption key and message authentication key, and establishes a communication channel with the device terminal after the integrity verification is successful, and transmits data through the communication channel.

2. The data transmission method for a power grid video monitoring system based on quantum cryptography as described in claim 1, characterized in that, The signature generation includes: concatenating the device's unique identifier, a random number, and a timestamp to obtain a message to be signed; processing the message to be signed according to a preset quantum-resistant hash function to obtain a corresponding message digest; randomly sampling a mask vector and calculating the high-order feature vector corresponding to the mask vector; concatenating the message digest and the high-order feature vector, and processing the concatenated data according to the quantum-resistant hash function to obtain a corresponding original challenge value; generating a corresponding candidate signature vector according to a preset quantum-resistant signature private key and the original challenge value; and encapsulating the candidate signature vector and the original challenge value when the norm of the candidate signature vector is not greater than a preset norm threshold to obtain the corresponding signature.

3. The data transmission method for a power grid video monitoring system based on quantum cryptography as described in claim 2, characterized in that, The step of verifying the connection request signature using the quantum-resistant signature public key includes: when the coefficients of the candidate signature vectors in the signature do not exceed a preset coefficient threshold, performing a reconstruction calculation on the candidate signature vectors and the original challenge value in the signature using the quantum-resistant signature public key to obtain a reconstructed high-order feature vector; processing the reconstructed high-order feature vector using the quantum-resistant hash function to obtain a reconstructed message digest; concatenating the reconstructed high-order feature vector and the message digest, and processing the concatenated reconstructed data using the quantum-resistant hash function to obtain a new challenge value; comparing the new challenge value with the original challenge value in the signature; if the new challenge value matches the original challenge value, the connection request signature verification passes; otherwise, it fails.

4. The data transmission method for a power grid video monitoring system based on quantum cryptography as described in claim 1, characterized in that, The step of generating corresponding ciphertext and a temporary symmetric session key based on the quantum-resistant handshake protocol public key and the random message includes: concatenating the random message with the quantum-resistant handshake protocol public key, performing a hash calculation on the concatenated data, and splitting the hash calculation result into a corresponding shared key root and a random factor; calculating the corresponding ciphertext component based on the random message and the random factor, and generating the corresponding original ciphertext based on the ciphertext component; and performing a hash calculation on the concatenated shared key root and the original ciphertext to obtain a corresponding temporary symmetric session key.

5. The data transmission method for a power grid video monitoring system based on quantum cryptography as described in claim 4, characterized in that, The process of desealing the ciphertext includes: performing desealing calculations on the original ciphertext according to a preset anti-quantum handshake protocol private key to obtain a corresponding intermediate polynomial, and reversing the intermediate polynomial to obtain a reconstructed random message; concatenating the reconstructed random message with the anti-quantum handshake protocol public key, and performing hash calculations on the concatenated reconstructed data, splitting the hash calculation result into a new shared key root and a random factor; generating a new ciphertext based on the new random factor and the reconstructed random message, and comparing the new ciphertext with the original ciphertext byte by byte; if the new ciphertext matches the original ciphertext, the ciphertext desealing is successful; otherwise, the ciphertext desealing fails.

6. The data transmission method for a power grid video monitoring system based on quantum cryptography as described in claim 5, characterized in that, The generation of the handshake confirmation information includes: after the ciphertext is successfully decrypted, generating a confirmation message and encrypting the confirmation message according to the data encryption key and the preset encryption algorithm; encrypting the encrypted confirmation message again according to the message authentication key and the encryption algorithm to obtain a verification tag, and then using the encrypted confirmation message and the verification tag as the handshake confirmation information.

7. The data transmission method for a power grid video monitoring system based on quantum cryptography as described in claim 6, characterized in that, The step of decrypting and verifying the integrity of the handshake confirmation information based on the data encryption key and the message authentication key includes: decrypting the verification tag in the handshake confirmation information based on the message authentication key; when the decryption result is consistent with the encrypted confirmation message in the handshake confirmation information, decrypting the decryption result again based on the data encryption key to obtain the corresponding plaintext, and determining whether the status word in the plaintext conforms to the preset protocol. If it does, the integrity verification is passed; otherwise, it is not passed.

8. A data transmission device for a power grid video monitoring system based on quantum cryptography resistance technology, characterized in that, include: The module includes a request receiving module, a signature verification module, a ciphertext generation module, a ciphertext decryption module, a key derivation module, and a data transmission module. The request receiving module is used to receive a connection request sent by a device terminal; wherein the connection request includes: a unique device identifier, a random number, a timestamp, and a signature; wherein the signature is generated by the terminal device performing a quantum-resistant signature on the unique device identifier, the random number, and the timestamp using its own preset quantum-resistant signature private key; the signature verification module is used to match the unique device identifier with the quantum-resistant signature public key corresponding to the device terminal, and perform signature verification on the connection request using the quantum-resistant signature public key; the ciphertext generation module is used to, when the connection request signature verification passes, match the unique device identifier with the quantum-resistant handshake protocol public key corresponding to the device terminal, and generate a random message. The system generates corresponding ciphertext and a temporary symmetric session key based on the quantum-resistant handshake protocol public key and a random message. The ciphertext decryption module sends the ciphertext to a device terminal for decryption and sends a handshake confirmation message upon successful decryption. The key derivation module, upon receiving the handshake confirmation message, derives the corresponding data encryption key and message authentication key from the temporary symmetric session key. The data transmission module decrypts and verifies the integrity of the handshake confirmation message using the data encryption key and message authentication key, establishes a communication channel with the device terminal after successful integrity verification, and transmits data through the communication channel.

9. An electronic device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the data transmission method for a power grid video surveillance system based on quantum cryptography as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to perform the data transmission method of the power grid video monitoring system based on quantum cryptography as described in any one of claims 1 to 7.

Images