CN113784345B - Power distribution terminal point-to-point key negotiation method and device based on quantum secure channel - Google Patents

Abstract

The present invention provides a point-to-point key negotiation method and device for a power distribution terminal based on a quantum secure channel, including: the first power distribution terminal and the relay device are based on the received first transmission key and relay key. establishing a first channel, the second power distribution terminal and the relay device generate a second channel based on the received second transmission key and the relay key; the first power distribution terminal converts the first negotiated key and the intermediate negotiation key are respectively sent to the second power distribution terminal; the second power distribution terminal sends the second negotiation key and the intermediate negotiation key to the first power distribution terminal respectively; the first power distribution terminal The electrical terminal and the second power distribution terminal generate the first combined key and the second combined key respectively; if the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the The second power distribution terminal establishes a data transmission channel based on the first combined key and/or the second combined key.

Description

Method and device for point-to-point key agreement for power distribution terminal based on quantum secure channel

technical field

The invention relates to the technical field of data transmission, in particular to a method and device for point-to-point key negotiation of power distribution terminals based on a quantum secure channel.

Background technique

In recent years, the country has been promoting the deep integration of the power grid and the Internet, and striving to build an energy Internet. Through the full application of modern information technologies and advanced communication technologies such as mobile internet, artificial intelligence, 5G communication, Beidou and quantum secrecy, the interconnection of all things and human-computer interaction in all aspects of the power system will be realized, and a comprehensive state perception, efficient information processing, convenient and flexible application will be created. Smart grid provides strong data resource support for the safe and economic operation of the power grid, improving business performance, improving service quality, and cultivating and developing strategic emerging industries.

With the gradual maturity of 5G technology, the power system gradually considers the use of 5G technology for data transmission according to the communication situation of the application scenario for a large number of power distribution terminal systems. But what follows is that the power distribution business faces new security threats in terms of business information, business models, business carriers, etc. If the network is invaded, it will seriously affect the stable operation of various key systems, and then seriously threaten the economy. Social stability and people's production and life. The traditional defense-in-depth system that relies on physical isolation and deployment of security measures is no longer applicable to 5G networks. How to carry out effective business security protection has become a new problem that needs to be solved urgently.

Quantum secure communication technology utilizes the principle of quantum uncertainty and the non-replicable feature of quantum state for secure key distribution. An attacker cannot measure and copy the key (quantum state), and it will be discovered once eavesdropping, which is more efficient than traditional keys. The higher security of the distribution mechanism is also the most practical quantum technology at present. Therefore, it is of great significance to explore the use of quantum security communication security protection technology and the existing 5G network security protection technology compatibility mechanism to improve the security level of 5G network in power system applications, which is of great significance to improve the operation of dispatch automation services in 5G system network.

The domestic company has completed the first domestic verification of using 5G+ quantum communication terminals to carry precise load control services, and further proposed an application solution for 5G+ quantum communication terminals with strong promotion and simple deployment. It can be applied to various business scenarios, and solves the security and reliability problems of power production control services carried by the public network 5G network. As the first integration application of 5G communication technology, quantum encryption technology and power business equipment in China, this application not only takes advantage of 5G's high bandwidth, low latency, and wide link, but also takes advantage of the security and reliability of quantum communication. The application in electric power provides all-round support capabilities such as scientific and technological research, experimental verification, performance testing, safety analysis, and innovative research and development.

Figure 1 shows the network infrastructure design diagram of the quantum security service platform, which mainly includes a quantum key generation system, a quantum key scheduling system, and a quantum key application system. The functions of each part are as follows:

1. Quantum key generation system, including quantum key generation and management terminal, quantum random number generator, the main function is: use quantum characteristics to generate quantum key, and provide quantum key support for front-end system.

2. Quantum key scheduling system, including exchange encryption machine, quantum encryption service platform system, quantum key charging system, the main functions are: exchange encryption machine is responsible for quantum key storage and output; quantum encryption service platform system is responsible for realizing quantum encryption. The scheduling and negotiation of the key ensures that the quantum key can be distributed to the quantum key application system in a safe and orderly manner; the quantum key charging system is responsible for charging the quantum key through U shield/TF card, etc. Key application terminal use.

3. Quantum key application system, including quantum security gateway and quantum CPE, the main functions are: use quantum key to build quantum security encrypted transmission channel, improve the security level of 5G transmission channel, and ensure that business system data can be safely transmitted to wireless security The access area is transmitted to the main station system of the power intranet through the secure access area.

The existing quantum secure communication scheme distributes quantum keys to quantum CPEs and power distribution terminals through quantum key distribution, and establishes a quantum secure channel between quantum CPEs and power distribution terminals through key negotiation. Its quantum key is generally generated by a quantum key generation system, and the key distribution is completed by a quantum key distribution system, but there is no efficient way to establish a secure channel between power distribution terminals.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a method and device for point-to-point key negotiation of power distribution terminals based on quantum secure channels, which can obtain corresponding keys through point-to-point negotiation between power distribution terminals to ensure the security of data transmission.

A first aspect of the embodiments of the present invention provides a point-to-point key agreement method for a power distribution terminal based on a quantum secure channel, a first power distribution terminal, a second power distribution terminal, and a relay device, the first power distribution terminal, The second power distribution terminal and the relay device are respectively connected to the quantum network basic platform, and key negotiation is performed between the first power distribution terminal and the second power distribution terminal through the following steps, including:

The first power distribution terminal and the relay device establish a first channel based on the received first transmission key and the relay key, and the second power distribution terminal and the relay device establish a first channel based on the received first transmission key and the relay key. 2. The transmission key and the relay key generate the second channel;

The first power distribution terminal generates a first negotiation key based on the attribute information and data capture information at the current moment, the first negotiation key is transmitted to the relay device through the first channel, and the relay device is based on the first negotiation key. The attributes of the channel and the second channel generate an intermediate negotiation key, and send the first negotiation key and the intermediate negotiation key to the second power distribution terminal respectively;

The second power distribution terminal generates a second negotiation key based on the attribute information and data capture information at the current moment, the second negotiation key is transmitted to the relay device through the second channel, and the relay device is based on the second negotiation key. The attributes of the channel and the first channel generate an intermediate negotiation key, and send the second negotiation key and the intermediate negotiation key to the first power distribution terminal respectively;

The first power distribution terminal and the second power distribution terminal generate a first combined key and a second combined key based on the first negotiated key, the relay key, and the second negotiated key, respectively;

If the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal establish data based on the first combined key and the second combined key transmission channel.

Optionally, in a possible implementation manner of the first aspect, the quantum network infrastructure platform is configured to generate a first transmission key, a relay key, and a second transmission key;

The first transmission key, the relay key and the second transmission key are distributed to the first power distribution terminal, the relay device and the second power distribution terminal respectively based on the quantum security service engine and the terminal key distribution system.

Optionally, in a possible implementation manner of the first aspect, attribute information of the first power distribution terminal and the second power distribution terminal is preset. Optionally, in a possible implementation manner of the first aspect, generating the first negotiation key by the first power distribution terminal based on the attribute information and data capture information at the current moment includes:

Obtain the power monitoring data of the first power distribution terminal at the current moment, and capture the first power information and the second power information in the power monitoring data, and the data capture information includes the first power information and the second power information ;

The attribute information includes the encoded information value of the first power distribution terminal and the time information of the current moment, and the quantized time value is obtained by quantizing the time information;

The first negotiated key is calculated by the following formula,

为第一协商密钥，

为第一电能信息的权重值，

为第一电能信息的 量值，

为第二电能信息的权重值，

为第二电能信息的量值，

为第一配电终端的编 码信息值，

为第一配电终端量化后的时间值，

为预设的调整值； in,

is the first negotiated key,

is the weight value of the first electric energy information,

is the magnitude of the first electric energy information,

is the weight value of the second electric energy information,

is the magnitude of the second electrical energy information,

is the encoded information value of the first power distribution terminal,

is the quantized time value of the first distribution terminal,

is the preset adjustment value;

The relay device generating the intermediate negotiation key based on the attributes of the first channel and the second channel includes:

The relay device acquires the first moment when the first channel is established and the second moment when the second channel is established, and generates an intermediate negotiation key based on the first moment and the second moment.

Optionally, in a possible implementation manner of the first aspect, the second power distribution terminal generates a second negotiation key based on the attribute information and data capture information at the current moment, and the second negotiation key passes through the first negotiation key. The two-channel transmission to the repeater includes:

Acquire the power monitoring data of the second power distribution terminal at the current moment, and capture the third power information and the fourth power information in the power monitoring data, and the data capture information includes the third power information and the fourth power information;

The attribute information includes the encoded information value of the second power distribution terminal and the time information at the current moment, and the time information is quantized to obtain a quantized time value;

Calculate the second negotiated key by the following formula,

为第二协商密钥，

为第三电能信息的权重值，

为第三电能信息的 量值，

为第四电能信息的权重值，

为第四电能信息的量值，

为第二配电终端的编 码信息值，

为第二配电终端量化后的时间值，

为预设的调整值； in,

is the second negotiated key,

is the weight value of the third electric energy information,

is the magnitude of the third electric energy information,

is the weight value of the fourth electric energy information,

is the magnitude of the fourth electric energy information,

is the encoded information value of the second power distribution terminal,

is the quantized time value of the second distribution terminal,

is the preset adjustment value;

The relay device generating the intermediate negotiation key based on the attributes of the second channel and the first channel includes:

The relay device acquires the first moment when the first channel is established and the second moment when the second channel is established, and generates an intermediate negotiation key based on the first moment and the second moment.

Optionally, in a possible implementation manner of the first aspect, the first power distribution terminal and the second power distribution terminal are generated based on the first negotiation key, the relay key, and the second negotiation key, respectively. The first composite key and the second composite key include:

The first power distribution terminal and the second power distribution terminal respectively obtain the encoded information value of the first power distribution terminal and the second power distribution terminal, and based on the encoded information value, the first negotiation key and the relay key are assigned. and the second negotiated key are respectively filled into the preset key generation template to generate the first combined key and the second combined key.

Optionally, in a possible implementation manner of the first aspect, the first negotiated key, the relay key, and the second negotiated key are respectively filled into a preset key based on the encoded information value. Generating the first combined key and the second combined key in the generating template includes:

The key generation template includes a first slot, a second slot and a third slot;

If the encoded information value of the first power distribution terminal is greater than the encoded information value of the second power distribution terminal, the first combined key is placed in the first slot, and the second combined key is placed in the third slot, setting the relay key in the second slot.

Optionally, in a possible implementation manner of the first aspect, if the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal Establishing a data transmission channel based on the first combined key and the second combined key includes:

The first power distribution terminal and the second power distribution terminal generate the first combined key and the second combined key and send them to the relay device respectively;

The relay device determines that the first combined key and the second combined key are the same, and sends a request instruction to the first power distribution terminal and a receive instruction to the second power distribution terminal;

After receiving the request instruction, the first power distribution terminal requests the second power distribution terminal to establish a data transmission channel based on the first combined key;

The second power distribution terminal receives the request of the first power distribution terminal based on the receiving instruction, and verifies the first combined key according to the second combined key. If the key is the same, the first power distribution terminal and the second power distribution terminal establish a data transmission channel based on the first combined key.

Optionally, in a possible implementation manner of the first aspect, the first power distribution terminal and the second power distribution terminal respectively have unique encoded information values.

A second aspect of the embodiments of the present invention provides a point-to-point key agreement device for power distribution terminals based on quantum secure channels, a first power distribution terminal, a second power distribution terminal, and a relay device, the first power distribution terminal, The second power distribution terminal and the relay device are respectively connected to the quantum network basic platform, and key negotiation is performed between the first power distribution terminal and the second power distribution terminal through the following means, including:

A first channel establishment module, configured to enable the first power distribution terminal and the relay device to establish a first channel based on the received first transmission key and relay key, and the second power distribution terminal and the relay device. The relay device generates a second channel based on the received second transmission key and the relay key;

A first key negotiation module, configured to enable the first power distribution terminal to generate a first negotiation key based on the attribute information and data capture information at the current moment, and the first negotiation key is transmitted to the relay through the first channel device, the relay device generates an intermediate negotiation key based on the attributes of the first channel and the second channel, and sends the first negotiation key and the intermediate negotiation key to the second power distribution terminal respectively;

The second key negotiation module is configured to enable the second power distribution terminal to generate a second negotiation key based on the attribute information and data capture information at the current moment, and the second negotiation key is transmitted to the relay through the second channel device, the relay device generates an intermediate negotiation key based on the attributes of the second channel and the first channel, and sends the second negotiation key and the intermediate negotiation key to the first power distribution terminal respectively;

The combination module is configured to enable the first power distribution terminal and the second power distribution terminal to generate a first combined key and a second combined key based on the first negotiation key, the relay key, and the second negotiation key, respectively. key;

The second channel establishment module, if the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal are based on the first combined key and the second power distribution terminal. The two combined keys establish a data transmission channel.

In a third aspect of the embodiments of the present invention, a readable storage medium is provided, where a computer program is stored in the readable storage medium, and the computer program is used to implement the first aspect and the first aspect of the present invention when executed by a processor Various possible designs of the described method.

The invention provides a point-to-point key negotiation method and device for a power distribution terminal based on a quantum secure channel. First, the first power distribution terminal, the second power distribution terminal and the relay device establish a quantum communication channel according to the basic quantum network platform, and then a quantum communication channel is established. The first negotiation key and the second negotiation key are respectively generated according to the attributes of the first power distribution terminal and the second power distribution terminal, and the first negotiation key and the second negotiation key are respectively sent through the relay device to realize the first distribution. The key negotiation between the electrical terminal and the second power distribution terminal enables the first power distribution terminal and the second power distribution terminal to generate the corresponding first negotiation key, the second negotiation key and the intermediate negotiation key, respectively. A combined key and a second combined key, so that each terminal will fully consider the situation of other terminals and obtain the information of other terminals when generating the key, so that the generated key will change according to the current data transmission scenario, The security of the data transmission channel established between the first power distribution terminal and the second power distribution terminal is guaranteed.

When generating the first negotiation key and the second negotiation key, the present invention will fully consider the attribute information of the first power distribution terminal and the second power distribution terminal, the current power data capture information and the time information at the current moment, ensuring that The first negotiated key and the second negotiated key will not be duplicated. In addition, the first negotiation key and the second negotiation key are dynamically changed, and there will be a certain association with the first power distribution terminal and the second power distribution terminal when dynamically changing, which not only guarantees the first negotiation key and the second power distribution terminal. The followability of the negotiated key also ensures that it has a certain randomness.

When the present invention generates the first combined key and the second combined key, the first negotiated key, the relay key and the second negotiated key are analyzed according to the encoded information of the first power distribution terminal and the second power distribution terminal. Sorting is performed, and the sorting result is filled into the corresponding slot, so that the first negotiated key, the relay key, and the second negotiated key can be quickly combined to obtain a combined key, which improves the generation of the combined key. s efficiency.

Description of drawings

Figure 1 is a schematic diagram of the connection structure of the quantum network basic platform;

Fig. 2 is a flow chart of the first embodiment of the point-to-point key agreement method for power distribution terminals based on quantum secure channels;

3 is a flowchart of a second embodiment of a quantum secure channel-based power distribution terminal point-to-point key agreement method;

4 is a structural diagram of a first embodiment of a power distribution terminal point-to-point key agreement device based on a quantum secure channel;

Figure 5 is a schematic diagram of the channel between the power distribution terminal and the CPE;

FIG. 6 is a schematic diagram of a distribution terminal and a channel between the distribution terminals.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to Describe a particular order or sequence. It is to be understood that the data so used may be interchanged under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein.

It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of each process does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be used in the embodiments of the present invention. Implementation constitutes any limitation.

It should be understood that in the present invention, "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to Those steps or elements that are expressly listed may instead include other steps or elements that are not expressly listed or are inherent to the process, method, product or apparatus.

It should be understood that, in the present invention, "plurality" refers to two or more. "And/or" is just an association relationship that describes an associated object, indicating that there can be three kinds of relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone. Happening. The character "/" generally indicates that the associated objects are an "or" relationship. "Contains A, B and C", "contains A, B, C" means that A, B, and C are all contained, "contains A, B or C" means that one of A, B, and C is contained, "Comprising A, B and/or C" means including any one or any two or three of A, B, and C.

It should be understood that in the present invention, "B corresponding to A", "B corresponding to A", "A corresponds to B" or "B corresponds to A" means that B is associated with A, according to A B can be determined. Determining B based on A does not mean determining B based only on A, but also determining B based on A and/or other information. The matching between A and B means that the similarity between A and B is greater than or equal to a preset threshold.

"If" as used herein may be interpreted as "at" or "when" or "in response to determining" or "in response to detecting," depending on the context.

The technical solutions of the present invention will be described in detail below with specific examples. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

The present invention provides a point-to-point key negotiation method for power distribution terminals based on a quantum secure channel, a first power distribution terminal, a second power distribution terminal and a relay device, the first power distribution terminal, the second power distribution terminal and the middle power distribution terminal. The relay devices are respectively connected to the basic platform of the quantum network. As shown in Figure 1, the quantum security gateway can be regarded as the gateway connected to the first power distribution terminal or the second power distribution terminal.

The quantum network basic platform is used to generate a first transmission key, a relay key and a second transmission key;

The first transmission key, the relay key and the second transmission key are distributed to the first power distribution terminal, the relay device and the second power distribution terminal respectively based on the quantum security service engine and the terminal key distribution system. The present invention can generate the first transmission key, the relay key and the second transmission key through the quantum key generation system.

The relay device is a quantum CPE, and the quantum CPE decrypts the relay key through the charging key of the quantum security TF card; the quantum CPE and the first power distribution terminal are based on the relay key and the first transmission key, respectively. A first channel is established; the quantum CPE and the second power distribution terminal respectively establish a second channel based on the relay key and the second transmission key. The first channel and the second channel can be regarded as quantum-safe encryption tunnels in the figure.

As shown in Figure 2, the point-to-point key agreement method for the power distribution terminal specifically includes:

Step S110, the first power distribution terminal and the relay device establish a first channel based on the received first transmission key and the relay key, and the second power distribution terminal and the relay device are based on the received first transmission key and relay key. The received second transmission key and relay key generate a second channel. According to the technical solution provided by the present invention, the first channel and the second channel can be quantum security encryption tunnels, and the quantum security encryption tunnel can guarantee the connection between the first power distribution terminal and the relay device, and the second power distribution terminal and the relay device. Security of data transfer between.

Step S120, the first power distribution terminal generates a first negotiated key based on the attribute information and data capture information at the current moment, the first negotiated key is transmitted to the relay device through the first channel, and the relay device is based on the The attributes of the first channel and the second channel are used to generate an intermediate negotiation key, and the first negotiation key and the intermediate negotiation key are respectively sent to the second power distribution terminal. The attribute information of the first power distribution terminal and the second power distribution terminal is preset.

In an embodiment of step S120, step S120 specifically includes:

Obtain the power monitoring data of the first power distribution terminal at the current moment, and capture the first power information and the second power information in the power monitoring data, and the data capture information includes the first power information and the second power information . The current moment in the present invention may be the moment when the first channel is established between the first power distribution terminal and the relay device, and the first moment may be 12:19 on October 15, 2020. Since the first power distribution terminal performs power distribution, corresponding power distribution voltage, power distribution current, power distribution power, etc. will be generated during the power distribution process. The first power information and the second power information in the present invention may be distribution voltage, distribution current, distribution power, and the like. The first power information and the second power information may be 1000V, 20A, etc. The present invention does not make any limitation on the specific forms of the first power information and the second power information.

The attribute information includes the encoded information value of the first power distribution terminal and the time information of the current moment, and the quantized time value is obtained by quantizing the time information. The present invention quantifies the time value to make it a numerical value. For example, at 12:19 on October 15, 2020, the present invention can directly quantify it as 202010151219, count it as a number, and quantify it. The purpose is that it is convenient for calculation and key generation. The encoded information value may be preset. In the technical solution of the present invention, each of the first power distribution terminal and the second power distribution terminal respectively has a unique encoded information value, and the encoded information value may be Arabic numerals, such as 11100, 11421 and many more.

The first negotiated key is calculated by the following formula,

为第一协商密钥，

为第一电能信息的权重值，

为第一电能信息的 量值，

为第二电能信息的权重值，

为第二电能信息的量值，

为第一配电终端的编 码信息值，

为第一配电终端量化后的时间值，

为预设的调整值。 in,

is the first negotiated key,

is the weight value of the first electric energy information,

is the magnitude of the first electric energy information,

is the weight value of the second electric energy information,

is the magnitude of the second electrical energy information,

is the encoded information value of the first power distribution terminal,

is the quantized time value of the first distribution terminal,

is the preset adjustment value.

可以得到第一配电终端在电能维度上的相关数量 值，通过

可以得到第一配电终端在其自身编码和对电能信息的采集时间值，其中

为固定的，

、

以及

都是随着时间的变化、用电场景的变化而动态变化的。通过

可以对

的量值进行调整，使得第一协商密钥能够达到相应的位数。 pass

The relevant quantity value of the first power distribution terminal in the power dimension can be obtained by

The time value of the first power distribution terminal in its own coding and collection of power information can be obtained, wherein

is fixed,

,

as well as

All of them change dynamically with the change of time and the change of electricity consumption scene. pass

yes

is adjusted so that the first negotiated key can reach the corresponding number of bits.

The generated first negotiation key will include the coding information, time information, and power information of the first power distribution terminal. Since the time information and power information are both dynamically changed, the first negotiation key will also be dynamically changed. , it is guaranteed that the first dynamic key will not be deciphered.

The relay device generating the intermediate negotiation key based on the attributes of the first channel and the second channel includes:

=第一时刻

+第二时刻

， 其中

和

可以是一天中的某个时间，例如说07:52:57和10:02:37，07:52:57则为75257， 100237则为，中间协商密钥

=75257+100237。 The relay device acquires the first moment when the first channel is established and the second moment when the second channel is established, and generates an intermediate negotiation key based on the first moment and the second moment. In the present invention, when a data transmission channel is established between the first power distribution terminal and the second power distribution terminal, the relay device will participate, which will be obtained according to the first moment when the first channel is established and the second moment when the second channel is established. intermediate negotiation key, intermediate negotiation key

= first moment

+ second moment

, in

and

Can be a time of day, say 07:52:57 and 10:02:37, 07:52:57 is 75257, 100237 is, the intermediate negotiated key

=75257+100237.

Step S130, the second power distribution terminal generates a second negotiation key based on the attribute information and data capture information at the current moment, the second negotiation key is transmitted to the relay device through the second channel, and the relay device is based on the The attributes of the second channel and the first channel are used to generate an intermediate negotiation key, and the second negotiation key and the intermediate negotiation key are respectively sent to the first power distribution terminal.

Wherein, step S130 specifically includes:

Acquire the power monitoring data of the second power distribution terminal at the current moment, and capture the third power information and the fourth power information in the power monitoring data, and the data capture information includes the third power information and the fourth power information. The current moment in the present invention may be the moment when the second channel is established between the first power distribution terminal and the relay device, and the second moment may be 14:21 on October 15, 2020. Since the second power distribution terminal performs power distribution, corresponding power distribution voltage, power distribution current, power distribution power, etc. will be generated during the power distribution process. The third power information and the fourth power information in the present invention may be distribution voltage, distribution current, distribution power, and the like. The third power information and the fourth power information may be 1000V, 20A, etc. The present invention does not make any limitation on the specific forms of the third power information and the fourth power information.

The attribute information includes the encoded information value of the second power distribution terminal and the time information of the current moment, and the quantized time value is obtained by quantizing the time information. The present invention quantifies the time value to make it a numerical value. For example, at 14:21 on October 15, 2020, the present invention can directly quantify it as 202010151421, count it as a number, and quantify it. The purpose is that it is convenient for calculation and key generation. The encoded information value may be preset. In the technical solution of the present invention, each of the first power distribution terminal and the second power distribution terminal respectively has a unique encoded information value, and the encoded information value may be Arabic numerals, such as 11100, 11421 and many more.

Calculate the second negotiated key by the following formula,

为第二协商密钥，

为第三电能信息的权重值，

为第三电能信息的 量值，

为第四电能信息的权重值，

为第四电能信息的量值，

为第二配电终端的编 码信息值，

为第二配电终端量化后的时间值，

为预设的调整值。 in,

is the second negotiated key,

is the weight value of the third electric energy information,

is the magnitude of the third electric energy information,

is the weight value of the fourth electric energy information,

is the magnitude of the fourth electric energy information,

is the encoded information value of the second power distribution terminal,

is the quantized time value of the second distribution terminal,

is the preset adjustment value.

可以得到第二配电终端在电能维度上的相关数量 值，通过

可以得到第二配电终端在其自身编码和对电能信息的采集时间值，其中

为固定的，

、

以及

都是随着时间的变化、用电场景的变化而动态变化的。通 过

可以对

的量值进行调整，使得第二协商密钥能够达到相应的位 数。 pass

The relevant quantity value of the second power distribution terminal in the power dimension can be obtained by

The time value of the second power distribution terminal in its own coding and collection of power information can be obtained, wherein

is fixed,

,

as well as

All of them change dynamically with the change of time and the change of electricity consumption scene. pass

yes

is adjusted so that the second negotiated key can reach the corresponding number of bits.

The generated first negotiation key will include the coding information, time information, and power information of the first power distribution terminal. Since the time information and power information are both dynamically changed, the first negotiation key will also be dynamically changed. , it is guaranteed that the first dynamic key will not be deciphered.

The relay device generating the intermediate negotiation key based on the attributes of the second channel and the first channel includes:

The relay device acquires the first moment when the first channel is established and the second moment when the second channel is established, and generates an intermediate negotiation key based on the first moment and the second moment. This step is similar to the step of step S120, and will not be repeated in the present invention.

Step S140, the first power distribution terminal and the second power distribution terminal generate a first combined key and a second combined key based on the first negotiated key, the intermediate negotiated key, and the second negotiated key, respectively.

In the technical solution provided by the embodiment of the present invention, step S140 specifically includes:

The first power distribution terminal and the second power distribution terminal respectively obtain the encoded information values of the first power distribution terminal and the second power distribution terminal, and based on the encoded information values, the first negotiation key and the intermediate negotiation key are assigned. and the second negotiated key are respectively filled into the preset key generation template to generate the first combined key and the second combined key.

Wherein, based on the encoded information value, the first negotiated key, the intermediate negotiation key, and the second negotiated key are respectively filled into a preset key generation template to generate a first combined key and a second combined key Keys include:

The key generation template includes a first slot, a second slot and a third slot. The key generation template can be □-□-□, the first box is the first slot of the key generation template, the second box is the second slot of the key generation template, and the third box is The third slot of the key generation template.

If the encoded information value of the first power distribution terminal is greater than the encoded information value of the second power distribution terminal, the first combined key is placed in the first slot, and the second combined key is placed in the third slot, setting the relay key in the second slot.

In the present invention, when the first negotiated key, the intermediate negotiation key and the second negotiated key are respectively filled into the key generation template, it can be determined according to the encoded information value of each power distribution terminal. The code information value of the power distribution terminal is 11100, and the code information value of the second power distribution terminal is 11421, then the code information value of the second power distribution terminal is greater than the code information value of the first power distribution terminal. The first negotiation key corresponding to a power distribution terminal is filled into the third slot, and the second negotiation key corresponding to the second power distribution terminal is filled into the first slot. The first combined key and the second combined key at this time are the number of the second negotiated key - the number of the relay key - the number of the first combined key.

The first negotiation key, the intermediate negotiation key, and the second negotiation key will be sorted according to the coding information of the first power distribution terminal and the second power distribution terminal, and the sorting result will be filled into the corresponding slot, so that The combined key can be obtained by combining the first negotiated key, the intermediate negotiated key and the second negotiated key quickly, which improves the efficiency of generating the combined key.

Step S150: If the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal are based on the first combined key and/or the second combined key. The combined key establishes a data transmission channel.

In the technical solution provided by the present invention, as shown in FIG. 3 , step S150 specifically includes:

In step S1501, the first power distribution terminal and the second power distribution terminal generate the first combined key and the second combined key and send them to the relay device respectively. The first power distribution terminal and the second power distribution terminal will send the respectively generated first combined key and second combined key to the relay device for verification.

Step S1502: The relay device determines that the first combined key and the second combined key are the same, and sends a request instruction to the first power distribution terminal and a receive instruction to the second power distribution terminal. When the first combined key and the second combined key are the same, the relay device as a third party will send corresponding instructions to the first power distribution terminal and the second power distribution terminal respectively. The following equipment will judge the relationship between the coded information values of the first power distribution terminal and the second power distribution terminal. In the present invention, the terminal with the larger coded information value will be used as the second power distribution terminal, and the terminal with the smaller coded information value will be used as the first power distribution terminal. Two power distribution terminals. The setting of this mode enables the relay device to fix the establishment mode of the data transmission channel between the first power distribution terminal and the second power distribution terminal. That is, a request instruction is sent to the first power distribution terminal, and a receive instruction is sent to the second power distribution terminal.

Step S1503: After receiving the request instruction, the first power distribution terminal requests the second power distribution terminal to establish a data transmission channel based on the first combined key. In the technical solution provided by the present invention, after receiving the request instruction, the first power distribution terminal will request the second power distribution terminal to establish a data transmission channel with it.

Step S1504, the second power distribution terminal receives the request of the first power distribution terminal based on the receiving instruction, and verifies the first combined key according to the second combined key. If the two combined keys are the same, the first power distribution terminal and the second power distribution terminal establish a data transmission channel based on the first combined key. After receiving the request from the first power distribution terminal, the second power distribution terminal verifies the first combined key sent by the first power distribution terminal. When the first combined key is the same as the second combined key, then The first power distribution terminal establishes a data transmission channel with the second power distribution terminal. At this time, the encryption key of the data transmitted in the data transmission channel is the first combined key.

Embodiments of the present invention further provide a point-to-point key agreement device for power distribution terminals based on quantum secure channels, a first power distribution terminal, a second power distribution terminal and a relay device, the first power distribution terminal and the second power distribution terminal The electrical terminal and the relay device are respectively connected to the quantum network basic platform, and the key negotiation is performed between the first power distribution terminal and the second power distribution terminal through the following means. As shown in Figure 4, the power distribution terminal point-to-point key The negotiation device specifically includes:

A first channel establishment module, configured to enable the first power distribution terminal and the relay device to establish a first channel based on the received first transmission key and relay key, and the second power distribution terminal and the relay device. The relay device generates a second channel based on the received second transmission key and the relay key;

A first key negotiation module, configured to enable the first power distribution terminal to generate a first negotiation key based on the attribute information and data capture information at the current moment, and the first negotiation key is transmitted to the relay through the first channel device, the relay device generates an intermediate negotiation key based on the attributes of the first channel and the second channel, and sends the first negotiation key and the intermediate negotiation key to the second power distribution terminal respectively;

The second key negotiation module is configured to enable the second power distribution terminal to generate a second negotiation key based on the attribute information and data capture information at the current moment, and the second negotiation key is transmitted to the relay through the second channel device, the relay device generates an intermediate negotiation key based on the attributes of the second channel and the first channel, and sends the second negotiation key and the intermediate negotiation key to the first power distribution terminal respectively;

The combination module is configured to enable the first power distribution terminal and the second power distribution terminal to generate a first combined key and a second combined key based on the first negotiation key, the intermediate negotiation key, and the second negotiation key, respectively. key;

The second channel establishment module, if the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal are based on the first combined key and/or or the second combined key to establish a data transmission channel.

之间的共享密钥为

。现需要为配电终端之间两两建立安全通道，例如，为配电终端

和 配电终端

建立一个安全通道（即利用

和

为

和

协商出一个共享密钥）。设计 配电终端之间的密钥协商机制。两个配电终端之间的密钥协商主要分为三个阶段，第一阶 段

通过量子CPE的中转将

传给

，而后第二阶段

同样通过量子CPE将

传给

，最后第三阶段双方利用相同哈希函数得出一致的共享密钥。双方交换的具体内容如下表 所示： In another embodiment of the present invention, as shown in FIG. 5 , the quantum CPE and the i-th power distribution terminal are set

The shared key between

. Now it is necessary to establish a safe channel between the power distribution terminals, for example, for the power distribution terminals

and distribution terminals

Establish a secure channel (i.e. use

and

for

and

negotiate a shared secret). Design a key agreement mechanism between power distribution terminals. The key negotiation between two power distribution terminals is mainly divided into three stages, the first stage

Transit via Quantum CPE will

pass to

, and then the second stage

Similarly, the quantum CPE will

pass to

, and finally, in the third stage, both parties use the same hash function to obtain a consistent shared key. The specific content of the exchange between the two parties is shown in the following table:

The basic idea:

随机生成一个数

，并通过

与量子CPE之间的安全量子通道 把N _i 发送给量子CPE。 (1) Step 001,

generate a random number

, and pass

A secure quantum channel with the quantum _CPE sends Ni to the quantum CPE.

之间的安全量子通道把N _i 转发给

。 (2) Step 002, the quantum CPE communicates with

A secure quantum channel between forwards Ni _to

.

随机生成一个数

，并通过

与量子CPE之间的安全量子通道 把

发送给量子CPE。 (3) Step 003,

generate a random number

, and pass

Secure quantum channel with quantum CPE put

Sent to Quantum CPE.

之间的安全量子通道把

转发给

。 (4) Step 004, the quantum CPE communicates with

A secure quantum channel between

forward to

.

和

各自计算

。得到的K就是

和

之间的共享密钥。 (5) If the first 4 steps are correct,

and

Calculate separately

. The obtained K is

and

shared key between.

(6) Step 005, if there is a network failure or transmission error, each party can transmit ERROR No. 005 to the other two, and the party receiving the RST clears the message queue established before, forcing the object that just participated in the negotiation to re-start the message No. 001 Start key negotiation.

和

之间的安全 通道已被建立，且共享密钥为K。现需要认证所协商出的密钥K的安全性和正确性。保证密钥 协商结果的正确性。两个配电终端之间的验证过程分为四个阶段。第一阶段，

利用共享 密钥K和对方

的公钥通过哈希函数映射到一个值

，而后通过刚才双方建立的安全通 道将其发给

。第二阶段，在

收到

之后，其验证自己的公钥

和自己算出的共享密 钥K经过哈希映射后是否能得到相同的t值。此时如果验证通过进入第三阶段，否则密钥协 商失败，发送005号消息重新协商。第三阶段，

利用共享密钥K和对方

的公钥通过哈希 函数映射到一个值

，并把

发给

。第四阶段，在

收到

之后，其验证自己的公钥

和自己算出的共享密钥K经过哈希映射后是否能得到相同的t值。此时如果相等，则验证 通过，否则密钥协商失败，发送005号消息重新协商。交换的具体内容如下表所示： In another embodiment of the present invention, as shown in FIG. 6 , the power distribution terminal is set

and

The secure channel between them has been established, and the shared key is K. It is now necessary to authenticate the security and correctness of the negotiated key K. Ensure the correctness of the key negotiation result. The verification process between two power distribution terminals is divided into four stages. The first stage,

Using the shared key K and the other party

The public key is mapped to a value via a hash function

, and then send it to the

. In the second stage, in

receive

After that, it verifies its own public key

Whether the same t value can be obtained after hash mapping with the shared key K calculated by yourself. At this time, if the verification passes and enters the third stage, otherwise the key negotiation fails, and the 005 message is sent to renegotiate. The third phase,

Using the shared key K and the other party

The public key is mapped to a value via a hash function

, and put

send to

. In the fourth stage, in

receive

After that, it verifies its own public key

Whether the same t value can be obtained after hash mapping with the shared key K calculated by yourself. At this time, if they are equal, the verification is passed, otherwise the key negotiation fails, and message 005 is sent to renegotiate. The specific content of the exchange is shown in the following table:

The basic idea:

计算

，并把

发送给

。 (1) Step 006,

calculate

, and put

send to

.

收到

后，计算

并比较

是否等于

，如果 相等，则验证通过，否则密钥协商失败，发送005号消息重新协商。 (2) Step 007,

receive

After that, calculate

and compare

Is it equal to

, if they are equal, the verification is passed, otherwise the key negotiation fails, and message 005 is sent to renegotiate.

计算

，并把

发送给

。 If the verification is passed, go to step 008,

calculate

, and put

send to

.

收到

后，计算

，并比较

是否等于

，如 果相等，则验证通过，否则密钥协商失败，发送005号消息重新协商。 (3) Step 009,

receive

After that, calculate

, and compare

Is it equal to

, if they are equal, the verification is passed, otherwise the key negotiation fails, and message 005 is sent to renegotiate.

The readable storage medium may be a computer storage medium or a communication medium. Communication media includes any medium that facilitates transfer of a computer program from one place to another. Computer storage media can be any available media that can be accessed by a general purpose or special purpose computer. For example, a readable storage medium is coupled to the processor such that the processor can read information from, and write information to, the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium may be located in application specific integrated circuits (Application Specific Integrated Circuits, ASIC for short). Alternatively, the ASIC may be located in the user equipment. Of course, the processor and the readable storage medium may also exist in the communication device as discrete components. The readable storage medium may be read only memory (ROM), random access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and the like.

The present invention also provides a program product including execution instructions stored in a readable storage medium. At least one processor of the device can read the execution instruction from the readable storage medium, and the execution of the execution instruction by the at least one processor causes the device to implement the methods provided by the various embodiments described above.

In the above embodiments of the terminal or server, it should be understood that the processor may be a central processing unit (English: Central Processing Unit, CPU for short), or other general-purpose processors, digital signal processors (English: Digital Signal Processor) , referred to as: DSP), application specific integrated circuit (English: Application Specific Integrated Circuit, referred to as: ASIC) and so on. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the present invention can be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features thereof can be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present invention. scope.

Claims (9)

1. A point-to-point key agreement method for power distribution terminals based on a quantum secure channel, characterized in that it comprises a first power distribution terminal, a second power distribution terminal and a relay device, the first power distribution terminal and the second power distribution terminal and the relay devices are respectively connected to the quantum network basic platform, and perform key negotiation between the first power distribution terminal and the second power distribution terminal through the following steps, including: The first power distribution terminal and the relay device establish a first channel based on the received first transmission key and the relay key, and the second power distribution terminal and the relay device establish a first channel based on the received first transmission key and the relay key. 2. The transmission key and the relay key generate the second channel; The first power distribution terminal generates a first negotiation key based on the attribute information and data capture information at the current moment, the first negotiation key is transmitted to the relay device through the first channel, and the relay device is based on the first negotiation key. The attributes of the channel and the second channel generate an intermediate negotiation key, and send the first negotiation key and the intermediate negotiation key to the second power distribution terminal respectively; The second power distribution terminal generates a second negotiation key based on the attribute information and data capture information at the current moment, the second negotiation key is transmitted to the relay device through the second channel, and the relay device sends the second negotiation key to the relay device. sending the negotiation key and the intermediate negotiation key to the first power distribution terminal respectively; The first power distribution terminal and the second power distribution terminal generate a first combined key and a second combined key based on the first negotiation key, the intermediate negotiation key, and the second negotiation key, respectively; If the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal are based on the first combined key and/or the second combined key Establish a data transmission channel. 2. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 1, is characterized in that, The quantum network basic platform is used to generate a first transmission key, a relay key and a second transmission key; The first transmission key, the relay key and the second transmission key are distributed to the first power distribution terminal, the relay device and the second power distribution terminal respectively based on the quantum security service engine and the terminal key distribution system. 3. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 2, is characterized in that, The attribute information of the first power distribution terminal and the second power distribution terminal is preset. 4. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 1, is characterized in that, The generation of the first negotiation key by the first power distribution terminal based on the attribute information and the data capture information at the current moment includes: Obtain the power monitoring data of the first power distribution terminal at the current moment, and capture the first power information and the second power information in the power monitoring data, and the data capture information includes the first power information and the second power information; The attribute information includes the encoded information value of the first power distribution terminal and the time information at the current moment, and the quantized time value is obtained by quantizing the time information; The first negotiated key is calculated by the following formula,

in,

is the first negotiated key,

is the weight value of the first electric energy information,

is the magnitude of the first electric energy information,

is the weight value of the second electric energy information,

is the magnitude of the second electrical energy information,

is the encoded information value of the first power distribution terminal,

is the quantized time value of the first distribution terminal,

is the preset adjustment value; The relay device generating the intermediate negotiation key based on the attributes of the first channel and the second channel includes: The relay device acquires the first moment when the first channel is established and the second moment when the second channel is established, and generates an intermediate negotiation key based on the first moment and the second moment. 5. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 1, is characterized in that, The second power distribution terminal generates a second negotiation key based on the attribute information and data capture information at the current moment, and the second negotiation key is transmitted to the relay device through the second channel, including: Acquire the power monitoring data of the second power distribution terminal at the current moment, and capture the third power information and the fourth power information in the power monitoring data, and the data capture information includes the third power information and the fourth power information; The attribute information includes the encoded information value of the second power distribution terminal and the time information at the current moment, and the time information is quantized to obtain a quantized time value; Calculate the second negotiated key by the following formula,

in,

is the second negotiated key,

is the weight value of the third electric energy information,

is the magnitude of the third electric energy information,

is the weight value of the fourth electric energy information,

is the magnitude of the fourth electric energy information,

is the encoded information value of the second power distribution terminal,

is the quantized time value of the second power distribution terminal,

is the preset adjustment value; The relay device generating the intermediate negotiation key based on the attributes of the second channel and the first channel includes: The relay device acquires the first moment when the first channel is established and the second moment when the second channel is established, and generates an intermediate negotiation key based on the first moment and the second moment. 6. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to any one of claims 4 or 5, wherein, The first power distribution terminal and the second power distribution terminal respectively generate a first combined key and a second combined key based on the first negotiation key, the intermediate negotiation key, and the second negotiation key, including: The first power distribution terminal and the second power distribution terminal obtain the encoded information value of the first power distribution terminal and the second power distribution terminal respectively, and based on the encoded information value, the first negotiation key and the intermediate negotiation encryption key are obtained. The key and the second negotiated key are respectively filled into the preset key generation template to generate the first combined key and the second combined key. 7. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 6, characterized in that, Based on the encoded information value, the first negotiated key, the intermediate negotiation key, and the second negotiated key are respectively filled into a preset key generation template to generate a first combined key and a second combined key include: The key generation template includes a first slot, a second slot and a third slot; If the encoded information value of the first power distribution terminal is greater than the encoded information value of the second power distribution terminal, the first negotiated key is placed in the first slot, and the second negotiated key is placed in the third The slot and the relay key are set in the second slot. 8. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 7, characterized in that, If the relay device determines that the first combined key and the second combined key are the same, the first power distribution terminal and the second power distribution terminal are based on the first combined key and/or the second combined key Establishing a data transmission channel includes: The first power distribution terminal and the second power distribution terminal generate the first combined key and the second combined key and send them to the relay device respectively; The relay device determines that the first combined key and the second combined key are the same, and sends a request instruction to the first power distribution terminal and a receive instruction to the second power distribution terminal; After receiving the request instruction, the first power distribution terminal requests the second power distribution terminal to establish a data transmission channel based on the first combined key; The second power distribution terminal receives the request of the first power distribution terminal based on the receiving instruction, and verifies the first combined key according to the second combined key. If the key is the same, the first power distribution terminal and the second power distribution terminal establish a data transmission channel based on the first combined key. 9. The point-to-point key agreement method for power distribution terminals based on quantum secure channel according to claim 6, characterized in that, The first power distribution terminal and the second power distribution terminal respectively have unique encoded information values.

Images