CN103716163B - SV message encryption and decryption method meeting IEC61850-9-2 (LE) standard - Google Patents

Abstract

The invention discloses a SV message encryption and decryption method meeting the IEC61850-9-2 (LE) standard. The method comprises the following steps: extracting key data, reflecting an actual sampling value, in each ASDU of a SV message and combining the key data into a to-be-encrypted data block according to the sequence of the ASDUs; using a TEA algorithm to encrypt the to-be-encrypted data block to obtain an equal-length cipher text; cutting the cipher text and covering the position of the key data according to the sequence of the ASDUs to obtain an encrypted SV message; extracting a section of cipher text in the key data position of each ASDU of the encrypted SV message and combining the cipher text into a cipher text block according to the sequence of the ASDUs; using the TEA algorithm to decrypt the cipher text block to obtain an equal-length key data block; and cutting the key data block and covering the positions of the sections of cipher texts according to the sequence of the ASDUs to obtain a decrypted SV message. The integrity, confidentiality and real-time property of the SV message can be effectively guaranteed.

Description

A method for encrypting and decrypting SV message conforming to IEC61850-9-2(LE) standard

technical field

The invention relates to the technical field of electric power communication information security, in particular to an SV message encryption and decryption method conforming to the IEC61850-9-2 (LE) standard.

Background technique

In the power system communication network, the sampling value transmission message (SV message) conforming to the IEC61850‐9‐2 (LE) standard contains real-time electrical quantity information, which is of great significance to the protection, measurement and control of the power system ; Moreover, the message is transmitted frequently and has a large amount of data. In the case of normal operation of the power system, it occupies most of the bandwidth of the power communication network, and its security, accuracy and real-time performance greatly affect the operation of the power system. reliability.

Moreover, in the context of more and more applications in smart grids represented by digital substations, SV power messages may be transmitted across regions and grids, making them more likely to suffer from intrusion events such as eavesdropping, attacks, and tampering. Its importance in power information security is becoming more and more prominent.

However, the prior art lacks an effective method for encrypting SV message information with high real-time requirements. Therefore, it is urgent to use encryption and decryption technology to enhance the confidentiality of SV power messages; however, message encryption and decryption generally take a lot of time, and SV messages have strict real-time requirements. According to the provisions of the IEC61850 standard, the communication delay of the SV signal should be less than 4ms. How to realize the integrity and confidentiality of the SV message on the basis of satisfying the real-time nature of the SV message becomes the key to the problem.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies of the prior art, and provide a method for encrypting and decrypting SV messages conforming to the IEC61850-9-2 (LE) standard with high confidentiality, less time-consuming encryption and decryption, and strong hardware adaptability.

In order to achieve the above object, the technical solution adopted in the present invention is, a kind of SV message encryption and decryption method conforming to IEC61850‐9‐2 (LE) standard, comprising the following steps:

S1, encryption

S11, check whether there is a CRC32 check code in the FCR block of the SV message, if not, perform a CRC32 operation on the SV message, and place the CRC32 check code of the gained in the FCR block of the SV message;

S12. Extract the key data reflecting the substantial value of the sampling value in each ASDU (Application Service Data Unit) in the SV message, and combine them into a data block to be encrypted according to the order of the ASDU;

S13. Using the TEA algorithm to encrypt the data block to be encrypted to obtain equal-length ciphertext;

S14, cutting the ciphertext, covering the key data positions according to the ASDU sequence, and obtaining encrypted SV messages;

S2, decryption

S21, extracting each section of ciphertext in the key data position of each ASDU in the encrypted SV message, and combining them into ciphertext blocks in order of ASDU;

S22. Decrypt the ciphertext block using the TEA algorithm to obtain an equal-length key data block;

S23. Cutting the key data block, covering the positions of each section of ciphertext according to the order of ASDU, and obtaining the decrypted SV message;

S24. Perform a CRC32 check on the decrypted SV message. If the check passes, keep the SV message and complete the decryption; otherwise, discard the SV message.

More specifically, the CRC32 check is a cyclic redundancy check code (Cyclic Redundancy Check, CRC) check, which is used to detect or check errors that may occur after the SV message is encrypted, decrypted, transmitted or saved, and ensures that the message integrity.

More specifically, the key data of the SV message is the actual sampled values (ActualValues) in the Dataset (analog sampled values) in each ASDU.

When the encryption algorithm and key length are constant, the key to reducing the time-consuming encryption and decryption of SV packets is to reduce the length of the required encrypted packets. By analyzing the information in each field of the SV message, the key information of the message is extracted, and a balance is achieved between its real-time and confidentiality. According to the IEC61850 standard, the SV message adopts the ISO/IEC802.3 protocol at the data link layer, which consists of the MAC address field, TPID (label protocol identification) field, TCI (identification control information) field, and EtherType (Ethernet message type) field , APPID (application identification) domain, Length (length) domain, Reserved1 (reserved 1) domain, Reserved2 (reserved 2) domain and APDU (application protocol data unit, that is, message content) domain. The frame structure of SV is shown in Table 1. The contents of the MAC address field, TPID field, TCI field, EtherType field, APPID field, Length field, Reserved1, and Reserved2 fields mainly represent the communication-related basic content such as the communication information and message length of the SV message, and do not include the SV message. Therefore, the content of these content fields remains unchanged and no encryption is performed.

Table 1 Frame structure of SV message

The essential content of the power system such as the analog sampling value is mainly concentrated in the APDU domain. The APDU field is composed of noASDU (ASDU number) and SequenceOfASDU (ASDU data sequence). SequenceOfASDU is a sequence composed of multiple ASDUs in sequence. The frame structure of the APDU of the SV message is shown in Table 2.

Table 2 The frame structure of the APDU of the SV message

Each ASDU (Application Service Data Unit) consists of fields such as svID, smpCnt (sampling counter), confRev (configuration version number), smpSynch (synchronization flag), and Dataset (sampling value). The frame structure is shown in Table 3.

Table 3 ASDU structure of SV message

ASDU characterizes the essential content of the analog sampling value contained in the SV message, and its confidentiality directly determines the overall confidentiality of the SV message. The svID, smpCnt, ConfRev, and smpSynch data content in the ASDU does not directly involve the analog sample value data, and does not need to be encrypted. Therefore, only the Dataset data that actually stores the analog sampling value is encrypted. The frame structure in the Dataset is shown in Table 4. Each Dataset can contain up to 8 channels of analog sampling values, and each channel of analog is composed of 4 bytes of actual sampling values (ActualValues) and 4 bytes of quality description (Q ), Q is only used to mark the quality of the sampled value and does not need to participate in encryption, so the actual sampled value (ActualValues) is the key data that really needs to be encrypted.

Table 4Dataset structure

More specifically, the step of S12: first extract the key data of the first analog quantity of the DataSet of ASDU1, and then extract the key data of the second analog quantity of the DataSet of ASDU1, and then extract the key data of ASDU2 after the key data extraction of ASDU1 is completed, Follow the above sequence until ASDUn, and finally get the data block to be encrypted with a length of 256*n Bit.

More specifically, the TEA algorithm is a tiny encryption algorithm (Tiny Encryption Algorithm, TEA), which is easy to describe and execute, and can satisfy the real-time performance of the SV message while ensuring the confidentiality of the SV message; The key encrypts the data of 64Bit length to obtain 64Bit ciphertext, and the overall key data length of the SV message is an integer multiple of 64Bit, so when the TEA algorithm is used to encrypt the data block to be encrypted, the result will be the same as the data block to be encrypted. Long ciphertext, no need to pad key data.

More specifically, the step of S14: cutting the ciphertext in units of 32Bit, and covering the key data positions with each section of ciphertext after cutting in order of ASDU, to obtain an encrypted SV message.

More specifically, the step of S21: first extract the ciphertext of the key data position of the first analog quantity of the DataSet of ASDU1, and then extract the ciphertext of the key data position of the second analog quantity of the DataSet of ASDU1, the key data position of the ASDU1 After the ciphertext extraction is completed, then extract the ciphertext of the key data position of ASDU2, follow the above sequence until ASDUn, and finally obtain a ciphertext block with a length of 256*n Bit;

More specifically, the step of S23: cutting the key data block in units of 32Bit, and covering the position of each piece of ciphertext with the cut pieces of key data according to the order of ASDU, to obtain the decrypted SV message.

Compared with the prior art, the beneficial effects of the present invention are:

(1) The present invention applies the efficient TEA cryptographic algorithm to the key data of the SV message reflecting the substantial value of the sampling value of the electrical quantity, which not only ensures the security of the key data, but also avoids the time-consuming application of the encryption algorithm in the full text and is difficult to meet the power requirements. The requirements of the real-time information system; the following example can be used to illustrate: Assuming that there are 8 valid ASDUs in the SV message (there can be 8 valid ASDUs at most), the length of the full text of the message (excluding the FCR block) is 34 +751=785 bytes, the key data wherein is 8*8*4=256 bytes, accounts for 32.6% of the full text, then the encryption and decryption data amount of the present invention reduces 67.4% relative to the method for full text encryption and decryption; When the number of effective ASDUs in the text is small, the advantages of the present invention are more obvious. If there is only one effective ASDU in the SV message, the length of the original text of the message (excluding the FCR block) is 34+124=158 bytes , where the key data is 8*4=32 bytes, accounting for 20.25% of the full text, and the encryption and decryption workload of this algorithm is reduced by 79.75% compared with the full text encryption and decryption method.

(2) The present invention retains the CRC32 check of the full text of the message (the check code is placed in the FCR block), which greatly guarantees the integrity of the message.

Description of drawings

Fig. 1 is the flow chart of the SV message encryption method conforming to the IEC61850-9-2 (LE) standard of the present invention.

Fig. 2 is the flow chart of the SV message decryption method conforming to the IEC61850-9-2 (LE) standard of the present invention.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings and examples, but the protection scope of the present invention is not limited to the range expressed in the examples. Other changes and modifications made by those skilled in the art without departing from the spirit and protection scope of the present invention are still included in the protection scope of the claims.

Example

In this embodiment, a method for encrypting and decrypting SV messages conforming to the IEC61850-9-2 (LE) standard includes:

As shown in Figure 1, the SV message encryption method has the following specific steps:

S-1. Encryption

S-11. Check whether there is a CRC32 check code in the FCR block of the SV message, if not, perform CRC32 calculation on the SV message, and place the obtained CRC32 check code in the FCR block of the SV message;

S-12. First extract the ActualValues data of the first analog quantity in the DataSet of ASDU1, and then extract the ActualValues data of the second analog quantity in the DataSet of ASDU1. After the key data extraction of ASDU1 is completed, then extract the ActualValues data of ASDU2, press the above The sequence is up to ASDUn, and finally the data block to be encrypted with a length of 256*n Bit is obtained;

S-13. Use the TEA algorithm to encrypt the data block to be encrypted to obtain equal-length ciphertext;

S-14, cutting the ciphertext, covering the key data position according to the ASDU order, and obtaining the encrypted SV message;

As shown in Figure 2, the SV message decryption method has the following specific steps:

S-2. Decryption

S-21. First extract the data of the first analog ActualValues data position in the DataSet of ASDU1, and then extract the data of the second analog ActualValues data position in the DataSet of ASDU1. After the key data extraction of ASDU1 is completed, then extract ASDU2 The data of the ActualValues data position, according to the above sequence until ASDUn, finally get a ciphertext block with a length of 256*n Bit;

S-22. Decrypt the ciphertext block with the TEA algorithm to obtain a key data block of equal length;

S-23. Cut the key data blocks, cover the positions of each section of ciphertext according to the order of ASDU, and obtain the decrypted SV message;

S-24. Perform a CRC32 check on the decrypted SV message. If the check passes, keep the SV message and complete the decryption; otherwise, discard the SV message.

The working principle of this embodiment:

The key data content of the SV message that reflects the actual value of the electrical quantity sampling value is extracted for encryption and decryption. The encryption uses the TEA algorithm, and the SV message is verified using the CRC32 technology.

The above-mentioned embodiment is a preferred embodiment of the present invention, but the embodiment of the present invention is not limited by the above-mentioned embodiment, and any other changes, modifications, substitutions, combinations, Simplifications should be equivalent replacement methods, and all are included in the protection scope of the present invention.

Claims (5)

1. A method for encrypting and decrypting SV messages conforming to the IEC61850‐9‐2 (LE) standard, characterized in that it comprises the following steps: S1, encryption S11, check whether there is a CRC32 check code in the FCR block of the SV message, if not, perform a CRC32 operation on the SV message, and place the CRC32 check code of the gained in the FCR block of the SV message; S12. Extract the key data reflecting the substantial value of the sampling value in each ASDU in the SV message, and combine them into data blocks to be encrypted according to the order of the ASDUs; S13. Using the TEA algorithm to encrypt the data block to be encrypted to obtain equal-length ciphertext; S14, cutting the ciphertext, covering the key data positions according to the ASDU sequence, and obtaining the encrypted SV message, specifically: cutting the ciphertext in units of 32Bit, and covering each segment of the ciphertext after cutting according to the ASDU sequence Key data location, get encrypted SV message; S2, decryption S21, extracting each section of ciphertext in the key data position of each ASDU in the encrypted SV message, and combining them into ciphertext blocks in order of ASDU; S22. Decrypt the ciphertext block using the TEA algorithm to obtain an equal-length key data block; S23, cut the key data block, cover the positions of the ciphertexts in the order of ASDU, and obtain the decrypted SV message, specifically: cut the key data block in units of 32Bit, and divide the key data of each segment after cutting according to the ASDU Sequentially cover the positions of each section of ciphertext to obtain the decrypted SV message; S24. Perform a CRC32 check on the decrypted SV message. If the check passes, keep the SV message and complete the decryption; otherwise, discard the SV message. 2. A kind of SV message encryption and decryption method conforming to the IEC61850-9-2 (LE) standard according to claim 1, characterized in that: the CRC32 check is a cyclic redundancy check code check, used for Detect or verify errors that may occur after SV message encryption, decryption, transmission or storage, to ensure the integrity of the message. 3. A kind of SV message encryption and decryption method conforming to the IEC61850-9-2 (LE) standard according to claim 1, characterized in that: the key data of the SV message is in the Dataset in each ASDU actual sampled value. 4. A kind of SV message encryption and decryption method conforming to the IEC61850-9-2 (LE) standard according to claim 1, characterized in that, the step of S12: first extract the key data of the first analog quantity of the DataSet of ASDU1 , and then extract the key data of the second analog quantity of the DataSet of ASDU1, and then extract the key data of ASDU2 after the key data of ASDU1 is extracted, follow the above sequence until ASDUn, and finally obtain the data block to be encrypted with a length of 256*n Bit. 5. A kind of SV message encryption and decryption method conforming to the IEC61850‐9‐2 (LE) standard according to claim 1, characterized in that, the step of S21: first extract the key data of the first analog quantity of the DataSet of ASDU1 Then extract the ciphertext of the key data position of the second analog quantity of the DataSet of ASDU1. After the ciphertext extraction of the key data position of ASDU1 is completed, then extract the ciphertext of the key data position of ASDU2, according to the above sequence until ASDUn , and finally get a ciphertext block with a length of 256*n Bit.