A power grid dispatching data dynamic perception and protection method based on a commercial secret algorithm

Abstract

The present application relates to the field of power grid dispatching data security, and more particularly to a power grid dispatching data dynamic perception and protection method based on a commercial secret algorithm. The method captures power grid dispatching network data streams in real time, obtains original service data containing dispatching instructions, measurement data and state information through protocol analysis and deep packet detection; then uses a dynamic data perception engine to identify sensitive data units, and dynamically generates data sensitivity labels according to the business type and the power grid operation state; dynamically matches commercial cryptographic algorithms from the commercial secret algorithm library according to the labels and distributes temporary session keys to generate an encryption strategy; encrypts the sensitive units, adds a security mark containing an algorithm identifier and a key index to the data packet header to form a protected data stream; sends the protected data stream to the target end, updates the session key state and uploads the execution log to the audit center. The present application realizes dynamic, accurate identification and differentiated encryption protection of power grid dispatching sensitive data.

Description

Technical Field

[0001] This invention relates to the field of power grid dispatch data security, and in particular to a method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms. Background Technology

[0002] Power grid dispatch data is a core business carrier ensuring real-time monitoring of the power system, issuance of dispatch instructions, and adjustment of operational status. The transmitted content includes critical data such as dispatch instructions, measurement data, and equipment status information, directly impacting power grid operational safety and energy supply stability. With the advancement of new power system construction, the power grid dispatch network is evolving from a traditional closed private network to an open and interconnected intelligent network. The dedicated communication protocols upon which it relies, such as IEC60870-5-104 and IEC61850 MMS, were not designed with built-in security mechanisms. A large amount of core data is transmitted in plaintext, facing severe security threats such as data eavesdropping, instruction tampering, and injection of false data. Existing power grid dispatch data security protection measures have significant shortcomings and cannot adapt to dynamic and refined protection requirements: Most solutions adopt static protection strategies, which cannot capture and deeply analyze dispatch network data streams in real time, making it difficult to accurately separate dispatch instructions, measurement data, and status information from mixed traffic, resulting in a lack of accurate data foundation for security protection; Sensitive data identification relies on fixed rules and does not dynamically determine based on business type and real-time power grid operating status, failing to identify abnormal measurements or dynamic sensitive data in emergency situations, and also wasting resources due to indiscriminate protection; The encryption algorithms used are rigid, failing to build dynamic adaptation mechanisms according to national commercial cryptography compliance requirements, and mostly using fixed algorithms for uniform encryption, unable to match SM2, SM3, SM4, and SM9 according to data sensitivity. Commercial cryptographic algorithms struggle to balance strong protection for highly sensitive data with efficient transmission of low-sensitivity data. Key management employs a static allocation model, lacking a dynamic generation, distribution, and status update mechanism for temporary session keys. Data transmission lacks traceable security markers, and the encryption process lacks complete audit logs. This prevents dynamic control over the entire process from data perception and encryption adaptation to transmission auditing. Consequently, it fails to address the core issues of insufficient dynamic perception, rigid encryption strategies, lagging key management, and lack of security auditing in power grid dispatch data transmission. Therefore, an integrated protection technology is urgently needed that can perceive data flows in real time, dynamically identify sensitive data, adaptively select commercial cryptographic algorithms, dynamically manage session keys, and complete full-process auditing. Summary of the Invention

[0003] This invention provides a method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms, aiming to solve the problems of insufficient dynamic sensing, rigid encryption strategies, lagging key management, and lack of security auditing in power grid dispatch data transmission.

[0004] To achieve the above objectives, the following technical solution is adopted.

[0005] A method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms includes the following steps: The system captures data streams transmitted in the power grid dispatch network in real time, performs protocol parsing and deep packet inspection on the data streams, and obtains raw business data containing dispatch instructions, measurement data and status information. Based on the original business data, a dynamic data perception engine is used to identify sensitive data units in the data stream, and data sensitivity labels are dynamically generated according to the business type to which the data belongs and the current power grid operation status. Based on the data sensitivity label, a matching commercial cryptographic algorithm is dynamically selected from the commercial cryptographic algorithm library, and a temporary session key is allocated to the data stream to generate an encryption strategy; According to the encryption strategy, the sensitive data unit is encrypted, and a security tag containing the algorithm identifier and key index is added to the header of the encrypted data packet to form a protected data stream. The protected data stream is sent to the target receiving end, and the status of the temporary session key is updated after the transmission is completed. At the same time, the encryption policy execution log is uploaded to the audit center.

[0006] Optionally, the step of capturing the data stream transmitted in the power grid dispatch network in real time, performing protocol parsing and deep packet inspection on the data stream to obtain raw service data containing dispatch instructions, measurement data, and status information specifically includes: Bypass deployment of traffic capture probes on the core switches of the power grid dispatch network, and real-time replication of data packets in the network through port mirroring to obtain the original network data stream; The original network data stream is reassembled using the TCP / IP protocol stack. The reassembled data packets are parsed using the application layer protocol according to the IEC60870-5-104 protocol specification or the IEC61850 MMS protocol specification. The header and payload fields in the protocol data unit are extracted to obtain the parsed protocol data unit. Deep packet inspection is performed on the load field in the parsed protocol data unit. Based on the preset keyword feature library and regular expression rules, circuit breaker opening and closing commands, transformer tap adjustment commands, and generator output adjustment commands are identified and separated from the load field to form dispatch command data. At the same time, voltage amplitude measurement data, current amplitude measurement data, active power measurement data, and reactive power measurement data of each node are separated to form measurement data. Meanwhile, switch status information, protection device action status information, and equipment operation status information are separated to form status information data. The scheduling instruction data, measurement data, and status information data are associated and combined according to the original timestamps to form structured original business data.

[0007] Optionally, based on the original business data, a dynamic data awareness engine is used to identify sensitive data units in the data stream, and data sensitivity labels are dynamically generated according to the business type of the data and the current power grid operating status. This specifically includes: The raw business data is input into the dynamic data perception engine. The dynamic data perception engine first performs semantic parsing on the raw business data to identify the business type corresponding to each data record. The business types include scheduling and control business, measurement and acquisition business and status monitoring business. For raw business data of the scheduling and control type, it is directly marked as an inherent sensitive data unit; for raw business data of the measurement and acquisition type or the status monitoring type, a baseline anomaly detection algorithm based on statistics is used to compare the current measurement value or status value with the statistical baseline of the historical data of the same period. When the deviation exceeds the preset deviation threshold, the current data record is marked as a dynamic sensitive data unit. The current power grid operation status level is obtained from the power grid dispatching system in real time. The power grid operation status level includes normal status, alert status and emergency status. Based on the data unit's business type, whether it is a dynamically sensitive data unit, and the current power grid operation status level, a predefined sensitivity mapping rule table is queried to assign a data sensitivity label to each data unit. The data sensitivity label levels include low sensitivity, medium sensitivity, high sensitivity, and core sensitivity.

[0008] Optionally, the steps of dynamically selecting a matching commercial cryptographic algorithm from a commercial cryptographic algorithm library based on data sensitivity tags, allocating a temporary session key to the data stream, and generating an encryption strategy specifically include: Construct a commercial cryptographic algorithm library containing a variety of commercial cryptographic algorithms, including the SM2 elliptic curve public key cryptography algorithm, the SM3 cryptographic hash algorithm, the SM4 block cipher algorithm, and the SM9 identifier cryptography algorithm; Pre-configure the applicable data sensitivity label level and performance overhead metrics for each commercial cryptographic algorithm; Read the data sensitivity label of the current data unit, traverse each commercial cryptographic algorithm in the commercial cryptographic algorithm library, calculate the matching degree between the data length of the data unit and the performance overhead index of the commercial cryptographic algorithm, and select the commercial cryptographic algorithm with the highest matching degree and whose applicable level covers the current data sensitivity label as the matching commercial cryptographic algorithm. A temporary session key application is initiated to the key management service center. The key management service center uses a true random number generator to generate a symmetric key as the temporary session key, and uses the SM2 public key of the receiving end to encrypt and protect the temporary session key, thereby generating an encrypted temporary session key. The encryption strategy for this data unit is formed by associating the algorithm identifier of the matching commercial cryptographic algorithm with the encrypted temporary session key.

[0009] Optionally, according to the encryption strategy, sensitive data units are encrypted, and a security tag containing the algorithm identifier and key index is added to the header of the encrypted data packet to form a protected data stream. Specifically, this includes: Based on the algorithm identifier in the encryption strategy, instantiate the corresponding commercial cryptographic algorithm instance from the commercial cryptographic algorithm library; If the matched commercial cryptographic algorithm is the SM4 block cipher algorithm, then the cipher block chaining mode is used to encrypt the payload field of the sensitive data unit, convert the plaintext payload field into the ciphertext payload field, and fill the ciphertext data header with a randomly generated initialization vector. If the matched commercial cryptographic algorithm is the SM2 elliptic curve public key cryptography algorithm, then the SM2 public key of the receiving end is directly used to encrypt the payload field of the sensitive data unit to generate the ciphertext payload field; the encrypted ciphertext payload field replaces the payload field in the original data packet, keeping the IP header and TCP header of the original data packet unchanged, to form the encrypted data packet; A new custom security flag option is added to the TCP header options field of the encrypted data packet. The security flag option includes an algorithm identifier field, a key index field, and an initialization vector field. The key index field points to the storage location of the encrypted temporary session key in the key management service center.

[0010] Optionally, the steps of sending the protected data stream to the target receiver, updating the status of the temporary session key after transmission, and uploading the encryption policy execution log to the audit center include: The encrypted data packet with added security tags is sent to the target receiver along the original routing path; After the data packet is sent, a key status update request is sent to the key management service center. The key status update request includes the key index and usage count of the temporary session key. After receiving the key status update request, the key management service center updates the status of the temporary session key from "in use" to "used" and records the business data identifier and timestamp of this use; Simultaneously, the execution log of this encryption process is collected from the encryption policy execution module. The execution log includes data stream quintuple information, data sensitivity label, selected algorithm identifier, encryption timestamp, and key index. The execution logs are encapsulated as audit event records and uploaded to the audit center through a secure transmission channel. The audit center then digitally signs the execution logs and archives them for subsequent security audits and tracing.

[0011] Optionally, a temporary session key application is initiated to the key management service center. The key management service center generates a symmetric key using a true random number generator as the temporary session key, and encrypts and protects the temporary session key using the SM2 public key of the receiving end. The steps of generating the encrypted temporary session key specifically include: After receiving a temporary session key application, the key management service center first verifies the initiator's identity certificate and access permissions to confirm that the initiator has the authority to apply for the corresponding data sensitivity label. The built-in quantum random number generator collects circuit noise and photonic noise, and generates a true random number sequence through entropy extraction and post-processing algorithms. The true random number sequence is used as the original key material for the temporary session key. Query the target receiver's SM2 public key certificate from the database of the key management service center, and verify the validity and revocation status of the SM2 public key certificate; The temporary session key is encrypted using the SM2 elliptic curve public key encryption algorithm with the verified SM2 public key to generate an encrypted temporary session key, and a globally unique key index is assigned to the encrypted temporary session key. The key index is associated with the encrypted temporary session key and stored in the temporary key table of the key management service center, and the key index and the encrypted temporary session key are returned to the initiator.

[0012] Optionally, a custom security flag option is added to the TCP header options field of the encrypted data packet. This security flag option includes steps such as an algorithm identifier field, a key index field, and an initialization vector field. In the TCP header options field, a unique option type number that has not yet been assigned by IANA is used to identify the option as a custom security tag option. In the security tag option, a fixed-length data structure is allocated, in which the first 2 bytes store an algorithm identifier field, which uses an enumerated value to represent the SM2, SM3, SM4 or SM9 algorithm; The next 4 bytes store the key index field, which is a numerical representation of the globally unique key index; Next, 8 bytes are used to store the initialization vector field, which is the initialization vector value used during SM4 encryption. When assembling TCP packets at the sending end, the above three fields are filled into the numerical part of the security flag option in a predetermined order, and the TCP header checksum is calculated to ensure that the security flag option is not modified or discarded by intermediate network devices. After receiving the data packet, the receiving end parses the TCP header option field, identifies the security flag option, and extracts the algorithm identifier field, key index field, and initialization vector field from it for subsequent decryption operations.

[0013] Optionally, it also includes the step of decrypting and verifying the protected data stream at the receiving end, specifically including: After the target receiver captures the protected data stream, it first parses the TCP header options field of the data packet and extracts the algorithm identifier field, key index field, and initialization vector field from the security tag options; The receiving end initiates a key acquisition request to the key management service center based on the key index field. The key acquisition request includes the key index and the receiving end's own identity certificate. After verifying the validity of the receiving end's identity certificate, the key management service center looks up the encrypted temporary session key corresponding to the key index in the temporary key table, and decrypts the encrypted temporary session key using the receiving end's SM2 private key to obtain the original temporary session key. The original temporary session key, algorithm identifier field, and initialization vector field are returned to the decryption module at the receiving end. The decryption module instantiates the corresponding commercial cryptographic algorithm based on the algorithm identifier field, and uses the original temporary session key and initialization vector to perform decryption operations on the ciphertext payload field of the data packet to recover the plaintext payload field. The recovered plaintext payload fields are subjected to integrity and semantic verification to confirm that the data has not been tampered with during transmission and conforms to business logic. The verified data is then submitted to the scheduling application system.

[0014] Optionally, it also includes steps for lifecycle management and automatic renewal of temporary session keys, specifically including: The Key Management Service Center sets lifecycle attributes for each generated temporary session key, including the effective start time, effective end time, and maximum number of uses. During the validity period of the temporary session key, each time a key acquisition request is received, the key management service center increments the count of the number of times the temporary session key has been used; When the usage count reaches the maximum, or when the current time exceeds the expiration time, the key management service center will automatically update the status of the temporary session key to "expired" and reject any subsequent key acquisition requests for that key index. In the encryption policy execution module, before each data transmission, the remaining validity period and remaining usage count of the currently used temporary session key are checked. When the remaining validity period is lower than the preset update threshold or the remaining usage count is lower than the preset number of times threshold, the temporary session key application process is automatically triggered to apply for a new temporary session key to replace the temporary session key that is about to expire. Information about the switch between the old and new keys is recorded in the encryption policy execution log to ensure that the data receiving end can smoothly transition to using the new key to decrypt subsequent data streams.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This application captures power grid dispatch network data streams in real time, performs protocol parsing and deep packet inspection, accurately extracts raw business data, identifies sensitive data units and generates sensitivity tags based on a dynamic perception engine, dynamically selects matching commercial cryptographic algorithms based on the tags, allocates temporary session keys and generates encryption strategies, encrypts sensitive data and adds security tags to form a protected data stream, updates the key status and uploads audit logs after transmission, fundamentally solving the problems of insufficient dynamic perception, rigid encryption strategies, lagging key management and lack of security audit in power grid dispatch data transmission in existing technologies. It achieves real-time adaptation of data protection with data sensitivity and power grid operation status, ensuring dynamic security and commercial cryptographic compliance of dispatch data transmission. Simultaneously, by deploying traffic capture probes in a bypass manner and adapting to the power grid's dedicated communication protocol, data reconstruction and deep parsing are completed. Combined with semantic parsing and baseline anomaly detection, accurate distinction between inherently sensitive data and dynamically sensitive data is achieved. A hierarchical adaptation mechanism is built based on multiple types of commercial cryptographic algorithm libraries. The optimal algorithm is selected based on data length and performance overhead. Temporary session keys are generated using true random numbers and protected by SM2 public key encryption. Custom security tags in the TCP header ensure reliable carrying of algorithm identifiers, key indexes, and initialization vectors. With automatic key lifecycle management, receiver decryption verification, and digital signature archiving of audit logs, the accuracy of data extraction and sensitive identification is improved, secure and efficient adaptation of commercial cryptographic algorithms is achieved, and the security of the entire key distribution and use process is ensured. This makes the entire data protection process monitorable, traceable, and auditable, fully meeting the stringent requirements of power grid dispatching scenarios for data security, transmission efficiency, and operational reliability. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the steps of an embodiment of the power grid dispatch data dynamic sensing and protection method based on commercial cryptographic algorithms of the present invention. Detailed Implementation

[0017] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0018] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used in this invention is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0019] like Figure 1 As shown, the power grid dispatching system, as the core of the safe and stable operation of the power system, transmits dispatching instructions, measurement data, and status information that directly affect the normal operation of the power system. Once this data is stolen, tampered with, or leaked, it can lead to serious consequences such as power grid dispatching errors, equipment failures, and even large-scale power outages. Existing power grid dispatching data protection methods mostly employ fixed encryption algorithms and fixed key strategies, which suffer from problems such as mismatch between encryption strategies and data sensitivity, rigid key management, and inability to adapt to dynamic changes in the power grid's operating status. This results in insufficient data protection security, significant resource waste, and difficulty in meeting the real-time and dynamic requirements of power grid dispatching data. Therefore, this method dynamically senses the sensitivity of power grid dispatching data, dynamically matches commercial cryptographic algorithms, and dynamically manages temporary session keys. Combining the high security of commercial cryptographic algorithms with the special characteristics of power grid dispatching operations, it constructs a dynamic, efficient, and secure data sensing and protection system to address the shortcomings of existing technologies and improve the security and reliability of power grid dispatching data transmission.

[0020] The first step is to capture real-time data streams and extract raw business data. This process forms the foundation of the entire data protection workflow. Its core lies in achieving comprehensive, real-time capture of all data streams in the power grid dispatching network, as well as ensuring the accuracy of protocol parsing and the precision of deep packet inspection, thus guaranteeing the complete extraction of all types of raw data required for dispatching operations. In the specific implementation, traffic capture probes are first deployed in bypass mode on the core switches of the power grid dispatching network. The deployment location is chosen on the core transmission link between the power grid dispatching master station and each substation. This bypass deployment avoids impacting the original network transmission, ensuring the real-time transmission of power grid dispatching data is not interfered with. The traffic capture probes use high-performance network interface cards, supporting gigabit-level data transmission rates, which can meet the capture needs of large data streams during peak power grid dispatching periods. The probes replicate all data packets in the network in real time using port mirroring. During port mirroring configuration, both the uplink and downlink ports of the core switch are configured as mirror ports to ensure the capture of bidirectional data streams, namely, the dispatching command data stream sent from the dispatching master station to the substations, and the measurement data and status information data stream uploaded from the substations to the master station, avoiding any data stream omissions.

[0021] After capturing the raw network data stream, TCP / IP protocol stack reassembly is performed. Since data packets transmitted in the power grid dispatch network may be fragmented or out of order, direct protocol parsing would lead to parsing failures or errors; therefore, protocol stack reassembly is necessary first. During the protocol stack reassembly process, data is reassembled step-by-step according to the layered structure of the TCP / IP protocol, starting from the link layer, network layer, and transport layer. Fragmented data packets are first reassembled according to their sequence numbers, and then out-of-order data packets are repaired to ensure that the reassembled data packets completely reflect the content of the original data stream. After reassembly, parsing is performed according to commonly used application layer protocol specifications in the power grid dispatch field, primarily supporting the IEC60870-5-104 protocol specification and the IEC61850 MMS protocol specification. These two protocols are the mainstream protocols for power grid dispatch data transmission, covering the vast majority of power grid dispatch business scenarios. During the protocol parsing process, a protocol parsing engine is used to parse the reassembled data packets. The parsing engine has built-in complete protocol rules for two protocols, which can automatically identify the protocol type corresponding to the data packet. Then, according to the format of the corresponding protocol, the header field and payload field in the protocol data unit are extracted. The header field contains basic information such as the source address, destination address, protocol type, and data length of the data packet, while the payload field contains specific scheduling business data.

[0022] To accurately separate different types of raw business data from the load field, deep packet inspection is required on the load field of the parsed protocol data unit. During deep packet inspection, a keyword feature library and regular expression rules are pre-built. The keyword feature library, based on the characteristics of power grid dispatching business, includes core keywords corresponding to dispatching instructions, measurement data, and status information. Examples include keywords such as "opening," "closing," "regulation," and "adjustment" in dispatching instructions; "voltage," "current," "active power," and "reactive power" in measurement data; and "switch status," "protection action," and "operation status" in status information. The regular expression rules are designed to match the format characteristics of different data types. For example, for circuit breaker opening and closing instructions, a regular expression matching the format "[circuit breaker number] + [opening / closing] + [timestamp]" is designed; for voltage amplitude measurement data, a regular expression matching the format "[node number] + [voltage amplitude] + [unit] + [timestamp]" is designed. During deep packet inspection, the load field is matched against a keyword feature library, and regular expression rules are applied for filtering to accurately identify and separate dispatch instruction data, measurement data, and status information data. Dispatch instruction data mainly includes circuit breaker opening and closing instructions, transformer tap adjustment instructions, and generator output adjustment instructions. Each dispatch instruction contains information such as instruction number, execution object, instruction content, and sending time. Measurement data mainly includes voltage amplitude measurement data, current amplitude measurement data, active power measurement data, and reactive power measurement data at each node. Each measurement data contains information such as measurement node number, measurement value, measurement time, and measurement accuracy. Status information data mainly includes switch status information, protection device operation status information, and equipment operating status information. Each status information contains information such as equipment number, status value, and status update time.

[0023] After separating the three types of data, the scheduling instruction data, measurement data, and status information data are associated and combined according to their original timestamps to form structured raw business data. During the timestamp association process, the original acquisition time or transmission time of each data entry is used as a benchmark to associate the three types of data generated at the same time point or within the same business process. For example, a circuit breaker opening / closing instruction sent at a certain moment is associated with the corresponding node voltage and current measurement data, as well as the circuit breaker's switch status information, to form a complete business data record. During the structuring process, a tabular data format is used to organize the associated business data, clearly defining the meaning and data type of each data record's fields to ensure the standardization and readability of the raw business data, laying the foundation for subsequent sensitive data identification and encryption. Simultaneously, a data source identifier is added to the raw business data to identify which substation and device each data entry originates from, facilitating subsequent data traceability and auditing.

[0024] After extracting the raw business data, the process moves to the dynamic data perception and sensitivity tag generation stage. This stage is one of the core innovations of this technical solution. Its core lies in achieving dynamic identification of sensitive data and dynamic allocation of sensitivity tags, breaking the limitations of fixed sensitive data division and fixed tag allocation in existing technologies. This allows sensitivity tags to accurately match the actual sensitivity of the data and the power grid's operating status, providing a basis for subsequent dynamic encryption strategies. In specific implementation, structured raw business data is input into the dynamic data perception engine. The dynamic data perception engine adopts a three-layer perception architecture of "semantic parsing + anomaly detection + state linkage" to achieve accurate identification of sensitive data units and dynamic generation of sensitivity tags. This architecture has strong adaptability and flexibility, and can adapt to the dynamic changes in power grid dispatching operations.

[0025] The dynamic data perception engine first performs semantic analysis on the raw business data. This semantic analysis employs a combination of natural language processing and a power grid business dictionary to construct a semantic model for power grid dispatching operations. The power grid business dictionary pre-includes professional terminology, business processes, and data types in the power grid dispatching field. The semantic model identifies the business type corresponding to each data record by performing word segmentation, part-of-speech tagging, and semantic matching on the text content of the raw business data. These business types are mainly divided into dispatch control, measurement and acquisition, and status monitoring. Dispatch control data primarily corresponds to dispatch instructions that directly affect the power grid's operating status. If this data is tampered with or leaked, it will directly lead to power grid dispatching errors, thus exhibiting high inherent sensitivity. Measurement and acquisition data primarily corresponds to the measured values ​​of operating parameters at various nodes of the power grid. The sensitivity of this data changes with the power grid's operating status. Status monitoring data primarily corresponds to the operating status information of power grid equipment, and its sensitivity is also related to the power grid's operating status. During the semantic parsing process, the contextual information of the data is also analyzed. For example, by combining information such as the sending object and sending scenario of the data, the business type corresponding to the data is further confirmed to ensure the accuracy of business type identification and avoid identification errors caused by semantic ambiguity.

[0026] After identifying the business type, sensitive data units are marked differently for different business types. For raw business data of the dispatch control type, since it is directly related to the power grid's dispatch decisions and safe operation, any leakage or tampering could lead to serious security incidents. Therefore, it is directly marked as an inherently sensitive data unit. This type of data unit is sensitive data under any power grid operating state and requires high-strength encryption protection. For raw business data of the measurement acquisition or status monitoring type, its sensitivity is not fixed but related to the current measurement values, status values, and power grid operating state. Therefore, a statistical baseline anomaly detection algorithm is used to identify dynamically sensitive data units. The core of the baseline anomaly detection algorithm is to construct a statistical baseline of historical data from the same period. During the construction of the statistical baseline, measurement data or status data of the same type from the same time period, the same equipment, and the same type are collected over a past period. Statistical methods are used to calculate statistical indicators such as the mean, variance, maximum value, and minimum value of the data to form a historical statistical baseline. The current measured value or status value is then compared with the corresponding historical statistical baseline to calculate the deviation. When the deviation exceeds a preset deviation threshold, it indicates that the current data is abnormal and may reflect abnormal changes in the power grid's operating status. Such data, if leaked, could be maliciously used to identify weaknesses in the power grid's operation; therefore, it is marked as a dynamic sensitive data unit. When the deviation does not exceed the preset deviation threshold, it indicates that the current data is within the normal range and has low sensitivity; therefore, it is not marked as a sensitive data unit. The deviation threshold is reasonably set by those skilled in the art based on different types of data, different power grid equipment, and different operating scenarios to ensure the accuracy and rationality of anomaly detection.

[0027] To achieve dynamic allocation of sensitivity labels, the current power grid operating status level needs to be obtained from the power grid dispatching system in real time. The power grid operating status level is divided based on factors such as power grid load, equipment operating status, and fault conditions, mainly including normal state, alert state, and emergency state. Normal state means the power grid load is within a reasonable range, all equipment is operating normally, no faults occur, and the power grid is operating stably. Alert state means the power grid load is close to its upper limit, some equipment exhibits minor anomalies, and there is a potential risk of faults. Emergency state means the power grid has experienced a fault, some equipment is out of service, the load is severely unbalanced, and emergency dispatching is required. The power grid operating status level is obtained through real-time acquisition and dynamic updates. The power grid dispatching system's status monitoring module collects various operating parameters of the power grid in real time, including total load, regional load, equipment operating status, and fault alarm information. Then, according to preset status level classification rules, the system automatically determines the current power grid operating status level and synchronizes it to the dynamic data perception engine in real time, ensuring that the dynamic data perception engine can promptly detect changes in the power grid operating status.

[0028] Based on the data unit's business type, whether it is a dynamically sensitive data unit, and the current power grid operating status level, a predefined sensitivity mapping rule table is queried to assign a data sensitivity label to each data unit. Sensitivity label levels include low sensitivity, medium sensitivity, high sensitivity, and core sensitivity. The sensitivity mapping rule table is pre-defined based on the security requirements and data characteristics of power grid dispatching operations. Its core logic is to combine the inherent sensitivity and dynamic sensitivity of the data with the power grid operating status to achieve precise allocation of sensitivity labels. The specific mapping logic is as follows: Inherently sensitive data units of dispatching and control operations are assigned a high sensitivity label under normal conditions, a core sensitivity label under alert conditions, and a core sensitivity label under emergency conditions; dynamically sensitive data units of measurement and acquisition or status monitoring operations are assigned a medium sensitivity label under normal conditions, a high sensitivity label under alert conditions, and a core sensitivity label under emergency conditions; non-dynamically sensitive data units of measurement and acquisition or status monitoring operations are assigned a low sensitivity label under normal conditions, a medium sensitivity label under alert conditions, and a high sensitivity label under emergency conditions. This dynamic mapping method allows sensitivity tags to be adjusted in real time as the power grid's operating status changes, ensuring that sensitive data units receive protection commensurate with their sensitivity level. At the same time, it avoids excessive encryption of non-sensitive data, reduces system resource consumption, and improves data transmission efficiency.

[0029] After generating sensitivity tags, the next step is to generate encryption strategies. The core of this step is to dynamically select commercial cryptographic algorithms and dynamically allocate temporary session keys. Combining the data sensitivity tags with the transmission requirements of power grid dispatch data, the optimal encryption strategy is generated to ensure the security and efficiency of encryption protection, while also showcasing the innovation of this technical solution. In specific implementation, a commercial cryptographic algorithm library is first constructed, encompassing various commercial cryptographic algorithms required for power grid dispatch data protection, including the SM2 elliptic curve public-key cryptography algorithm, the SM3 cryptographic hash algorithm, the SM4 block cipher algorithm, and the SM9 identifier cryptography algorithm. These algorithms all comply with national commercial cryptography standards, possess high security and applicability, and can meet the encryption needs of data with different sensitivity levels. The commercial cryptographic algorithm library adopts a modular design, with each commercial cryptographic algorithm existing as an independent module, facilitating algorithm updates, maintenance, and expansion. New commercial cryptographic algorithm modules can be added later based on technological developments and security requirements, improving the adaptability of the algorithm library.

[0030] To enable dynamic selection of commercial cryptographic algorithms, each algorithm needs to be pre-configured with its applicable data sensitivity label level and performance overhead. The applicable data sensitivity label level clarifies the level of sensitive data each algorithm can handle. For example, the SM4 block cipher is suitable for encrypting low, medium, and high sensitivity data; the SM2 elliptic curve public-key cryptography algorithm is suitable for encrypting high and core sensitivity data; the SM9 identifier cipher is suitable for encrypting core sensitivity data; and the SM3 cryptographic hash algorithm is mainly used for data integrity verification. Performance overhead mainly includes the algorithm's encryption speed, decryption speed, and resource utilization. Different commercial cryptographic algorithms differ in performance overhead. For example, the SM4 block cipher has a fast encryption speed and low resource utilization, making it suitable for rapid encryption of large amounts of data; the SM2 elliptic curve public-key cryptography algorithm offers high encryption security but a relatively slow encryption speed and relatively high resource utilization, making it suitable for encrypting a small amount of core sensitive data with extremely high security requirements. The configuration of performance overhead is based on the actual test results of the algorithm to ensure the rationality and accuracy of the configuration.

[0031] After reading the data sensitivity label of the current data unit, the algorithm iterates through each commercial cryptographic algorithm in the commercial cryptographic algorithm library, calculating the matching degree between the data length of the data unit and the performance overhead index of the commercial cryptographic algorithm. The matching degree calculation employs a comprehensive evaluation approach, combining factors such as data length, real-time encryption requirements, and security requirements to construct a matching degree evaluation model. The core logic of the model is: for data with a large data length and high real-time requirements, algorithms with fast encryption speed and low resource consumption are prioritized to improve the matching degree; for data with a small data length and high security requirements, algorithms with high encryption security are prioritized to improve the matching degree. Through the matching degree evaluation model, the commercial cryptographic algorithm with the highest matching degree and applicable level covering the current data sensitivity label is selected as the matching commercial cryptographic algorithm. For example, for medium-sensitivity measurement data with a large data length, due to its high real-time requirements and moderate security requirements, the SM4 block cipher algorithm is selected as the matching algorithm; for core-sensitivity scheduling instruction data with a small data length, due to its extremely high security requirements and relatively low real-time requirements, the SM2 elliptic curve public key cryptography algorithm or the SM9 identifier cryptography algorithm is selected as the matching algorithm. This dynamic selection method enables precise matching between algorithms and data, ensuring both data encryption security and real-time data transmission, thus avoiding the security deficiencies or resource waste caused by fixed algorithms in existing technologies.

[0032] After selecting a matching commercial cryptographic algorithm, a temporary session key application is initiated to the Key Management Service Center. The temporary session key is dynamically generated and uses a one-time pad approach to ensure key security and avoid the risk of leakage due to long-term key use. This is one of the innovative aspects of this technical solution. The Key Management Service Center is the core module specifically responsible for key generation, storage, management, distribution, and destruction. It is deployed in a distributed architecture to ensure the reliability and availability of key management and avoid key management failure due to single points of failure. Upon receiving the temporary session key application, the Key Management Service Center first generates a symmetric key as the temporary session key using a true random number generator. The true random number generator uses a physical noise-based generation method, collecting circuit noise and photonic quantum noise as random sources. After entropy extraction and post-processing algorithms, a true random number sequence is generated. This true random number sequence is used as the original key material for the temporary session key. Compared to traditional pseudo-random number generation methods, the true random number sequence has higher randomness and unpredictability, effectively improving the security of the temporary session key and reducing the risk of key cracking.

[0033] After generating the temporary session key, it needs to be encrypted using the receiving end's SM2 public key to prevent it from being stolen during transmission. Specifically, the key management service center queries its database for the target receiving end's SM2 public key certificate. This certificate, issued by an authoritative certificate authority, contains the receiving end's identity information, SM2 public key, and certificate validity period. The key management service center verifies the validity and revocation status of the SM2 public key certificate, including its validity period, signature authenticity, and whether it has been revoked, ensuring the SM2 public key used is legitimate and valid. After successful verification, the temporary session key is encrypted using the SM2 elliptic curve cryptography algorithm, generating an encrypted temporary session key. A globally unique key index is assigned to this encrypted temporary session key. This key index uses a randomly generated string and number combination to ensure each temporary session key has a unique identifier, facilitating subsequent key lookup, management, and use. Finally, the key index is associated with the encrypted temporary session key and stored in the temporary key table of the key management service center. The key index and the encrypted temporary session key are then returned to the initiator, who associates them with the algorithm identifier of the matching commercial cryptographic algorithm to form the encryption strategy for the data unit. The encryption strategy includes core information such as the algorithm identifier, the encrypted temporary session key, and the key index, providing a basis for subsequent encryption processing.

[0034] After generating the encryption strategy, the process proceeds to the encryption of sensitive data units and the generation of protected data streams. The core of this stage is to accurately encrypt the sensitive data units according to the encryption strategy and add security tags to ensure that the encrypted data can be correctly decrypted by the target receiving end, while preventing data tampering or forgery during transmission. In specific implementation, firstly, based on the algorithm identifier in the encryption strategy, a corresponding commercial cryptographic algorithm instance is instantiated from the commercial cryptographic algorithm library. During the instantiation process, the parameters and configurations required by the algorithm are loaded to ensure that the algorithm can run normally. Different commercial cryptographic algorithms correspond to different encryption processes. Based on the matched algorithm type, the corresponding encryption method is used to encrypt the payload field of the sensitive data unit.

[0035] If the matched commercial cryptographic algorithm is the SM4 block cipher, since it is a block cipher, the payload field of the sensitive data unit needs to be grouped according to a fixed block length. The block length is set according to the standard requirements of the SM4 algorithm. Then, a cipher block chaining mode is used to encrypt each group of data. The core of the cipher block chaining mode is to use the encryption result of the previous group of data as the encryption input of the next group of data, forming a chain encryption structure to improve encryption security. During the encryption process, an initialization vector is randomly generated. The length of the initialization vector is the same as the block length. The initialization vector is filled into the header of the ciphertext data and used as the initial input for decryption, ensuring that the result of each encryption is unique. Even the same plaintext data will generate different ciphertext data under different initialization vectors, further improving encryption security. After encryption, the plaintext payload field is replaced with the ciphertext payload field to obtain the encrypted payload data.

[0036] If the matched commercial cryptographic algorithm is the SM2 elliptic curve public-key cryptography algorithm, since it is a public-key cryptography algorithm, there is no need to block the data. The receiver's SM2 public key is directly used to encrypt the payload field of the sensitive data unit. During the SM2 encryption process, the payload field is first hashed to generate a hash value. Then, the hash value and the payload field are encrypted together to generate the ciphertext payload field. This ensures both data confidentiality and provides a basis for subsequent integrity verification. After encryption, the encrypted ciphertext payload field replaces the payload field in the original data packet, keeping the IP header and TCP header of the original data packet unchanged. This avoids data packet transmission failures due to modifications to the IP header and TCP header, ensuring data transmission compatibility and reliability.

[0037] Regardless of the commercial cryptographic algorithm used for encryption, a security tag containing the algorithm identifier and key index must be added to the encrypted data packet header. The purpose of this security tag is to provide the target receiver with the critical information needed for decryption, and also to identify the data packet as protected encrypted data, preventing unauthorized devices from tampering with or forging the data. The security tag is added to the TCP header options field of the encrypted data packet. In practice, a pre-assigned option type number is first reserved in the TCP header options field to identify the option as a custom security tag option, avoiding conflicts with existing TCP header options and ensuring that the security tag can be correctly recognized.

[0038] The security tag option uses a fixed-length data structure to ensure data format standardization and compatibility, facilitating parsing by the receiving end. The specific design of the data structure is as follows: The first two bytes store the algorithm identifier field. This field uses enumerated values ​​to represent different commercial cryptographic algorithms. For example, 01 represents the SM2 elliptic curve public key cryptography algorithm, 02 represents the SM3 cryptographic hash algorithm, 03 represents the SM4 block cipher algorithm, and 04 represents the SM9 identifier cipher algorithm. The enumerated values ​​are concise and clear, allowing the receiving end to quickly identify the algorithm type. The next four bytes store the key index field. This field is a numerical representation of a globally unique key index. The receiving end can use this key index to query the corresponding encrypted temporary session key at the key management service center, providing crucial information for decryption. The next eight bytes store the initialization vector field. This field contains the initialization vector value used during SM4 encryption. For data packets encrypted using algorithms such as SM2 and SM9, this field can be filled with default values ​​without affecting the decryption process. When assembling TCP packets at the sending end, the three fields mentioned above are filled into the numerical part of the security flag options in a predetermined order, and the TCP header checksum is calculated. The calculation of the TCP header checksum covers the entire TCP header (including the security flag options) to ensure that the security flag options are not modified or discarded by intermediate network devices. If an intermediate network device modifies the TCP header, it will cause a checksum mismatch, and the data packet will be discarded, thus ensuring data integrity and security. After receiving the data packet, the receiving end parses the TCP header option fields, identifies the security flag options, and extracts the algorithm identifier field, key index field, and initialization vector field from them for subsequent decryption operations.

[0039] After the protected data stream is generated, the process proceeds to data transmission, key status update, and audit log upload. The core of this stage is ensuring the protected data stream is securely and accurately transmitted to the target receiver, while simultaneously achieving dynamic key management and traceable operation logs, further enhancing the security and manageability of the technical solution. In specific implementation, the encrypted data packet with added security tags is first sent to the target receiver along the original routing path. The original routing path is automatically determined by the power grid dispatch network's routing protocol. An acknowledgment mechanism is used during transmission: after sending the data packet, the sender waits for an acknowledgment from the receiver. If no acknowledgment is received within a preset time, it indicates data packet transmission failure, and the sender automatically retransmits the data packet to ensure successful transmission to the target receiver and prevent data loss.

[0040] After the data packet is sent, a key status update request is sent to the key management service center. This request includes the key index and usage count of the temporary session key. The usage count represents the number of times the temporary session key has been used to encrypt and send a data packet. Upon receiving the request, the key management service center looks up the corresponding temporary session key in the temporary key table based on the key index. It then updates the temporary session key's status from "in use" to "used," and records information such as the business data identifier, usage timestamp, sender identifier, and receiver identifier, creating a key usage record for subsequent key traceability and management. Updating the key status prevents the temporary session key from being reused, ensuring the "one-time key" principle is implemented and improving key security.

[0041] Simultaneously, execution logs for this encryption process are collected from the encryption policy execution module. These logs provide a detailed record of the entire encryption process, offering a basis for subsequent security audits and traceability. The execution logs include data flow 5-tuple information, data sensitivity tags, selected algorithm identifiers, encryption timestamps, and key indexes. Specifically, the data flow 5-tuple information includes source IP address, destination IP address, source port, destination port, and protocol type, used to identify the data flow transmitted. The data sensitivity tag records the sensitivity level of the encrypted data unit. The selected algorithm identifier records the commercial cryptographic algorithm used. The encryption timestamp records the execution time of the encryption operation. The key index is used to associate the temporary session key used. After collecting the execution logs, they are encapsulated into audit event records. These audit event records use a standardized format to ensure the audit center can correctly parse and process them.

[0042] Audit event logs are uploaded to the audit center via a secure transmission channel. This channel employs the SM9 identifier cryptography algorithm for encryption protection, ensuring that audit event logs are not stolen, tampered with, or leaked during transmission. Upon receiving the audit event logs, the audit center performs digital signature processing. The digital signature uses the SM2 elliptic curve public-key cryptography algorithm; the audit center signs the audit event log using its own SM2 private key, generating a digital signature. The audit event log and digital signature are then archived and stored together. Distributed storage is used for archiving to ensure the security and reliability of the audit logs and prevent log loss or corruption. The archived audit logs can be used for subsequent security audits and traceability. In the event of a data security issue, the audit logs can be used to query the detailed encryption and transmission process, pinpoint the cause of the problem, investigate relevant responsibilities, and provide a basis for optimizing security policies.

[0043] To ensure that the protected data stream can be correctly decrypted and verified by the target receiver, this method also includes a step of decryption and verification of the protected data stream at the receiver. This step corresponds to the encryption processing steps at the sender, forming a complete data encryption-decryption closed loop to ensure data integrity and availability. In specific implementation, after the target receiver captures the protected data stream through its network interface, it first performs preliminary parsing of the data packets, extracting the TCP header options field. Then, it identifies the custom security flag options and extracts the algorithm identifier field, key index field, and initialization vector field from these security flag options. These fields are crucial for the decryption operation.

[0044] The receiving end initiates a key acquisition request to the key management service center based on the extracted key index field. This request includes the key index and the receiving end's own identity certificate. The identity certificate proves the receiving end's legitimate identity, preventing unauthorized devices from obtaining the temporary session key. Upon receiving the key acquisition request, the key management service center first verifies the receiving end's identity certificate, including its validity period, signature authenticity, and whether it has been revoked, ensuring the receiving end is a legitimate target. After successful verification, the center looks up the corresponding encrypted temporary session key in the temporary key table based on the key index. Then, it decrypts the encrypted temporary session key using the receiving end's SM2 private key to obtain the original temporary session key. Because the temporary session key is encrypted using the receiving end's SM2 public key, only the receiving end's SM2 private key can decrypt it, ensuring the confidentiality of the temporary session key and preventing unauthorized devices from obtaining it.

[0045] The key management service center returns the original temporary session key, algorithm identifier field, and initialization vector field to the decryption module at the receiving end. The decryption module instantiates the corresponding commercial cryptographic algorithm from the commercial cryptographic algorithm library based on the algorithm identifier field. Then, it uses the original temporary session key and initialization vector to decrypt the ciphertext payload field of the data packet, recovering the plaintext payload field. The decryption process is the reverse of the encryption process at the sending end. For example, if the sending end uses the SM4 block cipher algorithm with ciphertext block chaining mode for encryption, the receiving end uses the same ciphertext block chaining mode, with the initialization vector as the initial input, and uses the temporary session key to decrypt the ciphertext payload field group by group, recovering the plaintext payload field. If the sending end uses the SM2 elliptic curve public-key cryptography algorithm for encryption, the receiving end uses its own SM2 private key to decrypt the ciphertext payload field, recovering the plaintext payload field and hash value.

[0046] After recovering the plaintext payload field, it needs to undergo integrity and semantic verification to ensure that the data has not been tampered with during transmission and conforms to business logic. Integrity verification uses the SM3 cryptographic hash algorithm. The receiving end hashes the recovered plaintext payload field to generate a receiver hash value. Simultaneously, it extracts the sender-generated hash value from the decrypted data packet (if SM2 encryption is used, this hash value is included; if SM4 encryption is used, the sender hash value is calculated separately and added to the data packet). The two hash values ​​are compared. If they match, the data has not been tampered with during transmission, and integrity is guaranteed. If they do not match, the data has been tampered with, and the receiving end discards the data packet and sends a data tampering alarm to the sending end. Semantic verification combines the logical rules of power grid dispatching operations to verify the content of plaintext payload fields. For example, it verifies whether the format of dispatching instructions is correct, whether the range of measurement data is reasonable, and whether the status information conforms to the normal operating logic of the equipment. If the verification passes, the data is submitted to the dispatching application system for dispatchers to view and use. If the verification fails, the receiving end discards the data packet and sends a data verification failure alarm message to the sending end to ensure that the data submitted to the dispatching application system is legal and valid.

[0047] To further enhance the security of temporary session keys and avoid security risks caused by key expiration or overuse, this method also includes a lifecycle management and automatic update step for temporary session keys. This step is the core of key management and one of the innovative aspects of this technical solution. Through dynamic key lifecycle management, the security and validity of keys are ensured, while preventing data transmission interruptions caused by key updates. In specific implementation, the key management service center sets lifecycle attributes for each generated temporary session key. These attributes include an effective start time, an effective end time, and a maximum number of uses. These attributes are set according to the actual needs of power grid dispatching operations to ensure the rationality of lifecycle management. The effective start time is the time the temporary session key is generated; the effective end time is the expiration time; and the maximum number of uses is the maximum number of times the temporary session key can be used. After exceeding this number, the key will become invalid.

[0048] During the validity period of a temporary session key, the key management service center increments the usage count of the temporary session key each time a key acquisition request is received, recording the key's usage status in real time. When the usage count reaches the maximum number of uses, or when the current time exceeds the expiration date, the key management service center automatically updates the status of the temporary session key to "expired" and rejects any subsequent key acquisition requests for that key index, preventing expired or overused keys from continuing to be used and reducing the risk of key cracking. For expired temporary session keys, the key management service center will destroy them after a preset time, completely deleting the key's related information to prevent key information leakage.

[0049] To ensure continuous data transmission and prevent decryption failures due to expired temporary session keys, the encryption policy execution module checks the remaining validity period and remaining usage count of the currently used temporary session key before each data transmission. The remaining validity period is the difference between the expiration date and the current time, and the remaining usage count is the difference between the maximum usage count and the current usage count. When the remaining validity period falls below a preset update threshold or the remaining usage count falls below a preset usage count threshold, the encryption policy execution module automatically triggers a temporary session key application process. Following the aforementioned temporary session key application steps, it applies to the key management service center for a new temporary session key to replace the soon-to-expire temporary session key. The update threshold and usage count threshold are set reasonably based on the transmission frequency and real-time requirements of the power grid dispatch data to ensure sufficient time for the switch between old and new keys, avoiding data transmission interruptions.

[0050] During the key switching process, a dual-key parallel mechanism is employed. After the new temporary session key is generated, the sending end uses both the old and new keys simultaneously for encryption transmission until it is confirmed that the receiving end has successfully acquired and is using the new temporary session key. Only then does it stop using the old temporary session key, ensuring a smooth transition for the receiving end to decrypt subsequent data streams using the new key and avoiding decryption failures. Simultaneously, information about the key switching is recorded in the encryption policy execution log, including the key index of the old key, the key index of the new key, the switching time, and the reason for the switching, facilitating subsequent key traceability and auditing. Through this dynamic key lifecycle management and automatic update mechanism, "one-time pad" and "dynamic updates" of the temporary session key are achieved, greatly improving key security while ensuring the continuity and reliability of data transmission.

[0051] In summary, this implementation method details the specific implementation process of a dynamic sensing and protection method for power grid dispatch data based on commercial cryptographic algorithms, incorporating designs such as "dynamic sensing of sensitive data," "dynamic matching of commercial cryptographic algorithms," and "dynamic management of temporary session keys." This technical solution, by constructing a complete system encompassing data stream capture, sensitive data sensing, encryption strategy generation, encryption processing, data transmission, decryption verification, key management, and audit traceability, achieves dynamic, efficient, and secure protection of power grid dispatch data. It effectively addresses the problems of insufficient security, resource waste, and poor adaptability in existing power grid dispatch data protection methods, improving the security and reliability of the power grid dispatch system and meeting the actual needs of power grid dispatch operations.

[0052] As is known from common technical knowledge, this invention can be implemented through other embodiments that do not depart from its spirit or essential characteristics. Therefore, the disclosed embodiments described above are merely illustrative in all respects and are not the only ones. All modifications within the scope of this invention or its equivalents are included in this invention.

Claims

1. A method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms, characterized in that, Includes the following steps: The system captures data streams transmitted in the power grid dispatch network in real time, performs protocol parsing and deep packet inspection on the data streams, and obtains raw business data containing dispatch instructions, measurement data and status information. Based on the original business data, a dynamic data perception engine is used to identify sensitive data units in the data stream, and data sensitivity labels are dynamically generated according to the business type to which the data belongs and the current power grid operation status. Based on the data sensitivity label, a matching commercial cryptographic algorithm is dynamically selected from the commercial cryptographic algorithm library, and a temporary session key is allocated to the data stream to generate an encryption strategy; According to the encryption strategy, the sensitive data unit is encrypted, and a security tag containing the algorithm identifier and key index is added to the header of the encrypted data packet to form a protected data stream. The protected data stream is sent to the target receiving end, and the status of the temporary session key is updated after the transmission is completed. At the same time, the encryption policy execution log is uploaded to the audit center.

2. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 1, characterized in that, The steps of real-time capture of data streams transmitted in the power grid dispatch network, protocol parsing and deep packet inspection of the data streams to obtain raw service data containing dispatch instructions, measurement data, and status information specifically include: Bypass deployment of traffic capture probes on the core switches of the power grid dispatch network, and real-time replication of data packets in the network through port mirroring to obtain the original network data stream; The original network data stream is reassembled using the TCP / IP protocol stack. The reassembled data packets are parsed using the application layer protocol according to the IEC60870-5-104 protocol specification or the IEC61850MMS protocol specification. The header and payload fields in the protocol data unit are extracted to obtain the parsed protocol data unit. Deep packet inspection is performed on the load field in the parsed protocol data unit. Based on the preset keyword feature library and regular expression rules, circuit breaker opening and closing commands, transformer tap adjustment commands, and generator output adjustment commands are identified and separated from the load field to form dispatch command data. At the same time, voltage amplitude measurement data, current amplitude measurement data, active power measurement data, and reactive power measurement data of each node are separated to form measurement data. Meanwhile, switch status information, protection device action status information, and equipment operation status information are separated to form status information data. The scheduling instruction data, measurement data, and status information data are associated and combined according to the original timestamps to form structured original business data.

3. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 1, characterized in that, Based on raw business data, a dynamic data awareness engine is used to identify sensitive data units in the data stream, and data sensitivity labels are dynamically generated according to the business type of the data and the current power grid operating status. The specific steps include: The raw business data is input into the dynamic data perception engine. The dynamic data perception engine first performs semantic parsing on the raw business data to identify the business type corresponding to each data record. The business types include scheduling and control business, measurement and acquisition business and status monitoring business. For raw business data of the scheduling and control type, it is directly marked as an inherent sensitive data unit; for raw business data of the measurement and acquisition type or the status monitoring type, a statistical baseline anomaly detection algorithm is used to compare the current measurement value or status value with the statistical baseline of the historical data of the same period. When the deviation exceeds the preset deviation threshold, the current data record is marked as a dynamic sensitive data unit. The current power grid operation status level is obtained from the power grid dispatching system in real time. The power grid operation status level includes normal status, alert status and emergency status. Based on the business type of the data unit, whether it is a dynamic sensitive data unit, and the current power grid operation status level, the predefined sensitivity mapping rule table is queried to assign a data sensitivity label to each data unit. The data sensitivity label levels include low sensitivity, medium sensitivity, high sensitivity, and core sensitivity.

4. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 3, characterized in that, The steps of dynamically selecting matching commercial cryptographic algorithms from a commercial cryptographic algorithm library based on data sensitivity labels, allocating temporary session keys to the data stream, and generating encryption strategies specifically include: Construct a commercial cryptographic algorithm library containing a variety of commercial cryptographic algorithms, including the SM2 elliptic curve public key cryptography algorithm, the SM3 cryptographic hash algorithm, the SM4 block cipher algorithm, and the SM9 identifier cryptography algorithm; Pre-configure the applicable data sensitivity label level and performance overhead metrics for each commercial cryptographic algorithm; Read the data sensitivity label of the current data unit, traverse each commercial cryptographic algorithm in the commercial cryptographic algorithm library, calculate the matching degree between the data length of the data unit and the performance overhead index of the commercial cryptographic algorithm, and select the commercial cryptographic algorithm with the highest matching degree and whose applicable level covers the current data sensitivity label as the matching commercial cryptographic algorithm. A temporary session key application is initiated to the key management service center. The key management service center uses a true random number generator to generate a symmetric key as the temporary session key, and uses the SM2 public key of the receiving end to encrypt and protect the temporary session key, thereby generating an encrypted temporary session key. The encryption strategy for this data unit is formed by associating the algorithm identifier of the matching commercial cryptographic algorithm with the encrypted temporary session key.

5. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 4, characterized in that, The steps of encrypting sensitive data units according to the encryption strategy and adding a security tag containing the algorithm identifier and key index to the header of the encrypted data packet to form a protected data stream include: Based on the algorithm identifier in the encryption strategy, instantiate the corresponding commercial cryptographic algorithm instance from the commercial cryptographic algorithm library; If the matched commercial cryptographic algorithm is the SM4 block cipher algorithm, then the cipher block chaining mode is used to encrypt the payload field of the sensitive data unit, convert the plaintext payload field into the ciphertext payload field, and fill the ciphertext data header with a randomly generated initialization vector. If the matched commercial cryptographic algorithm is the SM2 elliptic curve public key cryptography algorithm, then the SM2 public key of the receiving end is directly used to encrypt the payload field of the sensitive data unit to generate the ciphertext payload field; the encrypted ciphertext payload field replaces the payload field in the original data packet, keeping the IP header and TCP header of the original data packet unchanged, to form the encrypted data packet; In the TCP header options field of the encrypted data packet, a new custom security flag option is added. The security flag option includes an algorithm identifier field, a key index field, and an initialization vector field, wherein the key index field points to the storage location of the encrypted temporary session key as described in claim 4 in the key management service center.

6. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 5, characterized in that, The steps of sending the protected data stream to the target receiver, updating the state of the temporary session key after transmission, and uploading the encryption policy execution log to the audit center include: The encrypted data packet with added security tags is sent to the target receiver along the original routing path; After the data packet is sent, a key status update request is sent to the key management service center. The key status update request includes the key index and usage count of the temporary session key. After receiving the key status update request, the key management service center updates the status of the temporary session key from "in use" to "used" and records the business data identifier and timestamp of this use; Simultaneously, the execution log of this encryption process is collected from the encryption policy execution module. The execution log includes data stream quintuple information, data sensitivity label, selected algorithm identifier, encryption timestamp, and key index. The execution logs are encapsulated as audit event records and uploaded to the audit center through a secure transmission channel. The audit center then digitally signs the execution logs and archives them for subsequent security audits and tracing.

7. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 5, characterized in that, The steps of initiating a temporary session key application to the key management service center, whereby the key management service center generates a symmetric key using a true random number generator as the temporary session key, and encrypts and protects the temporary session key using the receiving end's SM2 public key, specifically include: After receiving a temporary session key application, the key management service center first verifies the initiator's identity certificate and access permissions to confirm that the initiator has the authority to apply for the corresponding data sensitivity label. The built-in quantum random number generator collects circuit noise and photonic noise, and generates a true random number sequence through entropy extraction and post-processing algorithms. The true random number sequence is used as the original key material for the temporary session key. Query the target receiver's SM2 public key certificate from the database of the key management service center, and verify the validity and revocation status of the SM2 public key certificate; The temporary session key is encrypted using the SM2 elliptic curve public key encryption algorithm with the verified SM2 public key to generate an encrypted temporary session key, and a globally unique key index is assigned to the encrypted temporary session key. The key index is associated with the encrypted temporary session key and stored in the temporary key table of the key management service center, and the key index and the encrypted temporary session key are returned to the initiator.

8. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 7, characterized in that, In the TCP header options field of the encrypted data packet, a new custom security flag option is added. This security flag option includes the steps of an algorithm identifier field, a key index field, and an initialization vector field, specifically: In the TCP header options field, a unique option type number that has not yet been assigned by IANA is used to identify the option as a custom security tag option. In the security tag option, a fixed-length data structure is allocated, in which the first 2 bytes store an algorithm identifier field, which uses an enumerated value to represent the SM2, SM3, SM4 or SM9 algorithm; The next 4 bytes store the key index field, which is a numerical representation of the globally unique key index; Next, 8 bytes are used to store the initialization vector field, which is the initialization vector value used during SM4 encryption. When assembling TCP packets at the sending end, the above three fields are filled into the numerical part of the security flag option in a predetermined order, and the TCP header checksum is calculated to ensure that the security flag option is not modified or discarded by intermediate network devices. After receiving the data packet, the receiving end parses the TCP header option field, identifies the security flag option, and extracts the algorithm identifier field, key index field, and initialization vector field from it for subsequent decryption operations.

9. The method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 1, characterized in that, It also includes the steps of decrypting and verifying the protected data stream at the receiving end, specifically including: After the target receiver captures the protected data stream, it first parses the TCP header options field of the data packet and extracts the algorithm identifier field, key index field, and initialization vector field from the security tag options; The receiving end initiates a key acquisition request to the key management service center based on the key index field. The key acquisition request includes the key index and the receiving end's own identity certificate. After verifying the validity of the receiving end's identity certificate, the key management service center looks up the encrypted temporary session key corresponding to the key index in the temporary key table, and decrypts the encrypted temporary session key using the receiving end's SM2 private key to obtain the original temporary session key. The original temporary session key, algorithm identifier field, and initialization vector field are returned to the decryption module at the receiving end. The decryption module instantiates the corresponding commercial cryptographic algorithm based on the algorithm identifier field, and uses the original temporary session key and initialization vector to perform decryption operations on the ciphertext payload field of the data packet to recover the plaintext payload field. The recovered plaintext payload fields are subjected to integrity and semantic verification to confirm that the data has not been tampered with during transmission and conforms to business logic. The verified data is then submitted to the scheduling application system.

10. A method for dynamic sensing and protection of power grid dispatch data based on commercial cryptographic algorithms according to claim 4, characterized in that, It also includes steps for lifecycle management and automatic renewal of temporary session keys, specifically including: The Key Management Service Center sets lifecycle attributes for each generated temporary session key, including the effective start time, effective end time, and maximum number of uses. During the validity period of the temporary session key, each time a key acquisition request is received, the key management service center increments the count of the number of times the temporary session key has been used; When the usage count reaches the maximum, or when the current time exceeds the expiration time, the Key Management Service Center will automatically update the status of the temporary session key to "expired" and reject any subsequent key acquisition requests for that key index. In the encryption policy execution module, before each data transmission, the remaining validity period and remaining usage count of the currently used temporary session key are checked. When the remaining validity period is lower than the preset update threshold or the remaining usage count is lower than the preset number of times threshold, the temporary session key application process described in claim 4 is automatically triggered to apply for a new temporary session key to replace the temporary session key that is about to expire. Information about the switch between the old and new keys is recorded in the encryption policy execution log to ensure that the data receiving end can smoothly transition to using the new key to decrypt subsequent data streams.

Images