Blockchain-based power communication network security data transmission method and system

Abstract

This invention discloses a blockchain-based method and system for secure data transmission in power communication networks, belonging to the field of network security technology. The method includes: acquiring a random metastable signal of the initial state of an SRAM cell; obtaining a composite entropy source based on the random metastable signal and a device identifier; dynamically acquiring a temporary random number based on a timestamp; using the temporary random number and the composite entropy source as input to a key derivation function to obtain a symmetric session key; encrypting and splitting the symmetric session key to obtain a secure data packet; and performing security verification on the secure data packet using the blockchain. If the security verification passes, the transmission is successful; otherwise, a security mechanism is triggered. This invention overcomes the technical problem of difficulty in improving data transmission security and efficiency in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a blockchain-based method and system for secure data transmission in power communication networks. Background Technology

[0002] With the accelerated digital transformation of the power industry, power communication networks bear the burden of massive amounts of critical data transmission tasks, ranging from real-time operating parameters of the power system to user electricity consumption information. The secure transmission of this data is crucial for ensuring the stable operation of the power system, fair trading in the electricity market, and reliable power supply for users. Existing technologies primarily collect power operating parameters in real time and encapsulate these parameters into raw data units according to a pre-defined structured format. During the encapsulation process, a collection timestamp and a four-segment unique device identifier consisting of "regional code + substation ID + equipment type code + physical port number" are added. Subsequently, a symmetric session key is derived based on this unique device identifier. After processing the data using this symmetric session key, the data is stored using a blockchain consensus mechanism, thereby achieving data transmission. However, the aforementioned solutions have significant shortcomings in terms of security and efficiency. From a security perspective, structured coding suffers from low entropy and predictable patterns. Specifically, the value space for fields such as area codes and substation IDs is limited. Attackers can obtain coding rules through network scanning or social engineering, and then reconstruct the generation logic of device identification codes. Especially in scenarios where backdoors are pre-installed in the supply chain, malicious suppliers may pre-install vulnerabilities in the identification code generation algorithm in the device firmware, allowing all derived keys to be reverse-engineered. In key association leakage scenarios, after an attacker cracks the key of a single device, since other devices in the same substation have the same area code and substation ID, it is possible to deduce the keys of these devices, thus causing large-scale security risks. From an efficiency perspective, the process of securely verifying predictable symmetric session keys using blockchain is cumbersome and complex, involving close collaboration and data processing across multiple stages. Therefore, how to improve the security and efficiency of data transmission is a technical challenge that current technologies urgently need to overcome. Summary of the Invention

[0003] To address the technical problem of existing technologies' inability to improve data transmission security and efficiency, this invention provides a blockchain-based method and system for secure data transmission in power communication networks. It obtains a composite entropy source by combining a random metastable signal characterizing the natural differences in the metastable state of an SRAM cell at power-on with the device identifier code. This composite entropy source is then used as input to a key derivation function to obtain a symmetric session key, thereby increasing the entropy value of the symmetric session key and blocking the correlation between device keys. Security verification of difficult-to-predict data packets is performed using blockchain, reducing the complexity of security verification via blockchain and improving data transmission efficiency. This overcomes the technical problem of existing technologies' inability to improve data transmission security and efficiency.

[0004] To address the aforementioned technical problems, this invention provides a blockchain-based method for secure data transmission in power communication networks, comprising the following steps: Obtain the random metastable signal of the initial state of the SRAM cell, and obtain the composite entropy source based on the random metastable signal and the device identifier code; Temporary random numbers are dynamically obtained based on timestamps. The temporary random numbers and composite entropy sources are used as inputs to the key derivation function to obtain a symmetric session key. The symmetric session key is then encrypted and split to obtain a secure data packet. The blockchain is used to verify the security of data packets. If the security verification passes, the transmission is successful; otherwise, the security mechanism is triggered.

[0005] By adopting the above technical solution, the present invention has the following advantages: By obtaining a composite entropy source through a random metastable signal characterizing the natural differences in the metastable state of an SRAM cell at power-on and the device identifier code, and using a temporary random number and the composite entropy source as inputs to a key derivation function to obtain a symmetric session key, the entropy value of the symmetric session key is improved. Furthermore, the correlation between device keys is blocked, ensuring the uniqueness and tamper resistance of the symmetric session key and preventing computational attacks. Since easily predictable security data packets are easily tampered with, the success rate of security verification using blockchain is low. When a verification fails, subsequent security data packets need to be obtained again for repeated verification, significantly reducing data transmission efficiency. Therefore, by obtaining and verifying unpredictable security data packets, the complexity of security verification using blockchain is reduced, data transmission efficiency is improved, and the technical problem of improving data transmission security and efficiency in existing technologies is overcome. By acquiring secure data packets that are difficult to predict, and combining this with the decentralized, immutable, and traceable characteristics of blockchain, dual security is provided for data transmission, significantly improving the security of data transmission.

[0006] Preferably, the step of obtaining the composite entropy source based on the random metastable signal and the device identifier includes: The physical entropy source is obtained by using a random metastable signal, the physical entropy source is connected with the device identifier, and the composite entropy source is obtained by using a first hash function.

[0007] Preferably, obtaining the symmetric session key by using a temporary random number and a composite entropy source as inputs to the key derivation function includes: Preprocess the composite entropy source to obtain the adaptation key; The inner key is obtained by bitwise XORing the adaptation key with the inner padding constant in the second hash function. The temporary random number is then appended to the inner key to obtain the first data block, and the inner hash value is obtained in turn. The outer key is obtained by bitwise XORing the adaptation key with the outer padding constant in the second hash function. The inner hash value is then appended to the outer key to obtain the second data block, and thus the intermediate seed is obtained. The intermediate seed is input into the key expansion algorithm to obtain the symmetric session key; The second hash function and the key expansion algorithm together constitute the key derivation function.

[0008] Preferably, the step of encrypting and splitting the symmetric session key to obtain a secure data packet includes: Based on the symmetric session key, the original data is encrypted using the first encryption algorithm to generate the ciphertext data body; Obtain the public key of the scheduling center, and based on the public key of the scheduling center, use the second encryption algorithm to encrypt the symmetric session key to generate the key ciphertext; The symmetric encryption key is split into complementary key fragments, and the key fragments, key data body and key ciphertext are combined to obtain a secure data packet.

[0009] Preferably, the security verification of the secure data packet via blockchain includes: The blockchain nodes broadcast the received security data packets to the power system nodes. The power system nodes perform the first security verification on the security data packets. If the first security verification passes, the security data packets are packaged with the consensus proof generated during the first security verification to obtain a new block, and the new blockchain is connected to the blockchain. When a new block that meets preset conditions is detected in the blockchain, the private key of the scheduling center is obtained, and a second security verification is performed on the secure data packet based on the private key of the scheduling center.

[0010] Preferably, the power system node performs a first security verification on the security data packet, including: Power system nodes verify the time validity of data security packets using the registered device public key; Power system nodes initiate a query operation to the whitelist smart contract deployed on the blockchain using the device identification code in the security data packet, and verify the legitimacy of the data security packet's source through the query operation result; Parse secure data packets to obtain zero-knowledge proofs, and verify the key reliability of secure data packets based on zero-knowledge proofs.

[0011] Preferably, the second security verification of the secure data packet based on the scheduling center's private key includes: The security data packet is decrypted using the private key of the scheduling center to obtain the decryption result. The decryption result is then compared with the evidence stored on the blockchain to obtain the hash comparison result, which is then used for a second security verification of the security data packet.

[0012] Preferably, it also includes: when the hash comparison result is greater than a preset deviation, it indicates that the security verification has failed, or when the first security verification has failed, it indicates that the security verification has failed.

[0013] The beneficial effects of this plan are: By obtaining a composite entropy source through a random metastable signal characterizing the natural differences in the metastable state of an SRAM cell at power-on and the device identifier code, and using a temporary random number and the composite entropy source as inputs to a key derivation function to obtain a symmetric session key, the entropy value of the symmetric session key is improved. Furthermore, the correlation between device keys is blocked, ensuring the uniqueness and tamper resistance of the symmetric session key and preventing computational attacks. Since easily predictable security data packets are easily tampered with, the success rate of security verification using blockchain is low. When a verification fails, subsequent security data packets need to be obtained again for repeated verification, significantly reducing data transmission efficiency. Therefore, by obtaining and verifying unpredictable security data packets, the complexity of security verification using blockchain is reduced, data transmission efficiency is improved, and the technical problem of improving data transmission security and efficiency in existing technologies is overcome. By acquiring secure data packets that are difficult to predict, and combining this with the decentralized, immutable, and traceable characteristics of blockchain, dual security is provided for data transmission, significantly improving the security of data transmission. Since zero-knowledge proofs establish a mapping relationship between symmetric session keys and entropy sources using the BLS-12-381 curve pairing algorithm, the verifier only needs to use public parameters and public curve pairing functions to complete the verification without accessing the actual symmetric session key. Therefore, verifying the key reliability of secure data packets through zero-knowledge proofs ensures the integrity of the symmetric session key path and the system's anti-forgery capability. At the same time, it ensures that the encryption key in each communication session comes from a high-entropy, unique, and legitimate hardware entropy source, further improving the security of data transmission.

[0014] This invention also provides a blockchain-based secure data transmission system for power communication networks, applicable to the aforementioned blockchain-based secure data transmission method for power communication networks, comprising: The composite entropy source acquisition module is used to acquire the random metastable signal of the initial state of the SRAM cell, and to acquire the composite entropy source based on the random metastable signal and the device identification code. The secure data packet acquisition module is used to dynamically acquire temporary random numbers based on timestamps, use the temporary random numbers and composite entropy sources as inputs to the key derivation function to obtain the symmetric session key, and encrypt and split the symmetric session key to obtain secure data packets. The security verification module is used to perform security verification on secure data packets via blockchain, and to trigger a security mechanism if the security verification fails.

[0015] The beneficial effects of this plan are: By obtaining a composite entropy source through a random metastable signal characterizing the natural differences in the metastable state of an SRAM cell at power-on and the device identifier code, and using a temporary random number and the composite entropy source as inputs to a key derivation function to obtain a symmetric session key, the entropy value of the symmetric session key is improved. Furthermore, the correlation between device keys is blocked, ensuring the uniqueness and tamper resistance of the symmetric session key and preventing computational attacks. Since easily predictable security data packets are easily tampered with, the success rate of security verification using blockchain is low. When a verification fails, subsequent security data packets need to be obtained again for repeated verification, significantly reducing data transmission efficiency. Therefore, by obtaining and verifying unpredictable security data packets, the complexity of security verification using blockchain is reduced, data transmission efficiency is improved, and the technical problem of improving data transmission security and efficiency in existing technologies is overcome. By acquiring secure data packets that are difficult to predict, and combining this with the decentralized, immutable, and traceable characteristics of blockchain, dual security is provided for data transmission, significantly improving the security of data transmission.

[0016] The present invention also provides a computer device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the steps of the blockchain-based power communication network security data transmission method. Attached Figure Description

[0017] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0018] Figure 1 This is a flowchart of the blockchain-based power communication network security data transmission method of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only one preferred embodiment of this invention and are only used to explain this invention. They do not limit the scope of protection of this invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0020] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations (or steps) can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but it may also have additional steps not included in the figures; the process may correspond to a method, function, procedure, subroutine, subroutine, etc.

[0021] Example 1: As Figure 1 As shown, a blockchain-based method for secure data transmission in power communication networks includes the following steps: S1: Obtain the random metastable signal of the initial state of the SRAM cell, and obtain the composite entropy source based on the random metastable signal and the device identifier code.

[0022] The method for obtaining the composite entropy source based on random metastable signals and device identifiers includes: The physical entropy source is obtained by using a random metastable signal, the physical entropy source is connected with the device identifier, and the composite entropy source is obtained by using a first hash function.

[0023] Because the initial state of SRAM is affected by microscopic random perturbations in the manufacturing process, the PUF response difference rate of different chips on the same wafer is greater than 99.97%. Therefore, during each power-on startup of the device, the SRAMPUF module deployed in the hardware security module utilizes random metastable signals that characterize the natural differences in the metastable state of the SRAM cells inside the chip at the moment of power-on to generate a unique and uncopyable 256-bit physical entropy source. The device identification code consists of four segments: "region code + substation ID + device type code + physical port number". Since other devices in the same substation have the same region code and substation ID, a symmetric session key is derived from the device identification code. When an attacker cracks the symmetric session key of one device, they can deduce the symmetric session keys of the remaining devices based on the correlation between device identification codes. Therefore, this invention uses a random composite entropy source as the basis for symmetric session key derivation, making the symmetric session key derivation process of each device independent and no longer dependent on the correlation between device identification codes. This indirectly cuts off the correlation path between device keys, significantly improving the security of device communication.

[0024] In this embodiment, the first hash function is specifically a SHA-3 hash function. The expression for concatenating the physical entropy source with the device identifier and obtaining the composite entropy source through the first hash function is as follows: ,in, Represents a composite entropy source. This refers to the SHA-3 hash function. Indicates the device identification code. Represents the source of physical entropy. This indicates a bit string concatenation operation. The process is executed in a physically isolated secure environment within the hardware security module. The generated physical entropy source is irreversible; even if an attacker obtains the composite entropy source, they cannot reconstruct the original physical entropy source and device identifier from it. This effectively defends against reverse engineering and replay attacks. Furthermore, the device identifier, as a binding factor, enhances the individualization of the entropy source, further improving the system's collision and tamper resistance during key generation.

[0025] S2: Dynamically obtain temporary random numbers based on timestamps, use the temporary random numbers and composite entropy source as inputs to the key derivation function to obtain the symmetric session key, and encrypt and split the symmetric session key to obtain secure data packets.

[0026] In this embodiment, temporary random numbers are dynamically updated with millisecond-level precision, and the temporary random numbers and composite entropy source are used as inputs to the key derivation function to obtain symmetric session keys, ensuring the uniqueness of multiple symmetric session keys generated consecutively on the same device.

[0027] As a preferred embodiment, obtaining the symmetric session key by using a temporary random number and a composite entropy source as inputs to the key derivation function includes: Preprocess the composite entropy source to obtain the adaptation key; The inner key is obtained by bitwise XORing the adaptation key with the inner padding constant in the second hash function. The temporary random number is then appended to the inner key to obtain the first data block, and the inner hash value is obtained in turn. The outer key is obtained by bitwise XORing the adaptation key with the outer padding constant in the second hash function. The inner hash value is then appended to the outer key to obtain the second data block, and thus the intermediate seed is obtained. The intermediate seed is input into the key expansion algorithm to obtain the symmetric session key; The second hash function and the key expansion algorithm together constitute the key derivation function.

[0028] In this embodiment, the second hash function is specifically HMAC-SM3 (an HMAC function based on the national cryptographic SM3 algorithm). By preprocessing the composite entropy source, the composite entropy source is adapted to the block size of HMAC-SM3 so that the composite entropy source can be processed by HMAC-SM3.

[0029] The expression for obtaining the inner key by bitwise XORing the adaptation key with the inner padding constant in the second hash function is as follows: ,in, Indicates the inner key. Indicates the adaptation key. Indicates the inner layer fill constant. This represents an XOR operation. The expression for appending a temporary random number to the inner key to obtain the first data block is as follows: ,in, Indicates the first data block. Represents a temporary random number. This represents a bit string concatenation operation. The inner hash value is obtained by performing an SM3 hash calculation on the first data block. The expression for obtaining the outer key by bitwise XORing the adaptation key with the outer padding constant in the hash function is as follows: ,in, Indicates the outer key. This represents the outer padding constant. The expression for appending the inner hash value to the outer key to retrieve the second data block is as follows: ,in, Indicates the second data block. This represents the inner hash value. The intermediate seed is obtained by performing an SM3 hash calculation on the second data block. The key expansion algorithm is specifically the SM4-KeyExpand algorithm. The SM4-KeyExpand algorithm expands the key to produce a high-strength 128-bit symmetric session key, meeting the key structure requirements of the SM4 algorithm. Throughout the process, the memory residency time of the symmetric session key is strictly limited to less than 1 millisecond. The symmetric session key is immediately cleared from memory after the encryption operation to prevent recovery or theft through memory remnants or cache attacks. This mechanism maintains the temporality and uniqueness of the symmetric session key while enhancing the security of key lifecycle management through both physical and logical clearing measures.

[0030] As a preferred embodiment, the step of encrypting and splitting the symmetric session key to obtain a secure data packet includes: Based on the symmetric session key, the original data is encrypted using the first encryption algorithm to generate the ciphertext data body; Obtain the public key of the scheduling center, and based on the public key of the scheduling center, use the second encryption algorithm to encrypt the symmetric session key to generate the key ciphertext; The symmetric encryption key is split into complementary key fragments, and the key fragments, key data body and key ciphertext are combined to obtain a secure data packet.

[0031] In this embodiment, the first encryption algorithm is specifically the SM4 algorithm, and the second encryption algorithm is specifically the SM2 algorithm. Power operation parameters are acquired in real time through a data acquisition module deployed within the hardware security chip of the power terminal equipment. These parameters include at least voltage, current, frequency, and equipment status variables. The parameters are encapsulated according to the MMS message structure of the IEC 61850 standard, and a timestamp and a unique device identifier are added to obtain the original data. The key fragments include a first key fragment and a second key fragment. The first key fragment is stored in the secure area of ​​the device's hardware security chip. Even if the device is physically stolen, an attacker cannot directly extract the complete symmetric session key. The second key fragment, the key data body, and the key ciphertext are combined to obtain a secure data packet, ensuring the security of the second key fragment during transmission. An attacker must simultaneously compromise both the hardware security chip and the secure data packet to obtain the complete symmetric session key. Therefore, by splitting the symmetric encryption key into complementary key fragments, the risk of exposure of the symmetric session key is reduced.

[0032] S3: Secure data packets are verified using the blockchain. If the verification passes, the transmission is successful; otherwise, a security mechanism is triggered.

[0033] As a preferred embodiment, the security verification of the secure data packet via blockchain includes: The blockchain nodes broadcast the received security data packets to the power system nodes. The power system nodes perform the first security verification on the security data packets. If the first security verification passes, the security data packets are packaged with the consensus proof generated during the first security verification to obtain a new block, and the new blockchain is connected to the blockchain. When a new block that meets preset conditions is detected in the blockchain, the private key of the scheduling center is obtained, and a second security verification is performed on the secure data packet based on the private key of the scheduling center.

[0034] In this embodiment, the power system nodes include power plant nodes, substation nodes, and dispatch center nodes. When a new block linked to the blockchain contains the identifier of the data-sending device, it indicates that the new block meets preset conditions. The security mechanism specifically includes freezing device communication permissions and initiating a data tracing procedure.

[0035] In a preferred embodiment, the power system node performs a first security verification on the security data packet, including: Power system nodes verify the time validity of data security packets using the registered device public key; Power system nodes initiate a query operation to the whitelist smart contract deployed on the blockchain using the device identification code in the security data packet, and verify the legitimacy of the data security packet's source through the query operation result; Parse secure data packets to obtain zero-knowledge proofs, and verify the key reliability of secure data packets based on zero-knowledge proofs.

[0036] In this embodiment, the power system node verifies the dynamic permission token attached to the security data packet. This token is generated into a digital signature using the SM2 algorithm through the device's local hardware security chip. The power system node uses the device's public key registered in the permission chain formed by the power system nodes to verify the validity of the digital signature, confirming that the data security packet was generated by a legitimate device within the authorized time period, and thus verifying the time validity of the data security packet.

[0037] The whitelist smart contracts are managed uniformly by the registration process within the power blockchain system. Before their first onboarding, newly connected power terminal devices must submit their device identifier and a registration certificate generated by their SRAMPUF module. This registration certificate consists of a composite entropy source. After submitting the registration request, comprised of the device identifier and registration certificate, to the core consensus node in the permissioned blockchain, the registration request must be reviewed and signed by at least three power system nodes with consensus weights. The signing process employs a BLS aggregate signature mechanism, where each node first checks for identical messages. Generate signatures independently. Indicates the same message, Indicates the device identification code. The composite entropy source is represented, and then the independently generated signatures are merged into an aggregate signature through a bilinear curve mapping. , This represents the i-th independent signature. Indicates aggregate signature, This represents a multiplication operation. Once the aggregate signature is formed, any power system node can quickly verify it using the corresponding public key set, without needing to verify each signature separately, thus improving verification efficiency. Once the aggregate signature verification is successful, consensus proof is obtained. Simultaneously, the whitelist smart contract automatically calls the write logic to store the corresponding device identifier and its composite entropy source on the chain, granting the power terminal device legitimate communication and data reporting permissions, serving as a reference for data security packet verification. This allows power system nodes to initiate a query operation to the whitelist smart contract deployed on the chain based on the device identifier contained in the security data packet, thereby verifying the legitimacy of the data security packet's source, i.e., whether the current device has completed registration and authorization. This prevents counterfeit devices or illegal terminals from participating in the consensus process, ensuring the authenticity of the device identity chain, the uniqueness of the key source, and the traceability of the access process throughout the system.

[0038] Verifying the key reliability of secure data packets based on zero-knowledge proofs includes: verifying the zero-knowledge proof using the BLS-12-381 curve pairing algorithm, thereby verifying the key reliability of the secure data packets. Understandably, verifying the key reliability of secure data packets using the BLS-12-381 curve pairing algorithm ensures the uniqueness, high entropy, and traceability of the symmetric session key, and also guarantees the integrity of the key path and the system's anti-forgery capability, thus improving the security of data transmission. In this embodiment, the first security verification is considered successful when the time validity of the secure data packet, the legality of the secure data packet's source, and the key reliability of the secure data packet all pass.

[0039] As a preferred embodiment, the second security verification of the secure data packet based on the scheduling center's private key includes: The security data packet is decrypted using the private key of the scheduling center to obtain the decryption result. The decryption result is then compared with the evidence stored on the blockchain to obtain the hash comparison result, which is then used for a second security verification of the security data packet.

[0040] In this embodiment, the decryption result is obtained by decrypting the security data packet using the private key of the scheduling center, and the hash comparison result is obtained by hash comparison with the evidence storage data on the blockchain. This includes: decrypting the key ciphertext in the security data packet using the private key of the scheduling center to restore the second key fragment, performing an XOR operation with the first key fragment stored in the device hardware security module to reconstruct the symmetric session key, then decrypting the ciphertext data body using the reconstructed symmetric session key to obtain the decryption result, i.e., the original data, obtaining the hash value corresponding to the original data, and comparing the hash value with the evidence storage data on the blockchain to obtain the hash comparison result.

[0041] As a preferred embodiment, it further includes: when the hash comparison result is greater than a preset deviation, it indicates that the security verification has failed, or when the first security verification has failed, it indicates that the security verification has failed.

[0042] In this embodiment, the hash comparison result , This represents the hash value corresponding to the original data. This indicates that the data stored on the blockchain has a preset deviation of 20%.

[0043] Example 2: This example also provides a blockchain-based secure data transmission system for power communication networks, applicable to the aforementioned blockchain-based secure data transmission method for power communication networks, including: The composite entropy source acquisition module is used to acquire the random metastable signal of the initial state of the SRAM cell, and to acquire the composite entropy source based on the random metastable signal and the device identification code. The secure data packet acquisition module is used to dynamically acquire temporary random numbers based on timestamps, use the temporary random numbers and composite entropy sources as inputs to the key derivation function to obtain the symmetric session key, and encrypt and split the symmetric session key to obtain secure data packets. The security verification module is used to perform security verification on secure data packets via blockchain, and to trigger a security mechanism if the security verification fails.

[0044] In this embodiment, obtaining the composite entropy source based on the random metastable signal and the device identifier code includes: The physical entropy source is obtained through a random metastable signal, concatenated with the device identifier, and a composite entropy source is obtained through a first hash function. Because the initial state of SRAM is affected by microscopic random disturbances in the manufacturing process, the PUF response difference rate of different chips on the same wafer is greater than 99.97%. Therefore, during each power-on startup of the device, the SRAMPUF module deployed within the hardware security module utilizes a random metastable signal characterizing the natural differences in the metastable state of the SRAM cells inside the chip at the moment of power-on to generate a unique and uncopyable 256-bit physical entropy source. The device identifier consists of four segments: "regional code + substation ID + device type code + physical port number". In this embodiment, the expression for concatenating the physical entropy source with the device identifier and obtaining the composite entropy source through the first hash function is as follows: ,in, Represents a composite entropy source. This refers to the SHA-3 hash function. Indicates the device identification code. Represents the source of physical entropy. This indicates a bit string concatenation operation. The process is executed in a physically isolated secure environment within the hardware security module. The generated physical entropy source is irreversible; even if an attacker obtains the composite entropy source, they cannot reconstruct the original physical entropy source and device identifier from it. This effectively defends against reverse engineering and replay attacks. Furthermore, the device identifier serves as a binding factor, enhancing the individualization of the entropy source and further improving the system's collision and tamper resistance during key generation.

[0045] In this embodiment, the second hash function and the key expansion algorithm constitute the key derivation function, which dynamically updates the temporary random number with millisecond-level precision. The temporary random number and the composite entropy source are used as inputs to the key derivation function to obtain the symmetric session key, thus ensuring the uniqueness of multiple symmetric session keys generated consecutively on the same device.

[0046] Example 3: This example also provides a computer device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the steps of the blockchain-based power communication network security data transmission method.

[0047] The substantial effects of this invention: By obtaining a composite entropy source through a random metastable signal characterizing the natural differences in the metastable state of an SRAM cell at power-on and the device identifier, and using a temporary random number and the composite entropy source as inputs to a key derivation function to obtain a symmetric session key, the entropy value of the symmetric session key is improved. Furthermore, the correlation between device keys is blocked, ensuring the uniqueness and tamper resistance of the symmetric session key and preventing computational attacks. By obtaining and verifying unpredictable secure data packets, the complexity of security verification via blockchain is reduced, data transmission efficiency is improved, and the technical problem of improving data transmission security and efficiency in existing technologies is overcome. By acquiring secure data packets that are difficult to predict, and combining this with the decentralized, immutable, and traceable characteristics of blockchain, dual security is provided for data transmission, significantly improving the security of data transmission. Since zero-knowledge proofs establish a mapping relationship between symmetric session keys and entropy sources using the BLS-12-381 curve pairing algorithm, the verifier only needs to use public parameters and public curve pairing functions to complete the verification without accessing the actual symmetric session key. Therefore, verifying the key reliability of secure data packets through zero-knowledge proofs ensures the integrity of the symmetric session key path and the system's anti-forgery capability. At the same time, it ensures that the encryption key in each communication session comes from a high-entropy, unique, and legitimate hardware entropy source, further improving the security of data transmission. When it is determined that the current symmetric session key has been cracked or the data integrity has been tampered with, a security mechanism is triggered. The scheduling center immediately freezes the communication permissions of the relevant terminal device, modifies its communication status identifier to "blocked" through the on-chain permission control smart contract, and simultaneously initiates a data tracing program to perform a full-chain backtracking analysis of all data blocks submitted by the device in the recent period. By comparing each temporary random number, key fragment, and evidence record, potential abnormal behavior paths are identified, thereby locating the specific source node of the symmetric session key leakage or forgery. This forms a closed-loop security control mechanism, enabling the system to quickly isolate and accurately locate high-risk security events.

[0048] The specific embodiments described above are preferred embodiments of the blockchain-based power communication network security data transmission method and system of the present invention, and are not intended to limit the specific scope of the present invention. The scope of the present invention includes but is not limited to the specific embodiments described above. All equivalent changes made in accordance with the shape and structure of the present invention are within the protection scope of the present invention.

Claims

1. A blockchain-based secure data transmission method for power communication networks, characterized in that, Includes the following steps: Obtain the random metastable signal of the initial state of the SRAM cell, and obtain the composite entropy source based on the random metastable signal and the device identifier code; Temporary random numbers are dynamically obtained based on timestamps. The temporary random numbers and composite entropy sources are used as inputs to the key derivation function to obtain a symmetric session key. The symmetric session key is then encrypted and split to obtain a secure data packet. The blockchain is used to verify the security of data packets. If the security verification passes, the transmission is successful; otherwise, the security mechanism is triggered. 2.The blockchain-based secure data transmission method for power communication network according to claim 1, wherein, The method for obtaining the composite entropy source based on random metastable signals and device identifiers includes: The physical entropy source is obtained by using a random metastable signal, the physical entropy source is connected with the device identifier, and the composite entropy source is obtained by using a first hash function. 3.The blockchain-based secure data transmission method for power communication network according to claim 1, wherein, The step of obtaining the symmetric session key by using a temporary random number and a composite entropy source as inputs to a key derivation function includes: Preprocess the composite entropy source to obtain the adaptation key; The inner key is obtained by bitwise XORing the adaptation key with the inner padding constant in the second hash function. The temporary random number is then appended to the inner key to obtain the first data block, and the inner hash value is obtained in turn. The outer key is obtained by bitwise XORing the adaptation key with the outer padding constant in the second hash function. The inner hash value is then appended to the outer key to obtain the second data block, and thus the intermediate seed is obtained. The intermediate seed is input into the key expansion algorithm to obtain the symmetric session key; The second hash function and the key expansion algorithm together constitute the key derivation function.

4. The blockchain-based secure data transmission method for power communication networks according to claim 1, characterized in that, The step of encrypting and splitting the symmetric session key to obtain secure data packets includes: Based on the symmetric session key, the original data is encrypted using the first encryption algorithm to generate the ciphertext data body; Obtain the public key of the scheduling center, and based on the public key of the scheduling center, use the second encryption algorithm to encrypt the symmetric session key to generate the key ciphertext; The symmetric encryption key is split into complementary key fragments, and the key fragments, key data body and key ciphertext are combined to obtain a secure data packet.

5. The blockchain-based secure data transmission method for power communication networks according to claim 1, characterized in that, The security verification of secure data packets via blockchain includes: The blockchain nodes broadcast the received security data packets to the power system nodes. The power system nodes perform the first security verification on the security data packets. If the first security verification passes, the security data packets are packaged with the consensus proof generated during the first security verification to obtain a new block, and the new blockchain is connected to the blockchain. When a new block that meets preset conditions is detected in the blockchain, the private key of the scheduling center is obtained, and a second security verification is performed on the secure data packet based on the private key of the scheduling center.

6. The blockchain-based secure data transmission method for power communication networks according to claim 5, characterized in that, The power system node performs a first security verification on the security data packet, including: Power system nodes verify the time validity of data security packets using the registered device public key; Power system nodes initiate a query operation to the whitelist smart contract deployed on the blockchain using the device identification code in the security data packet, and verify the legitimacy of the data security packet's source through the query operation result; Parse secure data packets to obtain zero-knowledge proofs, and verify the key reliability of secure data packets based on zero-knowledge proofs.

7. The blockchain-based secure data transmission method for power communication networks according to claim 5, characterized in that, The second security verification of the secure data packet based on the scheduling center's private key includes: The security data packet is decrypted using the private key of the scheduling center to obtain the decryption result. The decryption result is then compared with the evidence stored on the blockchain to obtain the hash comparison result, which is then used for a second security verification of the security data packet.

8. The blockchain-based secure data transmission method for power communication networks according to claim 7, characterized in that, Also includes: When the hash comparison result is greater than the preset deviation, it indicates that the security verification has failed, or when the first security verification has failed, it indicates that the security verification has failed.

9. A blockchain-based secure data transmission system for power communication networks, applicable to the blockchain-based secure data transmission method for power communication networks as described in any one of claims 1-8, characterized in that, include: The composite entropy source acquisition module is used to acquire the random metastable signal of the initial state of the SRAM cell, and to acquire the composite entropy source based on the random metastable signal and the device identification code. The secure data packet acquisition module is used to dynamically acquire temporary random numbers based on timestamps, use the temporary random numbers and composite entropy sources as inputs to the key derivation function to obtain the symmetric session key, and encrypt and split the symmetric session key to obtain secure data packets. The security verification module is used to perform security verification on secure data packets via blockchain, and to trigger a security mechanism if the security verification fails.

10. A computer device, characterized in that: include: The computer device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the steps of the blockchain-based power communication network security data transmission method as described in any one of claims 1-8.

Images