An off-line sub-certificate issuing system and method for authorized time-limited sub-certificates in a substation

Abstract

The application belongs to the technical field of secure communication, and discloses an offline sub-certificate issuing system and method with authorized time limit in a substation, which comprises a root authorization center and a sub-issuing node in the substation; the root authorization center comprises an authorization token generation module, and when a substation secondary device requests sub-certificate issuing, the root authorization center calls the authorization token generation module to generate an authorization token and off-line issues the authorization token to the sub-issuing node in the substation; the sub-issuing node in the substation comprises an identity binding verification module and a chain issuing log system, and when a substation secondary device requests sub-certificate issuing, the sub-issuing node in the substation calls the identity binding verification module to perform identity binding verification on a certificate signature request issued by the substation secondary device, and after the verification, the sub-issuing node in the substation issues a time-limited sub-certificate to the substation secondary device according to the authorization token and enters the issuing information into the chain issuing log system. The application realizes an authorized time-limited sub-certificate issuing mechanism and closed-loop management of the whole life cycle of a digital certificate.

Description

Technical Field

[0001] This invention belongs to the field of secure communication technology, and in particular relates to an authorized time-limited sub-certificate issuance system and method in offline substations. Background Technology

[0002] As a core component of the power system, the information security of secondary equipment in substations directly affects the stable operation of industrial control networks. Digital certificates are the core security carrier for achieving relay equipment authentication and encrypted data transmission. Current certificate management for substation secondary equipment generally relies on traditional PKI systems, which have significant adaptability defects in the physically isolated offline operating environment of substations: First, the issuance permission control is crude, failing to finely restrict the time, quantity, and device type of certificate issuance, easily leading to unrestricted and unauthorized issuance; second, there is a lack of strong correlation between device identity and certificate, failing to utilize the unique device identity code for full-process binding, resulting in frequent security attacks such as certificate duplication, private key cloning, and cross-device impersonation; third, the traceability of issuance behavior is poor, lacking a standardized, tamper-proof log system, making it difficult to conduct security audits and risk assessments in offline scenarios.

[0003] The aforementioned problems are further amplified in the context of relay equipment certificate management, which not only reduces the security and standardization of certificate management, but also poses a serious threat to the information security of substation industrial control networks. The traditional PKI system can no longer meet the needs of offline substations for refined, secure, and full lifecycle management of relay equipment digital certificates. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide an authorized time-limited sub-certificate issuance system and method in an offline substation, so as to realize the secure and controllable issuance, full life cycle management and auditable traceability of relay equipment certificates, effectively prevent attacks such as certificate copying and private key cloning, and improve the security and refinement of the substation relay equipment certificate management process.

[0005] To achieve the above-mentioned technical objectives, the present invention is implemented using the following solution: This invention provides an authorized time-limited sub-certificate issuance system for offline substations, including a root authorization center and sub-issuance nodes within the substation; The root authorization center includes an authorization token generation module. When a substation secondary device requests the issuance of a subcertificate, the root authorization center calls the authorization token generation module to generate an authorization token and distributes the authorization token offline to the sub-issuance node within the station. The sub-issuance node within the station includes an identity binding verification module and a chain-style issuance log system. When a secondary device in the substation requests the issuance of a sub-certificate, the sub-issuance node within the station calls the identity binding verification module to perform identity binding verification on the certificate signature request issued by the secondary device in the substation. After the verification is passed, the sub-issuance node issues a time-limited sub-certificate to the secondary device in the substation based on the authorization token and records the issuance information into the chain-style issuance log system.

[0006] Furthermore, the authorization token includes an authorization number, a valid time window, a maximum number of tokens that can be issued, a set of allowed device types for issuance, a maximum sub-certificate validity period, and a root authorization center digital signature. The root authorization digital signature uses the root private key to perform a joint digital signature on the authorization number, valid time window, maximum number of tokens that can be issued, a set of allowed device types for issuance, and a maximum sub-certificate validity period.

[0007] Furthermore, the sub-issuance node within the station includes an authorization token verification module and a local authorization token library. After receiving the authorization token, the sub-issuance node within the station uses the root public key to verify the root authorization digital signature. Authorization tokens that pass verification are stored in the local authorization token library, while exception information generated by verification failure is recorded in the chain-style issuance log system.

[0008] Furthermore, the root authorization center includes a global device identity information database, and the sub-signing nodes within the station include a local device identity information database. The data in the global device identity information database and the local device identity information database are encrypted and synchronized. The data in both the global device identity information database and the local device identity information database include the unique identification code of the substation secondary equipment, the equipment type, the equipment deployment information, and the initial public key information of the equipment.

[0009] Furthermore, the certificate signing request includes standard fields, extended fields, and a device digital signature. The standard fields include the device name, deployment information, and device type. The extended fields include the SM3 hash value that uniquely encodes the device identity. The device digital signature is completed using the device's private key.

[0010] Furthermore, the sub-issuance nodes within the site include a local sub-certificate repository, and the root authorization center includes a global certificate audit repository. Data from the local sub-certificate repository and the chained issuance log system is periodically uploaded offline to the root authorization center. After the uploaded data passes hash verification, it is synchronized to the global certificate audit repository.

[0011] This application also provides a method for issuing authorized time-limited subcertificates in offline substations, applied to the aforementioned system for issuing authorized time-limited subcertificates in offline substations, including: When a substation secondary device requests the issuance of a sub-certificate, an authorization token is generated by the root authorization center and issued offline to the sub-issuance node within the station. The system performs identity binding verification on certificate signing requests issued by secondary equipment in the substation through sub-signing nodes. After the verification is successful, it issues time-limited sub-certificates to the secondary equipment in the substation based on the authorization token and records the signing information into the chain-type signing log system.

[0012] Furthermore, the identity binding verification is performed on the certificate signature requests issued by the substation secondary equipment, including: Device identity uniqueness code binding verification: Match the SM3 hash value of the device identity uniqueness code with the data in the local device identity information database to verify whether the device belongs to the set of device types allowed to be issued in the authorization token and whether the device has any historical abnormal issuance records; Public key and identity joint verification: The joint hash digest calculated by combining the device public key with the device identity uniqueness code is compared with the joint hash digest of the device public key combined with the device identity uniqueness code in the local device identity information database to determine whether the device public key has been tampered with or the device identity has been impersonated. Issuance count and identity binding verification: Verify whether the number of authorized tokens issued has reached the maximum number of issuances, and if the maximum number of issuances has not been reached, record the current issuance count value and the hash value of the previous log block in the chained log block of the chained issuance log system based on the device's unique identity encoding; Certificate content binding verification: Verify the existence of the sub-certificate serial number generated by combining the authorization token with the device identity uniqueness code and hash in the local sub-certificate library.

[0013] Furthermore, after successful verification, a time-limited sub-certificate is issued to the substation secondary equipment based on the authorization token, and the issuance information is recorded in the chain-based issuance log system, including: The sub-certificate is generated by using the issuing private key and the pre-generated sub-certificate serial number in accordance with the power industry digital certificate standard through the sub-issuance node in the station. The device identity uniqueness code, authorization token number, actual certificate validity period and issuance time are embedded in the sub-certificate. After the subcertificate is issued, the issued count of the authorization token is updated through the sub-issuance node in the site. The full amount of issued information is written to the chain log block. The log block is encrypted with SM3 hash and then uploaded to the chain. The subcertificate information is stored in the local subcertificate store and the certificate status is marked as issued.

[0014] Furthermore, it also includes: If the system time exceeds the valid time window of the authorization token or the number of tokens issued reaches the maximum number of tokens that can be issued, the issuance function of the sub-issuing nodes within the station will be locked. Once the issued subcertificate reaches the validity period set in the certificate, it will automatically expire. The certificate status will be updated to expired in the local subcertificate database through the sub-issuance node within the site, and the expiration time will be recorded. Search for information on the entire certificate issuance process by using the device's unique identification code, certificate serial number, or authorization token number. If, during the audit process, certificate forgery, identity theft, unauthorized issuance, or equipment replacement or network security incidents occur at the substation, the root authorization center generates and issues a token cancellation instruction to the sub-issuing nodes within the station. The sub-issuing nodes within the station then cancel the corresponding authorization token, stop issuing cancellation authorization tokens, and cancel any abnormal sub-certificates that have already been issued. Beneficial effects

[0015] This invention is highly adaptable to offline operating environments: it does not rely on external PKI systems and achieves secure and controllable certificate issuance under completely offline conditions with physical isolation in substations, which meets the deployment and operation requirements of power systems on site.

[0016] This invention provides refined control over certificate issuance permissions: by using authorization tokens, it achieves precise triple control over the time window, number of certificates issued, and device type, thereby preventing unrestricted and unauthorized issuance from the source and improving the refinement of permission management.

[0017] This invention features end-to-end device identity strong binding: embedding the device identity uniqueness code into the entire process of certificate request, generation, verification, and logging, achieving a strong four-fold association between the device and the certificate request, the certificate itself, the public key, and the issuance log, ensuring that each relay device corresponds to only one unique digital certificate.

[0018] This invention effectively prevents various security attacks: it constructs a protection system from multiple dimensions such as certificate generation, public key verification, and log recording, which can effectively resist common security attacks such as certificate copying, private key cloning, and cross-device impersonation, and greatly improve the security of certificate management.

[0019] This invention enables auditable and traceable signing behavior throughout the entire process: the chain-hash structure of the signing log is immutable, providing complete and authentic evidence for offline auditing, and can quickly locate the entire process information of each certificate signing behavior, facilitating security risk investigation and handling.

[0020] This invention enables full lifecycle management of certificates: covering the entire process of certificate issuance, validity period control, automatic expiration, and renewal / new issuance, forming a closed-loop management system for digital certificates of relay equipment, and adapting to the long-term and dynamic equipment certificate management needs of substations.

[0021] This invention offers high deployment flexibility: the sub-signing nodes within the station can be flexibly deployed as independent servers or integrated into existing station control layer equipment, without requiring large-scale modifications to the existing hardware facilities of the substation, thus reducing implementation costs and deployment difficulty. Attached Figure Description

[0022] Figure 1This is a schematic diagram of the architecture of an authorized time-limited sub-certificate issuance system in an offline substation provided by an embodiment of the present invention; Figure 2 This is a flowchart illustrating a method for issuing authorized time-limited sub-certificates in an offline substation, as provided in an embodiment of the present invention. Figure 3 This is a schematic diagram illustrating the implementation process of the four-fold strong identity binding mechanism in an authorized time-limited subcertificate issuance method within an offline substation, as provided in an embodiment of the present invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention. Example 1

[0024] like Figure 1 As shown, an authorized time-limited sub-certificate issuance system for offline substations has the following overall architecture: The root authorization center is deployed in the security control area of ​​the dispatch master station. It is configured with root key pairs, root certificate management modules, authorization token generation modules, and a global audit module, possessing the highest authorization authority and responsible for overall authorization policy formulation and security control. Sub-issuance nodes are deployed locally within the substation. They can be flexibly deployed as independent encryption servers or integrated into the logical function modules of existing substation control layer equipment. They are only configured with sub-certificate issuance execution modules, local device information databases, log storage modules, and authorization token verification modules, lacking root key operation authority and serving only as the actual certificate issuance execution end. Encrypted communication debugging between the two is completed to ensure physical isolation of the link and encrypted data transmission.

[0025] The root authorization center uniformly collects basic data such as the unique identification code (the hardware unique identifier fixed by the equipment at the factory), equipment type (such as protection device, measurement and control device, merging unit, smart terminal, etc.), equipment deployment information, and initial public key information of all secondary equipment in the substation, and establishes an encrypted global equipment identity information database. At the same time, the above information is synchronized to the sub-signature node in the station through a physical security medium to establish a local equipment identity information database. The hash verification of the data in the two databases is consistent, providing a basis for subsequent identity binding.

[0026] A chained issuance log system is deployed on the sub-issuance nodes within the station. The log block structure is initialized, and each log block contains core fields such as the device's unique identity code, authorization token number, issuance count value, previous log hash value, public key joint verification result, issuance time, and certificate serial number. After the log is generated, it is linked by a hash chain to ensure immutability. At the same time, a local sub-certificate library is initialized, and certificate status indicators (pending issuance, issued, expired, and invalidated) are configured. The root authorization center synchronously initializes the global certificate audit library, which supports offline import of station logs and certificate data.

[0027] The root authorization center generates a unique authorization token based on the actual certificate issuance needs of the substation (such as adding equipment, renewing certificates, and expanding equipment types). The token contains six core elements: authorization number, valid time window, maximum number of certificates issued, set of allowed equipment types, maximum subcertificate validity period, and root authorization center digital signature. The configuration of each element follows these rules: Authorization Number: The authorization number adopts a combination of "root center code + substation code + timestamp + random code" as the token identity identifier; Valid time window: Sets the start and end time for the sub-issuing node to perform issuance operations, adapting to the substation on-site work plan. Tokens will automatically expire if the time window is exceeded. Maximum number of certificates issued: Sets the maximum number of subcertificates that this token can issue. It supports configuring the number threshold separately for each device type. Allowed equipment type set: Based on the substation equipment management requirements, the types of equipment for which certificates can be issued are limited, and certificates will be rejected for equipment not included in the set. Maximum Subcertificate Validity Period: Sets the maximum validity period for the subcertificate issued this time. The validity period of all subcertificates shall not exceed this threshold. Root Authority Digital Signature: The root authority uses the root private key to perform a joint digital signature on all elements of the token, preventing the token from being tampered with or forged.

[0028] For devices within a substation that require digital certificates, the generation of public / private key pairs and the creation of Certificate Signature Requests (CSRs) are completed independently locally. The device's private key is stored only in the device's local encrypted area. The specific steps are as follows: The device generates an asymmetric public / private key pair using a national cryptographic algorithm. The private key is stored in the device's hardware encryption module, and the public key is used for certificate application and communication encryption. The device generates a Certificate Signature Request (CSR) in a standard format, filling in basic information such as device name, deployment information, and device type in the standard fields of the CSR. The SM3 hash value of the device's unique identity code is written in the extended fields of the CSR to ensure a strong association between the device's identity and the CSR. The device digitally signs the complete CSR using its own private key, completing the CSR generation. The device submits the signed CSR offline to the substation's sub-certificate issuance node through the substation's local network to apply for sub-certificate issuance. Example 2

[0029] This embodiment provides a method for issuing authorized time-limited subcertificates in an offline substation, applied to the offline authorized time-limited subcertificate issuance system described in Embodiment 1. It is applicable to substations of all voltage levels and targets offline management of digital certificates for substation relay equipment such as relay protection devices, measurement and control devices, and merging units. The execution entities are the root authorization center and the substation sub-issuance nodes. It achieves controllable subcertificate issuance without external network dependence and full-process auditability and traceability, without requiring large-scale modifications to the existing substation hardware. The hash algorithm used in this embodiment is SM3, the digital signature algorithm is SM2, the authorization token is stored in encrypted format, and the encryption algorithm is SM4, conforming to the requirements of power system information security specifications.

[0030] Specifically, such as Figure 2 As shown, the process for issuing authorized time-limited subcertificates within the offline substation is as follows: Step 1: Overall Architecture Deployment and Initialization 1. Deployment of a two-tier hierarchical authorization architecture The root authorization center is deployed in the security control area of ​​the dispatch master station. It is configured with root key pairs, root certificate management modules, authorization token generation modules, and a global audit module, possessing the highest authorization authority and responsible for overall authorization policy formulation and security control. Sub-issuance nodes are deployed locally within the substation. They can be flexibly deployed as independent encryption servers or integrated into the logical function modules of existing substation control layer equipment. They are only configured with sub-certificate issuance execution modules, local device information databases, log storage modules, and authorization token verification modules, lacking root key operation authority and serving only as the actual certificate issuance execution end. Encrypted communication debugging between the two is completed to ensure physical isolation of the link and encrypted data transmission.

[0031] 2. Initialize basic equipment information The root authorization center uniformly collects basic data such as the unique identification code (the hardware unique identifier fixed by the equipment at the factory), equipment type (such as protection device, measurement and control device, merging unit, smart terminal, etc.), equipment deployment information, and initial public key information of all secondary equipment in the substation, and establishes an encrypted global equipment identity information database. At the same time, the above information is synchronized to the sub-signature node in the station through a physical security medium to establish a local equipment identity information database. The hash verification of the data in the two databases is consistent, providing a basis for subsequent identity binding.

[0032] 3. Log and certificate store initialization A chained issuance log system is deployed on the sub-issuance nodes within the station. The log block structure is initialized, and each log block contains core fields such as the device's unique identity code, authorization token number, issuance count value, previous log hash value, public key joint verification result, issuance time, and certificate serial number. After the log is generated, it is linked by a hash chain to ensure immutability. At the same time, a local sub-certificate library is initialized, and certificate status indicators (pending issuance, issued, expired, and invalidated) are configured. The root authorization center synchronously initializes the global certificate audit library, which supports offline import of station logs and certificate data.

[0033] Step 2: Generation, Issuance, and Verification of Authorization Tokens The authorization token is the sole legal basis for certificate issuance by sub-signing nodes within the site. It is uniformly generated and encrypted by the root authorization center. Specific steps are as follows: 1. Customized generation of authorization tokens The root authorization center generates a unique authorization token based on the actual certificate issuance needs of the substation (such as adding equipment, renewing certificates, and expanding equipment types). The token contains six core elements: authorization number, valid time window, maximum number of certificates issued, set of allowed equipment types, maximum subcertificate validity period, and root authorization center digital signature. The configuration of each element follows these rules: Authorization Number: The authorization number adopts a combination of "root center code + substation code + timestamp + random code" as the token identity identifier; Valid time window: Sets the start and end time for the sub-issuing node to perform issuance operations, adapting to the substation on-site work plan. Tokens will automatically expire if the time window is exceeded. Maximum number of certificates issued: Sets the maximum number of subcertificates that this token can issue. It supports configuring the number threshold separately for each device type. Allowed equipment type set: Based on the substation equipment management requirements, the types of equipment for which certificates can be issued are limited, and certificates will be rejected for equipment not included in the set. Maximum Subcertificate Validity Period: Sets the maximum validity period for the subcertificate issued this time. The validity period of all subcertificates shall not exceed this threshold. Root Authority Digital Signature: The root authority uses the root private key to perform a joint digital signature on all elements of the token, preventing the token from being tampered with or forged.

[0034] 2. Offline issuance of authorization tokens The root authorization center transmits the generated authorization token offline via a physical security medium, without any wide area network intervention. The transmission medium must be encrypted and bound with unique usage permissions, allowing only designated management personnel at the substation to read it. Management personnel then import the authorization token into the substation's sub-signing node locally.

[0035] 3. Token local validity verification After receiving the authorization token, the sub-issuing node within the site immediately initiates the verification process: First, it uses the root public key to verify the digital signature of the root authorization center, verifying the integrity and legality of the token; if the signature verification fails, it directly rejects the token and records the abnormal information (including the token content, import time, and reason for verification failure) to the chain log; if the verification passes, it stores the token information in the local authorization token library, marks the token status as pending activation, and initializes the issued count of the token.

[0036] Step 3: Generating and Submitting Certificate Signing Request For devices within a substation that require digital certificates, the generation of public / private key pairs and the creation of Certificate Signature Requests (CSRs) are completed independently locally. The device's private key is stored only in the device's local encrypted area. The specific steps are as follows: The device generates an asymmetric public / private key pair using a national cryptographic algorithm. The private key is stored in the device's hardware encryption module, and the public key is used for certificate application and communication encryption. The device generates a Certificate Signature Request (CSR) in a standard format, filling in basic information such as device name, deployment information, and device type in the standard fields of the CSR. The SM3 hash value of the device's unique identity code is written in the extended fields of the CSR to ensure a strong association between the device's identity and the CSR. The device digitally signs the complete CSR using its own private key, completing the CSR generation. The device submits the signed CSR offline to the substation's sub-certificate issuance node through the substation's local network to apply for sub-certificate issuance.

[0037] Step 4: Four-fold identity binding and full-dimensional verification After receiving the device's CSR, the sub-signing node within the station initiates a four-fold strong identity binding mechanism for full-dimensional verification. The signing operation can only be executed after all verification items pass; if any verification item fails, the signing is directly rejected, and the reason for failure, device identity information, and verification time are recorded in the chained signing log. Figure 3 The specific verification steps are shown below: (a) Device uniqueness code binding verification Extract the device identity uniqueness code / its SM3 hash value from the CSR extended field and accurately match it with the data in the local device identity information database; Verify whether the device belongs to the set of device types that are allowed to be issued in the current authorization token; Verify whether the device has any historical abnormal issuance records (such as duplicate issuance, illegal issuance, certificate invalidation, etc.); If the encoding fails to match, the device type is incompatible, or there are historical anomalies, the CSR is rejected directly; if the match is successful and the device status is normal, proceed to the next verification step.

[0038] (ii) Joint verification of public key and identity Extract the device public key from the CSR, combine it with the device's unique identity code, and use the SM3 algorithm to calculate the joint hash digest of the two. The calculated joint digest is compared with the joint digest of the device's public key and identity pre-stored in the local device identity information database; If the combined digest does not match, it is determined that the public key has been tampered with and the device identity has been impersonated, and the CSR is rejected; if the comparison matches, the legitimate binding relationship between the device's public key and identity is confirmed, and the next step of verification is carried out.

[0039] (III) Issuance Counting and Identity Binding Pre-verification Read the current authorized token issuance count and maximum issuance quantity, and check whether the quantity limit has been reached. If the threshold is configured according to device type, then check the issuance quantity of the corresponding device type separately. If the quantity limit has been reached, the CSR is rejected directly and the authorization token is marked as expired; if the limit has not been reached, the chained log block for this issuance is initialized based on the device's unique identity encoding, recording the current issuance count value and the hash value of the previous log block, completing the pre-binding of the device and the issuance log, and proceeding to the next verification step.

[0040] (iv) Certificate content binding pre-verification Extract the authorization number and device identity uniqueness code of the current authorization token, perform joint hashing using the SM3 algorithm, and generate a subcertificate serial number / extended field base value. This value is the unique identifier for this subcertificate issuance. Verify that the base value already exists in the local subcertificate store to ensure that each device corresponds to only one subcertificate; If the base value already exists, it is determined that the device has applied for a certificate repeatedly, and the CSR is rejected; if it does not exist, the pre-binding of the certificate content and the device identity is completed, and all four strong identity binding verifications pass.

[0041] Step 5: Authorize the issuance and dynamic management of time-limited sub-certificates. After all four identity verifications are passed, the sub-certificate issuance node within the site executes the sub-certificate issuance operation and monitors the issuance status in real time, achieving dynamic control over time, quantity, and validity period. Specific steps are as follows: 1. Standardized generation of subcertificates The sub-issuance node within the station uses its own sub-issuance private key, combined with the pre-generated sub-certificate serial number / extended field base value, to generate a relay equipment sub-certificate according to the power industry digital certificate standard; the certificate embeds core information such as the device's unique identity code, authorization token number, actual certificate validity period, and issuance time to ensure a strong association between the certificate information and the device and authorization token.

[0042] 2. Issuance information is instantly uploaded to the blockchain. After the sub-certificate is issued, the sub-issuing node within the site immediately updates the issued count of the current authorization token, writes all the information of this issuance (device identity uniqueness code, certificate serial number, public key joint verification result, authorization token number, issuance time, certificate validity period) into the initialized chained log block, and completes the on-chain encryption of the log block after SM3 hash encryption to ensure that the log is tamper-proof; at the same time, the sub-certificate information is stored in the local sub-certificate store, and the certificate status is marked as issued.

[0043] 3. Sub-certificate issuance and equipment deployment The sub-issuing node within the station pushes the generated sub-certificate to the requesting device through the substation's local network. After receiving the certificate, the device verifies its legitimacy (verifying the consistency between the sub-issuing node's signature and the device's identity information). Once the verification is successful, the device pairs the sub-certificate with its own private key and stores it in the local encryption module, completing the certificate deployment. The device can then use this certificate to achieve identity authentication and encrypted communication.

[0044] 4. Automatic failure and quantity capping control The sub-issuance nodes within the station monitor the status of authorization tokens and certificate validity periods in real time, achieving dual dynamic control: if the current system time exceeds the validity period window of the authorization token, or if the number of issued certificates reaches the maximum number of certificates set for the token (including separate thresholds for device types), the issuance function of the sub-issuance nodes is automatically locked, all certificate issuance operations are stopped, and the token termination time and reason are recorded in the chain log, marking the token status as expired; once the issued sub-certificates reach the validity period set in the certificate, they automatically expire, and the sub-issuance nodes within the station update the certificate status to expired in the local sub-certificate library and record the expiration time; the device locally synchronously detects the certificate validity period, and automatically stops using the certificate after it expires, requiring a new application for issuance.

[0045] Step Six: Offline Auditing and Security Risk Management Based on an immutable chained issuance log, the entire process of substation subcertificate issuance is audited offline and quickly traced, and emergency security control is supported in abnormal situations. Specific steps are as follows: 1. Local offline auditing and traceability Substation managers can quickly query the entire certificate issuance process information, including issuance time, authorization basis, public key verification result, log hash value, certificate validity period, etc., at the sub-issuance node within the station based on any search criteria such as the device's unique identity code, certificate serial number, and authorization token number. They can also perform batch audits on issuance activities for specified time periods and device types to check for issues such as unauthorized issuance, excessive issuance, and overdue issuance.

[0046] 2. Global auditing and data synchronization Substation managers regularly export the chain logs and certificate repository data of the substation's sub-issuing nodes through a physical security medium and upload them offline to the root authorization center. The root authorization center performs hash verification on the imported data, and after confirming that the data has not been tampered with, it synchronizes it to the global certificate audit repository to achieve global unified audit of the certificate issuance behavior of each substation.

[0047] 3. Emergency Management of Abnormal Situations If security anomalies such as certificate forgery, identity impersonation, or unauthorized issuance are discovered during the audit process, or if special circumstances such as equipment replacement or network security incidents occur at the substation, the root authorization center can immediately generate a token invalidation command and send it offline to the sub-issuance node within the station via a physical security medium. Upon receiving the command, the sub-issuance node immediately invalidates the specified authorization token, marks the token status as invalid, and stops all issuance operations corresponding to that token. At the same time, it can also invalidate abnormal certificates that have already been issued, mark the certificate status as invalid, and automatically stop using the certificate after the device detects the certificate invalidation information locally, thus timely managing security risks.

[0048] Step 7: Reusing the Certificate Renewal and New Issuance Process When the certificates of relay equipment in the substation are about to expire and need to be renewed, or when new equipment needs to be added and a new certificate is required, the entire process of this implementation method can be reused directly: the root authorization center regenerates the authorization token according to the actual needs, and the sub-issuance nodes in the station perform the operation according to the steps of "token verification → CSR reception → four-fold identity binding verification → certificate issuance → log on chain". It only needs to update the latest status information of the equipment in the equipment identity information database, without redeploying the system architecture, which is suitable for the long-term and dynamic equipment certificate management needs of substations.

[0049] In summary, this invention is applicable to communication encryption scenarios for secondary equipment in substations without WAN access and with physical isolation. It constructs a two-tiered hierarchical authorization architecture with a root authorization center and sub-issuing nodes within the substation. An authorization token containing six core elements is designed to achieve precise control over the time, quantity, and device type of issuance permissions. A four-fold strong identity binding mechanism is established, consisting of a unique device identity code, certificate request, certificate itself, issuance log, and public key. Data security is ensured by combining national cryptographic algorithms such as SM3, SM2, and SM4. Simultaneously, an immutable chain-like issuance log system is built to achieve automatic certificate invalidation and quantity capping control, and supports offline auditing and emergency management of abnormal tokens / certificates. This invention does not rely on an external PKI system, achieving secure and controllable issuance of sub-certificates in a completely offline environment. It effectively prevents security attacks such as certificate duplication and private key cloning, completing closed-loop management of the entire lifecycle of digital certificates from issuance, validity period control, automatic invalidation to auditing and traceability. Furthermore, the deployment of sub-issuing nodes within the substation is flexible, requiring no large-scale modification of existing hardware, significantly improving the security, precision, and standardization of offline substation secondary equipment certificate management.

[0050] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An offline substation authorized time-limited subcertificate issuance system, characterized in that, This includes the root authorization center and sub-signing nodes within the site; The root authorization center includes an authorization token generation module. When a substation secondary device requests the issuance of a subcertificate, the root authorization center calls the authorization token generation module to generate an authorization token and distributes the authorization token offline to the sub-issuance node within the station. The sub-issuance node within the station includes an identity binding verification module and a chain-style issuance log system. When a secondary device in the substation requests the issuance of a sub-certificate, the sub-issuance node within the station calls the identity binding verification module to perform identity binding verification on the certificate signature request issued by the secondary device in the substation. After the verification is passed, the sub-issuance node issues a time-limited sub-certificate to the secondary device in the substation based on the authorization token and records the issuance information into the chain-style issuance log system.

2. The offline substation authorized time-limited subcertificate issuance system according to claim 1, characterized in that, The authorization token includes an authorization number, a valid time window, a maximum number of tokens that can be issued, a set of allowed device types for issuance, a maximum sub-certificate validity period, and a root authorization center digital signature. The root authorization digital signature uses the root private key to perform a joint digital signature on the authorization number, valid time window, maximum number of tokens that can be issued, and maximum sub-certificate validity period.

3. The offline substation authorized time-limited subcertificate issuance system according to claim 2, characterized in that, The sub-issuance node within the site includes an authorization token verification module and a local authorization token library. After receiving the authorization token, the sub-issuance node uses the root public key to verify the root authorization digital signature. Authorization tokens that pass verification are stored in the local authorization token library, while exception information generated by verification failure is recorded in the chain-style issuance log system.

4. The offline substation authorized time-limited subcertificate issuance system according to claim 1, characterized in that, The root authorization center includes a global device identity information database, and the sub-signing nodes within the station include a local device identity information database. The data in the global device identity information database and the local device identity information database are encrypted and synchronized. The data in both the global device identity information database and the local device identity information database includes the unique identification code of the substation secondary equipment, the equipment type, the equipment deployment information, and the initial public key information of the equipment.

5. The offline substation authorized time-limited subcertificate issuance system according to claim 1, characterized in that, The certificate signing request includes standard fields, extended fields, and a device digital signature. The standard fields include the device name, deployment information, and device type. The extended fields include the SM3 hash value that uniquely encodes the device identity. The device digital signature is completed using the device's private key.

6. The offline substation authorized time-limited subcertificate issuance system according to claim 1, characterized in that, The sub-issuance nodes within the site include local sub-certificate repositories, and the root authorization center includes a global certificate audit repository. Data from the local sub-certificate repository and the chained issuance log system is periodically uploaded offline to the root authorization center. After the uploaded data passes hash verification, it is synchronized to the global certificate audit repository.

7. A method for issuing authorized time-limited subcertificates in an offline substation, characterized in that, An authorized time-limited subcertificate issuance system for offline substations as described in any one of claims 1 to 6, comprising: When a substation secondary device requests the issuance of a sub-certificate, an authorization token is generated by the root authorization center and issued offline to the sub-issuance node within the station. The system performs identity binding verification on certificate signing requests issued by secondary equipment in the substation through sub-signing nodes. After the verification is successful, it issues time-limited sub-certificates to the secondary equipment in the substation based on the authorization token and records the signing information into the chain-type signing log system.

8. The method for issuing authorized time-limited subcertificates in an offline substation according to claim 7, characterized in that, The identity binding verification is performed on certificate signature requests issued by secondary equipment in the substation, including: Device identity uniqueness code binding verification: Match the SM3 hash value of the device identity uniqueness code with the data in the local device identity information database to verify whether the device belongs to the set of device types allowed to be issued in the authorization token and whether the device has any historical abnormal issuance records; Public key and identity joint verification: The joint hash digest calculated by combining the device public key with the device identity uniqueness code is compared with the joint hash digest of the device public key combined with the device identity uniqueness code in the local device identity information database to determine whether the device public key has been tampered with or the device identity has been impersonated. Issuance count and identity binding verification: Verify whether the number of authorized tokens issued has reached the maximum number of issuances, and if the maximum number of issuances has not been reached, record the current issuance count value and the hash value of the previous log block in the chained log block of the chained issuance log system based on the device's unique identity encoding; Certificate content binding verification: Verify the existence of the sub-certificate serial number generated by combining the authorization token with the device identity uniqueness code and hash in the local sub-certificate library.

9. The method for issuing authorized time-limited subcertificates in an offline substation according to claim 7, characterized in that, After successful verification, a time-limited sub-certificate is issued to the substation secondary equipment based on the authorization token, and the issuance information is recorded in the chain-based issuance log system, including: The sub-certificate is generated by using the issuing private key and the pre-generated sub-certificate serial number in accordance with the power industry digital certificate standard through the sub-issuance node in the station. The device identity uniqueness code, authorization token number, actual certificate validity period and issuance time are embedded in the sub-certificate. After the subcertificate is issued, the issued count of the authorization token is updated through the sub-issuance node in the site. The full amount of issued information is written to the chain log block. The log block is encrypted with SM3 hash and then uploaded to the chain. The subcertificate information is stored in the local subcertificate store and the certificate status is marked as issued.

10. The method for issuing authorized time-limited subcertificates in an offline substation according to claim 7, characterized in that, Also includes: If the system time exceeds the valid time window of the authorization token or the number of tokens issued reaches the maximum number of tokens that can be issued, the issuance function of the sub-issuing nodes within the station will be locked. Once the issued subcertificate reaches the validity period set in the certificate, it will automatically expire. The certificate status will be updated to expired in the local subcertificate database through the sub-issuance node within the site, and the expiration time will be recorded. Search for information on the entire certificate issuance process by using the device's unique identification code, certificate serial number, or authorization token number. If, during the audit process, certificate forgery, identity theft, unauthorized issuance, or equipment replacement or network security incidents occur at the substation, the root authorization center generates and issues a token cancellation instruction to the sub-issuing nodes within the station. The sub-issuing nodes within the station then cancel the corresponding authorization token, stop issuing cancellation authorization tokens, and cancel any abnormal sub-certificates that have already been issued.

Images