Lightweight endogenous security encryption method and device for adapting power edge communication terminal, storage medium and computer equipment

Abstract

The application discloses a lightweight endogenous security encryption method and device suitable for a power edge communication terminal, a storage medium and computer equipment, and relates to the field of power edge communication terminal security encryption. The method comprises the following steps: after the power edge communication terminal receives service data, the service type is identified in real time, and characteristic parameters are extracted, and a service characteristic matrix is constructed; based on the matrix, the number of encryption rounds, the dynamic key update period, the segment check length and the error correction strength of each type of service are determined; the dynamic key is generated according to the update period; for the service data, the data is segmented according to the segment check length, and the segment check code and the global check code are generated; the data segments are encrypted based on the number of encryption rounds and the dynamic key, and the encryption frame unit is generated by combining the segment check code, the error correction code and the global check code, and finally the encryption is completed and the encryption is sent. While guaranteeing the security requirements of multiple types of services under the limited resources of the power edge communication terminal, the dynamic balance between encryption efficiency and protection capability is realized.

Description

Technical Field

[0001] This application relates to the field of power communication security technology, and in particular to a lightweight intrinsic security encryption method, device, storage medium and computer equipment adapted to power edge communication terminals. Background Technology

[0002] With the rapid development of the power Internet of Things and smart distribution networks, power edge communication terminals (smart converged terminals, distribution terminals, line monitoring terminals, etc.) serve as core nodes for power grid field sensing and data transmission. They are widely deployed in distribution network areas, line towers, distributed power source access points, and other scenarios, undertaking data transmission tasks for core power services such as relay protection, stability control, telemetry and telecontrol, and video inspection. The communication security of power edge communication terminals is directly related to the security and stability of power grid production control; therefore, it is essential to encrypt and protect the business data transmitted by the terminals to prevent data theft, tampering, or forgery.

[0003] Currently, encryption schemes in the power communication field mostly adopt the common national cryptographic SM4 / SM9 algorithms or traditional symmetric / asymmetric encryption algorithms. They are not customized for the hardware characteristics of power edge communication terminals and the differentiated needs of power services, resulting in many technical shortcomings: 1. High computing power consumption, unsuitable for low-latency services: Power edge communication terminals are mostly low-computing-power, low-power embedded devices without dedicated encryption chips. The general national cryptographic algorithm is a full-round operation, which consumes a lot of computing power. Direct deployment will lead to terminal response delay and data transmission lag, which cannot meet the real-time requirements of low-latency services such as relay protection. 2. Security risks in key management: Traditional encryption schemes use static key storage or unified distribution by a key distribution center. Static keys are easily cracked and stolen. There is a risk of transmission leakage during the key distribution process. In addition, the power field terminals are distributed in a scattered manner, resulting in high maintenance costs for key distribution and updates. 3. Weak anti-interference capability and low transmission reliability: There are strong electromagnetic interference and line loss problems in the power field, which makes it easy for errors such as bit flipping to occur during data transmission. Traditional encryption algorithms have an avalanche effect, and a small number of bit errors can cause the entire frame of data to fail to be decrypted, which cannot guarantee the continuity of power business communication. 4. Inefficient encryption for undifferentiated services: The relay protection, telemetry and signaling, and video inspection services transmitted by power edge communication terminals have significant differences in frame length, latency, and reliability requirements. Traditional solutions use a uniform encryption strategy, which cannot achieve a dynamic balance between encryption efficiency and security strength, resulting in wasted resources. Summary of the Invention

[0004] In view of this, embodiments of this application provide a lightweight intrinsic security encryption method, apparatus, storage medium, and computer device adapted to power edge communication terminals.

[0005] According to one aspect of this application, a lightweight intrinsic security encryption method adapted to power edge communication terminals is provided, the method comprising: The power edge communication terminal receives service data, identifies the power service type corresponding to the service data in real time, and extracts the feature parameters corresponding to each power service type based on the service data corresponding to each power service type to construct a service feature matrix. Based on the business feature matrix, the encryption algorithm parameters corresponding to each power business type are determined, wherein the encryption algorithm parameters include the number of lightweight encryption rounds, the dynamic key update cycle, the segmented verification length, and the error correction strength; Generate a dynamic key for each power service type based on the dynamic key update cycle corresponding to each power service type; For any power service type, the service data is segmented according to the segmented verification length corresponding to the power service type, resulting in service data segments. A segmented verification code for each service data segment and a global verification code for the service data are generated. Based on the lightweight encryption round number corresponding to the power service type, the service data is encrypted using the encryption algorithm corresponding to the power service type and the dynamic key, resulting in encrypted service data segments. Based on the encrypted service data segments, the corresponding segmented verification codes, the error correction code corresponding to the error correction strength of the power service type, and the global verification code, multiple encrypted frame units are generated. The service data is then transmitted in encrypted form based on the encrypted frame units.

[0006] According to another aspect of this application, a lightweight intrinsic security encryption device adapted to a power edge communication terminal is provided, the device comprising: The service feature perception module is used for the power edge communication terminal to receive service data, identify the power service type corresponding to the service data in real time, and extract the feature parameters corresponding to each power service type based on the service data corresponding to each power service type to construct a service feature matrix. A lightweight encryption algorithm adaptive adaptation engine is used to determine the encryption algorithm parameters corresponding to each power business type based on the business feature matrix. The encryption algorithm parameters include the number of lightweight encryption rounds, dynamic key update cycle, segment verification length, and error correction strength. The dynamic key intrinsic security generation module is used to generate dynamic keys corresponding to each power service type according to the dynamic key update cycle corresponding to each power service type. The encryption / decryption execution module is used to: segment the business data for any power service type according to the segment verification length corresponding to the power service type, obtain business data segments, and generate segment verification codes for each business data segment and a global verification code for the business data; encrypt the business data using the encryption algorithm corresponding to the power service type based on the lightweight encryption round number corresponding to the power service type, to obtain encrypted business data segments; generate multiple encrypted frame units based on the encrypted business data segments, the corresponding segment verification codes, the error correction code corresponding to the error correction strength of the power service type, and the global verification code; and transmit the encrypted business data according to the encrypted frame units.

[0007] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described lightweight intrinsic security encryption method adapted to power edge communication terminals.

[0008] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the aforementioned lightweight intrinsic security encryption method adapted to a power edge communication terminal.

[0009] By utilizing the above technical solutions, this application provides a lightweight intrinsic security encryption method, device, storage medium, and computer equipment adapted to power edge communication terminals. First, the power edge communication terminal receives service data and uses a service feature code-based identification algorithm to identify the corresponding power service type (including relay protection and stability control type, telemetry and telecontrol type, and high-definition inspection video and AI analysis type) in real time. For each type, feature parameters such as frame length, transmission frequency, latency threshold, and reliability requirements are extracted and statistically analyzed according to a preset statistical period to construct a standardized service feature matrix. Then, based on this service feature matrix, a set of adapted encryption methods is determined for each power service type. The encryption algorithm parameters include the number of lightweight encryption rounds, the dynamic key update cycle, the segment verification length, and the error correction strength. Then, based on the dynamic key update cycle corresponding to each service type, a dynamic key corresponding to each service type is independently generated using a shared key seed and a key derivation function. Finally, for any service type's service data, the data is segmented according to its segment verification length, and segment verification codes and a global verification code are generated. Based on the number of lightweight encryption rounds, the dynamic key is used to encrypt the service data segments. Then, based on the encrypted data segments, the corresponding segment verification codes, the error correction codes corresponding to the error correction strength, and the global verification code, multiple encrypted frame units are generated and transmitted encrypted through the communication interface.

[0010] The above scheme, by identifying power service types in real time and constructing a service feature matrix, enables the encryption strategy to adapt to the respective communication characteristics of services such as relay protection, telemetry and telecontrol, and video inspection, avoiding resource waste or security deficiencies caused by a unified encryption strategy. By dynamically determining differentiated encryption rounds, key update cycles, verification lengths, and error correction strengths for different services, a balance is achieved between the terminal's limited computing power and power consumption and the requirements for high real-time performance and high security. The periodic independent generation of dynamic keys eliminates the security risks of key distribution in the channel. Through the joint framing of segmented verification, encryption, and error correction codes, multiple integrity verifications are provided for data from segmented to overall data. Ultimately, the power edge communication terminal can provide flexible, reliable, and lightweight intrinsically secure encrypted transmission guarantees for service data of different security levels under the premise of low latency and low power consumption.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 The illustration shows a flowchart of a lightweight intrinsic security encryption method adapted to a power edge communication terminal provided in an embodiment of this application; Figure 2 A flowchart illustrating another lightweight intrinsic security encryption method adapted to power edge communication terminals provided in an embodiment of this application is shown. Figure 3 This illustration shows a structural schematic diagram of a lightweight intrinsic security encryption device adapted to a power edge communication terminal, provided in an embodiment of this application. Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0013] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0014] This embodiment provides a lightweight intrinsic security encryption method adapted to power edge communication terminals, such as... Figure 1 As shown, the method includes: Step 101: The power edge communication terminal receives service data, identifies the power service type corresponding to the service data in real time, and extracts the feature parameters corresponding to each power service type based on the service data corresponding to each power service type to construct a service feature matrix.

[0015] In an optional embodiment, the power service type corresponding to the service data is identified in real time, and feature parameters corresponding to each power service type are extracted based on the service data corresponding to each power service type to construct a service feature matrix. This includes: using a recognition algorithm based on service feature codes to perform real-time identification of the power service type in the received service data, and extracting feature parameters from the received service data. The power service types include relay protection and stability control, telemetry and telecontrol, and high-definition inspection video and AI analysis. The feature parameters include frame length, transmission frequency, latency threshold, and reliability requirements. The feature parameters corresponding to each power service type are statistically analyzed according to a preset statistical period to obtain statistical values ​​of the feature parameters corresponding to each power service type within the current statistical period. A service feature matrix is ​​constructed based on the statistical values ​​of the feature parameters corresponding to each power service type. The service feature matrix is ​​represented as follows: Where i=1,2,3 correspond to relay protection and stability control type, telemetry and telecontrol type, and high-definition inspection video and AI analysis type, respectively. These correspond to frame length, transmission frequency, latency threshold, and reliability requirements, respectively. For the i-th type of business Statistical values ​​of the characteristic parameters.

[0016] Among them, the identification algorithm based on business feature codes refers to a classification method that determines the business affiliation by parsing a specific pre-set identifier field in a data frame; the relay protection and stability control type refers to key control business used for fault detection, isolation, and rapid recovery in power systems, characterized by extremely small data packets, strong burstiness, and extremely high real-time requirements; the telemetry and teleindication type refers to monitoring business used for remotely collecting power parameters (voltage, current) and switch status information, characterized by periodic generation, moderate data volume, and allowance for a certain degree of transmission delay; the high-definition inspection video and AI analysis type refers to video stream business used for visual inspection of power transmission and transformation equipment and image recognition using artificial intelligence, characterized by large data volume, strong continuity, and a certain tolerance for bit error rate.

[0017] A service feature code is a specific numerical label set at a fixed header position in each service data frame. There is a one-to-one mapping relationship between this label and the type of power service. For example, "0x01" represents relay protection and stability control type, "0x02" represents telemetry and telecontrol type, and "0x03" represents high-definition inspection video and AI analysis type.

[0018] The business feature matrix is ​​a standardized numerical array with 3 rows and 4 columns. Its row indices correspond to the three power service types mentioned above, and its column indices correspond to the four feature parameters: frame length, transmission frequency, latency threshold, and reliability requirements. Each element in the matrix... This represents the statistical value of the i-th type of business on the j-th feature.

[0019] In this embodiment, the power edge communication terminal is first connected to the power business data network, enabling it to receive mixed business data streams from relay protection devices, remote terminal units, and high-definition cameras. When the business data arrives at the terminal, an identification algorithm based on business feature codes is immediately executed. This algorithm specifically includes: parsing the header of each received data frame and reading a predefined one-byte-long business feature code field. The terminal maintains a feature code mapping table that binds feature code values ​​to power business types. When the read feature code is "0x01", the current data is determined to belong to the relay protection and stability control type; when the feature code is "0x02", it is determined to belong to the telemetry and telecontrol type; and when the feature code is "0x03", it is determined to belong to the high-definition inspection video and AI analysis type.

[0020] After identifying the service type, four characteristic parameters are extracted for each type of service data. For data frames identified as relay protection and stability control types, the following parameters are extracted: frame length (usually tens to hundreds of bytes), transmission frequency (number of frames per second, appearing as burst pulses), latency threshold (usually set in milliseconds, such as 3 or 5 milliseconds), and reliability requirements (usually "zero loss" level). For telemetry and teleindication type data, the following parameters are extracted: frame length (several hundred bytes), transmission frequency (stable periodicity, such as one frame per second or one frame per minute), latency threshold (usually set in hundreds of milliseconds or seconds), and reliability requirements (allowing for some packet loss and retransmission). For high-definition inspection video and AI analysis type data, the following parameters are extracted: frame length (usually very large, possibly spanning multiple maximum transmission units), transmission frequency (stable high frame rate video stream), latency threshold (relatively lenient, usually in seconds or hundreds of milliseconds), and reliability requirements (tolerating a small amount of packet loss, but requiring continuous transmission).

[0021] Subsequently, the terminal performs statistical and construction operations. Specifically, the terminal internally sets a loop timer, defining a preset statistical period (e.g., 5 seconds or 10 seconds). Within the current statistical period, whenever a service data frame is received, the corresponding characteristic parameters of the service type to which the frame belongs are cumulatively updated in memory. For example, for relay protection type, the average length of all frames received within the period is recorded, and the time interval distribution of frame arrivals within the period is recorded to calculate the transmission frequency. When the preset statistical period ends, the terminal calculates and stores the statistical values ​​of each characteristic parameter corresponding to each service type within the current period. After completing the statistics, the terminal performs the operation of constructing a service feature matrix.

[0022] Step 102: Based on the business feature matrix, determine the encryption algorithm parameters corresponding to each power business type, wherein the encryption algorithm parameters include the number of lightweight encryption rounds, the dynamic key update cycle, the segmented verification length, and the error correction strength.

[0023] The encryption algorithm parameters refer to a set of configurable values ​​that control the behavior of the encryption process. These include the number of lightweight encryption rounds, the dynamic key update cycle, the segment check length, and the error correction strength. These parameters collectively determine the security level, real-time overhead, and transmission reliability of the encryption operation. The number of lightweight encryption rounds refers to the number of times a data block is repeatedly processed during the execution of the encryption algorithm. This number is set to an integer smaller than the number of rounds in traditional encryption algorithms to adapt to the limited computing power of the terminal. The dynamic key update cycle is a time-length parameter used to specify the frequency interval for generating new keys. The segment check length is a data block size parameter used to specify the unit length for segmenting business data. The error correction strength refers to the redundancy level of a forward error correction coding system. The higher the level, the more transmission error bits can be corrected, but the greater the amount of redundant data introduced.

[0024] In this step, the business feature matrix is ​​input into the lightweight encryption algorithm adaptive adaptation engine. Specifically, the feature parameters corresponding to each row of the business feature matrix are first read. For example, when the feature parameters of a certain power business type indicate that it has the requirements of "high real-time performance and medium security", the module assigns it a set of lightweight parameters: the number of lightweight encryption rounds is set to a small value (such as 5 or 8 rounds) to ensure that the encryption calculation does not introduce significant latency; the dynamic key update cycle is set to a short duration (such as 30 seconds or 1 minute) to compensate for the possible security deficiencies of low-round encryption by frequently changing the key; the segmented verification length is set to a moderate value (such as 128 bytes or 256 bytes) to balance verification accuracy and computational overhead; and the error correction strength is set to a medium level (such as error correction capability of 3 bits or 5 bits) to cope with typical interference in power line communication. For example, when a certain business type is determined to have "low real-time performance and high security" requirements, the module assigns it another set of parameters: the number of lightweight encryption rounds is set to a relatively large value (such as 12 or 16 rounds); the dynamic key update cycle is set to a relatively long duration (such as 24 hours or once per session); the segment verification length is set to a small value (such as 64 bytes) to achieve finer-grained integrity verification; and the error correction strength is set to a high level (such as an error correction capability of 8 bits or 10 bits).

[0025] Step 103: Generate a dynamic key for each power service type based on the dynamic key update cycle corresponding to each power service type.

[0026] In this context, a dynamic key refers to a periodically updated symmetric encryption key. It is not permanently stored on either the terminal or the peer device, but rather generated synchronously between the communicating parties using a shared seed and the same key derivation function. The dynamic key update cycle defines the valid lifespan of the dynamic key. When the cycle ends, the currently used dynamic key is discarded, and a new dynamic key needs to be generated for subsequent encryption.

[0027] In this step, for each power service type and its defined dynamic key update cycle, the terminal executes an independent dynamic key generation process. Specifically, for services with short dynamic key update cycles (such as distribution automation services), the terminal uses a lightweight key derivation function for key generation. This derivation function takes a monotonically increasing time counter value and a shared key seed as input, and uses a hash operation (such as a lightweight variant of the SM3 algorithm) to calculate a new key of fixed length. Each increment of the counter represents the end of one update cycle and the beginning of a new cycle. The communicating end uses the exact same time counter and seed, and can independently calculate the same dynamic key without transmitting the key itself in the channel.

[0028] In one optional embodiment, a dynamic key for any power service type is generated once at the beginning of a dynamic key update cycle. The generation process includes: extracting the PUF inherent feature value of the chip of the power edge communication terminal; acquiring real-time grid operation data and chip status data collected by the sensing unit of the power edge communication terminal, wherein the grid operation data includes grid current value and grid voltage value, and the chip status data includes chip temperature value and power supply noise value; hashing and fusing the PUF inherent feature value, the grid operation data, the chip status data, and the service feature code of the power service type to construct a dynamic entropy factor; and using the dynamic entropy factor as a key seed to generate a dynamic key for the power service type through a national cryptographic key generation algorithm.

[0029] In this embodiment, the PUF inherent feature value of the power edge communication terminal chip is extracted. This characteristic is a unique physical feature formed during the chip manufacturing process and cannot be cloned or tampered with; the terminal's sensing unit collects real-time power grid operation data and chip status data, including power grid current values. Grid voltage value Chip temperature value Power supply noise value The above data is then normalized to obtain the normalized feature vector. ,in All are normalized values ​​between 0 and 1; PUF inherent characteristic values Normalized eigenvectors The hash fusion of business feature codes for power business types is used to construct a dynamic entropy factor. ,in For splicing operations, The SM3 hash algorithm is used; the dynamic entropy factor is used. As a key seed, a 256-bit dynamic session key is generated using the national cryptographic key generation algorithm. It achieves one-time key encryption, and the key generation and update process is completed entirely on the terminal, without the need to interact with the key distribution center or rely on pre-stored keys.

[0030] Step 104: For any power service type, segment the service data according to the segment verification length corresponding to the power service type to obtain service data segments, and generate segment verification codes for each service data segment and a global verification code for the service data; based on the lightweight encryption round number corresponding to the power service type, encrypt the service data using the encryption algorithm corresponding to the power service type according to the dynamic key corresponding to the power service type to obtain encrypted service data segments; based on the encrypted service data segments, the corresponding segment verification codes, the error correction codes corresponding to the error correction strength of the power service type, and the global verification code, generate multiple encrypted frame units; and transmit the encrypted service data according to the encrypted frame units.

[0031] Among them, the segment check code refers to a short, fixed-length check value generated by applying a hash function or cyclic redundancy check algorithm to a data block of a specific length (i.e., a business data segment), used to verify the integrity of the data segment during transmission; the global check code refers to a unique check value generated by applying an integrity check algorithm to the entire original business data (regardless of segmentation), used to verify the overall integrity of the business data; the error correction code refers to redundant coded data generated according to the error correction strength, which has a mathematical correlation with the original data, allowing the receiving end to recover the correct original data by decoding when receiving partially erroneous data; the encrypted frame unit refers to a structured data encapsulation format, which serves as the basic unit of transmission on the physical channel, and internally contains encrypted data segments, segment check codes, error correction codes, and global check codes in an orderly manner.

[0032] In this step, for the original business data corresponding to any power business type, the data is first segmented according to the segment verification length corresponding to that type. The segmentation operation involves dividing the data sequentially into several consecutive data blocks, starting from the first byte of the business data and following the specified number of bytes (e.g., 128 bytes) according to the segment verification length. The length of the last data block may be less than the segment verification length. If the total length of the business data is less than the segment verification length, the entire business data constitutes a single data segment. After segmentation, a segment verification code is independently generated for each business data segment. The verification code can be generated using a Cyclic Redundancy Check algorithm (CRC-16 or CRC-32). Simultaneously, a global verification code is generated for the original complete business data before segmentation. This global verification code can be generated using a more secure hash algorithm (e.g., SM3). Subsequently, based on the lightweight encryption rounds corresponding to that power business type, a lightweight symmetric encryption algorithm is used to encrypt each business data segment.

[0033] For example, the encryption algorithm corresponding to the relay protection and stability control type is a simplified SM4 algorithm; the encryption process of the simplified SM4 algorithm is expressed as follows: ,in, Indicates the number of lightweight encryption rounds. For the first Round-encrypted input data, For the first The wheel key, For simplified nonlinear transformation functions, only byte substitution is included. and row shift ,Right now omitting the full column mixing operation in the SM4 algorithm The encryption algorithm corresponding to the telemetry and teleindication type is the SM9 algorithm; the encryption algorithm corresponding to the high-definition inspection video and AI analysis type is the full SM4 algorithm. The encryption process uses the dynamic key generated in step 103. During encryption, the round function of the encryption algorithm (including byte substitution, row shifting, column obfuscation, and round key addition, etc., but more complex steps such as column obfuscation may be omitted according to the lightweight requirements) is repeatedly executed according to the number of lightweight encryption rounds set (such as 5 rounds, 8 rounds, or 12 rounds) to finally obtain the encrypted business data segments. Specifically, the encryption algorithm can be determined based on the following rules: (1) For relay protection / stability control services, which are short-frame, low-latency, and high-reliability types, the SM4 encryption scheme with 8 rounds of simplified round functions and hardware acceleration is adopted. Based on the low-latency and high-reliability characteristics of power services, redundant column mixing operations in the SM4 algorithm are omitted, and only byte substitution, row shifting, and round key addition operations are retained, with encryption latency ≤1ms; (2) For telemetry and teleindication services, which are medium-speed, fixed-frame-length, and massive data types, the SM9 lightweight signature scheme integrating compression and encryption is adopted. First, the telemetry data is feature-compressed to extract effective data dimensions, and then the SM9 signature encryption process is integrated into the data compression stage to reduce computing power consumption; (3) For high-definition inspection video / AI analysis services, which are long-frame, high-bandwidth, and non-real-time types, the 32-round full-round national cryptographic SM4 algorithm with dynamic key update mechanism is adopted to balance encryption security strength and transmission efficiency. The key update cycle is synchronized with the service data frame transmission cycle.

[0034] Next, encrypted frame units are generated. For example, based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check code, multiple encrypted frame units are generated, including: generating multiple encrypted frame units corresponding to multiple encrypted service data segments based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check code; wherein, the structure of the encrypted frame unit corresponding to the first encrypted service data segment is: [frame header identifier, segment sequence number, global check code, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; the structure of the encrypted frame units corresponding to other encrypted service data segments is: [frame header identifier, segment sequence number, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; or, based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check code, multiple encrypted frame units are generated corresponding to multiple encrypted service data segments. Multiple encrypted frame units corresponding to encrypted service data segments are generated based on the error correction code corresponding to the error strength and the global checksum. The structure of each encrypted frame unit corresponding to an encrypted service data segment is: [frame header identifier, segment sequence number, global checksum, encrypted service data segment, segment checksum, error correction code, and frame tail identifier]. Alternatively, multiple encrypted frame units corresponding to encrypted service data segments and encrypted frame units corresponding to the global checksum are generated based on the encrypted service data segments, the corresponding segment checksums, the error correction code corresponding to the error strength of the power service type, and the global checksum. The structure of each encrypted frame unit corresponding to an encrypted service data segment is: [frame header identifier, segment sequence number, encrypted service data segment, segment checksum, error correction code, and frame tail identifier]. The structure of the encrypted frame unit corresponding to the global checksum is: [frame header identifier, global checksum identifier, global checksum, and frame tail identifier].

[0035] Finally, based on the generated multiple encrypted frame units, the terminal performs the encrypted transmission operation of the service data: sending the encrypted frame units into the terminal's physical layer transmission queue, and transmitting them to the target receiving end via the communication interface of the power edge communication terminal (such as a 4G / 5G module, fiber optic Ethernet port, or power line carrier communication module).

[0036] By applying the technical solution of this embodiment, the power edge communication terminal first receives service data and uses a service feature code-based identification algorithm to identify the power service type (including relay protection and stability control type, telemetry and telecontrol type, high-definition inspection video and AI analysis type) corresponding to the service data in real time. For each type, feature parameters such as frame length, transmission frequency, latency threshold, and reliability requirements are extracted and statistically analyzed according to a preset statistical period to construct a standardized service feature matrix. Subsequently, based on this service feature matrix, a set of suitable encryption algorithm parameters is determined for each power service type. These parameters include the number of lightweight encryption rounds, dynamic... The dynamic key update cycle, segment verification length, and error correction strength are determined. Then, based on the dynamic key update cycle corresponding to each service type, a dynamic key corresponding to each service type is independently generated using a shared key seed and key derivation function. Finally, for any service type's service data, data is segmented according to its segment verification length, and segment verification codes and global verification codes are generated. Based on its lightweight encryption rounds, the dynamic key is used to encrypt the service data segments. Then, based on the encrypted data segments, the corresponding segment verification codes, the error correction codes corresponding to the error correction strength, and the global verification codes, multiple encrypted frame units are generated and transmitted encrypted through the communication interface.

[0037] This embodiment, through the above-described scheme, identifies power service types in real time and constructs a service feature matrix, enabling the encryption strategy to adapt to the respective communication characteristics of services such as relay protection, telemetry and telecontrol, and video inspection, thus avoiding resource waste or security deficiencies caused by a unified encryption strategy. By dynamically determining differentiated encryption rounds, key update cycles, verification lengths, and error correction strengths for different services, a balance is achieved between the terminal's limited computing power and power consumption and the requirements for high real-time performance and high security. The periodic independent generation of dynamic keys eliminates the security risks of key distribution in the channel. Through the joint framing of segmented verification, encryption, and error correction codes, multiple integrity verifications are provided for data from segmented to overall data. Ultimately, the power edge communication terminal can provide flexible, reliable, and lightweight intrinsically secure encrypted transmission guarantees for service data of different security levels under the premise of low latency and low power consumption.

[0038] Furthermore, as a refinement and extension of the specific implementation of the above embodiments, and to fully illustrate the specific implementation process of this embodiment, another lightweight intrinsic security encryption method adapted to power edge communication terminals is provided, such as... Figure 2 As shown, the method includes: Step 201: After receiving each encrypted frame unit, the receiving end decrypts each encrypted frame unit to obtain each decrypted service data segment, segment number, segment check code and error correction code corresponding to the decrypted service data segment, and global check code.

[0039] Step 202: For each decrypted service data segment, perform error detection on the decrypted service data segment based on the segment check code corresponding to the decrypted service data segment; if there are no erroneous bits, directly take the decrypted service data segment as the final decrypted service data segment; if there are erroneous bits and the proportion of erroneous bits is less than or equal to the error correction strength corresponding to the error correction code, perform error correction on the decrypted service data segment through an error correction algorithm to obtain the final decrypted service data segment; if there is an error and the proportion of erroneous bits is greater than the error correction strength corresponding to the error correction code, or the error correction through the error correction algorithm fails, send an encrypted frame unit retransmission request to the power edge communication terminal based on the segment sequence number of the decrypted service data segment, and use the re-received encrypted frame unit to acquire the final decrypted service data segment.

[0040] Step 203: Generate complete decrypted service data according to each final decrypted service data segment and the corresponding segment sequence number, and perform error detection on the complete decrypted service data based on the global check code; if there is a final decrypted service data segment that fails the check, send an encrypted frame unit retransmission request to the power edge communication terminal based on the segment sequence number corresponding to the final decrypted service data segment that fails the check, and use the re-received encrypted frame unit to acquire the final decrypted service data segment as well as generate and perform error detection on the complete decrypted service data. The error detection is implemented by a cyclic redundancy check algorithm, and the error correction algorithm is Hamming code error correction.

[0041] In this embodiment, a decryption and receiving method matching the above encrypted sending method is also provided. After receiving each encrypted frame unit, the receiving end first performs a decryption operation on each encrypted frame unit to obtain the decrypted service data segment, segment sequence number, segment check code, error correction code, and global check code therefrom. Then, for each decrypted service data segment, error detection is performed using its corresponding segment check code: if no erroneous bit is detected, the segment is directly taken as the final decrypted service data segment; if an error is detected and the proportion of erroneous bits does not exceed the error correction strength corresponding to the error correction code, error correction is performed thereon through the error correction algorithm to obtain the final decrypted service data segment; if the proportion of erroneous bits exceeds the error correction strength or the execution of the error correction algorithm fails, a retransmission request is sent to the transmitting end according to the segment sequence number of the segment, and the re-received encrypted frame unit is used to re-acquire the segment. Finally, the receiving end recombines each final decrypted service data segment and its corresponding segment sequence number into complete decrypted service data, and performs overall error detection on the complete data using the global check code. If it is detected that one or some segments fail to pass the check, a retransmission request is also initiated to the transmitting end according to the segment sequence number of the segments that fail the check, the re-received encrypted frame unit is used to re-acquire the corresponding segments, and the process of generating and checking the complete decrypted service data is re-executed until the global check is passed.

[0042] Through the above decryption and reception process, this embodiment constructs a complete closed-loop system for encrypted transmission and secure reception. This system implements a hierarchical error handling mechanism at the receiving end: First, segmented checksums are used to independently detect errors in each data segment, enabling rapid location of the specific problematic segment; for segments with errors within the error correction capability range, online recovery via error correction algorithms is possible without retransmission, reducing the number of retransmissions and transmission delays; selective retransmission is triggered only when the error exceeds the error correction capability, and the retransmission request is accurate to the sequence number of the segment where the error occurred, avoiding bandwidth waste caused by retransmitting the entire service data; finally, a global checksum is used to perform a secondary check on the reconstructed complete service data, ensuring the integrity across segment boundaries (e.g., preventing segment tampering, rearrangement, or loss). This mechanism enables the receiving end to reliably restore the complete and correct original service data with minimal retransmission overhead and recovery delay in power communication environments with variable channel quality and complex interference. Together with the lightweight encryption method at the sending end, it constitutes an end-to-end intrinsically secure communication solution adapted to the resource constraints of power edge communication terminals.

[0043] The test results of this embodiment show that: the encryption method of this application has an encryption latency of 0.8ms for relay protection services, a computing power consumption of 8% for telemetry and teleindication services, and the encryption security strength of high-definition inspection video services meets the requirements of power production control areas; in the strong electromagnetic interference environment of power sites, 3% bit errors in a single frame can be corrected without loss, with no whole frame data failures, and the continuity of service transmission is ≥99.99%; the dynamic session key is generated locally throughout the process, with no risk of leakage, and the hardware acceleration design of the device significantly reduces the computing power consumption of the terminal CPU, fully adapting to the low computing power hardware characteristics of the distribution network intelligent converged terminal.

[0044] Compared with the prior art, the present invention has the following significant technical effects: 1. Lightweight adaptation to meet the real-time requirements of terminal hardware and services: Dynamic lightweight trimming of national cryptographic algorithms driven by power business characteristics, combined with FPGA hardware acceleration, significantly reduces encryption latency and computing power consumption. For low-latency services such as relay protection, the encryption latency is ≤1ms, adapting to the low computing power and low power consumption hardware characteristics of power edge communication terminals. 2. Endogenous key generation enhances key security: Based on the inherent characteristics of the terminal chip's PUF and real-time power grid data, a dynamic entropy factor is constructed to achieve local generation of dynamic session keys with one-time pads. This eliminates the traditional static key storage and distribution mode, preventing the risk of key leakage and cracking. Furthermore, it eliminates the need for maintenance personnel to distribute and update keys, reducing maintenance costs. 3. Error tolerance and self-healing, enhancing anti-interference capability: The combined error correction algorithm of encrypted frame segment verification and Hamming code plus CRC is adopted. ≤5% bit error in a single frame can achieve lossless error correction, avoiding the avalanche effect of traditional encryption algorithms. Moreover, error segments are retransmitted separately, improving transmission efficiency and ensuring communication continuity in the strong electromagnetic interference environment of the power field. 4. Differentiated encryption for different business operations to achieve a dynamic balance between efficiency and security: Customized encryption solutions are matched for different power services such as relay protection, telemetry and telecontrol, and video inspection. Encryption efficiency is maximized while ensuring high security, and resource waste caused by uniform encryption strategies is avoided. 5. Integrated hardware and software architecture for easy deployment: Core computing is performed in the terminal FPGA hardware acceleration unit, and the software layer is only responsible for configuration and monitoring. No hardware modification is required for the power edge communication terminal. It can be directly deployed on existing terminals, with strong compatibility and low deployment cost.

[0045] Furthermore, as Figure 1 In terms of specific implementation, this application provides a lightweight intrinsic security encryption device adapted to power edge communication terminals, such as... Figure 3 As shown, the device includes: The service feature perception module is used for the power edge communication terminal to receive service data, identify the power service type corresponding to the service data in real time, and extract the feature parameters corresponding to each power service type based on the service data corresponding to each power service type to construct a service feature matrix. A lightweight encryption algorithm adaptive adaptation engine is used to determine the encryption algorithm parameters corresponding to each power business type based on the business feature matrix. The encryption algorithm parameters include the number of lightweight encryption rounds, dynamic key update cycle, segment verification length, and error correction strength. The dynamic key intrinsic security generation module is used to generate dynamic keys corresponding to each power service type according to the dynamic key update cycle corresponding to each power service type. The encryption / decryption execution module is used to: segment the business data for any power service type according to the segment verification length corresponding to the power service type, obtain business data segments, and generate segment verification codes for each business data segment and a global verification code for the business data; encrypt the business data using the encryption algorithm corresponding to the power service type based on the lightweight encryption round number corresponding to the power service type, to obtain encrypted business data segments; generate multiple encrypted frame units based on the encrypted business data segments, the corresponding segment verification codes, the error correction code corresponding to the error correction strength of the power service type, and the global verification code; and transmit the encrypted business data according to the encrypted frame units.

[0046] Optionally, the business feature perception module is specifically used for: An identification algorithm based on business feature codes is used to identify the power business type in real time from the received business data and to extract feature parameters from the received business data. The power business types include relay protection and stability control, telemetry and teleindication, and high-definition inspection video and AI analysis. The feature parameters include frame length, transmission frequency, latency threshold, and reliability requirements. The characteristic parameters corresponding to each power business type within the current statistical period are statistically analyzed according to a preset statistical period to obtain the statistical values ​​of the characteristic parameters corresponding to each power business type within the current statistical period. Based on the statistical values ​​of the characteristic parameters corresponding to each power business type, a business feature matrix is ​​constructed; wherein, the business feature matrix is ​​represented as follows: Where i=1,2,3 correspond to relay protection and stability control type, telemetry and telecontrol type, and high-definition inspection video and AI analysis type, respectively. These correspond to frame length, transmission frequency, latency threshold, and reliability requirements, respectively. For the i-th type of business Statistical values ​​of the characteristic parameters.

[0047] Optionally, the encryption algorithm corresponding to the relay protection and stability control type is a simplified SM4 algorithm; the encryption process of the simplified SM4 algorithm is expressed as follows: ,in, Indicates the number of lightweight encryption rounds. For the first Round-encrypted input data, For the first The wheel key, For simplified nonlinear transformation functions, only byte substitution is included. and row shift ,Right now omitting the full column mixing operation in the SM4 algorithm ; The encryption algorithm corresponding to the telemetry and teleindication type is the SM9 algorithm; The encryption algorithm corresponding to the high-definition inspection video and the AI ​​analysis type is the full SM4 algorithm.

[0048] Optionally, the dynamic key intrinsic security generation module is specifically used for: Extract the inherent PUF feature value of the chip of the power edge communication terminal, and obtain the real-time power grid operation data and chip status data collected by the sensing unit of the power edge communication terminal. The power grid operation data includes the power grid current value and the power grid voltage value, and the chip status data includes the chip temperature value and the power supply noise value. The inherent feature value of the PUF, the power grid operation data, the chip status data, and the business feature code of the power business type are hashed and fused to construct a dynamic entropy factor; The dynamic entropy factor is used as the key seed, and a dynamic key for the power service type is generated using the national cryptographic key generation algorithm.

[0049] Optionally, the encryption / decryption execution module is specifically used for: Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units corresponding to the encrypted service data segments are generated. The structure of the encrypted frame unit corresponding to the first encrypted service data segment is: [frame header identifier, segment sequence number, global check code, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; the structure of the encrypted frame units corresponding to other encrypted service data segments is: [frame header identifier, segment sequence number, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; or, Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units corresponding to the encrypted service data segments are generated; wherein, the structure of each encrypted frame unit corresponding to the encrypted service data segment is: [frame header identifier, segment sequence number, global check code, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; or, Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units corresponding to the encrypted service data segments and the encrypted frame units corresponding to the global check codes are generated. The structure of each encrypted frame unit corresponding to an encrypted service data segment is: [frame header identifier, segment sequence number, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; the structure of the encrypted frame unit corresponding to the global check code is: [frame header identifier, global check code identifier, global check code, and frame tail identifier].

[0050] Optionally, the encryption / decryption execution module is specifically used for: After receiving each encrypted frame unit, the receiving end decrypts each encrypted frame unit to obtain each decrypted service data segment, segment number, segment check code and error correction code corresponding to the decrypted service data segment, and global check code. The device further includes an error correction and self-healing module, used for: For each decrypted service data segment, error detection is performed on the decrypted service data segment based on the segment check code corresponding to the segment. If no erroneous bits are found, the decrypted service data segment is directly used as the final decrypted service data segment. If erroneous bits are found, and the proportion of erroneous bits is less than or equal to the error correction strength corresponding to the error correction code, the decrypted service data segment is corrected using an error correction algorithm to obtain the final decrypted service data segment. If errors are found, and the proportion of erroneous bits is greater than the error correction strength corresponding to the error correction code, or the error correction algorithm fails, a retransmission request for the encrypted frame unit is sent to the power edge communication terminal based on the segment sequence number of the decrypted service data segment, and the re-received encrypted frame unit is used to obtain the final decrypted service data segment. Based on each final decrypted service data segment and its corresponding segment number, complete decrypted service data is generated, and error detection is performed on the complete decrypted service data based on the global checksum. If there is a final decrypted service data segment that fails the checksum, an encryption frame unit retransmission request is sent to the power edge communication terminal based on the segment number corresponding to the failed final decrypted service data segment. The retransmitted encryption frame unit is used to obtain the final decrypted service data segments, generate complete decrypted service data, and perform error detection.

[0051] Optionally, the error detection is implemented using a cyclic redundancy check algorithm, and the error correction algorithm is Hamming code error correction.

[0052] It should be noted that for other corresponding descriptions of the functional units involved in the lightweight intrinsic security encryption device adapted to power edge communication terminals provided in this application embodiment, please refer to... Figures 1 to 2 The corresponding descriptions in the method will not be repeated here.

[0053] This application also provides a computer device, which may specifically be a personal computer, a server, a network device, etc. Figure 4 As shown, the computer device includes a bus, a processor, memory, and a communication interface, and may also include an input / output interface and a display device. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores location information. The network interface allows communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0054] Those skilled in the art will understand that Figure 4The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0055] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0056] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0057] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0058] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A lightweight intrinsic security encryption method adapted to power edge communication terminals, characterized in that, The method includes: The power edge communication terminal receives service data, identifies the power service type corresponding to the service data in real time, and extracts the feature parameters corresponding to each power service type based on the service data corresponding to each power service type to construct a service feature matrix. Based on the business feature matrix, the encryption algorithm parameters corresponding to each power business type are determined, wherein the encryption algorithm parameters include the number of lightweight encryption rounds, the dynamic key update cycle, the segmented verification length, and the error correction strength; Generate a dynamic key for each power service type based on the dynamic key update cycle corresponding to each power service type; For any power service type, the service data is segmented according to the segmented verification length corresponding to the power service type, resulting in service data segments. A segmented verification code for each service data segment and a global verification code for the service data are generated. Based on the lightweight encryption round number corresponding to the power service type, the service data is encrypted using the encryption algorithm corresponding to the power service type and the dynamic key, resulting in encrypted service data segments. Based on the encrypted service data segments, the corresponding segmented verification codes, the error correction code corresponding to the error correction strength of the power service type, and the global verification code, multiple encrypted frame units are generated. The service data is then transmitted in encrypted form based on the encrypted frame units.

2. The method according to claim 1, characterized in that, The system identifies the power service type corresponding to the business data in real time, and extracts the feature parameters corresponding to each power service type based on the business data for each power service type, constructing a business feature matrix, including: An identification algorithm based on business feature codes is used to identify the power business type in real time from the received business data and to extract feature parameters from the received business data. The power business types include relay protection and stability control, telemetry and teleindication, and high-definition inspection video and AI analysis. The feature parameters include frame length, transmission frequency, latency threshold, and reliability requirements. The characteristic parameters corresponding to each power business type within the current statistical period are statistically analyzed according to a preset statistical period to obtain the statistical values ​​of the characteristic parameters corresponding to each power business type within the current statistical period. Based on the statistical values ​​of the characteristic parameters corresponding to each power business type, a business feature matrix is ​​constructed; wherein, the business feature matrix is ​​represented as follows: Where i=1,2,3 correspond to relay protection and stability control type, telemetry and telecontrol type, and high-definition inspection video and AI analysis type, respectively. These correspond to frame length, transmission frequency, latency threshold, and reliability requirements, respectively. For the i-th type of business Statistical values ​​of the characteristic parameters.

3. The method according to claim 2, characterized in that, The encryption algorithm corresponding to the relay protection and stability control type is the simplified SM4 algorithm; the encryption process of the simplified SM4 algorithm is expressed as follows: ,in, Indicates the number of lightweight encryption rounds. For the first Round-encrypted input data, For the first The wheel key, For simplified nonlinear transformation functions, only byte substitution is included. and row shift ,Right now omitting the full column mixing operation in the SM4 algorithm ; The encryption algorithm corresponding to the telemetry and teleindication type is the SM9 algorithm; The encryption algorithm corresponding to the high-definition inspection video and the AI ​​analysis type is the full SM4 algorithm.

4. The method according to claim 3, characterized in that, The dynamic key for any power service type is generated once at the beginning of a dynamic key update cycle. The generation process includes: Extract the inherent PUF feature value of the chip of the power edge communication terminal, and obtain the real-time power grid operation data and chip status data collected by the sensing unit of the power edge communication terminal. The power grid operation data includes the power grid current value and the power grid voltage value, and the chip status data includes the chip temperature value and the power supply noise value. The inherent feature value of the PUF, the power grid operation data, the chip status data, and the business feature code of the power business type are hashed and fused to construct a dynamic entropy factor; The dynamic entropy factor is used as the key seed, and a dynamic key for the power service type is generated using the national cryptographic key generation algorithm.

5. The method according to claim 1, characterized in that, Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units are generated, including: Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units corresponding to the encrypted service data segments are generated. The structure of the encrypted frame unit corresponding to the first encrypted service data segment is: [frame header identifier, segment sequence number, global check code, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; the structure of the encrypted frame units corresponding to other encrypted service data segments is: [frame header identifier, segment sequence number, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; or, Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units corresponding to the encrypted service data segments are generated; wherein, the structure of each encrypted frame unit corresponding to the encrypted service data segment is: [frame header identifier, segment sequence number, global check code, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; or, Based on the encrypted service data segments, the corresponding segment check codes, the error correction codes corresponding to the error correction strength of the power service type, and the global check codes, multiple encrypted frame units corresponding to the encrypted service data segments and the encrypted frame units corresponding to the global check codes are generated. The structure of each encrypted frame unit corresponding to an encrypted service data segment is: [frame header identifier, segment sequence number, encrypted service data segment, segment check code, error correction code, and frame tail identifier]; the structure of the encrypted frame unit corresponding to the global check code is: [frame header identifier, global check code identifier, global check code, and frame tail identifier].

6. The method according to claim 5, characterized in that, The method further includes: After receiving each encrypted frame unit, the receiving end decrypts each encrypted frame unit to obtain each decrypted service data segment, segment number, segment check code and error correction code corresponding to the decrypted service data segment, and global check code. For each decrypted service data segment, error detection is performed on the decrypted service data segment based on the segment check code corresponding to the segment. If no erroneous bits are found, the decrypted service data segment is directly used as the final decrypted service data segment. If erroneous bits are found, and the proportion of erroneous bits is less than or equal to the error correction strength corresponding to the error correction code, the decrypted service data segment is corrected using an error correction algorithm to obtain the final decrypted service data segment. If errors are found, and the proportion of erroneous bits is greater than the error correction strength corresponding to the error correction code, or the error correction algorithm fails, a retransmission request for the encrypted frame unit is sent to the power edge communication terminal based on the segment sequence number of the decrypted service data segment, and the re-received encrypted frame unit is used to obtain the final decrypted service data segment. Based on each final decrypted service data segment and its corresponding segment number, complete decrypted service data is generated, and error detection is performed on the complete decrypted service data based on the global checksum. If there is a final decrypted service data segment that fails the checksum, an encryption frame unit retransmission request is sent to the power edge communication terminal based on the segment number corresponding to the failed final decrypted service data segment. The retransmitted encryption frame unit is used to obtain the final decrypted service data segments, generate complete decrypted service data, and perform error detection.

7. The method according to claim 6, characterized in that, The error detection is achieved through a cyclic redundancy check algorithm, and the error correction algorithm is Hamming code error correction.

8. A lightweight intrinsic security encryption device adapted to power edge communication terminals, characterized in that, The device includes: The service feature perception module is used for the power edge communication terminal to receive service data, identify the power service type corresponding to the service data in real time, and extract the feature parameters corresponding to each power service type based on the service data corresponding to each power service type to construct a service feature matrix. A lightweight encryption algorithm adaptive adaptation engine is used to determine the encryption algorithm parameters corresponding to each power business type based on the business feature matrix. The encryption algorithm parameters include the number of lightweight encryption rounds, dynamic key update cycle, segment verification length, and error correction strength. The dynamic key intrinsic security generation module is used to generate dynamic keys corresponding to each power service type according to the dynamic key update cycle corresponding to each power service type. The encryption / decryption execution module is used to: segment the business data for any power service type according to the segment verification length corresponding to the power service type, obtain business data segments, and generate segment verification codes for each business data segment and a global verification code for the business data; encrypt the business data using the encryption algorithm corresponding to the power service type based on the lightweight encryption round number corresponding to the power service type, to obtain encrypted business data segments; generate multiple encrypted frame units based on the encrypted business data segments, the corresponding segment verification codes, the error correction code corresponding to the error correction strength of the power service type, and the global verification code; and transmit the encrypted business data according to the encrypted frame units.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images