CN115694815A - Communication encryption method and device for power distribution terminal - Google Patents

Abstract

The invention discloses a communication encryption method and a communication encryption device for power distribution terminals, wherein a communication encryption strategy of a power service is determined according to the service priority of the power service to be transmitted between the power distribution terminals, and an original quantum key is obtained from a quantum key pool to encrypt and transmit the power service; calculating the net key generation rate of the quantum key pool in real time; when the net secret key generation rate is smaller than or equal to a preset rate threshold value, acquiring a recovery quantum secret key from a recovery secret key pool to carry out encryption transmission on a preset type of electric power service to be transmitted; wherein the recovered quantum key is generated from the used original quantum key. By adopting the method and the device, different communication encryption strategies can be distributed for the power services with different priorities, the encryption transmission process is adjusted according to the actual situation, and the residual secret key amount of the quantum secret key pool can meet the normal communication requirement between the power distribution terminals.

Description

Communication encryption method and device for power distribution terminal

technical field

The invention relates to the technical field of power distribution network, in particular to a communication encryption method and device for a power distribution terminal.

Background technique

Communication and information security are two major problems that restrict the automation and practicality of distribution network. The development of distribution automation access layer communication technology requires continuous iteration and improvement of matching information security technology. As far as the current technology development trend is concerned, 5G communication has become the main alternative method for distribution automation access layer communication. Feeder automation based on 5G communication generally adopts principles such as snap-action Multi-Agent and vertical differential protection as the main logic of feeder automation, which is especially suitable for scenarios that require extremely high reliability of power supply. New feeder automation principles such as snap-action Multi-Agent and longitudinal differential protection rely on horizontal peer-to-peer communication between terminals and terminals. However, the current distribution automation encryption certification system is only established in the vertical communication dimension between the master station and the terminal, and cannot adapt to horizontal encryption. Certified security business requirements.

Therefore, in response to the certification requirements of 5G feeder automation information communication, the communication data between terminals is encrypted through the quantum key unique to the quantum-safe mobile medium of power distribution terminals, so as to realize the secure transmission of "terminal-terminal" peer-to-peer communication sessions , to facilitate direct mutual authentication between terminals, and to prevent the identity information of key power terminals from being violently tampered with, captured, and stolen in a complex communication environment. Quantum Key Distribution (Quantum Key Distribution, QKD) technology has the advantage of "unconditional security" in theory, making quantum secure communication more secure and reliable than traditional communication methods.

However, the inventor found at least the following problems in the prior art: With the wide application of quantum secure communication, the communication business between power distribution terminals continues to increase, and the number of quantum keys required for data communication between power distribution terminals has increased significantly , the quantum key generation rate of the current quantum key distribution device is low. If all communication services adopt the one-time pad (OTP) scheme, the amount of quantum keys required to be consumed is large, resulting in a large amount of quantum keys Insufficient, it will not be able to meet the normal transmission needs of all power services between power distribution terminals.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a communication encryption method and device for power distribution terminals, which can assign different communication encryption strategies to power services with different priorities, and adjust the encrypted transmission process according to actual conditions to ensure quantum encryption. The remaining keys in the key pool can meet the normal communication requirements between power distribution terminals.

In order to achieve the above purpose, an embodiment of the present invention provides a communication encryption method for a power distribution terminal, including:

According to the service priority of the power service to be transmitted between the power distribution terminals, determine the communication encryption strategy of the power service;

According to the communication encryption strategy, the original quantum key is obtained from the quantum key pool to encrypt and transmit the power service; wherein, the original quantum key is an unused quantum key generated by the quantum key pool;

Calculate the net key generation rate of the quantum key pool in real time; the net key generation rate is the difference between the quantum key generation amount and the quantum key consumption of the quantum key pool per unit time;

When the net key generation rate is less than or equal to the preset rate threshold, the recovered quantum key is obtained from the recovered key pool to encrypt and transmit the preset type of power services to be transmitted; wherein, the recovered quantum key is generated from the original quantum key that has already been used.

As an improvement to the above solution, the higher the business priority of the power service, the higher the encryption level and key update frequency of the corresponding communication encryption strategy; The amount of key is positively correlated.

As an improvement to the above solution, the preset type of electric service is an electric service with a service priority lower than a first preset level threshold.

As an improvement of the above scheme, the recovered quantum key is generated and stored in the following manner:

In the process of obtaining the original quantum key for encrypted transmission of the power service, detecting whether the encrypted transmission process of the power service is safe;

When the encrypted transmission process is safe, obtain the first quantum key in the original quantum key used in the encrypted transmission process as the recovered quantum key, and store it in the recovered key pool; Wherein, the first quantum key is obtained by dividing the used original quantum key through a preset division algorithm.

As an improvement of the above solution, in the process of obtaining the original quantum key to encrypt and transmit the power service, it is detected whether the encrypted transmission process of the power service is safe, specifically:

Before encrypting and transmitting the power service, divide the obtained original quantum key into the first quantum key and the second quantum key by using the split algorithm;

；其中，k1为第一量子密钥，k2为第二量子密钥，x为所传输的电力业 务的业务数据，

为预设的哈希函数； Generate a detection tag according to the first quantum key, the second quantum key and the transmitted power service

; Wherein, k1 is the first quantum key, k2 is the second quantum key, and x is the business data of the electric power business transmitted,

is the preset hash function;

After encrypting and transmitting the power service, it is judged whether the service data is received by the power distribution terminal as the receiving end within the preset waiting period;

；其中， x’为接收到的业务数据； If yes, generate a verification tag based on the received business data

; Wherein, x' is the received business data;

When the detection tag is equal to the verification tag, it is determined that the encrypted transmission process of the power service is safe; when the detection tag is not equal to the verification tag, it is determined that the encrypted transmission process of the power service is not safe;

If not, it is determined that the encrypted transmission process of the electric power service is not safe.

As an improvement of the above scheme, the acquisition of the recovery quantum key from the recovery key pool encrypts and transmits the preset type of power services to be transmitted, specifically including:

Randomly obtain at least two recycled quantum keys in the recycled key pool;

Combining the at least two recycled quantum keys with a preset synthesis algorithm to obtain a combined quantum key, and using the combined quantum key to encrypt and transmit preset types of power services to be transmitted.

As an improvement of the above scheme, the acquisition of the recovery quantum key from the recovery key pool encrypts and transmits the preset type of power services to be transmitted, specifically including:

Randomly obtain two recovered quantum keys in the recovered key pool as the first recovered quantum key and the second recovered quantum key;

After using the first recovery quantum key to encrypt the business data of the preset type of power service to be transmitted once, then use the second recovery quantum key to encrypt the business data encrypted once and transmit it .

As an improvement to the above solution, the reclaimed quantum key is generated according to the original quantum key that has been used in the encrypted transmission process of the electric business whose service priority is higher than the second preset level threshold.

As an improvement of the above solution, when the net key generation rate is less than or equal to the preset rate threshold, the method further includes:

The communication encryption policy of each electric service is adjusted by reducing the encryption level and/or key update frequency of each electric service.

The embodiment of the present invention also provides a communication encryption device for a power distribution terminal, including:

An encryption policy determination module, configured to determine a communication encryption policy for the electric power service according to the service priority of the electric power service to be transmitted between power distribution terminals;

The first encryption transmission module is used to obtain the original quantum key from the quantum key pool to encrypt and transmit the power service according to the communication encryption strategy; wherein, the original quantum key is generated by the quantum key pool unused quantum keys;

The net key generation rate calculation module is used to calculate the net key generation rate of the quantum key pool in real time; the net key generation rate is the amount of quantum key generation and the quantum key of the quantum key pool per unit time difference in consumption;

The second encryption transmission module is used to obtain the recovery quantum key from the recovery key pool to encrypt and transmit the preset type of power service to be transmitted when the net key generation rate is less than or equal to the preset rate threshold; Wherein, the recovered quantum key is generated according to the used original quantum key.

Compared with the prior art, the communication encryption method and device for power distribution terminals disclosed in the present invention allocate different communication encryption strategies for power services with different business priorities between power distribution terminals, and obtain the encryption strategy from the quantum key pool The original quantum key is encrypted and transmitted. During the encrypted transmission process of the power business, the used original quantum key is recovered and stored. At the same time, the net key generation rate of the quantum key pool at the current moment is calculated in real time. When detected When the net key generation rate is less than or equal to the preset rate threshold, adjust the encrypted transmission mode for the electric power business, and obtain the recovered quantum key from the recovered key pool for encrypted transmission for the preset type of power business to be transmitted .

Using the technical means of the embodiment of the present invention, different communication encryption strategies are assigned to power services with different business priorities, and the consumption of quantum keys and key update frequency of the communication encryption strategies corresponding to power services with low business priorities is relatively small , the communication encryption strategy corresponding to the high business priority power business consumes a larger quantum key and key update frequency, thereby reducing the amount of quantum keys that the low business priority power business needs to consume during encrypted transmission Compared with the one-time pad scheme that all power services adopt, the embodiment of the present invention can effectively alleviate the problem that the quantum key pool can not meet the normal transmission requirements of all power services due to the low rate of quantum key generation. On this basis, when it is detected that the net key generation rate is too low, the encrypted transmission process of some power services is adjusted to use the quantum key that has already been used for encryption, which can further save the use of the original quantum key. The power business with high business priority retains more original quantum keys, increases the net key generation rate of the quantum key pool, and avoids the failure to meet the normal transmission requirements of all power services between power distribution terminals due to insufficient quantum keys The problem is to ensure the normal transmission requirements and transmission efficiency of power services between power distribution terminals.

Description of drawings

FIG. 1 is a schematic flowchart of a communication encryption method for a power distribution terminal in a first implementation mode provided by an embodiment of the present invention;

Fig. 2 is a schematic flow diagram of generating and recovering quantum keys in an embodiment of the present invention;

Fig. 3 is the schematic diagram of the principle of generating and recovering the quantum key in the embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a communication encryption device for a power distribution terminal provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Referring to FIG. 1 , it is a schematic flowchart of a communication encryption method for a power distribution terminal under the first implementation mode provided by an embodiment of the present invention. An embodiment of the present invention provides a communication encryption method for a power distribution terminal, which is applied to a power distribution network The system can be executed by a controller in the distribution network, and the method specifically includes steps S11 to S14:

S11. Determine the communication encryption strategy for the power service according to the service priority of the power service to be transmitted between the power distribution terminals;

S12. According to the communication encryption strategy, obtain the original quantum key from the quantum key pool to encrypt and transmit the power service; wherein, the original quantum key is an unused quantum key generated by the quantum key pool ;

S13. Calculate the net key generation rate of the quantum key pool in real time; the net key generation rate is the difference between the quantum key generation amount and the quantum key consumption amount of the quantum key pool per unit time;

S14. When the net key generation rate is less than or equal to the preset rate threshold, obtain the recovery quantum key from the recovery key pool to encrypt and transmit the power service of the preset type to be transmitted; wherein, the recovery quantum Keys are generated from raw quantum keys that have already been used.

There are usually several power services between different distribution terminals in the distribution network that require communication data transmission. As an example, common power services include relay protection, safety and stability control, dispatch data network, substation comprehensive monitoring, dispatch telephone, Business scenarios such as distribution network automation, communication intelligent management system, customer contact system, customer relationship management system, user electricity consumption information collection, data center and conference TV system. In the embodiment of the present invention, the quantum key unique to the quantum-safe mobile medium of the power distribution terminal is used to encrypt the power service communication data between the terminals, thereby realizing the secure transmission of peer-to-peer communication data between "terminals and terminals", which facilitates the communication between terminals. direct mutual authentication. The quantum CPE power distribution terminal is based on the decoy state BB84 protocol, and uses polarization coding to realize quantum key distribution, providing both communication parties with a secure quantum key that cannot be deciphered by calculation.

In the existing field of data communication, the one-time pad scheme is usually adopted for data encryption and transmission using quantum keys, and the amount of quantum keys consumed is equal to the amount of encrypted data, so the consumption of quantum keys is relatively large, especially When the key update frequency is fast, the original quantum key generation rate in the quantum key distribution device (that is, the quantum key pool) cannot meet the normal encryption communication requirements. The embodiments of the present invention improve the encrypted transmission process of power services between power distribution terminals, so as to ensure normal transmission of power services between power distribution terminals.

Specifically, divide the business priority of the power business that needs to be transmitted between power distribution terminals, and then assign different types of communication to the power business of different business registrations according to the corresponding relationship between the preset business priority and the type of communication encryption strategy. encryption policy.

As an optional implementation manner, the division of business priorities for power services that need to be transmitted between power distribution terminals specifically includes:

Determine the business type of the power business to be transmitted between power distribution terminals; wherein, the business type is obtained by dividing the importance and delay requirements of the power business; according to the business type of the power business, determine The service priority of the power service; wherein, the higher the importance and delay requirement of the power service, the higher the service priority.

As a preferred embodiment, the communication encryption strategy includes an encryption level and a key update frequency, and the encryption level is positively correlated with the amount of quantum keys used to transmit the electric power service, that is, the higher the encryption level, the The more quantum keys used in the transmission process, the higher the encryption security. The key update frequency refers to the frequency of updating the quantum key during business transmission. The higher the key update frequency, the higher the encryption security.

Then in step S11, according to the business priority of the power business to be transmitted between the power distribution terminals, determine the communication encryption strategy of the power business to meet the following requirements: the higher the business priority of the power business, the corresponding communication encryption The policy has a higher encryption level and key update frequency.

Furthermore, the power business to be transmitted between power distribution terminals obtains a corresponding number of original quantum keys from the quantum key pool for encrypted transmission according to the corresponding determined communication encryption strategy, according to the key update frequency and encryption level.

Specifically, according to the communication encryption strategy, the original quantum key required to encrypt the power service is obtained from the quantum key pool as the target quantum key;

Use the target quantum key to encrypt the service data of the electric power service to obtain encrypted service data, so that the power distribution terminal as the sending end sends the encrypted service data to the power distribution terminal as the receiving end through a quantum transmission channel .

In the specific application scenario, as an example, the power business of the distribution network is divided into three business types:

Electric power services belonging to the first business type include: relay protection, safety and stability control, dispatching data network, and comprehensive monitoring of substations;

The electric power business belonging to the second business type includes: dispatching telephone, distribution network automation, communication intelligent management system, customer contact system;

The electric power business belonging to the third business type includes: customer relationship management system, user electricity consumption information collection, data center, and video conference system.

Among them, the power business of the first business type is the key to maintaining the stability of the power system, and its safest and highest priority transmission should be guaranteed, the second business type is second, and the third business type is the last. Each service type corresponds to a service priority, the first service type corresponds to the first service priority, the second service type corresponds to the second service priority, and the third service type corresponds to the third service priority, wherein the first service priority higher than the second service priority, which is higher than the third service priority.

Further, for the three business priorities, three communication encryption strategies are set correspondingly:

The first communication encryption strategy is: one-time pad scheme, that is, the amount of quantum keys consumed is equal to the amount of encrypted data, and the amount of quantum keys consumed and the key update frequency are the largest under this encryption strategy.

The second communication encryption strategy is to use quantum keys instead of session keys. In this policy, the AES-128 encryption algorithm is selected. The length of each transaction and the key used for each encryption is 128 bits. The key update frequency is f=B/D, where f is the quantum key update frequency, B is the data flow of a power service transmission within one second, and D is the data transmission threshold, which means that the 128-bit quantum key is used Maximum encrypted data length. It can be seen that the quantum key length consumed by the power service with a length of Bt is 128 Bt/D during encrypted transmission. Considering the reduction of key freshness and potential security risks due to high data transmission threshold, the key is encrypted every 8-16 transactions. That is, the data transfer threshold ranges from 1 kbit to 2 kbit. The amount of quantum keys consumed and the frequency of key updates under this encryption strategy are next.

The third communication encryption strategy is to use quantum keys instead of master keys. In classical encryption, the way the master key generates the session key can be expressed as K _S =PRF(K _M ,n,S), where K _S is the session key, n is a random value negotiated by two sites, S is a non-random character string that prevents different plaintexts from choosing the same key, K _M is the master key, and its length can be recorded as 128 bits. PRF is a pseudo-random function, which is usually replaced by a hash function, and SHA-256 with higher security is more preferable. Therefore, the length of the generated session key is 256 bits. According to the ratio of the master key to the session key, when the master key is replaced, the key update threshold and quantum key update frequency are 2 times and 1/2 times that of the session key. Then the quantum key consumed by the traffic Bt is 64Bt/D. The amount of quantum keys consumed and the key update frequency are the smallest under this encryption strategy.

It should be noted that the above scenarios are only examples. In practical applications, the business priorities of different power services can be divided according to the actual application conditions of the distribution network, and different communication encryption strategies can be assigned to different business priorities. , all do not affect the beneficial effect that the present invention obtains.

And it needs to be specially noted that, in the process of encrypted transmission of the power service, the embodiment of the present invention also configures the controller to collect the original quantum key used in the encrypted transmission process, so as to generate the recovery quantum key key and store it in a pre-set recycled key pool as a backup.

Further, in the process of encrypted transmission of the electric power service, the controller calculates the net key generation rate of the quantum key pool in real time, specifically, step S13 is calculated through the following steps S131 to S133:

S131. Obtain the quantity of original quantum keys generated by the quantum key pool per unit time, recorded as the generated quantity X1, and the quantity of original quantum keys consumed by the quantum key pool per unit time, recorded as the consumed quantity X2;

S132. Calculate the difference between the generated quantity X1 and the consumed quantity X2;

S133. According to the difference and the unit time, calculate the net key generation rate of the quantum key pool:

△R=(X1-X2)/t;

Among them, ΔR is the net key generation rate, t is the unit time, and its value can be set and adjusted according to the actual situation.

Optionally, the quantity X2 of original quantum keys consumed by the quantum key pool per unit time is calculated according to the encrypted transmission requirements of all power services of the distribution network within the unit time. Consumption quantity X2 satisfies the following calculation formula:

表示采用第m种业务优先级的通信加密策略的电力业务所消耗的 总量子密钥量，其中，m为划分的业务优先级的数量。 in,

Indicates the total amount of quantum keys consumed by the power service using the communication encryption strategy of the m-th service priority, where m is the number of divided service priorities.

Taking the power business of the above three business priorities as an example, the consumption quantity Q2 satisfies the following calculation formula:

、

和

分别代表使用第一种业务优先级的通信加密策略的 第i个电力业务、使用第二种业务优先级的通信加密策略的第j个电力业务和使用第三种业 务优先级的通信加密策略的第k个电力业务所消耗的原始量子密钥量，y₁、y₂、y₃分别代表这 三种类型的电力业务的数量。 in,

,

and

respectively represent the i-th power business using the communication encryption strategy of the first business priority, the j-th power business using the communication encryption strategy of the second business priority, and the communication encryption strategy of the third business priority The amount of original quantum keys consumed by the kth power service, y ₁ , y ₂ , and y ₃ respectively represent the quantities of these three types of power services.

Usually, when the quantum key encryption is normal for the power business of the distribution network, the remaining key quantity in the key pool needs to fluctuate within a reasonable range, and the remaining quantity of the original quantum key in the quantum key pool The rate of increase and deceleration depends on the net key generation rate ΔR. When the net key generation rate ΔR is positive, the number of keys in the pool increases with time, otherwise it decreases. Therefore, in this embodiment of the present invention, a preset rate threshold R _set is set to characterize the net key generation rate, and the preset rate threshold R _set is greater than or equal to zero. Preferably, R _set =0.

When the net key generation rate satisfies ΔR≤R _set , it indicates that the number of original quantum keys generated in the current quantum key pool cannot meet the encrypted transmission requirements of all power services to be transmitted in the current distribution network. Therefore, it is necessary to Adjust the encrypted transmission process.

Specifically, when the net key generation rate is less than or equal to a preset rate threshold, it is judged whether the power service of the power distribution terminal currently has the power service of the preset type; It is a preset type of power business. For this preset type of power business, according to its communication encryption strategy, it is replaced by obtaining the recovered quantum key from the recovered key pool for encrypted transmission without consuming the quantum keys generated in the quantum key pool. Raw Quantum Key.

It can be understood that for power services that are not of the preset type, the original communication encryption strategy can still be used, and the generated original quantum key can be obtained from the quantum key pool for encrypted transmission.

Preferably, the preset type of electrical service is an electrical service whose service priority is lower than a first preset level threshold.

It should be noted that the first preset level threshold is preset, and its value may be determined according to the number of divisions of business priorities of electric power services in actual application situations, and is not specifically limited here.

Taking the power business of the above three business priorities as an example, the first preset level threshold can be set to 2, then for the power business of the first business priority and the second business level, when ΔR≤R _set is satisfied, The generated original quantum key can still be obtained from the quantum key pool for encrypted transmission; for the power business with the third business priority, it is replaced by obtaining the recycled quantum key from the recycled key pool for encrypted transmission.

The embodiment of the present invention provides a communication encryption method for power distribution terminals, which allocates different communication encryption strategies for power services with different business priorities between power distribution terminals, and obtains the original quantum key from the quantum key pool for encryption. Encrypted transmission, during the encrypted transmission process of power business, the used original quantum key is recovered and stored, and at the same time, the net key generation rate of the quantum key pool at the current moment is calculated in real time, when the net key is detected When the generation rate is less than or equal to the preset rate threshold, adjust the encryption transmission method for the power service, and obtain the recovery quantum key from the recovery key pool for encrypted transmission for the preset type of power service to be transmitted. Using the technical means of the embodiment of the present invention, different communication encryption strategies are assigned to power services with different business priorities, and the consumption of quantum keys and key update frequency of the communication encryption strategies corresponding to power services with low business priorities is relatively small , the communication encryption strategy corresponding to the high business priority power business consumes a larger quantum key and key update frequency, thereby reducing the amount of quantum keys that the low business priority power business needs to consume during encrypted transmission Compared with the one-time pad scheme that all power services adopt, the embodiment of the present invention can effectively alleviate the problem that the quantum key pool can not meet the normal transmission requirements of all power services due to the low rate of quantum key generation. On this basis, when it is detected that the net key generation rate is too low, the encrypted transmission process of some power services is adjusted to use the quantum key that has already been used for encryption, which can further save the use of the original quantum key. The power business with high business priority retains more original quantum keys, increases the net key generation rate of the quantum key pool, and avoids the failure to meet the normal transmission requirements of all power services between power distribution terminals due to insufficient quantum keys The problem is to ensure the normal transmission requirements and transmission efficiency of power services between power distribution terminals.

As a preferred implementation mode, the embodiment of the present invention is further implemented on the basis of the previous embodiment. Referring to FIG. 2, it is a schematic flow chart of generating and recovering the quantum key in the embodiment of the present invention. The generated and stored quantum keys are generated and stored through the following steps S21 to S22. To recover the quantum key:

S21. During the process of obtaining the original quantum key to encrypt and transmit the power service, check whether the encrypted transmission process of the power service is safe;

S22. When the encrypted transmission process is safe, obtain the first quantum key among the original quantum keys used in the encrypted transmission process as the recovered quantum key, and store it in the recovered key pool In; wherein, the first quantum key is obtained by dividing the original quantum key used by a preset division algorithm.

In the embodiment of the present invention, in order to ensure the application security of the used original quantum cryptography in the subsequent business encryption process, it is necessary to perform security verification on the recycled original quantum cryptography. Specifically, in the process of encrypting and transmitting the power services of the distribution network using the original quantum key generated by the quantum key pool, the controller is also used to detect the security of the encrypted transmission process. When the encrypted transmission is detected When the process is safe, the original quantum key used in the encrypted transmission process is recovered, and, more preferably, part of the quantum key (that is, the first quantum key) in the used original quantum key is recovered . When it is detected that the encrypted transmission process is not safe, the original quantum key used in the encrypted transmission process is discarded without recycling.

By adopting the technical means of the embodiment of the present invention, by recovering the original quantum key used after detecting the security of the encrypted transmission, the security of the subsequent business encrypted transmission process can be improved, and, by recovering part of the quantum key, it can The keys used in any two encrypted transmission processes are not exactly the same, which further improves the security of the encrypted transmission process.

Preferably, referring to FIG. 3 , it is a schematic diagram of the principle of generating and recovering the quantum key in the embodiment of the present invention, step S21, that is, in the process of obtaining the original quantum key for encrypted transmission of the power service, detecting the Whether the encrypted transmission process of the electric power business is safe, specifically includes steps S211 to S216:

S211. Before encrypting and transmitting the power service, divide the obtained original quantum key into the first quantum key and the second quantum key by using the split algorithm;

；其中，k1为第一量子密钥，k2为第二量子密钥，x为所传输的电 力业务的业务数据，

为预设的哈希函数； S212. Generate a detection tag according to the first quantum key, the second quantum key, and the transmitted power service

; Wherein, k1 is the first quantum key, k2 is the second quantum key, and x is the business data of the electric power business transmitted,

is the preset hash function;

S213. After encrypting and transmitting the power service, determine whether the service data is received by the power distribution terminal serving as the receiving end within a preset waiting period;

；其中，x’为接收到的业务数据； S214. If the power distribution terminal serving as the receiving end receives service data within the preset waiting time, generate a verification label according to the received service data

; Among them, x' is the received business data;

S215. When the detection tag is equal to the verification tag, determine that the encrypted transmission process of the electric power service is safe; when the detection tag is not equal to the verification tag, determine that the encrypted transmission process of the electric power service is not Safety;

S216. If the power distribution terminal serving as the receiving end does not receive the service data within the preset waiting time, determine that the encrypted transmission process of the power service is not safe.

，对于加密的业务数据x，

表示为AXU泛哈希函数。配电终端A 将字符串x‖t在传输信道C上发送给配电终端B，经过一段预定时间，判断配电终端B是否接 收到字符串x′‖t′后，若接收到该字符串，检查验证标签

是否与检 测标签tag相等，若相等，表明没有检测到非法监听，传输信道C的传输是安全的，则它在外 部接口接受并输出业务数据x′，并立即将配电终端A输出的密钥k1进行回收。若不相等，输 出错误符号nor，判定的传输过程是不安全的。如果经过预定时间未接收到该字符串，同样 输出错误符号nor，判定的传输过程是不安全的。 In the embodiment of the present invention, the original quantum key shared between the terminals (the power distribution terminal A as the sending end and the power distribution terminal B as the receiving end) is first divided into two parts k = k1∥k2, and they are used to generate a detection label tag,

, for encrypted business data x,

Expressed as an AXU universal hash function. Power distribution terminal A sends the string x‖t to power distribution terminal B on the transmission channel C. After a predetermined period of time, after judging whether power distribution terminal B has received the string x′‖t’, if it receives the string , check the authentication tab

Whether it is equal to the detection label tag, if it is equal, it indicates that no illegal interception has been detected, and the transmission of the transmission channel C is safe, then it accepts and outputs the business data x′ on the external interface, and immediately sends the key output by the power distribution terminal A k1 for recycling. If they are not equal, the error symbol nor is output, and the determined transmission process is unsafe. If the character string is not received after a predetermined time, the error symbol nor is also output, and the determined transmission process is unsafe.

It should be noted that the specific means of dividing the original quantum key k into the first quantum key k1 and the second quantum key k2 by using the preset segmentation algorithm are set according to the actual situation, which will not affect the beneficial effects obtained by the present invention .

Using the technical means of the embodiment of the present invention, by dividing the original quantum key into two parts, combined with the encrypted transmission business data, correspondingly generating detection labels and verification labels before and after transmission, to realize whether the encrypted transmission process is safe Judgment improves the accuracy of encryption security detection and ensures the usability of recovered quantum keys.

As a preferred implementation mode, the embodiment of the present invention is further implemented on the basis of any of the above-mentioned embodiments. In order to further improve the security of using the recovered quantum key for encrypted transmission, the embodiment of the present invention uses the recovered quantum key in the recovery key pool. Quantum keys optimize the process of encrypted transmission of power services.

In a preferred implementation manner, in step S14, the acquisition of the recovery quantum key from the recovery key pool encrypts and transmits the preset type of power services to be transmitted, specifically including steps S141a and S142a:

S141 a. Randomly obtain at least two recovered quantum keys in the recovered key pool;

S142a. Synthesize the at least two recovered quantum keys using a preset synthesis algorithm to obtain a combined quantum key, and use the combined quantum key to encrypt and transmit a preset type of power service to be transmitted.

In the embodiment of the present invention, for a preset type of power service to be transmitted, at least two recovered quantum keys are randomly obtained from the recovered key pool, and the at least two recovered quantum keys are synthesized, and then used Encrypted transmission of the power service.

It should be noted that the specific means of synthesizing at least two recovered quantum keys using a preset synthesis algorithm is set according to the actual situation, which will not affect the beneficial effects obtained by the present invention.

Using the technical means of the embodiment of the present invention, at least two recycled quantum keys are randomly obtained to synthesize a combined quantum key, and with a high probability, the combined quantum key is not used in the previous encryption process of the same power service The original quantum key, using the combined quantum key to encrypt and transmit subsequent services can further improve encryption security.

In another preferred implementation manner, in step S14, the acquisition of the recovery quantum key from the recovery key pool encrypts and transmits the preset type of power services to be transmitted, specifically including steps S141b and S142b:

S141b. Randomly obtain two recovered quantum keys in the recovered key pool as the first recovered quantum key and the second recovered quantum key;

S142b. After encrypting the service data of the power service of the preset type to be transmitted by using the first recovered quantum key, and then using the second recovered quantum key to encrypt the once-encrypted business data twice and transmit.

In the embodiment of the present invention, for a preset type of power service to be transmitted, two recovered quantum keys are randomly obtained from the recovered key pool, and one of the recovered quantum keys is used to encrypt the business data to be transmitted once, and then The encrypted data obtained after the first encryption is encrypted twice with another recovered quantum key to obtain the second encrypted data, and then the power distribution terminal at the sending end sends it to the power distribution terminal at the receiving end through the transmission channel.

Understandably, after receiving the twice-encrypted data, the power distribution terminal at the receiving end needs to perform one decryption, and then perform second decryption to obtain service data.

According to the technical means of the embodiment of the invention, the business data is encrypted twice by randomly obtaining two recovered quantum keys, which can further improve the security of the encryption, and largely avoid the use of the recovered quantum keys to encrypt the transmitted business data. vulnerable to eavesdropping.

As a preferred implementation mode, in order to further improve the security of encrypted transmission using the recovered quantum key, in the embodiment of the present invention, the recovered quantum key is based on the power of the business priority higher than the second preset level threshold It is generated by the original quantum key that has been used by the business during encrypted transmission.

It should be noted that the second preset level threshold is preset, and its value may be determined according to the number of divisions of business priorities of electric power services in an actual application situation, and is not specifically limited here.

Taking the power business of the above three business priorities as an example, the second preset level threshold can be set to 2, that is, only the original quantum key used in the encrypted transmission process for the power business of the first business priority For recovery, the original quantum key used in the encrypted transmission process for the second and third service priority power services is then discarded.

Optionally, in combination with the above-mentioned implementation manner, the power services whose business priority is higher than the second preset level threshold (for example, the power business with the first business priority) in the original quantum key that has been used in the encrypted transmission process Recycle the first quantum key, generate the recovered quantum key, and obtain the recovered quantum key pair service from the recovered key pool when it is detected that the net key generation rate of the quantum key pool is less than or equal to the preset rate threshold The power service to be transmitted whose priority is lower than the first preset level threshold (for example, the power service of the third service priority) is encrypted for transmission.

As a preferred implementation mode, the embodiment of the present invention further implements the method on the basis of any of the above embodiments and further includes step S15:

S15. When the net key generation rate is less than or equal to the preset rate threshold, encrypt the communication of each of the power services by reducing the encryption level and/or key update frequency of each of the power services Strategies are adjusted.

Specifically, step S15 includes:

S151. Acquire power services with a service priority greater than the third preset level threshold among the current power services to be transmitted, and use them as the first type of adjusted power services; The power business with a grade threshold is regarded as the second type of adjusted power business;

S152. Perform a first adjustment operation; the first adjustment operation includes: resetting the key update frequency of the first type of adjustment power service, and reducing the encryption level of the first type of adjustment power service by at least one level value , and, reducing the key update frequency of the second type of power adjustment service by at least one frequency adjustment step;

S153. After the first preset time period, judge whether the current adjustment success condition is met; wherein, the adjustment success condition is: the net key generation rate is greater than the second preset rate threshold R _set ', or the quantum The remaining quantum keys in the key pool are greater than the preset key quantity threshold; wherein, the second preset rate threshold R _set 'is greater than the preset rate threshold R _set ;

S154. If the condition for successful adjustment is met, reset the communication encryption policy of each electric power service;

S155. If the condition for successful adjustment is not met, perform a second adjustment operation, the second adjustment operation includes: reducing the key update frequency of the first type of adjusted power service by at least one frequency adjustment step, and resetting Setting the key update frequency of the second type of adjusted power service, and reducing the encryption level of the second type of adjusted power service by at least one level value;

S156. After a second preset period of time, determine whether the condition for successful adjustment is currently met;

S157. If the condition for successful adjustment is met, reset the communication encryption policy of each electric power service;

S158. If the condition for successful adjustment is not met, return to step S151 and re-execute the first adjustment operation.

Using the technical means of the embodiment of the present invention, when it is detected that the net key generation rate is less than or equal to the preset rate threshold, in addition to enabling the quantum key recovery mechanism, the encryption level and/or encryption Adjust the key update frequency to quickly increase the remaining number of original quantum keys in the quantum key pool, increase the net key generation rate, and ensure the normal transmission requirements and transmission efficiency of power services between power distribution terminals.

Referring to FIG. 4 , it is a schematic structural diagram of a communication encryption device for a power distribution terminal provided by an embodiment of the present invention. The embodiment of the present invention also provides a communication encryption device 30 for a power distribution terminal, including:

An encryption policy determination module 31, configured to determine a communication encryption policy for the power service according to the service priority of the power service to be transmitted between power distribution terminals;

The first encryption transmission module 32 is used to obtain the original quantum key from the quantum key pool to encrypt and transmit the power service according to the communication encryption strategy; wherein, the original quantum key is generated by the quantum key pool of unused quantum keys;

The net key generation rate calculation module 33 is used to calculate the net key generation rate of the quantum key pool in real time; difference in key consumption;

The second encryption transmission module 34 is used to obtain the recovery quantum key from the recovery key pool to encrypt and transmit the preset type of power service to be transmitted when the net key generation rate is less than or equal to the preset rate threshold ; Wherein, the recovery quantum key is generated according to the used original quantum key.

Using the technical means of the embodiment of the present invention, different communication encryption strategies are assigned to power services with different business priorities, and the quantum keys and key update frequencies consumed by different communication encryption strategies are different, reducing power services with low business priorities Compared with the one-time pad scheme used in all power services, the amount of quantum keys that need to be consumed in the encrypted transmission process, the embodiment of the present invention can effectively alleviate the low rate of quantum key generation by the quantum key pool, which cannot meet the requirements A matter of the normal transmission needs of all electricity services. On this basis, when it is detected that the net key generation rate is too low, the encrypted transmission process of some power services is adjusted to use the quantum key that has already been used for encryption, which can further save the use of the original quantum key. The power business with high business priority retains more original quantum keys, increases the net key generation rate of the quantum key pool, and avoids the failure to meet the normal transmission requirements of all power services between power distribution terminals due to insufficient quantum keys The problem is to ensure the normal transmission requirements and transmission efficiency of power services between power distribution terminals.

It should be noted that a communication encryption device for a power distribution terminal provided in an embodiment of the present invention is used to perform all the process steps of a communication encryption method for a power distribution terminal provided in any of the above-mentioned embodiments. The beneficial effects are one-to-one correspondence, and thus will not be repeated.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct related hardware, and the programs can be stored in a computer-readable storage medium. During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM) and the like.

The above description is a preferred embodiment of the present invention, and it should be pointed out that for those skilled in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications are also considered Be the protection scope of the present invention.

Claims (10)

1. A communication encryption method for a power distribution terminal is characterized by comprising the following steps:

determining a communication encryption strategy of the power service according to the service priority of the power service to be transmitted between the power distribution terminals;

according to the communication encryption strategy, an original quantum key is obtained from a quantum key pool to encrypt and transmit the power service; the original quantum key is an unused quantum key generated by a quantum key pool;

calculating the net key generation rate of the quantum key pool in real time; the net key generation rate is the difference between the quantum key generation amount and the quantum key consumption amount of the quantum key pool in unit time;

when the net secret key generation rate is smaller than or equal to a preset rate threshold value, acquiring a recovery quantum secret key from a recovery secret key pool to carry out encryption transmission on a preset type of electric power service to be transmitted; wherein the recovered quantum key is generated from the used original quantum key.

2. The communication encryption method for the power distribution terminal according to claim 1, wherein the higher the service priority of the power service is, the higher the encryption level and the key update frequency of the corresponding communication encryption policy are; wherein the encryption level has a positive correlation with the quantum key amount used for transmitting the power service.

3. The communication encryption method for the power distribution terminal according to claim 2, wherein the predetermined type of power traffic is power traffic having a traffic priority lower than a first predetermined level threshold.

4. The communication encryption method for the power distribution terminal according to claim 1, wherein the recycling quantum key is generated and stored by:

detecting whether the encryption transmission process of the power business is safe or not in the process of obtaining the original quantum key to carry out encryption transmission on the power business;

when the encryption transmission process is safe, acquiring a first quantum key in original quantum keys used in the encryption transmission process as the recovery quantum key, and storing the first quantum key in the recovery key pool; the first quantum key is obtained by dividing the used original quantum key through a preset segmentation algorithm.

5. The communication encryption method for the power distribution terminal according to claim 4, wherein in the process of obtaining the original quantum key to encrypt and transmit the power service, whether the encryption transmission process of the power service is safe is detected, specifically:

before the power business is encrypted and transmitted, dividing the obtained original quantum key into the first quantum key and the second quantum key by adopting the segmentation algorithm;

generating a detection tag from the first quantum key, the second quantum key, and the transmitted power traffic

(ii) a Wherein k1 is a first quantum key, k2 is a second quantum key, x is service data of the transmitted power service,

is a preset hash function;

after the power service is encrypted and transmitted, whether a power distribution terminal serving as a receiving end receives service data within a preset waiting time is judged;

if yes, generating a verification label according to the received service data

(ii) a Wherein x' is the received service data;

when the detection tag and the verification tag are equal, judging that the encryption transmission process of the power service is safe, and when the detection tag and the verification tag are not equal, judging that the encryption transmission process of the power service is unsafe;

and if not, judging that the encryption transmission process of the power service is unsafe.

6. The communication encryption method for the power distribution terminal according to claim 1, wherein the obtaining the recycling quantum key from the recycling key pool encrypts and transmits a preset type of power service to be transmitted, and specifically includes:

randomly acquiring at least two recovery quantum keys in the recovery key pool;

and synthesizing the at least two recovered quantum keys by adopting a preset synthesis algorithm to obtain a combined quantum key, and encrypting and transmitting the preset type of power service to be transmitted by adopting the combined quantum key.

7. The communication encryption method for the power distribution terminal according to claim 4, wherein the obtaining of the recycling quantum key from the recycling key pool performs encrypted transmission on a preset type of power service to be transmitted, and specifically includes:

randomly acquiring two recovered quantum keys in the recovered key pool as a first recovered quantum key and a second recovered quantum key;

and after the first recovery quantum key is adopted to encrypt the service data of the preset type of power service to be transmitted for the first time, the second recovery quantum key is adopted to encrypt the service data after the first encryption for the second time and transmit the service data.

8. The communication encryption method for the power distribution terminal according to claim 3, wherein the recovered quantum key is generated according to an original quantum key that has been used in the encryption transmission process by the power service with the service priority higher than the second preset level threshold.

9. The communication encryption method for the power distribution terminal according to claim 2, wherein when the net key generation rate is equal to or less than the preset rate threshold, the method further comprises:

and adjusting the communication encryption strategy of each power service by reducing the encryption grade and/or the key updating frequency of each power service.

10. A communication encryption apparatus for a power distribution terminal, comprising:

the encryption strategy determining module is used for determining a communication encryption strategy of the power service according to the service priority of the power service to be transmitted between the power distribution terminals;

the first encryption transmission module is used for acquiring an original quantum key from a quantum key pool according to the communication encryption strategy to encrypt and transmit the power service; the original quantum key is an unused quantum key generated by a quantum key pool;

the net key generation rate calculation module is used for calculating the net key generation rate of the quantum key pool in real time; the net key generation rate is the difference between the quantum key generation amount and the quantum key consumption amount of the quantum key pool in unit time;

the second encryption transmission module is used for acquiring a recovery quantum key from a recovery key pool to carry out encryption transmission on the preset type of power service to be transmitted when the net key generation rate is less than or equal to a preset rate threshold; wherein the recovered quantum key is generated from the used original quantum key.

Images