An encryption communication management system and method applied to an intelligent power distribution terminal

Abstract

The application discloses an encryption communication management system and method applied to an intelligent power distribution terminal, and relates to the technical field of big data analysis.The root key is allocated to the power distribution terminal, the first communication moment is recorded as the time origin, time periods are divided, and the number of data packets in each time period is counted; according to the root key, the current time period serial number and the global data packet cumulative number, five effective keys of the current and each two time periods are calculated to form a sliding window; the receiving end uses the sliding window to try decryption in turn, obtains the real time period serial number of the data packet after successful decryption, and calculates the relative clock drift amount; the drift amounts of all times are stored in a circular buffer queue and a delay curve is drawn, and the local time period serial number is compensated; after compensation, if decryption fails, invalidation information is fed back, the data packet is not counted and manual maintenance is triggered.The application can realize dynamic updating without additional key negotiation, has high security and communication continuity, and has closed-loop fault tolerance.

Description

Technical Field

[0001] This invention relates to the field of big data analytics, specifically to an encrypted communication management system and method for intelligent power distribution terminals. Background Technology

[0002] In the encrypted communication management of intelligent power distribution terminals, dynamic key update mechanisms are widely used to defend against increasingly severe cyberattack threats. This mechanism reduces the security risks caused by long-term key exposure by periodically changing the communication key. The higher the update frequency, the shorter the window of opportunity for the key to be cracked, and the stronger the security.

[0003] However, existing dynamic key update schemes require pausing business data transmission and sending additional key negotiation messages during each update, resuming business only after both parties have confirmed the changes. If the key update cycle is too short, frequent negotiation interactions will significantly increase the probability of communication interruption, impairing business continuity; if the cycle is too long, security will decrease, failing to meet high security requirements. Summary of the Invention

[0004] The purpose of this invention is to provide an encrypted communication management system and method for intelligent power distribution terminals, so as to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an encrypted communication management method applied to intelligent power distribution terminals, the encrypted communication management method comprising the following steps: Step S1: Assign a root key to the power distribution terminal, and record the time of the first connection between the power distribution terminal and the master station as the starting point to form a time axis. Divide the time axis into time periods of a preset length and output the time period sequence number. Count the number of data packets transmitted between the power distribution terminal and the master station. Step S2: Calculate the valid key for the current time period n based on the root key, the current time period number, and the cumulative number of global data packets. At the same time, cache the five valid keys n-2, n-1, n, n+1, and n+2 to form a sliding window. Step S3: After receiving the data packet, the receiving end uses a sliding window to try to decrypt it in turn. After successful decryption, the time period sequence number of the data packet is extracted and the difference between it and the current time period sequence number of the receiving end is calculated to obtain the relative clock drift. Step S4: The receiving end extracts all relative clock drift amounts, plots the delay curve, and compensates for the time period sequence number of the subsequently received data packets.

[0006] Furthermore, the specific steps of step S1 are as follows: A root key is assigned to each power distribution terminal, and the moment when the power distribution terminal first establishes a communication connection with the master station is recorded as the time origin. A continuously increasing time axis is constructed based on the time origin. The time axis is divided into multiple sequentially arranged time periods according to a preset time length, and each time period is assigned a time period number that monotonically increases with its time sequence. The time period number is used to identify the time interval where the data transmission occurs. The preset time length refers to a fixed time span value that is preset and fixed in the terminal and master station configuration file by the operation and maintenance personnel in the initial configuration stage before the power distribution terminal is put into operation, based on the data acquisition density or communication protocol standard of the power distribution network. During the communication process between the power distribution terminal and the master station, the number of data packets transmitted in each time period is accumulated and counted. The data packets include the time period number and the data to be transmitted. Each data packet is counted independently, and the counting result is used as the statistical value of the number of data packets in that time period.

[0007] Furthermore, the specific steps of step S2 are as follows: The three input variables are the root key, the target time period number, and the cumulative number of global data packets corresponding to the start time of the target time period. The target time period number is the time period number of the key to be calculated on the time axis. The cumulative number of global data packets is the total count of all data packets transmitted between the distribution terminal and the master station from the time origin to the start time of the target time period. The total count is obtained by summing the number of data packets in each time period. The three input variables are combined into a fixed-length bit string according to a preset function, which serves as the valid key corresponding to the target time period number. The preset function refers to a deterministic mathematical mapping rule that is pre-designed by the developers and built into the power distribution terminal security chip and the main station encryption module, which maps the root key, the target time period sequence number and the cumulative number of global data packets. Let the current time period number be denoted as n, and take n-2, n-1, n, n+1, and n+2 as five target time period numbers to be calculated. For each target time period number, combine the root key and the corresponding global cumulative data packet number to calculate the effective key of n-1, n-2, n, n+1, and n+2 respectively. The valid key is used to encrypt and decrypt data packets within the current time period and is the core element for realizing dynamic key updates; The five calculated valid keys are used to construct a sliding window containing five consecutive sequence positions in ascending order of time period numbers. When the local current time period number advances to the next number along the time axis, the valid key of the first time period number in the window is removed and the valid key corresponding to the current time period number is added. The number of global data packets used to calculate the valid key of n+1 and the valid key of n+2 is the cumulative number of global data packets n.

[0008] The sliding window allows the receiver to attempt decryption using multiple keys within the window when the time is out of sync, tolerating a certain amount of clock drift and avoiding decryption failure due to drift. Furthermore, the specific steps of step S3 are as follows: After receiving the data packet, the receiving end obtains the current sliding window. The receiving end uses each valid key in the sliding window as the decryption key in the order of the time period number from newest to oldest, and performs decryption operation on the ciphertext field. When a valid key is successfully decrypted, the receiving end marks the valid key as the matching key and records the time period sequence number corresponding to the matching key as the real time period sequence number of the data packet. The receiving end performs a difference operation between the real time period sequence number of the data packet and the current time period sequence number of the receiving end, and records it as the relative clock drift amount. The relative clock drift is used to quantify the time offset caused by clock asynchrony or network delay between the two communicating parties, providing a basis for subsequent compensation. Furthermore, the specific steps of step S4 are as follows: After successfully decrypting a data packet and obtaining the relative clock drift, the receiving end stores the relative clock drift as a data element in a pre-set fixed-length circular buffer queue according to the order of successful decryption. When storing a new data element, if the circular buffer queue is full, it overwrites the data element that has been stored in the queue the longest. Each data element in the circular buffer queue is accompanied by a corresponding receiving sequence number, which is the total number of data packets successfully decrypted since the receiving end started. The receiving end saves all data elements in the circular buffer queue and their corresponding receiving sequence numbers as a two-dimensional ordered point set, where each point in the two-dimensional ordered point set consists of the receiving sequence number and the relative clock drift. The preset fixed length refers to the maximum capacity value of the circular queue used to store the sample data of each relative clock drift, which is pre-allocated at system startup based on the maximum random access memory overhead allowed by the embedded hardware of the power distribution terminal. The receiving end extracts all data elements and their corresponding receiving sequence numbers from the circular buffer queue, forming a set containing multiple two-dimensional points; the receiving end uses the receiving sequence number as the independent variable and the relative clock drift as the dependent variable, and connects two adjacent data points with straight line segments in sequence to form a broken line composed of continuous straight line segments, which is called the delay curve. The circular buffer queue can store a fixed number of recent drift samples, which limits memory usage and ensures that the data used to plot the delay curve is always the latest history, reflecting the recent communication status. The delay curve can intuitively reflect the trend of relative clock drift as the receiving order changes, and is used to predict future drift, thereby guiding the compensation of time period sequence number; Tracing back from the delay curve, the receiver finds the receiving sequence number m with the smallest difference between the relative clock drift and the end. The relative clock drift F corresponding to m+1 is used as the predicted relative clock drift for the current receiving sequence number. The receiver obtains the current local time period number and performs an addition operation between the predicted relative clock drift and the current local time period number. The result is used as the compensated local time period number. Based on the compensated local time period number, the receiver constructs a sliding window to decrypt the data packet. If decryption fails, the receiver reports a data packet failure to the sender. At the same time, the sender does not count the data packet and performs manual inspection.

[0009] The predicted relative clock drift is used to perform additive compensation on the local time period sequence number at the receiving end, so as to eliminate the window offset that may be caused by drift when decrypting future data packets in advance, thereby improving the decryption success rate.

[0010] Furthermore, the encrypted communication management system includes a root key timing management module, a dynamic key generation module, a receiver decryption verification module, and a delay compensation module; The root key timing management module is used to allocate root keys to power distribution terminals, record the communication time start point and divide time periods, and count the number of data packets transmitted in each time period. The dynamic key generation module is used to calculate the effective key based on the root key, time period sequence number and the cumulative number of global data packets, and maintain a continuous sliding window. The receiver decryption verification module is used to attempt to decrypt the received data packets using the key in the sliding window, and calculate the relative clock drift between the decrypted time period sequence number and the local current sequence number. The delay compensation module is used to store the relative clock drift values ​​in each iteration, plot the delay curve, and predict the subsequent drift value based on the curve to compensate for the local time period sequence number.

[0011] Furthermore, the root key timing management module includes a time axis division unit and a data packet counting unit; The time axis division unit is used to divide the communication time axis into continuous time periods according to a preset length and output the sequence number of each time period; the data packet counting unit is used to count the cumulative number of data packets transmitted between the power distribution terminal and the master station in each time period.

[0012] Furthermore, the dynamic key generation module includes an effective key calculation unit and a sliding window caching unit; The effective key calculation unit is used to calculate the effective key corresponding to the current time and each of the five time periods; the sliding window caching unit is used to cache five consecutive effective keys and update the window content as the time period progresses.

[0013] Furthermore, the receiving end decryption verification module includes a window decryption attempt unit and a clock drift calculation unit; The window decryption attempt unit is used to decrypt the ciphertext field sequentially using the valid keys in the sliding window until successful; the clock drift calculation unit is used to calculate the difference between the time period sequence number of the data packet obtained after successful decryption and the current time period sequence number of the receiving end to obtain the relative clock drift amount.

[0014] Furthermore, the delay compensation module includes a delay curve plotting unit and a time period sequence number compensation unit; The delay curve plotting unit is used to construct a two-dimensional point set of relative clock drift according to the receiving order and connect them into a broken line as a delay curve; the time period sequence number compensation unit is used to perform additive compensation on the current local time period sequence number based on the predicted drift value at the end of the delay curve.

[0015] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention dynamically generates a valid key by combining the root key with the time period sequence number and the cumulative number of global data packets. Key updates can be completed without additional key negotiation messages, avoiding frequent negotiation interruptions to business data transmission, significantly reducing the probability of communication interruption, and ensuring continuous transmission of business data between the smart power distribution terminal and the master station. At the same time, the key changes with both data packet count and time, effectively resisting replay and cracking attacks, and balancing high security and high reliability.

[0016] 2. This invention uses a sliding window to cache five valid keys for the current time period and two time periods before and after. When the receiving end decrypts, it tries them sequentially, allowing for a maximum of two time periods of clock drift between the communicating parties. Decryption can be successful without precise synchronization, effectively tolerating network latency and clock deviation, significantly improving the decryption success rate, avoiding data packet loss due to slight clock asynchrony, and enhancing the system's adaptability to complex field communication environments.

[0017] 3. This invention records the relative clock drift obtained from each decryption through a circular buffer queue, plots the delay curve and predicts the future drift, performs additive compensation on the local time period sequence number to eliminate the drift effect in advance, and provides feedback on failure information when decryption fails, without the sending end counting it and triggering manual maintenance, forming a closed-loop fault tolerance mechanism, further improving the decryption success rate and system self-healing capability, and ensuring long-term stable operation. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating an encrypted communication management method for intelligent power distribution terminals according to the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example 1: As Figure 1 As shown, the present invention provides a technical solution, an encrypted communication management method applied to intelligent power distribution terminals, the encrypted communication management method comprising the following steps: Step S1: Assign a root key to the power distribution terminal, and record the time of the first connection between the power distribution terminal and the master station as the starting point to form a time axis. Divide the time axis into time periods of a preset length and output the time period sequence number. Count the number of data packets transmitted between the power distribution terminal and the master station. The specific steps of step S1 are as follows: A root key is assigned to each power distribution terminal, and the moment when the power distribution terminal first establishes a communication connection with the master station is recorded as the time origin. A continuously increasing time axis is constructed based on the time origin. The time axis is divided into multiple sequentially arranged time periods according to a preset time length, and each time period is assigned a time period number that monotonically increases with its time sequence. The time period number is used to identify the time interval where the data transmission occurs. During the communication process between the power distribution terminal and the master station, the number of data packets transmitted in each time period is accumulated and counted. The data packets include the time period number and the data to be transmitted. Each data packet is counted independently, and the counting result is used as the statistical value of the number of data packets in that time period. Step S2: Calculate the valid key for the current time period n based on the root key, the current time period number, and the cumulative number of global data packets. At the same time, cache the five valid keys n-2, n-1, n, n+1, and n+2 to form a sliding window. The specific steps of step S2 are as follows: The three input variables are the root key, the target time period number, and the cumulative number of global data packets corresponding to the start time of the target time period. The target time period number is the time period number of the key to be calculated on the time axis. The cumulative number of global data packets is the total count of all data packets transmitted between the distribution terminal and the master station from the time origin to the start time of the target time period. The total count is obtained by summing the number of data packets in each time period. The three input variables are combined into a fixed-length bit string according to a preset function, which serves as the valid key corresponding to the target time period number. Let the current time period number be denoted as n, and take n-2, n-1, n, n+1, and n+2 as five target time period numbers to be calculated. For each target time period number, combine the root key and the corresponding global cumulative data packet number to calculate the effective key of n-1, n-2, n, n+1, and n+2 respectively. The five calculated valid keys are used to construct a sliding window containing five consecutive sequence positions in ascending order of time period numbers. When the local current time period number advances to the next number along the time axis, the valid key of the first time period number in the window is removed and the valid key corresponding to the current time period number is added. The number of global data packets used to calculate the valid key of n+1 and the valid key of n+2 is the cumulative number of global data packets n. Step S3: After receiving the data packet, the receiving end uses a sliding window to try to decrypt it in turn. After successful decryption, the time period sequence number of the data packet is extracted and the difference between it and the current time period sequence number of the receiving end is calculated to obtain the relative clock drift. The specific steps of step S3 are as follows: After receiving the data packet, the receiving end obtains the current sliding window. The receiving end uses each valid key in the sliding window as the decryption key in the order of the time period number from newest to oldest, and performs decryption operation on the ciphertext field. When a valid key is successfully decrypted, the receiving end marks the valid key as the matching key and records the time period sequence number corresponding to the matching key as the real time period sequence number of the data packet. The receiving end performs a difference operation between the real time period sequence number of the data packet and the current time period sequence number of the receiving end, and records it as the relative clock drift amount. Step S4: The receiving end extracts all relative clock drift amounts, plots the delay curve, and compensates for the time period sequence number of the subsequently received data packets. The specific steps of step S4 are as follows: After successfully decrypting a data packet and obtaining the relative clock drift, the receiving end stores the relative clock drift as a data element in a pre-set fixed-length circular buffer queue according to the order of successful decryption. When storing a new data element, if the circular buffer queue is full, it overwrites the data element that has been stored in the queue the longest. Each data element in the circular buffer queue is accompanied by a corresponding receiving sequence number, which is the total number of data packets successfully decrypted since the receiving end started. The receiving end saves all data elements in the circular buffer queue and their corresponding receiving sequence numbers as a two-dimensional ordered point set, where each point in the two-dimensional ordered point set consists of the receiving sequence number and the relative clock drift. The receiving end extracts all data elements and their corresponding receiving sequence numbers from the circular buffer queue, forming a set containing multiple two-dimensional points; the receiving end uses the receiving sequence number as the independent variable and the relative clock drift as the dependent variable, and connects two adjacent data points with straight line segments in sequence to form a broken line composed of continuous straight line segments, which is called the delay curve. Tracing back from the delay curve, the receiver finds the receiving sequence number m with the smallest difference between the relative clock drift and the end. The relative clock drift F corresponding to m+1 is used as the predicted relative clock drift for the current receiving sequence number. The receiver obtains the current local time period number and performs an addition operation between the predicted relative clock drift and the current local time period number. The result is used as the compensated local time period number. Based on the compensated local time period number, the receiver constructs a sliding window to decrypt the data packet. If decryption fails, the receiver reports a data packet failure to the sender. At the same time, the sender does not count the data packet and performs manual inspection.

[0021] The encrypted communication management system includes a root key timing management module, a dynamic key generation module, a receiver decryption verification module, and a delay compensation module. The root key timing management module is used to allocate root keys to power distribution terminals, record the communication time start point and divide time periods, and count the number of data packets transmitted in each time period. The dynamic key generation module is used to calculate the effective key based on the root key, time period sequence number and the cumulative number of global data packets, and maintain a continuous sliding window. The receiver decryption verification module is used to attempt to decrypt the received data packets using the key in the sliding window, and calculate the relative clock drift between the decrypted time period sequence number and the local current sequence number. The delay compensation module is used to store the relative clock drift values ​​in each iteration, plot the delay curve, and predict the subsequent drift value based on the curve to compensate for the local time period sequence number.

[0022] The root key timing management module includes a time axis division unit and a data packet counting unit; The time axis division unit is used to divide the communication time axis into continuous time periods according to a preset length and output the sequence number of each time period; the data packet counting unit is used to count the cumulative number of data packets transmitted between the power distribution terminal and the master station in each time period.

[0023] The dynamic key generation module includes an effective key calculation unit and a sliding window caching unit; The effective key calculation unit is used to calculate the effective key corresponding to the current time and each of the five time periods; the sliding window caching unit is used to cache five consecutive effective keys and update the window content as the time period progresses.

[0024] The receiving end decryption verification module includes a window decryption attempt unit and a clock drift calculation unit; The window decryption attempt unit is used to decrypt the ciphertext field sequentially using the valid keys in the sliding window until successful; the clock drift calculation unit is used to calculate the difference between the time period sequence number of the data packet obtained after successful decryption and the current time period sequence number of the receiving end to obtain the relative clock drift amount.

[0025] The delay compensation module includes a delay curve plotting unit and a time period sequence number compensation unit; The delay curve plotting unit is used to construct a two-dimensional point set of relative clock drift according to the receiving order and connect them into a broken line as a delay curve; the time period sequence number compensation unit is used to perform additive compensation on the current local time period sequence number based on the predicted drift value at the end of the delay curve.

[0026] In this embodiment, taking the intelligent distribution terminal FTU-001 deployed on a 10kV distribution line as an example, the terminal communicates with the distribution master station via a wireless public network. Before FTU-001 is put into operation, the security management platform of the distribution master station assigns a 128-bit root key RK_FTU001 to the terminal, which is securely stored in the terminal's security chip in encrypted form.

[0027] The moment when the FTU-001 first establishes a communication connection with the power distribution master station is recorded as the time origin T. A continuously increasing time axis is constructed based on T, and the time is divided into several consecutive time periods according to a preset time length Δt = 60 seconds. Each time period is assigned a time period number that increases monotonically with its time sequence. The first time period is numbered 1, the second time period is numbered 2, and so on. The time period number is used to identify the time interval in which data is transmitted.

[0028] During communication between FTU-001 and the master station, the number of data packets transmitted in each time period is cumulatively counted. The ciphertext field is the ciphertext of the data to be transmitted after being encrypted with a valid key. For example, if FTU-001 uploads 15 data packets to the master station in the first time period, the count for the first time period is 15; if it uploads 22 data packets in the second time period, the count for the second time period is 22, and so on.

[0029] Using the root key RK_FTU001, the target time period number n, and the cumulative number of global data packets Count(n) corresponding to the start time of the target time period as three input variables, a valid key is generated according to a preset function. The key generation function used in this embodiment is: Key(n)=SM4_Encrypt(RK_FTU001,n||Count(n)||Padding) Where || represents bit string concatenation, Padding is the padding bits required to fill to an integer multiple of 128 bits, and SM4_Encrypt is the national standard SM4 block encryption algorithm. The global cumulative number of data packets Count(n) is the total count of all data packets transmitted from the origin T to the start time of the target time period, for example, Count(3) = 15 + 22 = 37.

[0030] Assuming the current local time period number is n=5, we take five target time period numbers: n-2=3, n-1=4, n=5, n+1=6, and n+2=7. Combined with the root key RK_FTU001 and the global cumulative data packet counts Count(3), Count(4), Count(5), Count(6), and Count(7) for each target time period, we calculate five valid keys: Key(3), Key(4), Key(5), Key(6), and Key(7). We then construct a sliding window W=[Key(3),Key(4),Key(5),Key(6),Key(7)] in ascending order of the time period number. When the current local time period number advances to 6, we remove the existing Key(3) from the window and calculate Key(8), adding it to the end of the window. The updated sliding window is W=[Key(4),Key(5),Key(6),Key(7),Key(8)]. The global cumulative data packet count used for calculating Key(6) and Key(7) is Count(5).

[0031] After receiving the data packet sent by FTU-001, the receiving end obtains the current sliding window W. The current local time period sequence number of the receiving end is 5, while the actual time period sequence number carried in the received data packet is 4.

[0032] The receiving end attempts to decrypt the data packet sequentially from newest to oldest time period numbers. First, it attempts to decrypt the ciphertext field using Key(5), which fails. Then, it attempts to decrypt using Key(4), which succeeds. The receiving end marks Key(4) as the matching key and records the time period number 4 corresponding to the matching key as the actual time period number of the data packet. Subsequently, the receiving end performs a difference operation between the actual time period number 4 and the current time period number 5, obtaining a relative clock drift Δ = 4 - 5 = -1, indicating that the data packet is one time period behind the receiving end's local time.

[0033] After successfully decrypting a data packet and obtaining the relative clock drift, the receiving end stores the drift as a data element in a pre-defined fixed-length circular buffer queue of length L=100. Each data element in the queue is accompanied by a corresponding receiving order number k. Assume that the current circular buffer queue contains 100 data elements, forming a two-dimensional ordered point set P={(1,Δ1),(2,Δ2),...,(100,Δ1),(2,Δ2),...,(100,Δ1),(2,Δ2),(2,Δ3),(2,Δ4),(2,Δ5),(2,Δ6),(2,Δ7),(2,Δ8),(2,Δ9),(2,Δ1),(2,Δ1),(2,Δ1),(2,Δ2 ... 100 )}, where the horizontal axis represents the receiving sequence number and the vertical axis represents the relative clock drift.

[0034] The receiver uses the reception sequence number as the independent variable and the relative clock drift as the dependent variable, connecting adjacent data points sequentially with straight line segments to form a delay curve. Tracing back from the end of the delay curve, assuming the reception sequence number with the smallest drift difference from the end is m=95, then the relative clock drift Δ corresponding to m+1=96 is... 96 =F is the predicted relative clock drift amount as the current reception sequence number.

[0035] Assuming the predicted relative clock drift is F=+2, and the receiver obtains the current local time period number as 100, then the predicted relative clock drift is added to the current local time period number to obtain the compensated local time period number as 102.

[0036] The receiving end uses the compensated local current time period number 102 as a basis to construct a sliding window [Key(100), Key(101), Key(102), Key(103), Key(104)] to decrypt subsequent data packets. If decryption fails, the receiving end reports a data packet failure to the sending end. The sending end does not count this data packet and triggers a manual inspection process.

[0037] On the other hand, taking the actual operating data of FTU-001 after 24 hours of continuous operation as an example, the clock drift compensation effect of the present invention will be explained.

[0038] Assume FTU-001 has been running continuously for 24 hours since time origin T, and the current local time period number is n=1440. During operation, due to the uncertainty of wireless public network transmission, the actual arrival time of data packets fluctuates randomly relative to the sending end time, resulting in several samples of relative clock drift.

[0039] The receiver's circular buffer queue stores the relative clock drift values ​​obtained from the last 100 successful decryptions, which fluctuate between -3 and +3. After plotting these sample points as a delay curve, the receiver finds that the predicted drift value is F=-2 through backtracking. The receiver then compensates the local current time period number with the predicted value F=-2, obtaining the compensated number 1438, and constructs a sliding window [Key(1436), Key(1437), Key(1438), Key(1439), Key(1440)] based on the compensated number.

[0040] If a data packet fails to decrypt after all five keys in the sliding window have been tried, it indicates that the data packet may be unrecoverable due to a serious communication anomaly. The receiving end sends a data packet failure message back to the sending end. The sending end does not count this data packet and triggers a manual maintenance process, where maintenance personnel troubleshoot the communication link fault through remote diagnostics or on-site inspection.

[0041] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for encrypted communication management applied to intelligent power distribution terminals, characterized in that: The encrypted communication management method includes the following steps: Step S1: Assign a root key to the power distribution terminal, and record the time of the first connection between the power distribution terminal and the master station as the starting point to form a time axis. Divide the time axis into time periods of a preset length and output the time period sequence number. Count the number of data packets transmitted between the power distribution terminal and the master station. Step S2: Calculate the valid key for the current time period n based on the root key, the current time period number, and the cumulative number of global data packets. At the same time, cache the five valid keys n-2, n-1, n, n+1, and n+2 to form a sliding window. The specific steps of step S2 are as follows: The three input variables are the root key, the target time period number, and the cumulative number of global data packets corresponding to the start time of the target time period. The target time period number is the time period number of the key to be calculated on the time axis. The cumulative number of global data packets is the total count of all data packets transmitted between the distribution terminal and the master station from the time origin to the start time of the target time period. The total count is obtained by summing the number of data packets in each time period. The three input variables are combined into a fixed-length bit string according to a preset function, which serves as the valid key corresponding to the target time period number. Let the current time period number be denoted as n, and take n-2, n-1, n, n+1, and n+2 as five target time period numbers to be calculated. For each target time period number, combine the root key and the corresponding global cumulative data packet number to calculate the effective key of n-1, n-2, n, n+1, and n+2 respectively. The five calculated valid keys are used to construct a sliding window containing five consecutive sequence positions in ascending order of time period numbers. When the local current time period number advances to the next number along the time axis, the valid key of the first time period number in the window is removed and the valid key corresponding to the current time period number is added. The number of global data packets used to calculate the valid key of n+1 and the valid key of n+2 is the cumulative number of global data packets n. Step S3: After receiving the data packet, the receiving end uses a sliding window to try to decrypt it in turn. After successful decryption, the time period sequence number of the data packet is extracted and the difference between it and the current time period sequence number of the receiving end is calculated to obtain the relative clock drift. Step S4: The receiving end extracts all relative clock drift amounts, plots the delay curve, and compensates for the time period sequence number of the subsequently received data packets. The specific steps of step S4 are as follows: After successfully decrypting a data packet and obtaining the relative clock drift, the receiving end stores the relative clock drift as a data element in a pre-set fixed-length circular buffer queue according to the order of successful decryption. When storing a new data element, if the circular buffer queue is full, it overwrites the data element that has been stored in the queue the longest. Each data element in the circular buffer queue is accompanied by a corresponding receiving sequence number, which is the total number of data packets successfully decrypted since the receiving end started. The receiving end saves all data elements in the circular buffer queue and their corresponding receiving sequence numbers as a two-dimensional ordered point set, where each point in the two-dimensional ordered point set consists of the receiving sequence number and the relative clock drift. The receiving end extracts all data elements and their corresponding receiving sequence numbers from the circular buffer queue, forming a set containing multiple two-dimensional points; the receiving end uses the receiving sequence number as the independent variable and the relative clock drift as the dependent variable, and connects two adjacent data points with straight line segments in sequence to form a broken line composed of continuous straight line segments, which is called the delay curve. Tracing back from the delay curve, the receiver finds the receiving sequence number m with the smallest difference between the relative clock drift and the end. The relative clock drift F corresponding to m+1 is used as the predicted relative clock drift for the current receiving sequence number. The receiver obtains the current local time period number and performs an addition operation between the predicted relative clock drift and the current local time period number. The result is used as the compensated local time period number. Based on the compensated local time period number, the receiver constructs a sliding window to decrypt the data packet. If decryption fails, the receiver reports a data packet failure to the sender. At the same time, the sender does not count the data packet and performs manual inspection.

2. The encrypted communication management method for intelligent power distribution terminals according to claim 1, characterized in that: The specific steps of step S1 are as follows: A root key is assigned to each power distribution terminal, and the moment when the power distribution terminal first establishes a communication connection with the master station is recorded as the time origin. A continuously increasing time axis is constructed based on the time origin. The time axis is divided into multiple sequentially arranged time periods according to a preset time length, and each time period is assigned a time period number that monotonically increases with its time sequence. The time period number is used to identify the time interval where the data transmission occurs. During the communication between the power distribution terminal and the master station, the number of data packets transmitted in each time period is accumulated and counted. The data packets include the time period number and the data to be transmitted. Each data packet is counted independently, and the counting result is used as the statistical value of the number of data packets in that time period.

3. The encrypted communication management method for intelligent power distribution terminals according to claim 1, characterized in that: The specific steps of step S3 are as follows: After receiving the data packet, the receiving end obtains the current sliding window. The receiving end uses each valid key in the sliding window as the decryption key in the order of the time period number from newest to oldest, and performs decryption operation on the ciphertext field. Once a valid key is successfully decrypted, the receiving end marks the valid key as the matching key and records the time period sequence number corresponding to the matching key as the actual time period sequence number of the data packet. The receiving end performs a difference operation between the actual time period sequence number of the data packet and the current time period sequence number of the receiving end, and records it as the relative clock drift amount.

4. An encrypted communication management system for intelligent power distribution terminals, which is applied to the encrypted communication management method for intelligent power distribution terminals as described in any one of claims 1-3, characterized in that: The encrypted communication management system includes a root key timing management module, a dynamic key generation module, a receiver decryption verification module, and a delay compensation module. The root key timing management module is used to allocate root keys to power distribution terminals, record the communication time start point and divide time periods, and count the number of data packets transmitted in each time period. The dynamic key generation module is used to calculate a valid key based on the root key, time period sequence number, and cumulative number of global data packets, and maintain a continuous sliding window; the receiving end decryption verification module is used to attempt to decrypt the received data packets using the key within the sliding window, and calculate the relative clock drift between the decrypted time period sequence number and the local current sequence number; the delay compensation module is used to store the relative clock drift amounts in each iteration, plot the delay curve, and predict subsequent drift amounts based on the curve to compensate for the local time period sequence number.

5. The encrypted communication management system for intelligent power distribution terminals according to claim 4, characterized in that: The root key timing management module includes a time axis division unit and a data packet counting unit; The time axis division unit is used to divide the communication time axis into continuous time periods according to a preset length and output the sequence number of each time period; the data packet counting unit is used to count the cumulative number of data packets transmitted between the power distribution terminal and the master station in each time period.

6. The encrypted communication management system for intelligent power distribution terminals according to claim 4, characterized in that: The dynamic key generation module includes an effective key calculation unit and a sliding window caching unit; The effective key calculation unit is used to calculate the effective key corresponding to the current time and each of the five time periods; the sliding window caching unit is used to cache five consecutive effective keys and update the window content as the time period progresses.

7. The encrypted communication management system for intelligent power distribution terminals according to claim 4, characterized in that: The receiving end decryption verification module includes a window decryption attempt unit and a clock drift calculation unit; The window decryption attempt unit is used to decrypt the ciphertext field sequentially using the valid keys in the sliding window until successful; the clock drift calculation unit is used to calculate the difference between the time period sequence number of the data packet obtained after successful decryption and the current time period sequence number of the receiving end to obtain the relative clock drift amount.

8. The encrypted communication management system for intelligent power distribution terminals according to claim 4, characterized in that: The delay compensation module includes a delay curve plotting unit and a time period sequence number compensation unit; The delay curve plotting unit is used to construct a two-dimensional point set of relative clock drift according to the receiving order and connect them into a broken line as a delay curve; the time period sequence number compensation unit is used to perform additive compensation on the current local time period sequence number based on the predicted drift value at the end of the delay curve.

Images