CN103647654B - A kind of power distribution terminal key management method based on trust computing - Google Patents

A kind of power distribution terminal key management method based on trust computing Download PDF

Info

Publication number
CN103647654B
CN103647654B CN201310726584.6A CN201310726584A CN103647654B CN 103647654 B CN103647654 B CN 103647654B CN 201310726584 A CN201310726584 A CN 201310726584A CN 103647654 B CN103647654 B CN 103647654B
Authority
CN
China
Prior art keywords
key
etm
distribution terminal
identity
sms4
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201310726584.6A
Other languages
Chinese (zh)
Other versions
CN103647654A (en
Inventor
徐震
于爱民
汪丹
周启惠
王志皓
赵保华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
State Grid Corp of China SGCC
State Grid Zhejiang Electric Power Co Ltd
China Electric Power Research Institute Co Ltd CEPRI
Global Energy Interconnection Research Institute
Institute of Information Engineering of CAS
Original Assignee
State Grid Corp of China SGCC
State Grid Zhejiang Electric Power Co Ltd
China Electric Power Research Institute Co Ltd CEPRI
Institute of Information Engineering of CAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by State Grid Corp of China SGCC, State Grid Zhejiang Electric Power Co Ltd, China Electric Power Research Institute Co Ltd CEPRI, Institute of Information Engineering of CAS filed Critical State Grid Corp of China SGCC
Priority to CN201310726584.6A priority Critical patent/CN103647654B/en
Publication of CN103647654A publication Critical patent/CN103647654A/en
Application granted granted Critical
Publication of CN103647654B publication Critical patent/CN103647654B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The present invention relates to a kind of power distribution terminal key management method based on trust computing, methods described includes:(1)ETM key structures are built according to distribution terminal;(2)Generate the distribution terminal letter of identity based on ETM keys;(3)Based on ETM key storages and manage distribution terminal data;(4)Distribution terminal state is proved based on ETM secret key remotes.Key involved by distribution terminal of the present invention is stored in electric power trusted module ETM, and ETM provides the protection of hardware-level for key, and the safety of key further ensures the safety of cipher key operation result;The Endpoint integrity state signed based on distribution terminal identity key, can be achieved the identity and context identification of distribution terminal in the communication system of power grids, further enhance communication system of power grids safety.

Description

A kind of power distribution terminal key management method based on trust computing
Technical field
A kind of electric-power system management method of the present invention, in particular to a kind of distribution terminal key pipe based on trust computing Reason method.
Background technology
As the intelligent grid of following power network development trend, the emphasis of countries in the world development is increasingly becoming, is set up in collection Into, intelligent grid on the basis of high-speed bidirectional communication network, using passing through advanced sensing and e measurement technology, advanced control Method processed and advanced DSS technology to realize the reliable of power network, it is safety, economy, efficient, environment-friendly and make With the target of safety.One valuable feature of intelligent grid is power distribution automation.
Distribution terminal in power distribution automation has the operation function for detecting and monitoring distribution wire.Due to answering for local environment Polygamy and uncertainty, its safety problem faced are more complicated than PC systems.Distribution terminal may be broken by such as physics Bad, viral wooden horse is threatened and the security threat from mobile Internet.Therefore, threatened for these, distribution terminal typically has Following demand for security, such as data integrity, data encryption, non-repudiation etc..In order to lift the safety of distribution terminal, utilize The method that OpenSSL encryption kits are tested the security protection ability of distribution terminal, and use hash operations and non- Symmetric cryptosystem realizes order integrity check and the authentication to distribution network master station.Added with distribution terminal using asymmetric Secret skill art carries out the methods such as unidirectional authentication and message integrity protection to distribution main website, and proposes external safe mould The thinking of block, to reduce the transformation to distribution terminal equipment.Although above-mentioned safety approach can improve distribution to a certain extent The safety of terminal, but these schemes all do not account for the safety management of key, once key is compromised or steals, then strong safety Scheme can not also play a role.
The content of the invention
In view of the shortcomings of the prior art, the present invention provides a kind of power distribution terminal key management method based on trust computing, This method devises electric power trusted module ETM(Electrical Trusted Module), include ETM key structure, and The generation of distribution terminal letter of identity, data safety storage and context identification based on ETM keys.In the safety management side of key Face, trust computing is a kind of good solution.Trust computing is a kind of information system security new technology.Its main thought is Safety chip is introduced on computer hardware platforms framework to improve the security of terminal system.In trust computing, key is Stored with tree structure, SRK is stored in safety zone, remaining key is by it as one-level key (also referred to as master key) Directly or indirectly protected, its protected mode is father's key encryption subkey.Trust computing contrasts the excellent of conventional security Putting is:Outside can not arbitrarily obtain the information in the hardware chip with security function.
The purpose of the present invention is realized using following technical proposals:
A kind of power distribution terminal key management method based on trust computing, it is theed improvement is that, methods described includes:
(1)ETM key structures are built according to distribution terminal;
(2)Generate the distribution terminal letter of identity based on ETM keys;
(3)Based on ETM key storages and manage distribution terminal data;
(4)Distribution terminal state is proved based on ETM secret key remotes.
It is preferred that, the step(1)Middle ETM keys solidify ETM key grooves, its key groove storage Binding key handle bag Include:ETM_IDENTITY_KEY_PRIV- identity key private keys handle, ETM_IDENTITY_KEY_PUB- identity keys public key sentence Handle, ETM_SMS4_KEY_1-SMS4- symmetric keys handle 1, ETM_SMS4_KEY_2-SMS4- symmetric keys handle 2, ETM_ SMS4_KEY_3-SMS4- symmetric keys handle 3 and ETM_SMS4_KEY_4-SMS4 symmetric keys handle 4.
It is preferred that, the step(2)Identity card including generating distribution terminal safety chip ETM based on electric power CA systems Book.
Further, the electric power CA systems include three-level authentication model;First layer is that total root CA nets in state;The second layer is state Two grades of CA that total root CA is signed and issued are netted, for netting provincial unit;Third layer is the three-level CA that two grades of CA are signed and issued, for prefecture-level list Position.
It is preferred that, the step(2)Including
(2.1)Chip manufacturer produces a pair of public and private keys when producing ETM, and sending certificates constructing to 2 grades of CA registration center please Ask;
(2.2)ETM Data Enter databases are forwarded certificate request to authentication center by registration center;
(2.3)Digital certificate is signed and issued by encrypting card apparatus using the CA private keys by authentication center;
(2.4)Digital certificate is stored in certificate data library backup by authentication center, and digital certificate is returned to registration center;
(2.5)Registration center returns to digital certificate and the public key certificate of the CA to chip manufacturer;
(2.6)Two certificates that the private key generated before and registration center return are stored in ETM chips by chip manufacturer.
It is preferred that, the step(3)Key and data encrypting and deciphering including storing and managing generation.
Further, the cryptographic algorithm that the key generation includes ETM supports has asymmetric cryptographic algorithm SM2, for body The generation of part key;With symmetric cryptographic algorithm SMS4, for data encrypting and deciphering.
Further, operation is encrypted and decrypted in chip internal in the data that distribution terminal is related to, for ensuring key The security of operation.
It is preferred that, the step(4)Including
(4.1)Distribution terminal is signed using identity key to PCR;
(4.2)According to the different CA for signing and issuing letter of identity, the certificate that distribution terminal is sent to remote parties is also different;
(4.3)Remote parties verify letter of identity, and letter of identity is verified, then continuation letter of identity checking PCR signatures, PCR signature verifications pass through, then are compared PCR value with reference value, unanimously then show that the SOT state of termination is proved successfully;Otherwise prove to lose Lose, the SOT state of termination is insincere.
Compared with the prior art, beneficial effects of the present invention are:
1)Key involved by distribution terminal is stored in electric power trusted module ETM, and ETM provides hardware-level for key Protection, the safety of key further ensures the safety of cipher key operation result;
2)ETM use can ensure the malicious act of the integrality of distribution terminal equipment, confrontation Malware and user;
3)The characteristics of ETM is for distribution terminal equipment and design, its using not influenceing the normal function of distribution terminal, Also big extra load will not be caused to distribution terminal;
4)Letter of identity based on distribution terminal identity key is all signed and issued by state's net CA systems, is realized and existing state The seamless combination of CA frameworks is netted, is easy to unified plan and management;
5)The Endpoint integrity state signed based on distribution terminal identity key, can be achieved distribution terminal in the communication system of power grids Identity and context identification, further enhance communication system of power grids safety.
Brief description of the drawings
A kind of power distribution terminal key management method flow chart based on trust computing that Fig. 1 provides for the present invention.
A kind of power distribution terminal key management method letter of identity flow based on trust computing that Fig. 2 provides for the present invention Figure.
A kind of power distribution terminal key management method remote proving flow based on trust computing that Fig. 3 provides for the present invention Figure.
Embodiment
The embodiment to the present invention is described in further detail below in conjunction with the accompanying drawings.
A kind of power distribution terminal key management method based on trust computing of the present invention, it is specific as follows:
(1)Electric power trusted module ETM key structure is designed according to the specific feature of distribution terminal;
In view of applying what in the electric power trusted module ETM of the distribution terminal finiteness and key of key space was used Simplicity, different from the key management system that TPM/TCM chips are cumbersome, ETM directly solidifies several key grooves, and there is provided corresponding close The Password Operations such as key generation, encryption and decryption, signature.
Different from TPM/TCM, ETM public key operations are all completed in ETM, therefore ETM needs to provide public key encryption, label Name checking etc. command operation, and public key certificate import, generation etc. supporting order.
Electric power trusted module ETM be similar to trust computing safety chip TPM/TCM, be deployed in power industry equipment such as with On electric terminals, chip internal has crypto-operation ability, safe storage capacity, externally provides similar with TPM/TCM credible Computing function, such as hardware identity mark, integrity measurement and storage, remote proving.
The ETM corresponding key handles of key groove include:ETM_IDENTITY_KEY_PRIV(Identity key private key sentence Handle)、ETM_IDENTITY_KEY_PUB(Identity key public key handle)、ETM_SMS4_KEY_1(SMS4 symmetric keys handle 1)、 ETM_SMS4_KEY_2(SMS4 symmetric keys handle 2)、ETM_SMS4_KEY_3(SMS4 symmetric keys handle 3)、ETM_SMS4_ KEY_4(SMS4 symmetric keys handle 4).
(2)The generation and management of distribution terminal letter of identity based on ETM keys;
In order to ensure the safety of higher level and be easy to unified management, all kinds of cards that distribution terminal safety chip ETM is related to Book is as letter of identity is all based on the generation of electric power CA systems.
Electric power CA systems are based on three-level authentication model.First layer is that total root CA nets in state, and the second layer is to net total root CA label by state Two grades of CA of hair, for netting provincial unit;Third layer is the three-level CA that two grades of CA are signed and issued, for prefecture-level unit.Power system State net the source that total root CA is all certificate verifications, therefore, each ETM, can be in the preset total root CA of chip internal when dispatching from the factory Certificate.
As shown in Fig. 2 the generation of ETM letters of identity depends on chip manufacturer sends corresponding request to electric power CA systems. According to the difference of distribution terminal suitable environment, the CA for issuing letter of identity is also different.If the distribution terminal is by net provincial company portion Administration uses, then ETM chips manufacturer needs to send in one's application to 2 grades of CA of power system.
1) chip manufacturer produces a pair of public and private keys when producing ETM using ETM, and certificate is sent to 2 grades of CA registration center Generation request;
2) ETM Data Enter databases are forwarded certificate request to authentication center by registration center;
3) digital certificate is signed and issued using encrypting card apparatus using the CA private keys by authentication center;
4) digital certificate is stored in certificate data library backup by authentication center, and digital certificate is returned to registration center;
5) registration center returns to digital certificate and the public key certificate of the CA to chip manufacturer;
6) two certificates that the private key generated before and registration center return are stored in ETM chips by chip manufacturer.
(3)Distribution terminal data storage management based on ETM keys;
Distribution terminal data storage management based on ETM keys includes:
1) key is generated, and includes the key generation process of the cryptographic algorithm of ETM internal supports;
2) data encrypting and deciphering, includes the data encrypting and deciphering process of ETM internal supports.
The cryptographic algorithm that ETM is supported has asymmetric cryptographic algorithm SM2 and symmetric cryptographic algorithm SMS4, SM2 key mainly to use In the generation of identity key, SMS4 keys are used for data encrypting and deciphering.
ETM key generation process is to have four key grooves in ETM inside solidifications, deposits four SMS4 keys, corresponds to respectively Fixed key handles facilitate application layer to use.When generating key, it is necessary to specify corresponding key handles.Internal hardware is according to connecing The instruction generation new key received, while it is placed into corresponding key groove with the binding of corresponding key handles.
The advantage of ETM data encrypting and decipherings is can ensure the safety of Password Operations with hardware, and the data that distribution terminal is related to are all It can only encrypt and decrypt in chip internal.
ETM data encrypting and decipherings process is that the instruction being encrypted using symmetric cryptographic algorithm is sent to ETM chips, specifies and adds Close key handles, give data to be encrypted, and chip internal completes to return to the data after encryption after encryption.Decryption with etc Seemingly.
(4)Distribution terminal status remote based on ETM keys is proved;
During distribution terminal startup optimization, ETM platform configuration register PCR(Platform Configuration Register)The SOT state of termination is have recorded, the PCR signed based on ETM identity keys can be demonstrate,proved to remote parties The bright SOT state of termination.
ETM PCR storage be terminal it is all operation parts integrity measurement values, according to part startup optimization order according to It is secondary to add up to extend in PCR, it is impossible to autonomous change, really reflect the running status of terminal.
As shown in figure 3, distribution terminal is signed using identity key to PCR;According to the difference for the CA for signing and issuing letter of identity, match somebody with somebody The certificate that electric terminals are sent to remote parties is also different, if letter of identity is issued by 2 grades of CA, distribution terminal by letter of identity, 2 grades CA certificate issues remote parties in the lump in company with the PCR of signature;Remote parties verify letter of identity, if being verified, continue to use identity Certification authentication PCR is signed, if being verified, PCR value is compared with reference value, shows that the SOT state of termination is proved into if consistent Work(, otherwise proves failure, and the SOT state of termination is insincere.
Finally it should be noted that:The above embodiments are merely illustrative of the technical solutions of the present invention rather than its limitations, to the greatest extent The present invention is described in detail with reference to above-described embodiment for pipe, and those of ordinary skill in the art should be understood:Still The embodiment of the present invention can be modified or equivalent, and without departing from any of spirit and scope of the invention Modification or equivalent, it all should cover among scope of the presently claimed invention.

Claims (8)

1. a kind of power distribution terminal key management method based on trust computing, it is characterised in that methods described includes:
(1) electric power trusted module ETM key structures are built according to distribution terminal;
(2) the distribution terminal letter of identity based on ETM keys is generated;
(3) ETM key storages are based on and distribution terminal data are managed;
(4) distribution terminal state is proved based on ETM secret key remotes;
The step (2) includes:
(2.1) a pair of public and private keys are produced during chip manufacturer production ETM, certificates constructing request is sent to two grades of CA registration center; Two grades of CA net total root CA by state and signed and issued, for netting provincial unit;
(2.2) ETM Data Enter databases are forwarded certificate request to authentication center by registration center;
(2.3) digital certificate is signed and issued by encrypting card apparatus using the CA private keys by authentication center;
(2.4) digital certificate is stored in certificate data library backup by authentication center, and digital certificate is returned to registration center;
(2.5) registration center returns to digital certificate and the public key certificate of the CA to chip manufacturer;
(2.6) two certificates that the private key generated before and registration center return are stored in ETM chips by chip manufacturer.
2. a kind of power distribution terminal key management method based on trust computing as claimed in claim 1, it is characterised in that described ETM keys are solidificated in ETM key grooves in step (1), and its key groove storage Binding key handle includes:ETM_IDENTITY_ KEY_PRIV- identity key private keys handle, ETM_IDENTITY_KEY_PUB- identity key public keys handle, ETM_SMS4_KEY_ 1-SMS4- symmetric keys handle 1, ETM_SMS4_KEY_2-SMS4- symmetric keys handle 2, ETM_SMS4_KEY_3-SMS4- pairs Claim key handles 3 and ETM_SMS4_KEY_4-SMS4 symmetric keys handle 4.
3. a kind of power distribution terminal key management method based on trust computing as claimed in claim 1, it is characterised in that described Step (2) includes generating distribution terminal safety chip ETM letter of identity based on electric power CA systems.
4. a kind of power distribution terminal key management method based on trust computing as claimed in claim 3, it is characterised in that described Electric power CA systems include three-level authentication model;First layer is that total root CA nets in state;The second layer is that two grades of CA that total root CA is signed and issued net in state, For netting provincial unit;Third layer is the three-level CA that two grades of CA are signed and issued, for prefecture-level unit.
5. a kind of power distribution terminal key management method based on trust computing as claimed in claim 1, it is characterised in that described Step (3) includes storing and managing the key and data encrypting and deciphering of generation.
6. a kind of power distribution terminal key management method based on trust computing as claimed in claim 5, it is characterised in that ETM The cryptographic algorithm of support has asymmetric cryptographic algorithm SM2 and symmetric cryptographic algorithm SMS4, SM2 to be used for the generation of identity key, SMS4 is used for data encrypting and deciphering.
7. a kind of power distribution terminal key management method based on trust computing as claimed in claim 5, it is characterised in that distribution Operation is encrypted and decrypted in chip internal in the data that terminal is related to, the security for ensuring cipher key operation.
8. a kind of power distribution terminal key management method based on trust computing as claimed in claim 1, it is characterised in that described Step (4) includes:
(4.1) distribution terminal is signed using identity key to platform configuration register PCR;
(4.2) according to the different CA for signing and issuing letter of identity, the certificate that distribution terminal is sent to remote parties is also different;
(4.3) remote parties checking letter of identity, letter of identity is verified, then continuation letter of identity checking PCR signatures, PCR Signature verification passes through, then is compared PCR value with reference value, unanimously then shows that the SOT state of termination is proved successfully;Otherwise failure is proved, should The SOT state of termination is insincere.
CN201310726584.6A 2013-12-25 2013-12-25 A kind of power distribution terminal key management method based on trust computing Active CN103647654B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201310726584.6A CN103647654B (en) 2013-12-25 2013-12-25 A kind of power distribution terminal key management method based on trust computing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201310726584.6A CN103647654B (en) 2013-12-25 2013-12-25 A kind of power distribution terminal key management method based on trust computing

Publications (2)

Publication Number Publication Date
CN103647654A CN103647654A (en) 2014-03-19
CN103647654B true CN103647654B (en) 2017-07-14

Family

ID=50252815

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201310726584.6A Active CN103647654B (en) 2013-12-25 2013-12-25 A kind of power distribution terminal key management method based on trust computing

Country Status (1)

Country Link
CN (1) CN103647654B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105187453A (en) * 2015-10-22 2015-12-23 宁波三星医疗电气股份有限公司 Security encryption communication method of fault indicator
CN114268643B (en) * 2021-11-26 2024-04-16 许继集团有限公司 Active identification technology-based power distribution Internet of things terminal and management method

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101216915A (en) * 2008-01-21 2008-07-09 深圳市路通网络技术有限公司 A secured mobile payment method
CN101888383A (en) * 2010-06-30 2010-11-17 北京交通大学 Method for implementing extensible trusted SSH
CN102035838A (en) * 2010-12-07 2011-04-27 中国科学院软件研究所 Trust service connecting method and trust service system based on platform identity
CN102065003A (en) * 2010-08-24 2011-05-18 吉林大学 Method, system and equipment for realizing trusted secure routing of vehicular information system
CN102427449A (en) * 2011-11-04 2012-04-25 北京工业大学 Trusted mobile storage method based on security chips

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4596256B2 (en) * 2005-08-02 2010-12-08 ソニー株式会社 Transmission / reception system and method, transmission device and method, reception device and method, and program

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101216915A (en) * 2008-01-21 2008-07-09 深圳市路通网络技术有限公司 A secured mobile payment method
CN101888383A (en) * 2010-06-30 2010-11-17 北京交通大学 Method for implementing extensible trusted SSH
CN102065003A (en) * 2010-08-24 2011-05-18 吉林大学 Method, system and equipment for realizing trusted secure routing of vehicular information system
CN102035838A (en) * 2010-12-07 2011-04-27 中国科学院软件研究所 Trust service connecting method and trust service system based on platform identity
CN102427449A (en) * 2011-11-04 2012-04-25 北京工业大学 Trusted mobile storage method based on security chips

Also Published As

Publication number Publication date
CN103647654A (en) 2014-03-19

Similar Documents

Publication Publication Date Title
CN102111265B (en) Method for encrypting secure chip of power system acquisition terminal
CN103067160B (en) A kind of method and system for the dynamic key production for encrypting SD card
CN108880800B (en) Power distribution and utilization communication system and method based on quantum secret communication
CN102983965B (en) Transformer station's quantum communications model, quantum key distribution center and model implementation method
US20140270179A1 (en) Method and system for key generation, backup, and migration based on trusted computing
CN103701757B (en) Identity authentication method and system for service access
CN103067170B (en) encrypting method based on EXT2 file system
CN104579679B (en) Wireless public network data forwarding method for agriculture distribution communication equipment
CN110753344B (en) NB-IoT-based smart meter secure access system
CN101771699A (en) Method and system for improving SaaS application security
CN103685323A (en) Method for realizing intelligent home security networking based on intelligent cloud television gateway
CN111435390B (en) Safety protection method for operation and maintenance tool of power distribution terminal
CN110050437A (en) The device and method of distributed certificate registration
CN101610150B (en) Third-party digital signature method and data transmission system
CN108123795A (en) Distributing method, application process, publishing platform and the system of quantum key chip
CN107948156A (en) The closed key management method and system of a kind of identity-based
CN102638568A (en) Cloud storage system and data management method thereof
WO2012072001A1 (en) Safe method for card issuing, card issuing device and system
CN107135070A (en) Method for implanting, framework and the system of RSA key pair and certificate
CN105281910A (en) Internet of things lock with CA digital certificate serving as network access identity identifier and network access identity identification method
CN104954137A (en) Method of virtual machine security certification based on domestic password technique
CN105471901A (en) Industrial information security authentication system
CN104980269A (en) Secret key sharing method, device and system
CN107911221A (en) The key management method of solid-state disk data safety storage
CN111435389A (en) Power distribution terminal operation and maintenance tool safety protection system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20171020

Address after: 100031 Xicheng District West Chang'an Avenue, No. 86, Beijing

Co-patentee after: China Electric Power Research Institute

Patentee after: State Grid Corporation of China

Co-patentee after: GLOBAL ENERGY INTERCONNECTION RESEARCH INSTITUTE

Co-patentee after: Institute of Information Engineering, Gas

Co-patentee after: State Grid Zhejiang Electric Power Company

Address before: 100031 Xicheng District West Chang'an Avenue, No. 86, Beijing

Co-patentee before: China Electric Power Research Institute

Patentee before: State Grid Corporation of China

Co-patentee before: Institute of Information Engineering, Gas

Co-patentee before: State Grid Zhejiang Electric Power Company