Electric power remote data secure transmission method and system fusing anti-quantum and lightweight password

Abstract

The invention relates to the technical field of power Internet of Things secure communication, and discloses a power remote data secure transmission method and system fusing anti-quantum and lightweight password, and the method comprises the steps: a sensor terminal builds a first session key with an edge gateway through employing a Kyber algorithm, performing XOR encryption on the monitoring data by using a derived key stream generated based on an SM3 hash algorithm, and sending the monitoring data to an edge gateway; the edge gateway decrypts and recovers the monitoring data, performs secondary encryption on the monitoring data by using an SM4 algorithm and then sends the monitoring data to the cloud server, and the edge gateway obtains physical state parameters and environmental risk index parameters of the sensor terminal to construct an equipment state sensing vector, dynamically calculates an effective life cycle of a first session key, and sends the effective life cycle to the cloud server; and a transition window timer and a dual-check decryption mechanism are utilized to execute key updating. According to the invention, adaptive balance between hardware resource consumption and security protection strength is realized through a hierarchical heterogeneous encryption system and a dynamic key strategy.

Description

Technical Field

[0001] This invention relates to the field of secure communication technology for the Internet of Things in the power industry, specifically to a method and system for secure remote data transmission in the power industry that integrates quantum resistance and lightweight cryptography. Background Technology

[0002] With the popularization of power Internet of Things (IoT) technology, the collection of monitoring data for power infrastructure such as hydropower is gradually developing towards greater precision and real-time capabilities. To ensure the confidentiality and integrity of monitoring data during transmission, encrypted transmission schemes are typically deployed. Especially with the development of quantum computing technology, traditional public-key cryptography based on large number factorization or discrete logarithm problems faces the risk of being cracked. Introducing quantum-resistant cryptographic algorithms has become an inevitable choice to ensure the long-term security of power monitoring.

[0003] In existing power monitoring and secure transmission systems, a unified encryption scheme is typically used between cloud servers and field acquisition terminals to simplify the system architecture. This might involve employing the standard SM4 block cipher algorithm or high-strength quantum-resistant encryption algorithms throughout the entire link. However, field-deployed sensor terminals usually utilize battery-powered microcontroller architectures, which are subject to strict limitations in computing frequency and storage space. Directly deploying computationally intensive block cipher algorithms or complex quantum-resistant encapsulation operations on resource-constrained sensor terminals would result in excessive microcontroller load, significantly shortening battery life and failing to meet the low-power requirements of long-term field monitoring.

[0004] Key management is a core component for ensuring the security of encrypted transmission. Existing key update strategies typically employ a preset fixed time period (e.g., updating every 24 hours). This static strategy lacks the ability to adapt to the device's operating environment. When the sensor terminal's battery is low, frequent key negotiations can accelerate device downtime; conversely, when the network faces increased risks of external malicious scanning or attacks, excessively long key update cycles cannot promptly prevent potential key leakage. Existing fixed-cycle strategies struggle to strike a balance between hardware resource consumption and security protection strength.

[0005] During key updates, both communicating parties typically activate the new key and discard the old key immediately after negotiation. However, due to transmission delays or jitter in industrial field networks, some data packets encrypted with the old key may only arrive at the receiving end after the key switch has occurred. Under the existing processing mechanism, the receiving end, having already deleted the old key, is unable to decrypt these delayed data packets, resulting in data loss or service interruption and affecting the continuity of power monitoring data. Summary of the Invention

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for secure remote data transmission over power systems that integrates quantum resistance and lightweight cryptography, applicable to systems including sensor terminals, edge gateways, and cloud servers;

[0007] The method includes the following steps: Step S1: The sensor terminal obtains the public key of the edge gateway, performs Kyber key encapsulation operation based on the public key, and negotiates with the edge gateway to establish a quantum-resistant first session key; Step S2: The sensor terminal collects the operating status parameters of the hydraulic equipment and adds a data frame header containing a data type identifier to generate monitoring data; Step S3: The sensor terminal generates a random number, performs iterative operations of the SM3 hash algorithm based on the first session key and the random number to generate a derived key stream; performs a bitwise XOR operation on the monitoring data using the derived key stream to generate first ciphertext data, and sends the first ciphertext data and the random number to the edge gateway; Step S4: The edge gateway receives the first ciphertext data and the random number, reconstructs the derived key stream using the locally stored first session key and the random number, and performs a decryption operation on the first ciphertext data to recover the monitoring data; Step S5: The edge gateway calls the second session key pre-negotiated with the cloud server, uses the second session key to perform SM4 block encryption on the monitoring data, generates second ciphertext data, and sends the second ciphertext data to the cloud server; Step S6: The cloud server receives the second encrypted data, performs SM4 decryption on the second encrypted data using the second session key stored locally, obtains the monitoring data, and stores it in the database.

[0008] Preferably, the process of generating the derived key stream in step S3 specifically includes: The sensor terminal constructs a padding input string, which is formed by bit-level concatenation of the first session key, the random number, a preset hexadecimal separator, a specified number of binary zero-padding sequences, and a hexadecimal value indicating the byte length of the first session key. In the first iteration, the sensor terminal uses the initial vector defined by the SM3 standard to perform an SM3 hash operation on the filled input string to generate the first hash value. In subsequent iterations, the hash output value of the previous round is used as the initial vector input for the current round, and the SM3 hash operation is performed on the filling input string. The sensor terminal concatenates the hash values ​​generated in each iteration to generate the derived key stream.

[0009] Preferably, before the sensor terminal performs the iterative calculation of the SM3 hash algorithm, it further includes: The sensor terminal acquires the current system time parameter, performs a hash operation on the concatenated data of the first session key and the system time parameter, and extracts the first byte of the hash output value as a random delay factor. The physical delay time is obtained by multiplying the random delay factor by a preset base delay time unit. The sensor terminal executes an empty instruction loop or sleep operation until the duration reaches the physical delay time, and then starts the iterative operation of the SM3 hash algorithm.

[0010] Preferably, in step S3, the sensor terminal further calculates a data authentication code based on the first session key and sends the data authentication code along with the first encrypted data and the random number to the edge gateway; After the sensor terminal sends data in step S3, and before the edge gateway performs the decryption operation in step S4, the method further includes: The edge gateway uses the first session key to verify the integrity of the data authentication code in the received data packet; If the integrity verification passes, the edge gateway retrieves the received random number from its local anti-replay record table; If there is no record of the same value in the anti-replay record table, the edge gateway writes the random number into the anti-replay record table and allows the decryption operation to be performed in step S4. When the first session key is updated, the edge gateway clears the data in the anti-replay record table.

[0011] Preferably, the process of generating the second ciphertext data in step S5 specifically includes: The edge gateway performs a padding operation on the monitoring data to generate dynamic random mask parameters; the edge gateway uses the second session key and the random mask parameters to perform SM4 block encryption on the padded monitoring data to generate the second ciphertext data; The random mask parameter is configured to perform an XOR scrambling operation on the intermediate state matrix during the round function operation of the SM4 algorithm.

[0012] Preferably, the method further includes step S7, whereby the edge gateway performs key lifecycle management, and step S7 specifically includes: The edge gateway's state awareness and key policy module acquires the physical state parameters of the sensor terminal, which include at least the remaining power ratio and the device temperature value. Using the min-maximum normalization algorithm, the physical state parameters are mapped to a dimensionless interval by calculating the difference between the original sampled value and the preset minimum value boundary and dividing it by the difference between the preset maximum value boundary and the preset minimum value boundary. The state awareness and key policy module identifies the data type identifier in the frame header field of the monitoring data generated in step S2, matches the corresponding numerical weight according to the business type mapping table, and obtains semantic feature parameters. The semantic feature parameters include at least the data priority coefficient. The state awareness and key policy module counts the number of illegal access interceptions within the most recent time window and performs logarithmic calculations to calculate the network threat index. Combined with the system time risk factor based on the current time, it generates environmental risk index parameters. The state awareness and key strategy module concatenates the normalized physical state parameters, the semantic feature parameters, and the environmental risk index parameters to generate a device state awareness vector.

[0013] Preferably, after generating the device state awareness vector, step S7 further includes: The state awareness and key strategy module calculates the resource constraint factor by weighting the remaining power ratio and the device temperature value in the device state awareness vector and combining them with a preset set of weighting coefficients. The value of the resource constraint factor is negatively correlated with the remaining power ratio and positively correlated with the equipment temperature value. The state awareness and key policy module calculates the security requirement factor by weighting the network threat index, the data priority coefficient and the time risk factor in the device state awareness vector and the weight coefficient set. The state awareness and key policy module calculates the ratio of the resource constraint factor to the security requirement factor, and multiplies the ratio by a preset baseline lifetime value to obtain the key lifetime parameter of the first session key.

[0014] Preferably, after calculating the key lifecycle parameter, the method further includes: The edge gateway is configured with a session timer to record the duration of the first session key. When the value of the session timer reaches the key lifecycle parameter, the edge gateway sends a key update command to the sensor terminal and starts a transition window timer; The edge gateway receives the updated encapsulated ciphertext from the sensor terminal and decapsulates it to obtain the updated session key. At the same time, the edge gateway retains the first session key as the old session key. The edge gateway uses the updated session key to verify and decrypt the received data packets first. If the verification fails but does not exceed the threshold of the transition window timer, the old session key is used for verification and decryption.

[0015] Preferably, the edge gateway's storage space is divided into a data buffer and configured with an aggregation timer; after restoring the monitoring data in step S4 and before generating the second encrypted data in step S5, the method further includes: The edge gateway writes the decrypted and recovered monitoring data into the data buffer for accumulation. When the data storage volume of the data buffer reaches a preset threshold or the aggregation timer is triggered, the edge gateway executes step S5 to perform batch encryption processing on the monitoring data accumulated in the data buffer.

[0016] Preferably, a power remote data security transmission system integrating quantum resistance and lightweight cryptography is provided, the system comprising a sensor terminal, an edge gateway, and a cloud server connected via a communication network; The sensor terminal integrates a key negotiation module and a stream cipher operation module, and is configured to execute steps S1 to S3 in the above method, for negotiating and establishing a first session key with the edge gateway based on the Kyber algorithm, and using the first session key and the derived key stream generated by the SM3 hash algorithm to perform XOR encryption on the collected monitoring data, generating first ciphertext data and sending it to the edge gateway. The edge gateway integrates an SM4 encryption module, an SM4 decryption module, and a state awareness and key policy module. It is configured to execute steps S4 to S5 in the above method, which are used to receive the first ciphertext data, decrypt and recover the monitoring data using the first session key, and use the second session key negotiated with the cloud server to call the SM4 block cipher algorithm to perform secondary encryption on the monitoring data, generate second ciphertext data and send it to the cloud server. The state awareness and key strategy module is further configured to acquire the state parameters of the sensor terminal and construct a device state awareness vector, so as to dynamically calculate the effective lifespan of the first session key based on the device state awareness vector. The cloud server is configured to execute step S6 of the above method, which is used to receive the second encrypted data, decrypt the monitoring data using the second session key, and store it.

[0017] This invention provides a method and system for secure remote data transmission over power lines that integrates quantum resistance and lightweight cryptography. It offers the following advantages: (1) This invention generates a derived key stream by performing iterative operations based on the SM3 hash algorithm using a stream cipher operation module at the sensor terminal, and performs bitwise XOR operations on the monitoring data. This adapts to the integer operation instruction set of the sensor terminal microcontroller, avoiding the running of high-computation-consumption block cipher algorithms on resource-constrained devices. Combined with the edge gateway using the SM4 encryption module and SM4 decryption module to perform a decryption-caching-re-encryption process in the data buffer, this invention transforms the stream cipher system of the edge-end lightweight secure transmission domain A into the block cipher system of the cloud-edge high-throughput secure transmission domain B. Under the premise of ensuring quantum-resistant security across the entire link, it realizes the asymmetric distribution of computing load between the edge and the cloud.

[0018] (2) This invention utilizes the edge gateway's state awareness and key policy module to obtain the remaining battery ratio and device temperature value of the sensor terminal, and constructs a device state awareness vector by combining it with the network threat index. The state awareness and key policy module dynamically adjusts the baseline lifecycle value based on the ratio of resource constraint factor to security requirement factor to calculate the key lifecycle parameter of the first session key. This mechanism enables the system to extend the key lifecycle to reduce the frequency of key negotiation when the sensor terminal's battery is low, and to shorten the key lifecycle to improve the protection level when the network threat index increases, thus achieving an adaptive balance between hardware resource consumption and security protection strength.

[0019] (3) After the edge gateway sends a key update command to the sensor terminal, the present invention starts a transition window timer and enters a dual-key parallel maintenance state. The edge gateway simultaneously retains the old session key and the updated session key in its memory and performs dual verification and decryption on the received data packets. The edge gateway first uses the updated session key to perform HMAC verification on the authentication tag in the data packet. If the verification fails and does not exceed the threshold of the transition window timer, it attempts to decrypt using the old session key. This mechanism avoids data decryption failure and packet loss caused by network latency during key switching, ensuring the continuity and integrity of power monitoring data. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram of the system framework of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see Figure 2 This invention provides a cloud-edge-device collaborative quantum-resistant secure transmission system for power monitoring. The system includes a cloud server, an edge gateway, a sensor terminal, and a communication network. The cloud server and the edge gateway are connected through the communication network, and the edge gateway and the sensor terminal are connected through the communication network.

[0023] The sensor terminal is deployed at the data acquisition site of the hydropower equipment. The sensor terminal is configured to perform physical signal acquisition and lightweight encryption operations. The sensor terminal collects the operating status parameters of the hydropower equipment and adds a data frame header containing data type identifier to generate monitoring data. The sensor terminal integrates a key negotiation module and a stream cipher operation module. The key negotiation module is configured to perform key encapsulation operation based on the Kyber algorithm, and the stream cipher operation module is configured to perform data operation operation based on the SM3 hash algorithm. The sensor terminal uses the first session key negotiated with the edge gateway to perform XOR encryption operation on the monitoring data to generate first ciphertext data. The sensor terminal sends the first ciphertext data to the edge gateway through the communication network.

[0024] In this embodiment, the sensor terminal is a resource-constrained device, with computing and storage resources lower than those of the edge gateway and cloud server.

[0025] The edge gateway is deployed on the local aggregation node and connects the cloud server and the sensor terminal. The edge gateway is configured to perform protocol conversion, data encryption and key management operations. The edge gateway receives the first ciphertext data from the sensor terminal and uses the first session key to decrypt the first ciphertext data to recover the monitoring data. The edge gateway uses the second session key negotiated with the cloud server to call the SM4 block cipher algorithm to perform a second encryption operation on the monitoring data to generate the second ciphertext data. The edge gateway sends the second ciphertext data to the cloud server.

[0026] The edge gateway is equipped with a state awareness and key policy module. The state awareness and key policy module is configured to acquire the physical state parameters of the sensor terminal, the semantic feature parameters of the monitoring data, and the environmental risk index parameters. The state awareness and key policy module calculates the effective lifespan of the first session key based on the physical state parameters, semantic feature parameters, and environmental risk index parameters. The edge gateway controls the key update frequency between the sensor terminal and the edge gateway based on the effective lifespan.

[0027] The cloud server is deployed in a remote data center and is configured to perform operations such as receiving, decrypting, storing and analyzing massive amounts of data. The cloud server receives second ciphertext data from the edge gateway and uses the second session key to perform decryption operations on the second ciphertext data to obtain monitoring data. The cloud server is equipped with a high-performance computing unit to support key encapsulation operations based on the Kyber algorithm and decryption operations based on the SM4 block cipher algorithm.

[0028] Logically, this system is divided into two independent secure transmission domains: edge-to-end lightweight secure transmission domain A and cloud-to-edge high-throughput secure transmission domain B. Edge-to-end lightweight secure transmission domain A consists of sensor terminals and edge gateways, employing a quantum-resistant key encapsulation combined with hash stream cipher encryption. Cloud-to-edge high-throughput secure transmission domain B consists of edge gateways and cloud servers, employing a quantum-resistant key encapsulation combined with block cipher encryption. The edge gateway acts as the connecting node between edge-to-end lightweight secure transmission domain A and cloud-to-edge high-throughput secure transmission domain B, blocking direct key interaction between sensor terminals and cloud servers.

[0029] Furthermore, the sensor terminal adopts a low-power embedded hardware architecture, which includes a microcontroller, memory, wireless communication circuits, and a battery or energy harvesting power supply. Due to the power supply limitations and the microcontroller's computing frequency constraints, the sensor terminal is configured as a lightweight computing node in the system. The sensor terminal's memory stores computer program instructions, which, when executed by the microcontroller, implement the functions of the key negotiation module and the stream cipher module. The key negotiation module utilizes the low computational complexity of the Kyber algorithm during the encapsulation stage to perform key encapsulation operations on the microcontroller. The stream cipher module uses the SM3 hash algorithm to generate a key stream and performs encryption through the microcontroller's XOR logic instructions to adapt to the sensor terminal's integer arithmetic instruction set.

[0030] The edge gateway adopts an industrial-grade embedded computer architecture, equipped with a continuous power supply and a high-performance processor that supports floating-point operations. As a protocol conversion hub, the edge gateway has higher hardware resource configuration than the sensor terminal. The edge gateway's processor is configured to perform Kyber algorithm decapsulation operations and SM4 algorithm block encryption operations, undertaking computationally intensive tasks that the sensor terminal cannot complete. The edge gateway maintains the state table of the first session key in its local storage space, blocking direct signaling interaction between the sensor terminal and the cloud server. The state awareness and key policy module inside the edge gateway runs on the edge gateway's processor, reads physical state parameters, semantic feature parameters, and environmental risk index parameters in real time, and completes the calculation of the key update cycle locally, avoiding the bandwidth consumption caused by uploading a large amount of state data to the cloud server.

[0031] The cloud server adopts a high-performance server cluster architecture, equipped with a hardware security module (HSM) and a large-scale disk array. As a global trust anchor, the cloud server uses its parallel computing capabilities to concurrently process key negotiation requests and data decryption requests from multiple edge gateways. The cloud server is responsible for generating and distributing global system parameters and persistently storing the decrypted monitoring data. Through differentiated hardware performance configurations of sensor terminals, edge gateways, and cloud servers, the system achieves asymmetric distribution of computing load between the edge and the cloud while ensuring the quantum-resistant security of monitoring data.

[0032] Please see Figure 1 Based on the above, this invention provides a method for secure remote data transmission in power systems that integrates quantum resistance and lightweight cryptography, specifically including the following steps: Step S1: The sensor terminal establishes an edge-to-edge secure channel with the edge gateway. The sensor terminal obtains the public key of the edge gateway. The key negotiation module of the sensor terminal performs Kyber key encapsulation operation based on the public key to generate the first session key and the encapsulated ciphertext. The sensor terminal sends the encapsulated ciphertext to the edge gateway. The edge gateway uses its local private key to perform decapsulation operation on the encapsulated ciphertext to obtain the first session key.

[0033] Step S2: The sensor terminal performs data acquisition and lightweight encryption. The sensor terminal collects the operating status of the hydraulic equipment and generates monitoring data. The sensor terminal generates random numbers. The stream cipher module of the sensor terminal performs iterative operations of the SM3 hash algorithm based on the first session key and the random numbers to generate a derived key stream with a length adapted to the monitoring data. The sensor terminal performs a bitwise XOR operation on the monitoring data and the derived key stream to obtain the first ciphertext data. The sensor terminal sends the first ciphertext data and the random numbers to the edge gateway.

[0034] Step S3: The edge gateway performs data reception and decryption. The edge gateway receives and extracts the first ciphertext data and a random number. Based on the first session key stored locally and the received random number, the edge gateway performs the same SM3 hash algorithm iterative operation as in step S2 to reconstruct the derived key stream. The edge gateway uses the derived key stream to perform a bitwise XOR operation on the first ciphertext data to recover the monitoring data.

[0035] Step S4: The edge gateway performs encryption scheme conversion and data forwarding. The edge gateway calls the second session key that has been pre-negotiated with the cloud server. The edge gateway inputs the monitoring data into the SM4 algorithm module, uses the second session key to perform block encryption operation, generates second ciphertext data, and sends the second ciphertext data to the cloud server.

[0036] Step S5: The cloud server performs data decryption and storage. The cloud server receives the second ciphertext data, and uses the second session key stored locally to perform SM4 decryption on the second ciphertext data to obtain the monitoring data. The cloud server then stores the monitoring data in the database.

[0037] Step S6: The edge gateway performs key lifecycle management. The edge gateway's state awareness and key policy module obtains the physical state parameters of the sensor terminal, the semantic feature parameters of the monitoring data, and the environmental risk index parameters. The state awareness and key policy module calculates the key lifecycle parameters of the first session key based on the above parameters. When the usage time of the first session key reaches the threshold set by the key lifecycle parameters, the edge gateway sends a key update command to the sensor terminal, triggering the system to re-execute steps S1 to S3.

[0038] Based on the aforementioned edge-to-end lightweight secure transmission domain A and cloud-to-edge high-throughput secure transmission domain B, the edge gateway is configured to perform cross-domain data collaboration between edge-to-end lightweight secure transmission domain A and cloud-to-edge high-throughput secure transmission domain B. The sensor terminal and the cloud server are physically connected but logically isolated. The two parties do not establish a transmission control protocol connection and do not perform direct key negotiation interaction. The edge gateway is configured as a server in edge-to-end lightweight secure transmission domain A to respond to data upload requests from the sensor terminal; and as a client in cloud-to-edge high-throughput secure transmission domain B to initiate data transmission requests to the cloud server.

[0039] The edge gateway's storage space is divided into a data buffer. The edge gateway receives the first ciphertext data sent by the sensor terminal and uses the first session key to perform a decryption operation to recover the monitoring data. The edge gateway temporarily writes the decrypted monitoring data into the data buffer. The edge gateway reads the monitoring data from the data buffer and uses the second session key to perform SM4 block encryption to generate the second ciphertext data. Through the decryption-caching-re-encryption process at the edge gateway, the system converts the stream cipher system adapted to the sensor terminal into the block cipher system adapted to the cloud server.

[0040] The edge gateway is configured with an aggregation timer. The edge gateway uses a data buffer and the aggregation timer to perform data aggregation and transmission operations. The sensor terminal sends the first encrypted data according to the preset acquisition frequency. The edge gateway accumulates the monitoring data from multiple sensor terminals or multiple acquisition cycles in the data buffer. When the data storage volume of the data buffer reaches the preset threshold or the aggregation timer is triggered, the edge gateway performs batch encryption processing on the accumulated monitoring data in the data buffer to generate the second encrypted data, and sends it to the cloud server through the communication network. This operation converts the low-speed discrete data stream of the sensor terminal into a high-speed batch data stream adapted to the cloud-edge high-throughput secure transmission domain B.

[0041] Furthermore, the sensor terminal's memory pre-stores the edge gateway's public key (denoted as...). ) and pre-shared key (denoted as The edge gateway's private key (denoted as ) is stored in the secure area of ​​the edge gateway's memory and is paired with the edge gateway's public key. ) and a pre-shared key consistent with the sensor terminal.

[0042] The sensor terminal uses the key negotiation module to perform key encapsulation operations. The key negotiation module calls the Kyber key encapsulation algorithm (Kyber.CCAKEM.Enc), using the edge gateway's public key as input parameters, to generate the first session key (denoted as ). ) and encapsulated ciphertext (denoted as The operation process satisfies the following relationship:

[0043] In the above formula, This indicates the symmetric key generated through negotiation, i.e., the first session key, whose data length is configured to be 32 bytes; This indicates the encapsulated ciphertext data, i.e., the encapsulated ciphertext, whose data length is configured to be 768 bytes; This represents the edge gateway public key as the public key input; Kyber.CCAKEM.Enc represents the Kyber key encapsulation function based on CCA security strength.

[0044] The sensor terminal performs a data integrity authentication operation. The sensor terminal obtains the current system time and generates a timestamp (denoted as ). The sensor terminal concatenates the encapsulated ciphertext with a timestamp at the bit level. Then, using a pre-shared key, the sensor terminal performs an HMAC-SM3 hash message authentication operation on the concatenated data to generate an authentication tag (denoted as...). The operation process satisfies the following relationship:

[0045] In the above formula, This refers to the calculated and generated message authentication code, i.e., the authentication tag; This refers to the authentication key pre-set by both communicating parties, i.e., the pre-shared key; This indicates the encapsulated ciphertext; Indicates the timestamp; HMAC-SM3 represents the key hash message authentication code function based on the SM3 hash algorithm.

[0046] The sensor terminal sends the encapsulated ciphertext, authentication tag, and timestamp to the edge gateway. The edge gateway receives the data and verifies the freshness of the timestamp. If the timestamp meets the valid time window requirement, the edge gateway uses the locally stored pre-shared key to perform calculations on the received encapsulated ciphertext and timestamp according to the HMAC-SM3 formula to generate a local authentication value. The edge gateway compares the local authentication value with the received authentication tag. If they match, the data integrity is confirmed.

[0047] After successful verification, the edge gateway uses its private key to perform key decapsulation. The edge gateway calls the Kyber key decapsulation algorithm (Kyber.CCAKEM.Dec) to decrypt the encapsulated ciphertext and recover the first session key. This operation satisfies the following relationship:

[0048] In the above formula, This represents the symmetric key recovered after decryption, i.e., the first session key; This indicates the input of the private key, i.e., the private key of the edge gateway; This represents the encapsulated ciphertext to be decrypted; Kyber.CCAKEM.Dec represents the Kyber key decapsulation function based on CCA security strength. Through the above steps, the sensor terminal and the edge gateway complete the synchronization of the quantum-resistant first session key in the edge-to-edge lightweight secure transmission domain A.

[0049] Furthermore, the sensor terminal acquires real-time physical signals and encodes them to generate monitoring data (denoted as...). The sensor terminal performs zero-padding on the high-order bits of the monitored data to ensure that the length of the padded data is a multiple of 64 bytes. The sensor terminal then generates a random number (denoted as ) specifically for this encrypted communication. The data length of this random number is configured to be 32 bytes.

[0050] The stream cipher module of the sensor terminal constructs and fills the input string (denoted as ). The stream cipher module performs bit-level concatenation of the first session key, random number, preset delimiter, and padding bits. This construction process satisfies the following relationship:

[0051] In the above formula, This represents the constructed and generated padding input string; This represents the first session key; Represents the random number; Indicates the default hexadecimal separator; Represents a binary zero-padding sequence, where The number of bits required to ensure that the total bit length of the filled input string is an integer multiple of 512; This represents a hexadecimal value indicating the length of the first session key in bytes; This indicates a data concatenation operation.

[0052] The sensor terminal is configured to introduce a random time delay before performing hash operations to reduce the risk of side-channel timing analysis. The stream cipher module obtains the current system time parameters (denoted as...). ), and calculate the delay parameter in conjunction with the first session key. This calculation satisfies the following relationship:

[0053]

[0054] In the above formula, This represents the calculated random delay factor; This represents the first session key; This represents the system time parameter; This indicates that the first byte of the hash output value is extracted. This indicates the final determined physical delay time; This indicates the preset baseline delay time unit; SM3 represents the SM3 cryptographic hash algorithm function, and the stream cipher module executes an empty instruction loop or sleep operation until the duration reaches [a certain value]. .

[0055] The stream cipher module performs iterative operations based on the SM3 hash algorithm to generate a derived key stream (denoted as ). The stream cipher module calls the SM3 compression function, and in the first iteration, it uses the initial vector defined by the SM3 standard (denoted as ). The stream cipher module performs operations on the padding input string. In subsequent iterations, the hash output value of the previous round is used as the initial vector input for the current round, and operations are performed on the padding input string. This iterative process satisfies the following relationship:

[0056]

[0057]

[0058] In the above formula, This represents the hash value generated in the first iteration; This represents the filled input string; Represents the initial vector; Indicates the first The hash value generated by the round of iteration; Indicates the first The hash value generated in the round of iteration, its number in the th round The initial vector input that replaces the standard SM3 algorithm in round operations; This indicates that the total length of the derived key stream generated by splicing is not less than the length of the monitoring data.

[0059] The sensor terminal performs data encryption and authentication. The stream cipher module performs a bitwise XOR operation on the zero-padded monitoring data and the derived key stream to generate the first ciphertext data (denoted as ). The operation process satisfies the following relationship:

[0060] In the above formula, This represents the encrypted first ciphertext data; This represents the monitoring data after zero padding; This refers to the derived key stream; This indicates a bitwise XOR logical operation.

[0061] The sensor terminal uses the first session key to calculate the data authentication code (denoted as ). The operation process satisfies the following relationship:

[0062] In the above formula, This represents the data authentication code; This represents the first session key; Represents the random number; The first ciphertext data is represented by HMAC-SM3, which represents the key hash message authentication code function based on the SM3 hash algorithm. The sensor terminal sends the first ciphertext data, the random number, and the data authentication code to the edge gateway.

[0063] The edge gateway receives data and uses the locally stored first session key to verify the integrity of the data authentication code. After successful verification, the edge gateway extracts a random number and reconstructs and fills the input string according to the above formula. The edge gateway performs the same SM3 iterative operation to generate a derived key stream and performs an XOR operation on the first ciphertext data to recover the monitoring data.

[0064] Furthermore, the edge gateway's memory stores a security verification module, which, when executed by the edge gateway's processor, performs integrity and freshness verification functions.

[0065] The security verification module performs data integrity verification operations, and reads the first session key stored locally (denoted as...). The security verification module uses the SM3 hash algorithm for message authentication logic. It performs concatenation and hash operations on the received random number and the first ciphertext data using the first session key to generate a local authentication value (denoted as...). The operation process satisfies the following relationship:

[0066] In the above formula, This refers to the local authentication value calculated and generated by the edge gateway; This represents the first session key; This refers to the random number extracted from the received data packet; This represents the first ciphertext data extracted from the received data packet; HMAC-SM3 represents the key hash message authentication code function based on the SM3 hash algorithm.

[0067] The security verification module compares the local authentication value with the received data authentication code. If the local authentication value and the data authentication code are inconsistent, the edge gateway determines that the integrity verification of the first encrypted data has failed and discards the data packet. If the local authentication value and the data authentication code are consistent, the edge gateway confirms the integrity and authenticity of the data source and initiates the freshness verification process.

[0068] The security verification module uses random numbers to perform freshness verification. The edge gateway's memory has an anti-replay record table, which is configured to store random numbers received within the current valid lifespan of the first session key. The security verification module searches the anti-replay record table for the currently received random number. If the same value already exists in the anti-replay record table, the edge gateway determines that the current data packet is replay data and refuses to process it. If the value does not exist in the anti-replay record table, the security verification module writes the currently received random number into the anti-replay record table and allows the edge gateway to perform decryption operations on the first encrypted data. When the first session key is updated, the edge gateway clears the data in the anti-replay record table.

[0069] Furthermore, the cloud server's storage pre-stores the edge gateway's public key (denoted as...). ) and cloud-based pre-shared key (denoted as The edge gateway's private key (denoted as ) is stored in the secure area of ​​the edge gateway's memory and is paired with the edge gateway's public key. The cloud server contains a cloud key negotiation module that is consistent with the cloud server's pre-shared key. When the cloud server's processor executes this module, it implements quantum-resistant key encapsulation logic.

[0070] The cloud server initiates a negotiation process using the cloud-based key negotiation module. This module calls the Kyber key encapsulation algorithm (Kyber.CCAKEM.Enc), taking the edge gateway's public key as input, and performs the operation to generate a second session key (denoted as...). ) and cloud-encapsulated ciphertext (denoted as The operation process satisfies the following relationship:

[0071] In the above formula, This indicates the generated symmetric key for cloud-edge communication, i.e., the second session key, whose data length is configured to be 16 bytes to adapt to the SM4 algorithm; This refers to the encrypted data generated through encapsulation, i.e., the cloud-encapsulated encrypted data; This represents the edge gateway public key as the public key input; Kyber.CCAKEM.Enc represents the Kyber key encapsulation function based on CCA security strength.

[0072] The cloud server performs integrity authentication and anti-replay processing on transmitted data. The cloud server obtains the current system time and generates a cloud-based timestamp (denoted as...). The cloud server performs bit-level concatenation of the cloud-encapsulated ciphertext and the cloud timestamp. Then, using the pre-shared key in the cloud, the cloud server performs HMAC-SM3 hash message authentication on the concatenated data to generate a cloud authentication tag (denoted as...). The operation process satisfies the following relationship:

[0073] In the above formula, This refers to the cloud-based authentication tag generated through computation; This refers to the authentication key pre-configured by both the cloud and edge, i.e., the cloud-pre-shared key; This indicates that the cloud-encapsulated ciphertext is present. This refers to the cloud timestamp; This indicates a data concatenation operation; HMAC-SM3 represents a key hash message authentication code function based on the SM3 hash algorithm. The cloud server sends the cloud-encapsulated ciphertext, cloud authentication tag, and cloud timestamp to the edge gateway.

[0074] The edge gateway receives the above data and performs a verification operation. The edge gateway verifies the freshness of the cloud timestamp. If the cloud timestamp is within the valid time window, the edge gateway uses the locally stored cloud pre-shared key to perform calculations on the received cloud encapsulated ciphertext and cloud timestamp according to the above HMAC-SM3 formula to generate a local authentication value. The edge gateway compares the local authentication value with the received cloud authentication tag. If the two match, the edge gateway confirms that the data source is legitimate and has not been tampered with.

[0075] After successful verification, the edge gateway uses its private key to perform a decapsulation operation. The edge gateway calls the Kyber key decapsulation algorithm (Kyber.CCAKEM.Dec) to decrypt the cloud-encapsulated ciphertext and recover the second session key. This operation process satisfies the following relationship:

[0076] In the above formula, This indicates the second session key recovered after decryption; This indicates the input of the private key, i.e., the private key of the edge gateway; This indicates the cloud-encapsulated ciphertext; Kyber.CCAKEM.Dec represents the Kyber key decapsulation function based on CCA security strength. Through the above steps, the cloud server and the edge gateway complete the synchronization of the second session key in the cloud-edge high-throughput secure transmission domain B. This key is then configured for encryption and decryption operations of the SM4 block cipher algorithm.

[0077] Furthermore, the edge gateway's memory stores an SM4 encryption module, which implements block encryption logic when executed by the edge gateway's processor. The cloud server's memory stores an SM4 decryption module, which implements block decryption logic when executed by the cloud server's processor.

[0078] The SM4 encryption module reads the monitoring data to be transmitted from the data buffer (denoted as...). The SM4 encryption module performs padding operations on the monitoring data according to the PKCS#7 padding standard, ensuring that the length of the padded data meets the 128-bit block alignment requirement. The SM4 encryption module generates dynamic random mask parameters (denoted as...). The SM4 encryption module utilizes a second session key (denoted as...). The monitoring data, after being padded, is encrypted using SM4 block encryption with random mask parameters to generate second ciphertext data (denoted as...). The encryption operation process satisfies the following relationship:

[0079] In the above formula, This represents the generated second ciphertext data; This indicates the second session key; This indicates the monitoring data after it has been filled in; This refers to the random mask parameter, which is configured to perform an XOR scrambling operation on the intermediate state matrix during the round function operation of the SM4 algorithm; This indicates an SM4 block encryption function that integrates a random mask protection mechanism, which is an SM4 module with enhanced side-channel protection.

[0080] The edge gateway sends the second encrypted data to the cloud server. The cloud server uses the SM4 decryption module to decrypt the received second encrypted data. The SM4 decryption module calls the locally stored second session key to perform SM4 block decryption on the second encrypted data to recover the monitoring data. This decryption process satisfies the following relationship:

[0081] In the above formula, This indicates that the monitoring data has been decrypted and padded out. This indicates the second session key; This indicates the received second ciphertext data; This represents the SM4 block decryption function.

[0082] The cloud server is configured with a cloud key timer (denoted as...). The cloud server uses a cloud key timer to accumulate the usage time of the second session key. The cloud server reads the cloud key lifecycle parameter (denoted as ) negotiated with the edge gateway. The cloud server continuously compares the value of the cloud key timer with the value of the cloud key lifecycle parameter. When the conditions are met... When the conditions are met, the cloud server determines that the second session key is about to expire and triggers the cloud key negotiation module to initiate a new round of key negotiation requests to the edge gateway.

[0083] Furthermore, based on the state awareness and key policy module configured within the edge gateway, the device state awareness vector (denoted as...) is... The construction process of the edge gateway is described in detail. The edge gateway uses the state awareness and key policy module to periodically extract feature data from the decrypted data stream and local system logs to quantitatively evaluate the current operating status of the sensor terminal.

[0084] The state awareness and key strategy module acquires the physical state parameters of the sensor terminal and performs numerical normalization. The edge gateway parses and decrypts the monitoring data, extracting the remaining battery percentage (denoted as...). ), Equipment temperature value (referred to as ) and vibration intensity value (denoted as The state awareness and key policy module uses the min-max normalization algorithm to map the above parameters to... For the interval, this normalization process satisfies the following relationship:

[0085] In the above formula, This represents the parameter value after normalization. This represents the sampled value of the original physical parameters extracted from the monitoring data; This indicates the minimum boundary value of the preset physical parameter within the normal operating range of the equipment; This indicates the maximum value boundary of the preset physical parameter within the normal operating range of the device.

[0086] The state awareness and key policy module extracts semantic feature parameters and performs quantization mapping. It reads a pre-set service type mapping table from the edge gateway's memory, identifies the data type identifier in the frame header field of the monitoring data, and matches the corresponding numerical weight according to the service type mapping table. The semantic feature parameters include the data priority coefficient (denoted as...). ) and data freshness requirements (denoted as For example, when the data type is identified as "emergency control instruction", the status awareness and key policy module assigns a data priority coefficient of 0.9; when the data type is identified as "periodic reporting", it assigns a value of 0.3.

[0087] The State Awareness and Key Policy module calculates environmental risk index parameters based on local security posture. It also reads the firewall logs of the edge gateway, counts the number of unauthorized accesses blocked within the most recent time window, and generates a network threat index (denoted as ) through a logarithmic function mapping. ), calculated using the following logarithmic formula:

[0088] in For the number of interceptions, The normalization coefficient is... The state awareness and key policy module reads the system clock. If the current time falls within a preset high-risk period (such as nighttime or periods of severe weather), it increases the time risk factor (denoted as...). The value of the time risk factor is set to a preset high-risk weight value (e.g., 1.5), otherwise it is set to the baseline value (e.g., 1.0).

[0089] The state awareness and key policy module performs a vector concatenation operation to generate a device state awareness vector. The state awareness and key policy module then concatenates the normalized and quantized sub-parameters in a predetermined order. This construction process satisfies the following relationship:

[0090] In the above formula, This represents the generated device state awareness vector; This represents the remaining battery percentage after normalization. This represents the normalized temperature value of the equipment. This represents the vibration intensity value after normalization. This represents the data priority coefficient after quantization mapping; This indicates the data freshness requirement after quantization mapping; This represents the calculated network threat index; This indicates the defined time risk factor; The vector transpose operator is used to indicate... It is a column vector structure.

[0091] Furthermore, the edge gateway's memory is pre-configured with a baseline lifetime value (denoted as...). ), weight coefficient set, minimum lifespan threshold (denoted as ) and maximum lifespan threshold (denoted as ).

[0092] The state awareness and key policy module calculates the resource constraint factor (denoted as ). The state awareness and key policy module extracts the remaining battery percentage (denoted as ) from the device state awareness vector. ) and equipment temperature value (denoted as The state awareness and key policy module reads the resource weight parameters from the weight coefficient set and performs a weighted operation. This operation satisfies the following relationship:

[0093] In the above formula, This represents the calculated resource constraint factor; This represents the remaining battery percentage, and its value ranges from [0,1]. This represents the temperature value of the device, which ranges from [0,1]. This represents the preset power sensitivity weighting coefficient; This represents the preset temperature sensitivity weighting coefficient; constant 1 is a reference bias to prevent the denominator from being zero or too small.

[0094] The state awareness and key policy module calculates the security requirement factor (denoted as ). The state awareness and key policy module extracts the network threat index (denoted as ) from the device state awareness vector. ), data priority coefficient (denoted as ) and time risk factor (denoted as The state awareness and key policy module reads the security weight parameters from the weight coefficient set and performs a weighted operation, which satisfies the following relationship:

[0095] In the above formula, This represents the calculated security requirement factor; This indicates the network threat index; This represents the data priority coefficient; This refers to the time risk factor; , , These represent the preset weighting coefficients for the corresponding parameters.

[0096] The state awareness and key policy module performs the synthesis operation of key lifecycle parameters. Based on the ratio of resource constraint factor to security requirement factor, the state awareness and key policy module dynamically adjusts the baseline lifecycle value. This operation process satisfies the following relationship:

[0097] In the above formula, This represents the calculated key lifecycle parameter; This represents the preset baseline lifespan value; This represents the resource constraint factor, which is directly proportional to the key lifecycle parameter and is used to extend the lifecycle when resources are limited. This represents the security requirement factor, which is inversely proportional to the key lifecycle parameter and is used to shorten the lifecycle when the security risk is high.

[0098] The state awareness and key policy module performs boundary constraint processing on the calculated key lifecycle parameters. The state awareness and key policy module compares the calculated key lifecycle parameters with the minimum lifecycle threshold and the maximum lifecycle threshold. If the calculation result is less than the minimum lifecycle threshold, the state awareness and key policy module assigns the key lifecycle parameter to the minimum lifecycle threshold; if the calculation result is greater than the maximum lifecycle threshold, the state awareness and key policy module assigns the key lifecycle parameter to the maximum lifecycle threshold.

[0099] Furthermore, the edge gateway's processor runs a session timer (denoted as...). The session timer is configured to record the current duration of validity of the first session key.

[0100] The state awareness and key policy module monitors the key update trigger conditions. It compares the current count value of the session timer with the key lifecycle parameter. When the session timer count value reaches or exceeds the key lifecycle parameter, the state awareness and key policy module determines that the current key period has ended. This comparison logic satisfies the following relationship:

[0101] In the above formula, This indicates the current key runtime recorded by the session timer; This refers to the key lifecycle parameters dynamically calculated by the state awareness and key policy module based on the device state; It indicates a comparison relationship between numerical values ​​that is greater than or equal to.

[0102] The state awareness and key policy module generates a key update command and sends it to the sensor terminal. The edge gateway then starts a transition window timer (denoted as...). This is used to define the valid time window for the coexistence of the old and new keys. The sensor terminal receives the key update command and performs Kyber encapsulation operation using the key negotiation module. The sensor terminal generates an update session key (denoted as ). The sensor terminal sends the updated encapsulated ciphertext to the edge gateway and immediately switches to using the updated session key to encrypt and transmit the subsequently collected monitoring data.

[0103] The edge gateway receives the updated encapsulated ciphertext and performs a decapsulation operation using its private key to recover the updated session key. At this time, the edge gateway's memory also retains the first session key (which is now marked as the old session key, denoted as ). With the updated session key, the edge gateway performs dual verification and decryption on the received encrypted data packets. First, the edge gateway performs HMAC verification on the authentication tag in the data packet using the updated session key. If the verification passes, the data is decrypted using the updated session key. If the verification fails and the current time has not exceeded the threshold of the transition window timer, the edge gateway attempts to perform HMAC verification and decryption again using the old session key.

[0104] When the edge gateway successfully decrypts using the updated session key a preset number of times, or when the transition window timer expires, the edge gateway performs an old key cleanup operation. The edge gateway deletes the old session key from the memory, resets the session timer to zero, and marks the updated session key as the first session key currently in use, thus completing the key cycle iteration.

[0105] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for secure remote data transmission over power lines that integrates quantum resistance and lightweight cryptography, characterized in that, Applications include systems containing sensor terminals, edge gateways, and cloud servers; The method includes the following steps: Step S1: The sensor terminal obtains the public key of the edge gateway, performs Kyber key encapsulation operation based on the public key, and negotiates with the edge gateway to establish a quantum-resistant first session key; Step S2: The sensor terminal collects the operating status parameters of the hydraulic equipment and adds a data frame header containing a data type identifier to generate monitoring data; Step S3: The sensor terminal generates a random number, performs iterative operations of the SM3 hash algorithm based on the first session key and the random number to generate a derived key stream; performs a bitwise XOR operation on the monitoring data using the derived key stream to generate first ciphertext data, and sends the first ciphertext data and the random number to the edge gateway; Step S4: The edge gateway receives the first ciphertext data and the random number, reconstructs the derived key stream using the locally stored first session key and the random number, and performs a decryption operation on the first ciphertext data to recover the monitoring data; Step S5: The edge gateway calls the second session key pre-negotiated with the cloud server, uses the second session key to perform SM4 block encryption on the monitoring data, generates second ciphertext data, and sends the second ciphertext data to the cloud server; Step S6: The cloud server receives the second encrypted data, performs SM4 decryption on the second encrypted data using the second session key stored locally, obtains the monitoring data, and stores it in the database.

2. The method for secure remote data transmission in power systems integrating quantum resistance and lightweight cryptography as described in claim 1, characterized in that: The process of generating the derived key stream in step S3 specifically includes: The sensor terminal constructs a padding input string, which is formed by bit-level concatenation of the first session key, the random number, a preset hexadecimal separator, a specified number of binary zero-padding sequences, and a hexadecimal value indicating the byte length of the first session key. In the first iteration, the sensor terminal uses the initial vector defined by the SM3 standard to perform an SM3 hash operation on the filled input string to generate the first hash value. In subsequent iterations, the hash output value of the previous round is used as the initial vector input for the current round, and the SM3 hash operation is performed on the filling input string. The sensor terminal concatenates the hash values ​​generated in each iteration to generate the derived key stream.

3. The method for secure remote data transmission in power systems integrating quantum resistance and lightweight cryptography as described in claim 2, characterized in that: Before the sensor terminal performs the iterative calculation of the SM3 hash algorithm, the following is also included: The sensor terminal acquires the current system time parameter, performs a hash operation on the concatenated data of the first session key and the system time parameter, and extracts the first byte of the hash output value as a random delay factor. The physical delay time is obtained by multiplying the random delay factor by a preset base delay time unit. The sensor terminal executes an empty instruction loop or sleep operation until the duration reaches the physical delay time, and then starts the iterative operation of the SM3 hash algorithm.

4. The method for secure remote data transmission in power systems integrating quantum resistance and lightweight cryptography as described in claim 1, characterized in that: In step S3, the sensor terminal also calculates a data authentication code based on the first session key and sends the data authentication code along with the first encrypted data and the random number to the edge gateway. After the sensor terminal sends data in step S3, and before the edge gateway performs the decryption operation in step S4, the method further includes: The edge gateway uses the first session key to verify the integrity of the data authentication code in the received data packet; If the integrity verification passes, the edge gateway retrieves the received random number from its local anti-replay record table; If there is no record of the same value in the anti-replay record table, the edge gateway writes the random number into the anti-replay record table and allows the decryption operation to be performed in step S4. When the first session key is updated, the edge gateway clears the data in the anti-replay record table.

5. The method for secure remote data transmission over power lines integrating quantum resistance and lightweight cryptography as described in claim 1, characterized in that: The process of generating the second ciphertext data in step S5 specifically includes: The edge gateway performs a padding operation on the monitoring data to generate dynamic random mask parameters; the edge gateway uses the second session key and the random mask parameters to perform SM4 block encryption on the padded monitoring data to generate the second ciphertext data; The random mask parameter is configured to perform an XOR scrambling operation on the intermediate state matrix during the round function operation of the SM4 algorithm.

6. The method for secure remote data transmission in power systems integrating quantum resistance and lightweight cryptography as described in claim 1, characterized in that: The method further includes step S7, which involves the edge gateway performing full lifecycle management of the key. Step S7 specifically includes: The edge gateway's state awareness and key policy module acquires the physical state parameters of the sensor terminal, which include at least the remaining power ratio and the device temperature value. Using the min-maximum normalization algorithm, the physical state parameters are mapped to a dimensionless interval by calculating the difference between the original sampled value and the preset minimum value boundary and dividing it by the difference between the preset maximum value boundary and the preset minimum value boundary. The state awareness and key policy module identifies the data type identifier in the frame header field of the monitoring data generated in step S2, matches the corresponding numerical weight according to the business type mapping table, and obtains semantic feature parameters. The semantic feature parameters include at least the data priority coefficient. The state awareness and key policy module counts the number of illegal access interceptions within the most recent time window and performs logarithmic calculations to calculate the network threat index. Combined with the system time risk factor based on the current time, it generates environmental risk index parameters. The state awareness and key strategy module concatenates the normalized physical state parameters, the semantic feature parameters, and the environmental risk index parameters to generate a device state awareness vector.

7. A method for secure remote data transmission over power lines that integrates quantum resistance and lightweight cryptography as described in claim 6, characterized in that: After generating the device state awareness vector, step S7 further includes: The state awareness and key strategy module calculates the resource constraint factor by weighting the remaining power ratio and the device temperature value in the device state awareness vector and combining them with a preset set of weighting coefficients. The value of the resource constraint factor is negatively correlated with the remaining power ratio and positively correlated with the equipment temperature value. The state awareness and key policy module calculates the security requirement factor by weighting the network threat index, the data priority coefficient and the time risk factor in the device state awareness vector and the weight coefficient set. The state awareness and key policy module calculates the ratio of the resource constraint factor to the security requirement factor, and multiplies the ratio by a preset baseline lifetime value to obtain the key lifetime parameter of the first session key.

8. A method for secure remote data transmission over power lines that integrates quantum resistance and lightweight cryptography as described in claim 7, characterized in that: After calculating the key lifecycle parameter, the method further includes: The edge gateway is configured with a session timer to record the duration of the first session key. When the value of the session timer reaches the key lifecycle parameter, the edge gateway sends a key update command to the sensor terminal and starts a transition window timer; The edge gateway receives the updated encapsulated ciphertext from the sensor terminal and decapsulates it to obtain the updated session key. At the same time, the edge gateway retains the first session key as the old session key. The edge gateway uses the updated session key to verify and decrypt the received data packets first. If the verification fails but does not exceed the threshold of the transition window timer, the old session key is used for verification and decryption.

9. A method for secure remote data transmission over power lines that integrates quantum resistance and lightweight cryptography as described in claim 1, characterized in that: The edge gateway's storage space is divided into data buffers and configured with an aggregation timer; After recovering the monitoring data in step S4 and before generating the second encrypted data in step S5, the method further includes: The edge gateway writes the decrypted and recovered monitoring data into the data buffer for accumulation. When the data storage volume of the data buffer reaches a preset threshold or the aggregation timer is triggered, the edge gateway executes step S5 to perform batch encryption processing on the monitoring data accumulated in the data buffer.

10. A power-based remote data security transmission system integrating quantum resistance and lightweight cryptography, characterized in that, The system includes sensor terminals, edge gateways, and cloud servers connected via a communication network; The sensor terminal integrates a key negotiation module and a stream cipher operation module, and is configured to execute steps S1 to S3 in the method of claim 1, for negotiating and establishing a first session key with the edge gateway based on the Kyber algorithm, and using the first session key and the derived key stream generated by the SM3 hash algorithm to perform XOR encryption on the collected monitoring data, and generate first ciphertext data to be sent to the edge gateway. The edge gateway integrates an SM4 encryption module, an SM4 decryption module, and a state awareness and key policy module. It is configured to execute steps S4 to S5 in the method of claim 1, for receiving the first ciphertext data, decrypting and recovering the monitoring data using the first session key, and using the second session key negotiated with the cloud server to call the SM4 block cipher algorithm to perform secondary encryption on the monitoring data, generating second ciphertext data and sending it to the cloud server. The state awareness and key strategy module is further configured to acquire the state parameters of the sensor terminal and construct a device state awareness vector, so as to dynamically calculate the effective lifespan of the first session key based on the device state awareness vector. The cloud server is configured to execute step S6 of the method of claim 1, which is used to receive the second encrypted data, decrypt the monitoring data using the second session key, and store it.

Images