Two-way encryption and decryption method and system for power market data based on partition deployment

Abstract

The application discloses a power market data bidirectional encryption and decryption method and system based on partition deployment, relates to the technical field of power information security, and comprises the following steps: concatenating to-be-transmitted plaintext data and an SM3 digest value of the plaintext data, performing SM4 encryption on the concatenated data by using a dynamically generated session encryption key, and obtaining encrypted data, wherein, a continuity verification mechanism based on a cross-zone ciphertext stream state chain is established according to the transmission order of the encrypted data; after the received encrypted data is decrypted, plaintext data and an original digest value are separated from the decrypted data according to the concatenation rule; and the SM3 digest value of the plaintext data is recalculated and compared with the original digest value, and the data integrity is confirmed if the values are consistent; the application solves the problems of difficulty in timely detection of data tampering caused by insufficient correlation between encrypted data and integrity check information in existing cross-zone data transmission and high risk of sensitive information leakage caused by temporary storage of data by isolation equipment or transit nodes.

Description

Technical Field

[0001] This invention relates to the field of power information security technology, and more specifically, to a method and system for bidirectional encryption and decryption of power market data based on partitioned deployment. Background Technology

[0002] With the deepening of power system reform, a trading mechanism centered on the electricity spot market has been gradually established, and data interaction between the power trading system and the electricity spot market system is becoming increasingly frequent. When transmitting electricity market data across security zones, isolation equipment or relay services are usually required to achieve data exchange between different regions, thus placing high demands on the security and integrity of data transmission.

[0003] In existing technologies, cross-regional data transmission schemes typically employ independent data encryption and integrity verification mechanisms, i.e., encrypting the original data and performing digest verification separately. In practical applications, due to the lack of effective correlation between encrypted data and verification information, insufficient data integrity protection is prone to occur. When data is tampered with during transmission, it is difficult to achieve reliable verification in a timely manner.

[0004] In addition, some existing cross-regional transmission solutions usually require intermediate temporary storage when data enters isolation equipment or relay nodes, which increases the risk of sensitive data exposure to some extent and makes it difficult to meet the requirements for secure data transmission in the power market scenario. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a bidirectional encryption and decryption method and system for power market data based on partitioned deployment. By employing a bidirectional encryption and decryption method based on digest concatenation, dynamic session key encryption, and isolated transmission of memory data streams, the present invention solves the problems of insufficient correlation between encrypted data and integrity verification information in existing cross-regional data transmission, which makes it difficult to detect data tampering in a timely manner, and the high risk of sensitive information leakage caused by temporary data stored in isolation devices or relay nodes.

[0006] To achieve the above objectives, the present invention provides the following technical solution: Firstly, this application provides a bidirectional encryption and decryption method for power market data based on partitioned deployment. The method includes: concatenating plaintext data to be transmitted with the SM3 digest value of the plaintext data, then performing SM4 encryption using a dynamically generated session encryption key to obtain encrypted data. The encrypted data is forwarded via an isolation buffer in a memory data stream manner. After the encrypted data enters the isolation buffer, a continuity verification mechanism based on a cross-regional ciphertext stream state chain is established according to the transmission order of the encrypted data. After decrypting the received encrypted data, the plaintext data and the original digest value are separated from the decrypted data according to the concatenation rules. The SM3 digest value of the plaintext data is recalculated and compared with the original digest value; if they match, the data integrity is confirmed.

[0007] In one embodiment, the isolation buffer is constructed at the network boundary between the information area where the power trading system is located and the production control area where the power spot market system is located. The isolation buffer is physically isolated from both the information area and the production control area, and its interior is divided into logical sub-regions, forming a two-layer isolation structure that combines physical isolation and logical isolation.

[0008] In one embodiment, a continuous verification mechanism based on a cross-regional encrypted stream state chain is established according to the transmission order of the encrypted data. This includes: dividing the encrypted data stream into multiple data blocks in sequence and generating a sequence identifier for each data block; generating an initial state value based on the current transmission session information; performing a hash operation on the previous state value, the current data block content, and its sequence identifier for each data block according to the data block order to obtain the current state value, and recursively forming a state chain; associating each data block with its corresponding state value and transmitting it along with the data block; and having the receiving end recalculate the verification state value of each data block based on the received sequence identifier and compare it with the received state value. If the sequence identifier does not satisfy a continuous increasing relationship or the verification state value is inconsistent with the received state value, then a transmission anomaly is determined.

[0009] In one embodiment, concatenating plaintext data to be transmitted with the SM3 digest value of the plaintext data includes: performing SM3 digest calculation on the plaintext data to obtain a digest value of fixed length; and appending the digest value to the plaintext data.

[0010] In one embodiment, the SM3 digest calculation employs block processing, including: adaptively adjusting the size of the data block processed each time based on the available memory capacity of the system and the processor load; sequentially reading data blocks in the processing order, iteratively performing SM3 compression operations and updating hash state variables until all data processing is completed, and generating the digest value.

[0011] In one embodiment, the dynamically generated session encryption key is generated in the following way: a session seed is generated based on the session identifier information of the current transmission session; the session seed is iteratively calculated using the HMAC-SM3 key derivation function with SM3 as the underlying hash function to generate the session encryption key; and the session encryption key is encrypted and encapsulated based on the master key pre-shared by the encryption end and the decryption end, and the resulting key ciphertext is transmitted together with the encrypted data.

[0012] In one embodiment, decrypting the received encrypted data includes: obtaining a session encryption key consistent with that of the encryption end; performing an SM4 decryption operation on the encrypted data to obtain initial data; and removing the encrypted padding content from the initial data.

[0013] In one embodiment, removing the encrypted padding content from the initial data includes: dividing the initial data into multiple data groups according to the SM4 block length; determining the actual padding length of each data group recursively based on a chained verification mechanism, wherein the actual padding length of each group is determined based on the data of the current group and the actual padding length of the previous group; padding each data group with the actual padding length determined based on a one-way function before encryption, so that each group reaches the SM4 block length; sequentially removing the padding bytes at the end of each group and concatenating them; if the padding length of any group does not meet the preset conditions, an anomaly is determined and the processing is terminated.

[0014] In one embodiment, recalculating the SM3 digest value of the plaintext data and comparing it with the original digest value includes: dividing the recalculated SM3 digest value and the original digest value into multiple segments respectively; generating a fragment permutation sequence through a deterministic pseudo-random sequence, and performing rearrangement and cyclic shift operations on each segment; performing an XOR accumulation operation on all processed segments to generate virtual digest values ​​respectively; and comparing the virtual digest values ​​using a constant-time comparison algorithm, confirming data integrity if they match.

[0015] Secondly, this application provides a bidirectional encryption and decryption system for power market data based on partitioned deployment. This system includes: a dynamic encrypted cross-regional transmission module, used to concatenate the plaintext data to be transmitted with the SM3 digest value of the plaintext data, and then perform SM4 encryption using a dynamically generated session encryption key to obtain encrypted data. The encrypted data is forwarded via an isolation buffer in a memory data stream manner, and is not persistently stored during transmission; a decryption and recovery module, used to decrypt the received encrypted data and separate the plaintext data and the original digest value from the decrypted data according to the concatenation rules; and an SM3 integrity verification module, used to recalculate the SM3 digest value of the plaintext data and compare it with the original digest value. If they match, the data integrity is confirmed.

[0016] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: By concatenating plaintext data with SM3 digest values ​​and performing SM4 encryption using dynamically generated session encryption keys, this solution achieves coordinated protection of data confidentiality and integrity, avoiding the security risks caused by long-term key use in traditional fixed-key encryption methods. Simultaneously, by forwarding encrypted data as a memory data stream through an isolated buffer, data does not need to be stored on disk during cross-regional transmission, reducing the possibility of unauthorized access or leakage of sensitive data and improving the security of cross-security domain transmission. At the receiving end, the plaintext data and original digest values ​​are decrypted and the SM3 digest is recalculated for consistency verification, effectively detecting tampering during transmission, encryption, and decryption, ensuring data authenticity and integrity. Therefore, this solution meets the needs of cross-regional data exchange in the power market while achieving highly secure, highly reliable, and low-leakage-risk bidirectional encryption and decryption transmission. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A schematic diagram of the bidirectional encryption and decryption method for electricity market data based on partitioned deployment provided in this application embodiment.

[0019] Figure 2 A schematic diagram of the architecture of a bidirectional encryption and decryption system for electricity market data based on partitioned deployment, provided in an embodiment of this application.

[0020] Figure 3 This is a schematic diagram of the power system isolation buffer architecture provided in an embodiment of this application.

[0021] Figure 4 The distribution feature map of the original plaintext data provided in the embodiments of this application.

[0022] Figure 5 This is a ciphertext distribution feature map provided for an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] Reference Figure 1 As shown in the diagram, the bidirectional encryption and decryption method for electricity market data based on partitioned deployment provided by this invention includes the following steps: S1. An isolation buffer is constructed between the information area where the power trading system is located and the production control area where the power spot market system is located, and cross-regional transmission services are deployed within the isolation buffer without disk-based storage, thereby reducing the risk of data leakage.

[0025] In this embodiment, as Figure 3 As shown, an isolation buffer is constructed, including: According to the power system security zoning specifications, the network boundary between the information zone where the power trading system is located and the production control zone where the power spot market system is located is determined, and a deployment area for setting up an isolation buffer zone is planned between the network boundaries. The deployment area includes at least one isolation buffer server, one or more network switching devices and isolation devices. Within the deployment area, an independent network environment is constructed, which is physically isolated from the information area and the production control area. This includes independent physical switches, routers, and firewalls, and can employ virtualization servers or independent operating systems to achieve physical isolation and form an initial isolation space. The initial isolation space is divided into logical sub-regions, and each logical sub-region is assigned an independent network address range and access control policy, thereby forming a logical isolation structure. Based on the logical isolation structure, isolation devices are deployed between the isolation buffer and the information area, and between the isolation buffer and the production control area, including unidirectional isolation devices or bidirectional isolation gateways, to establish cross-area data transmission channels.

[0026] Furthermore, constructing an isolation buffer also includes: Based on the cross-regional data transmission channel, configure a one-way isolation strategy or a two-way controlled communication strategy according to the business data flow direction, so that the data flows only in the preset direction; The unidirectional isolation strategy is used to realize unidirectional data transmission from the information area to the production control area, and the bidirectional controlled communication strategy is used to realize bidirectional data exchange under authentication and authorization conditions.

[0027] Based on the configuration strategy, a cross-regional transmission service module is deployed in the isolation buffer to receive, parse, and encapsulate data from the information area to generate standardized transmission data. The cross-regional transmission service module includes a data receiving unit, a data parsing unit, a data encapsulation unit, and an interface adaptation unit, which are used to achieve data format unification between different systems.

[0028] Based on standardized data transmission, the data is transmitted through a memory data stream within an isolated buffer, ensuring that the data is not persistently stored during transmission and is not left on the ground. The cross-regional data transfer service module, upon receiving data from the information zone or production control zone, does not write the data to hard drives, databases, log files, or other permanent storage media. Instead, it completes the data reception, parsing, and encapsulation processes solely within the server's running memory (RAM). Data is dynamically transferred between processing units in a streaming manner, and is immediately released or overwritten from memory after transmission, thus avoiding the formation of recoverable data copies on the local disk. This method ensures that even if the isolation buffer device is subjected to unauthorized access, disk theft, or system intrusion, historical transmission data is difficult to obtain. It effectively reduces the risks of sensitive transaction data leakage, residual data recovery, and cache misuse, enhancing the security and controllability of cross-regional data exchange.

[0029] The isolation device transmits data to the production control area, and performs access control and protocol verification during the transmission process to ensure the legality of data transmission. After the data transmission from the information area to the production control area is completed, a reverse transmission path from the production control area to the information area is established according to the same structure. An independent isolation policy and access control rules are configured for the reverse path. All data transmission processes within the isolation buffer are uniformly scheduled and managed to achieve controlled, isolated and secure data flow between the information area and the production control area.

[0030] S2, the power trading system receives the original declaration data submitted by market participants, generates plaintext data to be transmitted, and calculates its digest value based on the plaintext data to be transmitted using the SM3 algorithm to obtain a combined data structure. The combined data structure is formed by concatenating plaintext data and digest values, wherein the digest value is used to verify the integrity of the plaintext data.

[0031] In this embodiment, the power trading system receives the original declaration data submitted by market participants, generates plaintext data to be transmitted, and calculates its digest value using the SM3 algorithm based on the plaintext data to be transmitted, resulting in a combined data structure, including: The power trading system receives original declaration data from market participants. The original declaration data is structured electronic data and includes at least the transaction number, transaction party identifier, transaction time, transaction volume, price quote, and other market transaction-related information fields. Based on the original declaration data, the power trading system performs formatting and field verification on the original declaration data. The formatting process includes converting each field into a unified data type, a unified length, and a unified encoding format. The field verification includes verifying the uniqueness of the transaction number, the legality of the transaction volume, the validity of the quotation, and the completeness of the required fields, thereby generating plaintext data to be transmitted. Based on the plaintext data to be transmitted, the SM3 algorithm is used to perform digest calculation to obtain the digest value; The plaintext data to be transmitted and the digest value are concatenated according to a preset rule to form a combined data structure. The preset rule is to append the digest value after the plaintext data and distinguish them with a specific delimiter or a fixed-length field, so that the plaintext data and the digest value can be clearly distinguished in the combined data structure, so as to be used for integrity verification in subsequent data encryption and cross-regional transmission.

[0032] Further, based on the plaintext data to be transmitted, the SM3 algorithm is used to perform digest calculation to obtain a digest value, including: Obtain the total length of the plaintext data to be transmitted and use it as the basic input for subsequent block processing; Based on the length information of the plaintext data to be transmitted, monitor the current system's operating status parameters, including available memory capacity and processor load. Based on the system operating status parameters, the initial data block size is determined according to the preset allocation rules, so that the size of a single data block does not exceed the available memory threshold, thereby generating a block processing strategy. Specifically, the preset allocation rule is as follows: The available memory capacity threshold is set to M, the processor utilization threshold is set to P, and the basic block size is set to... The maximum block size is The minimum block size is ,and and All values ​​are multiples of 512 bits; when calculating the block size, the current block size B is determined according to the following rules: when the current available memory capacity is ≥ M and the processor utilization is ≤ P, take... When the current available memory capacity is detected to be <M or the processor utilization is >P, take... The calculated block size is then aligned to 512 bits to meet the requirements of the SM3 algorithm for grouping calculation, thus obtaining the final block size for data block processing.

[0033] Based on the block processing strategy, a data reading pointer is established on the plaintext data to be transmitted, which is used to locate the current data range to be processed in sequence; Based on the data read pointer and the initial data block size, the first data block is read from the plaintext data to be transmitted and used as the current data to be processed. Before processing the first data block, the hash state variables are initialized according to the SM3 algorithm specification for subsequent incremental calculations. Based on the first data block, it is padded and SM3 compression is performed to obtain an intermediate hash state value; After the first data block is processed, the data read pointer is updated according to the length of the processed data, so that it points to the next unprocessed data range; Based on the updated data read pointer, the system running status parameters are re-detected, and the block size is adaptively adjusted according to the current available memory and processor load to obtain the updated block processing strategy. The adaptive adjustment is calculated using the following formula:

[0034] In the formula, The size of the data block during the k-th processing iteration. For the updated data block size, This represents the current available memory capacity. This represents the current processor utilization rate.

[0035] According to the updated chunking strategy, the next data block is read from the plaintext data to be transmitted and used as the new current processing data; Based on the intermediate hash state value, SM3 compression operation is performed on the currently processed data to update the hash state variable and obtain a new intermediate hash state value. This process is repeated until all plaintext data to be transmitted is processed. After all data blocks have been processed, the final hash state variables are concatenated to generate a fixed-length digest value.

[0036] It should be noted that after acquiring the plaintext data to be transmitted, the data block size is dynamically adjusted based on the real-time operating status of the system. During the block processing, digest calculation and state iteration updates are performed block by block, thus ensuring that the data processing process is always controlled within the available memory capacity and processor load range. This scheme not only effectively avoids memory overflow problems caused by one-time loading during large-scale data processing, but also improves the utilization of computing resources and processing efficiency through adaptive adjustment of block size. At the same time, the block-by-block compression characteristics of the SM3 algorithm ensure the consistency and integrity of the digest calculation results, thereby achieving a highly reliable and high-performance digest calculation process while ensuring data security.

[0037] S3. Based on the session encryption key, the combined data structure is encrypted using SM4 to generate encrypted data. The encrypted data is then sent to the isolation buffer via the cross-regional transmission service. After the encrypted data enters the isolation buffer, a continuity verification mechanism based on the cross-regional ciphertext stream state chain is established according to the transmission order of the encrypted data.

[0038] In this implementation, the combined data structure is encrypted using SM4 based on the session encryption key to generate encrypted data, and the encrypted data is sent to the isolation buffer via the cross-area transmission service, including: Obtain the combined data structure to be transmitted across regions and determine the corresponding cross-region transmission request; Based on the cross-regional transmission request, a session-level dynamic key generation process is triggered, specifically including: The business system that initiated the cross-regional transmission request shall be subject to identity authentication and permission verification. After successful authentication, session identification information is generated and used as a unique identification parameter for subsequent key generation. Generate a random number for the session based on the session identifier information, and obtain the current system timestamp; The session identifier information, session random number and system timestamp are encoded and concatenated in a preset order to generate a session seed; Based on the session seed, a session encryption key is generated using the key derivation function (KDF), specifically including: Convert the session seed to UTF-8 or binary encoding; Input the encoded session seed into the HMAC-SM3-based key derivation function KDF; The HMAC-SM3-based key derivation function is an HMAC structure built using the SM3 hash algorithm as the underlying hash function. It takes the session seed as input data and performs HMAC operations in combination with a preset derivation key. It outputs a fixed-length intermediate digest value through at least one iteration, and then truncates or expands the intermediate digest value to generate a 128-bit symmetric key that meets the requirements of the SM4 algorithm.

[0039] The preset derived key is a high-strength random key parameter deployed in the key management module or secure storage area. It is used as the initial key factor in the HMAC-SM3 key derivation process. It is generated by a random number generation algorithm during the system initialization phase and protected by a hardware security module, key management system or encrypted storage mechanism. It is only called when performing session encryption key derivation operations to enhance the unpredictability of derivation key results between different session seeds and the ability to resist key deduction attacks.

[0040] A 128-bit output value is generated through iterative calculations; Use the 128-bit output value as the SM4 session encryption key; The session encryption key is a 128-bit symmetric key that conforms to the requirements of the SM4 algorithm.

[0041] Based on the preset master key, the session encryption key is encrypted and encapsulated to generate key ciphertext; the key ciphertext and subsequently generated encrypted data are then encapsulated together into the transmission data unit for the decryption end to recover the session encryption key.

[0042] Based on the session encryption key, the combined data structure is encrypted using SM4 to generate encrypted data, including the following sub-steps: The combined data structure is divided into multiple fixed-length data groups according to the SM4 group length, and a padding process is performed on each data group, wherein the padding length of each group is determined based on a one-way function, thereby generating a sequence of data blocks to be encrypted. Based on the session encryption key, the working mode and initial parameters of the SM4 encryption algorithm are set. The working mode includes block cipher mode, and the initial parameters include initialization vector or block start state. Based on the session encryption key, SM4 encryption is performed sequentially on each data packet in the sequence of data blocks to be encrypted to generate corresponding ciphertext data packets. All encrypted data is grouped and concatenated in their original order to generate complete encrypted data.

[0043] The encrypted data and the key ciphertext are encapsulated into a transmission data unit, and the transmission data unit includes at least the encrypted data, the key ciphertext, and transmission control information, and the transmission control information includes at least a data length identifier and a block identifier. The transmission data unit is sent to the cross-regional transmission service module, which receives and schedules the transmission. Within the cross-regional transmission service module, the transmission data unit is forwarded via a memory data stream, ensuring that the data is not stored on disk during transmission. Finally, the encrypted data is sent to the isolation buffer via an isolation device, thus achieving secure cross-regional transmission of the combined data structure.

[0044] It should be noted that by introducing a session-level dynamic key generation mechanism, the encryption key is made dynamic and single-use during cross-regional data transmission, effectively avoiding the leakage risk caused by the long-term reuse of traditional fixed keys. Simultaneously, the session seed is fused and iteratively calculated using a key derivation function based on HMAC-SM3, improving the randomness and anti-predictability of the session key. Furthermore, the session key is encrypted and encapsulated using a preset master key, ensuring recoverability and security during transmission, thus forming a two-layer security mechanism that separates encryption and key protection. In addition, the randomness and structural unidentifiableness of the ciphertext are improved by applying SM4 block encryption, padding, and initialization vector configuration to the combined data structure. Combined with the memory data stream forwarding mechanism of the cross-regional transmission service module and the diskless transmission method of the isolation device, the risk of data leakage and residue in the transmission link is further reduced. Ultimately, a multi-level data security transmission method with high confidentiality, high anti-attack capability, and suitability for cross-regional secure exchange scenarios in the power spot market is achieved.

[0045] like Figure 4 and Figure 5 The diagram shown is a comparison of the randomness of byte distribution between the original plaintext data and the SM4 encrypted data in this embodiment. Figure 4 The original transaction data exhibits a clear structured pattern based on byte frequency distribution. Figure 5 The byte distribution of the ciphertext data after SM4 encryption is uniformly discrete, indicating that the encrypted data has a high degree of randomness.

[0046] Furthermore, since electricity market systems typically employ a zoned deployment approach separating information and production control areas, while encrypted data can prevent plaintext leakage during cross-regional data exchange, the isolation buffer, acting only as a data forwarding node, cannot detect the continuous state of the encrypted data stream during transmission. When encrypted data experiences data block loss, duplicate transmission, changes in transmission order, or abnormal modifications during cross-regional transmission, existing methods based on post-decryption digest verification can only detect data anomalies after the data arrives at the target region and is decrypted, failing to promptly identify abnormalities in the encrypted data stream state during cross-regional transmission.

[0047] Therefore, after the encrypted data enters the isolation buffer, a continuity verification mechanism based on the cross-regional ciphertext stream state evolution is introduced. Without decrypting the ciphertext data or changing the original memory stream forwarding method, a state association relationship is established for the continuously transmitted encrypted data blocks, so that the receiving end can judge the data continuity in the cross-regional transmission process based on the ciphertext state evolution result.

[0048] The step of establishing a continuity verification mechanism based on the cross-regional ciphertext stream state chain according to the transmission order of the encrypted data after the encrypted data enters the isolation buffer includes: The continuous encrypted data stream entering the isolation buffer is divided into multiple ciphertext data blocks according to a preset length, and a corresponding data block sequence identifier is generated according to the time order in which each ciphertext data block enters the isolation buffer. An initial state value is generated based on the session identifier information, transmission direction identifier information, and random initialization parameters of the current transmission session, serving as the starting state of the cross-regional ciphertext stream state chain; Specifically, the session identifier information, the transmission direction identifier information, and the random initialization parameters are combined in a preset order to form state initialization data, and SM3 digest calculation is performed on the state initialization data, with the resulting digest value used as the initial state value.

[0049] The ciphertext state is recursively calculated for each ciphertext data block according to the increasing order of the data block sequence identifiers. Specifically, for the first ciphertext data block, the initial state value, the data content of the first ciphertext data block, and the data block sequence identifier corresponding to the first ciphertext data block are concatenated, and SM3 digest calculation is performed to obtain the first ciphertext state value. For the i-th ciphertext data block, the ciphertext state value corresponding to the (i-1)-th ciphertext data block, the data content of the i-th ciphertext data block, and the data block sequence identifier corresponding to the i-th ciphertext data block are concatenated, and SM3 digest calculation is performed to obtain the ciphertext state value corresponding to the i-th ciphertext data block. Through the above recursive calculation, the ciphertext state values ​​corresponding to each ciphertext data block are arranged in the order of data block transmission to form a cross-regional ciphertext stream state sequence. A temporary association is established between the data block sequence identifier, the ciphertext data block, and the corresponding ciphertext status value corresponding to each ciphertext data block, and the temporary association is stored in the running memory of the isolation buffer, so that the ciphertext status value corresponding to each ciphertext data block is transmitted across regions synchronously with the corresponding ciphertext data block. The temporary association exists only during the current transmission session. When the corresponding encrypted data block is sent or the transmission is terminated abnormally, the temporary association in the corresponding running memory is released to avoid persistent storage of state information during the transmission process.

[0050] After receiving the encrypted data, the receiving end determines the receiving order of the ciphertext data blocks according to the data block sequence identifier corresponding to each received ciphertext data block; Based on the initial state value and each received ciphertext data block, the verification state value corresponding to each ciphertext data block is recalculated using the same ciphertext state recursive calculation method as the sending end. The verification status value is compared with the received ciphertext status value, and the continuity status of the encrypted data stream during cross-regional transmission is determined based on the comparison result. Specifically, when the data block sequence identifiers of adjacent ciphertext data blocks do not satisfy a preset continuous increasing relationship, it is determined that the encrypted data stream has missing data blocks, repeated reception, or abnormal transmission order; when the recalculated verification status value is inconsistent with the received corresponding ciphertext status value, it is determined that the encrypted data stream has undergone abnormal modification during cross-regional transmission.

[0051] Specifically, based on the data block sequence identifiers corresponding to each received ciphertext data block, a set of received sequence identifiers corresponding to the current transmission session is established, and the continuous state of the encrypted data stream is determined based on the relationship between the data block sequence identifiers corresponding to the currently received ciphertext data block and the data block sequence identifiers corresponding to the previous ciphertext data block. When the data block sequence identifier corresponding to the current ciphertext data block is equal to the sum of the data block sequence identifier corresponding to the previous ciphertext data block and the preset increment step, it is determined that the current ciphertext data block and the previous ciphertext data block satisfy a continuous increment relationship. The preset increment step size is determined according to the numbering rule of the data block sequence identifier. The fixed number increment between the data block sequence identifiers corresponding to two adjacent consecutive ciphertext data blocks is determined as the preset increment step size. When the sequential increment numbering rule is adopted, the preset increment step size is set to 1.

[0052] When the sequence identifier of the data block corresponding to the current ciphertext data block is greater than the sum of the sequence identifier of the data block corresponding to the previous ciphertext data block and the preset increment step, it is determined that there is a missing data block based on the missing sequence identifier between the sequence identifier of the data block corresponding to the current ciphertext data block and the sequence identifier of the data block corresponding to the previous ciphertext data block, and the missing sequence identifier is determined as the missing data block sequence identifier. When the sequence identifier of the data block corresponding to the current ciphertext data block is already included in the set of received sequence identifiers, it is determined that a data block has been received repeatedly. When the sequence identifier of the data block corresponding to the current ciphertext data block is less than the sequence identifier of the data block corresponding to the previous ciphertext data block, and the sequence identifier of the data block corresponding to the current ciphertext data block is not included in the set of received sequence identifiers, it is determined that there is a transmission order abnormality.

[0053] Furthermore, after determining that a transmission anomaly exists, corresponding anomaly status information is generated according to the anomaly type, and anomaly handling is performed on the anomaly ciphertext data block based on the anomaly status information; wherein, the anomaly handling includes at least one of suspending the current ciphertext data flow to the subsequent processing stage, discarding the anomaly ciphertext data block, requesting retransmission of the anomaly ciphertext data block, and generating an anomaly alarm.

[0054] Handle different anomalies: When it is determined that a data block is missing, the missing ciphertext data block is identified based on the missing data block sequence identifier, and a retransmission request for the missing ciphertext data block is generated. When duplicate reception is detected, the duplicate received ciphertext data blocks are discarded. When a transmission order disorder is detected, the received ciphertext data blocks are temporarily sorted according to the data block sequence identifier, or the current transmission session is terminated and a retransmission is requested. When the verification status value is determined to be inconsistent with the received ciphertext status value, the corresponding ciphertext data block is marked as an integrity verification anomaly, and the ciphertext data block is prevented from entering the subsequent decryption process. At the same time, a transmission anomaly alarm is generated.

[0055] It should be noted that by introducing a continuous verification mechanism based on the cross-regional ciphertext stream state evolution into the isolation buffer, the isolation buffer is transformed from a traditional data forwarding node into a secure transmission node with ciphertext state awareness capabilities. Without decrypting the encrypted data or changing the original memory stream forwarding method, a continuous state chain is formed by utilizing the state correlation between consecutive ciphertext data blocks, enabling real-time detection of the ciphertext data stream state during cross-regional transmission. Compared to methods that rely solely on digest verification after decryption at the receiving end, this scheme can detect transmission anomalies such as missing, duplicate, out-of-order, and abnormal modifications of data blocks in advance during the ciphertext transmission stage. This improves the reliability, security, and anomaly detection capabilities of the data exchange process between the power market information area and the production control area, while avoiding plaintext exposure and persistent storage risks during transmission.

[0056] S4, the encrypted data is transmitted to the electricity spot market system via the isolation device according to the isolation buffer. After receiving the encrypted data, the electricity spot market system performs SM4 decryption based on the session encryption key to obtain combined data, including: The isolation buffer receives transmission data units sent from the cross-regional transmission service module, and parses the transmission data units to extract encrypted data, key ciphertext, and corresponding transmission control information. Based on the encrypted data obtained from the parsing, the encrypted data is sent from the isolation buffer to the electricity spot market system through a pre-established isolation device transmission channel; The electricity spot market system receives the encrypted data through the isolation device and performs format identification and length confirmation based on the transmission control information; Obtain a preset master key that is consistent with the encryption end; based on the preset master key, decapsulate the key ciphertext to obtain the session encryption key. Based on the session encryption key, the working mode and initial parameters of the SM4 decryption algorithm are set. The working mode is consistent with the encryption end, and the initial parameters include an initialization vector or a block start state. According to the block length requirement of the SM4 algorithm, the encrypted data is divided into multiple 128-bit ciphertext data blocks to generate a sequence of data blocks to be decrypted. Based on the session encryption key, SM4 decryption operation is performed sequentially on each ciphertext data block in the sequence of data blocks to be decrypted to obtain the corresponding plaintext data block. The decrypted plaintext data is grouped and concatenated in its original order to generate initial data; Based on the recursive chain verification algorithm, the padding content in the initial data is removed to obtain the complete combined data.

[0057] Furthermore, based on a recursive chain verification algorithm, the padding in the initial data is removed to obtain the complete combined data, including: The initial data is divided into multiple data groups according to the SM4 group length; Before processing the first packet, obtain the session encryption key and set the initial padding length check value as the starting condition for the recursive chained computation; Based on the initial padding length check value, the first block data, and the session encryption key, the one-way function h is called to calculate the actual padding length of the first block. The actual fill length of the first group is calculated using the following formula:

[0058] In the formula, This is the actual fill length of the first group. The first group of data, This is the initial padding length verification value. Use the session encryption key.

[0059] The one-way function h is an irreversible mapping function constructed based on a cryptographic hash algorithm. Specifically, the SM3 hash algorithm can be used to calculate the digest of the input parameters. The current block data, the previous padding length check value or the previous block padding length, and the session encryption key are encoded and concatenated according to a preset field order as input. After SM3 iterative compression processing, a fixed-length digest value is generated. The digest value is then moduloed or truncated according to the value range corresponding to the SM4 block length to output the actual padding length of the corresponding block.

[0060] Based on the actual padding length of the first block, remove the padding bytes at the end of the first block data and store the plaintext after removal into the output buffer; For each subsequent group, the fill length of the current group is recursively calculated based on the data content and fill length of the previous group; The actual fill length of the current group is calculated using the following formula:

[0061] In the formula, The actual fill length for the current group. For the i-th group of data, Fill the length of the previous group of the i-th group.

[0062] For each group in turn Remove the trailing padding bytes according to the calculated actual padding length of the current group, and concatenate the plaintext after removal to the output buffer; if the padding length of any group does not meet the preset length, an anomaly is immediately identified and the operation is stopped. The preset length is determined based on the fixed block length of the SM4 block encryption algorithm and is set to an integer range value that does not exceed the length of a single SM4 data block, in conjunction with the preset padding rules. Specifically, the SM4 block length of 16 bytes can be used as the maximum constraint range, and the allowable padding length of a single block can be limited to 1 to 16 bytes. The set of legal lengths for anomaly verification is determined by the system pre-configuration method.

[0063] After all grouping and padding removal are completed, the plaintext data in the output buffer is concatenated in the original order to obtain complete combined data, which can be used for subsequent business processing or integrity verification.

[0064] It should be noted that by introducing a depadding mechanism based on a recursive chain verification algorithm into the SM4 depadding process, the padding length of each data block not only depends on its own data but also forms a recursive association with the content and padding result of the previous block, thereby constructing a continuous constraint relationship across blocks. This method can detect the legality of the padding length in real time during the depadding process, and immediately terminate the processing if an anomaly is found, effectively avoiding the risks of memory out-of-bounds errors and denial-of-service due to malicious tampering or transmission errors. At the same time, this chain structure enhances the data's resistance to tampering and overall consistency, significantly improving the security, stability, and ability to identify abnormal data in the depadding process compared to traditional independent block depadding methods.

[0065] Furthermore, as shown in Table 1, the anomaly detection capabilities of the traditional PKCS padding removal method and the recursive chain verification padding removal method of this embodiment are compared: Table 1 Comparison of Anomaly Detection Capabilities for De-filling

[0066] As shown in Table 1, this embodiment enhances the constraint relationship between groups through a recursive chain association mechanism, thereby significantly improving the ability to identify abnormal data filling.

[0067] S5, re-perform SM3 digest calculation on the plaintext data in the decrypted combined data to obtain a checksum. Compare the digest value with the checksum. If they match, confirm data integrity and output plaintext data for business processing; otherwise, determine data anomaly and refuse processing, including: Receive combined data decrypted from the electricity spot market system, the combined data including plaintext data and the corresponding original digest value; Based on the preset encapsulation format of the combined data, the combined data is parsed to extract the plaintext data and the corresponding original digest value, and the plaintext data is used as the input data for integrity verification. Obtain the data length information and data boundary information of the plaintext data, and initialize the hash state variables according to the SM3 cryptographic hash algorithm specification, including initialization initial vector, message length count parameter and message expansion processing parameter, to provide the initial calculation state for subsequent digest calculation; According to the grouping rules of the SM3 algorithm, the plaintext data is divided into multiple fixed-length data groups, and the SM3 compression operation is performed on each data group in sequence. After each data group is processed, the current hash state variable is updated. After all data packets have been processed, the final hash state variable is output to generate a fixed-length SM3 digest value, which is then used as the check value recalculated based on the currently received plaintext data. Furthermore, to improve the resistance to side-channel attacks during the digest comparison process, a fragmentation and obfuscation process based on a deterministic pseudo-random sequence is performed on the recalculated SM3 digest value and the original digest value, specifically including: Based on the digest value length and the preset number of segments, the verification value and the original digest value are divided into multiple continuous segments respectively; The preset number of fragments is determined based on the SM3 digest output length and the preset fragment granularity. The fragment granularity adopts a fixed byte length configuration so that the length of each sub-segment is within a preset range. When the digest length cannot be divided by the number of fragments, the first few sub-segments are divided with the same length according to the sequential division principle, and the remaining bytes are assigned to the last sub-segment to ensure that all digest bytes participate in subsequent processing.

[0068] Furthermore, a piecewise permutation sequence is generated based on a deterministic pseudo-random sequence generation algorithm, wherein the deterministic pseudo-random sequence generation algorithm specifically includes: Obtain the current session identifier information, the number of fragments, and the preset derived parameters, and encode and concatenate them according to the preset field order to form a pseudo-random sequence to generate input data; The pseudo-random sequence generation input data is input into a deterministic pseudo-random generation function constructed based on the SM3 hash algorithm, and continuous pseudo-random output values ​​are generated through SM3 iterative calculation. Based on the correspondence between the generated pseudo-random output values ​​and the fragment numbers of each summary, the fragment numbers are sorted to generate a fragment permutation index sequence corresponding to the number of fragments.

[0069] The deterministic pseudo-random sequence generation algorithm outputs consistent results when the input parameters are the same, enabling the data sender and receiver to generate completely identical fragment permutation sequences based on the same input parameters, thereby ensuring that both parties can use the same rules to complete digest conversion and verification.

[0070] Based on the fragmentation permutation index sequence, the divided summary segments are rearranged. Specifically, the original sorted segments of the abstract are reordered according to the fragmentation replacement index sequence, so that the arrangement position of each segment changes during the combination process, resulting in a fragmented abstract sequence after fragmentation replacement.

[0071] Furthermore, a cyclic shift operation is performed on each of the digest segments after the fragment rearrangement is completed.

[0072] Specifically, for the j-th summary segment, the cyclic shift parameter is determined based on the index value of the corresponding position in the fragmentation permutation index sequence, and the summary segment is cyclically shifted to the left or right according to the preset cyclic direction.

[0073] The cyclic shift operation can be implemented at the byte level or the bit level. When using byte-level cyclic shift, the bytes in the digest segment are adjusted in a circular queue manner. When using bit-level cyclic shift, the binary bits in the digest segment are cyclically shifted according to a set shift number.

[0074] The cyclic shift direction and the number of shifts are determined by preset rules. These preset rules can be generated based on fragment index values, session identifier information, or preset shift parameters to ensure that the sending end and the receiving end can complete the cyclic shift process according to the same rules.

[0075] Furthermore, an XOR summation operation is performed on all the digest segments after the fragment rearrangement and cyclic shift to generate a virtual digest value.

[0076] Specifically, it includes: Use the first processed summary segment as the initial combination value; The subsequent digest segments are obtained sequentially according to the fragment arrangement order, and the current combined value is XORed with the current digest segment byte by byte. Repeat the above XOR operation until all digest sub-segments have been processed; Output the final XOR operation result to obtain the corresponding virtual digest value.

[0077] The length of the virtual digest value is consistent with the length of the original SM3 digest, so that the virtual digest value can be used as an equivalent comparison object in the digest integrity verification process.

[0078] The same fragmentation, deterministic pseudo-random sequence generation, fragment rearrangement, cyclic shift, and XOR accumulation processes are performed on both the recalculated SM3 digest value and the original digest value to obtain the corresponding first virtual digest value. Second virtual digest value .

[0079] Furthermore, a constant-time consistency comparison is performed on the first virtual digest value and the second virtual digest value using a constant-time comparison algorithm.

[0080] The constant-time comparison algorithm includes: Iterate through all bytes in the first and second virtual digest values ​​according to a fixed length; Perform an XOR operation on each group of corresponding bytes, and accumulate the results of each XOR operation; After all bytes have been compared, the final cumulative result is used to determine whether the two virtual digest values ​​are consistent. When the cumulative result is zero, the first virtual digest value and the second virtual digest value are determined to be completely identical; when the cumulative result is not zero, the two are determined to be different.

[0081] During the above comparison process, even if an inconsistency is found in the position of the preceding byte, the comparison process is not terminated immediately. Instead, the traversal of all bytes continues, thereby ensuring that the program execution time corresponding to different comparison results is basically consistent, and preventing attackers from obtaining digest value characteristics through time difference analysis.

[0082] Perform data processing operations based on the virtual digest alignment results: When the first virtual digest value is consistent with the second virtual digest value, it is determined that the plaintext data has not been tampered with during transmission, encryption and decryption, the data integrity is confirmed to be valid, and the plaintext data is output to the business processing module. When the first virtual digest value is inconsistent with the second virtual digest value, it is determined that the plaintext data is abnormal or has a potential risk of tampering, and the plaintext data is refused to be processed further, and the abnormal handling mechanism is triggered.

[0083] The anomaly handling mechanism includes generating anomaly logs, recording anomaly data identifiers, triggering security alerts, and executing subsequent security protection strategies.

[0084] It should be noted that this embodiment verifies the integrity of the decrypted plaintext data by re-performing the SM3 digest calculation. At the same time, it generates a fragment permutation sequence through a deterministic pseudo-random sequence and generates a virtual digest value by combining digest fragment rearrangement, cyclic shift, and XOR accumulation. This ensures that the digest verification process does not directly expose the original digest structure, reducing the possibility of attackers obtaining digest information through access sequence analysis, time analysis, or side-channel attacks.

[0085] Meanwhile, since the deterministic pseudo-random sequence is generated jointly by the shared session parameters and preset derived parameters, it can produce a unique corresponding fragmentation permutation result when the input conditions are consistent. Therefore, it will not affect the repeatability and accuracy of the digest verification process. This method improves the security of the data verification process in cross-regional transmission environments while ensuring data integrity and verification reliability, and can directly output plaintext data for subsequent business processing after confirming the data's legitimacy.

[0086] Reference Figure 2 As shown in the diagram, the bidirectional encryption and decryption system for electricity market data based on partitioned deployment provided by this invention includes: a dynamic encryption cross-regional transmission module, a decryption and recovery module, and an SM3 integrity verification module. The modules are interconnected. The dynamic encrypted cross-regional transmission module is used to concatenate the plaintext data to be transmitted with the SM3 digest value of the plaintext data, and then perform SM4 encryption with a dynamically generated session encryption key to obtain encrypted data. The encrypted data is forwarded via an isolation buffer in the form of a memory data stream, and is not persistently stored during the transmission process. The decryption and recovery module is used to decrypt the received encrypted data and then separate the plaintext data and the original digest value from the decrypted data according to the cascading rules. The SM3 integrity verification module is used to recalculate the SM3 digest value of the plaintext data and compare it with the original digest value. If they match, the data integrity is confirmed.

[0087] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0088] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0089] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0090] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A bidirectional encryption / decryption method for electricity market data based on partitioned deployment, characterized in that: include: After concatenating the plaintext data to be transmitted with the SM3 digest value of the plaintext data, SM4 encryption is performed using a dynamically generated session encryption key to obtain encrypted data. The encrypted data is forwarded via an isolation buffer in the form of a memory data stream. After the encrypted data enters the isolation buffer, a continuity verification mechanism based on the cross-regional ciphertext stream state chain is also included, according to the transmission order of the encrypted data. After decrypting the received encrypted data, the plaintext data and the original digest value are separated from the decrypted data according to the cascading rules. The SM3 digest value is recalculated for the plaintext data and compared with the original digest value. If they match, the data integrity is confirmed.

2. The method according to claim 1, characterized in that, The isolation buffer is constructed at the network boundary between the information area where the power trading system is located and the production control area where the power spot market system is located. The isolation buffer is physically isolated from both the information area and the production control area. It is internally divided into logical sub-regions, forming a two-layer isolation structure that combines physical isolation and logical isolation.

3. The method according to claim 1, characterized in that, The establishment of a continuity verification mechanism based on the cross-regional ciphertext stream state chain according to the transmission order of encrypted data includes: The encrypted data stream is divided into multiple data blocks in sequence, and a sequence identifier is generated for each data block; Generate an initial state value based on the current transmission session information; According to the data block order, for each data block, the previous state value, the current data block content and its sequence identifier are hashed to obtain the current state value, and the state chain is formed recursively. Each data block and its corresponding status value are associated and transmitted along with the data block; The receiving end recalculates the verification status value of each data block based on the received sequence identifier and compares it with the received status value. If the sequence identifier does not satisfy the continuous increment relationship or the verification status value is inconsistent with the received status value, the transmission is determined to be abnormal.

4. The method according to claim 1, characterized in that, The concatenation of the plaintext data to be transmitted with the SM3 digest value of the plaintext data includes: Perform SM3 digest calculation on the plaintext data to obtain a digest value of fixed length; The digest value is appended to the plaintext data.

5. The method according to claim 4, characterized in that, The SM3 digest calculation employs a block-based processing method, including: The size of the data block processed each time is adaptively adjusted based on the available memory capacity of the system and the processor load. Data blocks are read sequentially according to the processing order, SM3 compression operation is performed iteratively and hash state variables are updated until all data is processed and the digest value is generated.

6. The method according to claim 1, characterized in that, The dynamically generated session encryption key is generated in the following way: A session seed is generated based on the session identifier information of the current transmission session; The session encryption key is generated by iteratively calculating the session seed using the HMAC-SM3 key derivation function with SM3 as the underlying hash function. The session encryption key is encrypted and encapsulated based on the master key pre-shared between the encryption and decryption ends, and the resulting key ciphertext is transmitted together with the encrypted data.

7. The method according to claim 1, characterized in that, The decryption of the received encrypted data includes: Obtain the session encryption key that is consistent with the encryption end, and perform SM4 decryption operation on the encrypted data to obtain the initial data; The encrypted padding in the initial data is removed.

8. The method according to claim 7, characterized in that, Removing the encrypted padding from the initial data includes: The initial data is divided into multiple data groups according to the SM4 group length; Based on the chain verification mechanism, the actual filling length of each data group is determined recursively, where the actual filling length of each group is determined based on the data in this group and the actual filling length of the previous group. Each data packet is padded with the actual padding length determined by a one-way function before encryption, so that each packet reaches the SM4 packet length. Remove padding bytes from the end of each group sequentially and concatenate them; if the padding length of any group does not meet the preset condition, an error is identified and the processing is terminated.

9. The method according to claim 1, characterized in that, The SM3 digest value is recalculated for the plaintext data and compared with the original digest value, including: The recalculated SM3 digest value and the original digest value are each divided into multiple sub-segments; A piecewise permutation sequence is generated using a deterministic pseudo-random sequence, and rearrangement and cyclic shift operations are performed on each sub-segment; Perform an XOR summation operation on all processed segments to generate virtual digest values ​​respectively; A constant-time comparison algorithm is used to compare the virtual digest values; if they match, the data integrity is confirmed.

10. A system using the bidirectional encryption / decryption method for electricity market data based on partitioned deployment as described in any one of claims 1-9, characterized in that, include: The dynamic encrypted cross-regional transmission module is used to concatenate the plaintext data to be transmitted with the SM3 digest value of the plaintext data, and then perform SM4 encryption with a dynamically generated session encryption key to obtain encrypted data. The encrypted data is forwarded via an isolation buffer in the form of a memory data stream, and is not persistently stored during the transmission process. The decryption and recovery module is used to decrypt the received encrypted data and then separate the plaintext data and the original digest value from the decrypted data according to the cascading rules. The SM3 integrity verification module is used to recalculate the SM3 digest value of the plaintext data and compare it with the original digest value. If they match, the data integrity is confirmed.

Images