CN111343164A - Data encryption method and device applied to electric energy meter and storage medium - Google Patents

Abstract

The present application discloses a data encryption method, device and storage medium applied to an electric energy meter, including: obtaining a public key ciphertext, and decrypting the public key ciphertext with an authentication public key to obtain a public key of a management module. Then use the public key to encrypt the random number generated by the random number generator to obtain a random number ciphertext, and send it to the management module, so that the management module can decrypt the random number ciphertext with its own private key to obtain a random number for encryption. Synchronization of keys. Finally, the communication data is encrypted or decrypted by using the random number as the encryption key. It can be seen that the data volume of the public key and random number of the management module is small, so they are asymmetrically encrypted, which can overcome the problem of large amount of calculation, and has high security; while the data volume of communication data is large , so it is symmetrically encrypted, and the encryption key used is a random number, so it does not need a large database for key management, which can overcome the problem that the power company needs to add a large database for key management.

Description

A data encryption method, device and storage medium applied to an electric energy meter

technical field

The present application relates to the field of electric power technology, and in particular, to a data encryption method, device and storage medium applied to an electric energy meter.

Background technique

The electric energy meter in this application mainly refers to multi-core and multi-module smart electric energy meters, which may include but are not limited to IR46 electric energy meters. It is composed of electric energy meters to realize functions such as electric energy measurement, data processing, real-time monitoring, automatic control and information interaction.

The IR46 standard divides the software into legal measurement software and illegal measurement software. It clearly states that the electric energy meter should be able to protect legal measurement information and isolate the measurement and non-measurement parts from each other. If the metering part needs to communicate with the non-metering part, a specific communication interface should be set, and all information should be transmitted through this interface. Therefore, the metering module and the management module of the current electric energy meter are physically separated. FIG. 1 is a structural diagram of an IR46 multi-core and multi-module smart energy meter provided in the prior art. As shown in Figure 1, the electric energy meter includes a communication module, a metering module and a management module. Among them, the metering module has a metering MCU, which is used to provide legal data such as basic electric energy, instantaneous electric energy, clock, etc., and save the basic total electric energy every minute; the management module has a management MCU to manage the total electric energy of the module (including: forward active power, reverse active power, I/II/III/IV quadrant reactive total energy, etc.), the clock is based on the metering module and is synchronized in real time. For the brevity of the application documents, the specific structures of the communication module, the management module and the metering module in FIG. 1 will not be repeated, and reference may be made to the prior art.

The physical separation scheme is more conducive to testing and problem tracing, but the risk is that the data transmitted between the dual cores (the metering MCU and the management MCU) is more likely to be intercepted and tampered with. Therefore, a set of data security and confidentiality algorithms is required between the dual cores of the electric energy meter.

In the prior art, there are the following three schemes:

Scheme 1: The data between the two cores is transmitted in plain text, and the receiving end (the management module and the metering module can both be used as the receiving end, and the other party is the sending end) is verified by the received data communication protocol link protocol format as the legal data. If the data frame received by the receiving end conforms to the link protocol format, the data is considered valid; otherwise, the data is invalid. FIG. 2 is a schematic diagram of a man-in-the-middle attack process provided in the prior art. Among them, the sender sends plaintext data to the receiver, which is intercepted. After tampering with the intercepted plaintext data, the obtained data is repackaged and sent to the receiver. However, the receiving end does not know that the obtained data has been tampered with, so it is processed according to the normal processing flow, resulting in security risks.

Option 2: The symmetric encryption and decryption algorithm is used to protect the communication data transmission between the dual cores. The management module and the metering module save the symmetric encryption algorithm key respectively.

Option 3: Asymmetric encryption and decryption algorithm is used to protect communication data transmission between the dual cores. The management module and the metering module respectively store the encryption and decryption public key and private key of the asymmetric encryption algorithm. All communication data between the dual cores adopts asymmetric encryption. Post-algorithm transmission.

Although the above three schemes can ensure the security of communication data to a certain extent, they all have certain shortcomings. The specific shortcomings are as follows:

Disadvantage of scheme 1: Since the dual-core physical separation scheme is adopted, and the communication protocol between the dual-core links is open, therefore, if the third-party illegal intermediary intercepts the communication data by illegal means and makes modifications, the communication protocol between the dual-core links is reused. After the format is combined and sent to the receiving end, the receiving end cannot know whether the data source is legal or not. Once the data is processed as legal data, it is very likely to cause abnormal energy meter data and operation, affecting legal measurement, and measuring data error failure.

Disadvantage of scheme 2: The power company needs to manage the encryption key of the electric energy meter in a large database. When the management module is damaged and needs to be replaced, the electric power company needs to obtain the encryption key between the two cores of the electric energy meter by obtaining the asset information of the electric energy meter. After the key is set to the new management module, the new management module can be used to replace the fault management module. Because the key database management is complex and once the management module needs to be replaced on site, the operation and maintenance workload is huge and the operation is inconvenient.

Disadvantages of scheme 3: First of all, asymmetric encryption and decryption is very time-consuming, and it is not suitable to transmit a large amount of data, which affects the transmission efficiency of communication between two cores; When the on-site management module is damaged and needs to be replaced, the power company needs to obtain the energy meter management module key by obtaining the energy meter asset information and then set it to the new management module. After that, the new management module can be used to replace the fault management module. Group. Because the key database management is complex and once the management module needs to be replaced on site, the operation and maintenance workload is huge and the operation is inconvenient.

It can be seen that the above three data security and confidentiality algorithms have defects in the field implementation process, and cannot fundamentally solve the data transmission security problem. Therefore, how to ensure the security of the communication data between the two cores of the electric energy meter is a matter for those skilled in the art. Problems to be solved.

SUMMARY OF THE INVENTION

The purpose of this application is to provide a data encryption method, device and storage medium applied to an electric energy meter, which are used to ensure the secure transmission of communication data between two cores, and do not require the large database management required by the symmetric encryption algorithm, and also avoid the need for The problem of large amount of calculation caused by asymmetric encryption algorithm.

In order to solve the above-mentioned technical problems, the present application provides a data encryption method applied to an electric energy meter, applied to a metering module, and the method includes:

Initiating an acquisition request to the management module to obtain the public key ciphertext of the management module; wherein the public key ciphertext is obtained by encrypting the public key of the management module with the authentication private key of the authentication terminal;

Decrypting the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module;

Trigger the random number generator to generate random numbers;

The random number is encrypted by the public key of the management module to obtain a random number ciphertext, and sent to the management module so that the management module can use the private key of the management module to encrypt the random number. Decrypt the ciphertext to obtain the random number;

When a communication data transmission request is generated, the communication data is encrypted or decrypted by using the random number as an encryption key.

Preferably, when acquiring the public key ciphertext of the management module, the method further includes:

Obtain the digital signature certificate of the management module; wherein, the digital signature certificate is generated by the authentication terminal and sent to the management module;

Perform signature verification on the digital signature certificate according to the authentication public key, and determine whether the signature verification is passed;

If yes, enter the step of decrypting the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module.

Preferably, the public key ciphertext obtained by encrypting the public key of the management module with the authentication private key of the authentication terminal specifically includes:

obtaining, by the authentication terminal, the public key of the management module;

The authentication terminal encrypts the public key of the management module through the authentication private key to obtain the public key ciphertext;

The generation of the digital signature certificate by the authentication terminal specifically includes:

performing a hash operation on the public key ciphertext to obtain a public key ciphertext digest;

Encrypt the public key ciphertext digest with the authentication private key to obtain the digital signature;

A digital signature certificate is formed by the public key ciphertext and the digital signature.

Preferably, when the communication data transmission request is to send data, it further includes:

Accumulate and check the communication data.

Preferably, initiating the acquisition request to the management module is specifically: initiating the acquisition request when the metering module detects power-on or detects that the management module is replaced.

In order to solve the above-mentioned technical problems, the present application provides a data encryption method applied to an electric energy meter, applied to a management module, and the method includes:

Send the public key ciphertext of the management module to the metering module according to the acquisition request initiated by the metering module; wherein, the public key ciphertext is paired with the public key of the management module through the authentication private key of the authentication terminal encrypted;

Receive the random number ciphertext sent by the metering module; wherein, the random number ciphertext is obtained by the metering module encrypting the random number generated by the random number generator with the public key of the management module, so The public key of the management module is obtained by the metering module decrypting the public key ciphertext with the authentication public key of the authentication terminal;

Decrypt the random number ciphertext through the private key of the management module to obtain the random number;

When a communication data transmission request is generated, the communication data is encrypted or decrypted by using the random number as an encryption key.

Preferably, when the private key of the management module and the public key of the management module are stored in the off-chip memory, it also includes:

The private key of the management module and the public key of the management module are encrypted.

In order to solve the above-mentioned technical problems, the present application provides a data encryption device applied to an electric energy meter, applied to a metering module, and the device includes:

a request module, configured to initiate an acquisition request to the management module to obtain the public key ciphertext of the management module; wherein, the public key ciphertext is paired with the public key of the management module through the authentication private key of the authentication terminal encrypted;

a decryption module for decrypting the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module;

The trigger module is used to trigger the random number generator to generate random numbers;

The encryption module is used to encrypt the random number through the public key of the management module to obtain a random number ciphertext, and send it to the management module so that the management module can pass the private key of the management module. decrypting the random number ciphertext with the key to obtain the random number;

The transceiver module is used for encrypting or decrypting the communication data by using the random number as an encryption key when a communication data transmission request is generated.

In order to solve the above technical problems, the present application provides a data encryption device applied to an electric energy meter, applied to a management module, and the device includes:

A sending module, configured to send the public key ciphertext of the management module to the metrology module according to an acquisition request initiated by the metering module; wherein, the public key ciphertext is used for the management of the management module through the authentication private key of the authentication terminal. The public key of the module is encrypted;

A receiving module, configured to receive the random number ciphertext sent by the metering module; wherein, the random number ciphertext is a random number generated by the metering module using the public key of the management module to the random number generator Encrypted to obtain, the public key of the management module is obtained by the metering module decrypting the public key ciphertext with the authentication public key of the authentication terminal;

a decryption module, configured to decrypt the random number ciphertext through the private key of the management module to obtain the random number;

The transceiver module is used for encrypting or decrypting the communication data by using the random number as an encryption key when a communication data transmission request is generated.

In order to solve the above technical problems, the present application provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the data applied to the electric energy meter as described above is realized. The steps of the encryption method.

The data encryption method applied to the electric energy meter provided by this application is realized by the metering module, and specifically includes: initiating an acquisition request to the management module to acquire the public key ciphertext of the management module; after obtaining the public key ciphertext, Decrypt the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module. Then encrypt the random number generated by the random number generator with the public key of the management module to obtain the random number ciphertext, and send it to the management module, so that the management module can decrypt the random number ciphertext through the private key of the management module Obtain random numbers to synchronize encryption keys. Finally, when a communication data transmission request is generated, the communication data is encrypted or decrypted by using the random number as an encryption key. It can be seen that in this technical solution, the data volume of the public key and random number of the management module is small, so asymmetric encryption is performed on them, which can overcome the problem of large amount of calculation caused by asymmetric encryption, and is more secure. The communication data has a large amount of data, so it is symmetrically encrypted, and the encryption key used in the symmetrical encryption is a random number, which is randomly generated, so there is no need to manage a large database, so it can overcome the symmetry Encryption algorithms need to manage the problem of large databases.

Description of drawings

In order to describe the embodiments of the present application more clearly, the following will briefly introduce the drawings that are used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application, which are not relevant to ordinary skills in the art. As far as personnel are concerned, other drawings can also be obtained from these drawings on the premise of no creative work.

Fig. 1 is the structure diagram of a kind of IR46 multi-core multi-module smart electric energy meter provided by the prior art;

2 is a schematic diagram of a man-in-the-middle attack process provided in the prior art;

3 is a flowchart of a data encryption method applied to an electric energy meter provided by an embodiment of the present application;

4 is a schematic diagram of an algorithm encapsulation library provided by an embodiment of the present application;

5 is a schematic diagram of an off-chip memory of an MCU storing an asymmetric encryption key according to an embodiment of the present application;

6 is a schematic diagram of generating a digital signature certificate according to an embodiment of the present application;

7 is a schematic diagram of digital signature verification performed by a metering module provided in an embodiment of the present application;

8 is a flowchart of another data encryption method applied to an electric energy meter provided by an embodiment of the present application;

9 is a schematic diagram of interaction between a metering module and a management module according to an embodiment of the present application;

10 is a structural diagram of a data encryption device applied to an electric energy meter provided by an embodiment of the application;

FIG. 11 is a structural diagram of another data encryption device applied to an electric energy meter provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative work fall within the protection scope of the present application.

The core of the present application is to provide a data encryption method, device and storage medium applied to an electric energy meter.

In order to make those skilled in the art better understand the solution of the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

This application involves two encryption algorithms, one is a symmetric encryption algorithm and the other is an asymmetric encryption algorithm.

Symmetric encryption refers to an algorithm that uses the same key for encryption and decryption. It requires the sender and receiver to agree on a symmetric key before securely communicating. The security of symmetric algorithms is completely dependent on the key, and the leakage of the key means that anyone can decrypt the messages they send or receive, so the secrecy of the key is critical to communication.

Symmetric encryption is further divided into two modes: stream encryption and block encryption. Stream encryption treats a message as a stream of bytes and uses mathematical functions to act on each byte individually. When using stream encryption, the same plaintext bits are converted into different ciphertext bits each time it is encrypted. Stream encryption uses a keystream generator, which generates a stream of bytes that is XORed with the plaintext throttle to generate ciphertext. Block encryption divides a message into several blocks, which are then processed through a mathematical function, one block at a time. Assuming that a 64-bit block cipher is used, if the message length is 640 bits, it will be divided into 10 64-bit blocks (if the length of the last block is less than 64 bits, it will be added to 64 bits after padded with 0s), Each packet is processed with a series of mathematical formulas, resulting in 10 encrypted text packets. Then, send the ciphertext message to the peer. The opposite end must have the same block cipher, decrypt the 10 ciphertext blocks in reverse order using the previous algorithm, and finally obtain the plaintext message. The more commonly used block encryption algorithms are DES, 3DES, and AES. Among them, DES is an older encryption algorithm that has now been proven to be insecure. 3DES is a transitional encryption algorithm, which is equivalent to performing triple operations on the basis of DES to improve security, but it is essentially the same as the DES algorithm. AES is an alternative to the DES algorithm and is one of the most secure symmetric encryption algorithms.

Advantages of symmetric encryption algorithm: small amount of calculation, fast encryption speed, high encryption efficiency; disadvantages of symmetric encryption algorithm: (1) both parties use the same key, and the security cannot be guaranteed; (2) every time symmetric encryption is used When performing an algorithm, it is necessary to use a unique key that others do not know, which will make the number of keys possessed by both parties to send and receive information increase exponentially, and key management becomes a burden.

Asymmetric encryption algorithm

Before the advent of asymmetric key exchange algorithms, the main drawback of symmetric encryption was that it did not know how to transmit the symmetric key between the two communicating parties without allowing the middleman to steal it. After the birth of the asymmetric key exchange algorithm, the encryption and decryption of the symmetric key transmission is specially performed, which makes the interactive transmission of the symmetric key very secure.

The asymmetric key exchange algorithm itself is very complex. The key exchange process involves a series of extremely complex processes such as random number generation, modular exponentiation, blank filling, encryption, signature, etc. Common key exchange algorithms include RSA, ECDHE , DH, DHE and other algorithms. involves more complex mathematical problems. Among them, the most classic and the most commonly used is the RSA algorithm.

RSA: Born in 1977, after a long period of crack testing, the algorithm is very secure, and most importantly, the algorithm implementation is very simple. The disadvantage is that a relatively large prime number (2048 bits is commonly used at present) is required to ensure the security strength, which consumes CPU computing resources extremely. RSA is currently the only algorithm that can be used for both key exchange and certificate signing. RSA is the most classic and the most commonly used asymmetric encryption and decryption algorithm.

Asymmetric encryption is more secure than symmetric encryption, but it also has two fatal shortcomings:

(1) The consumption of CPU computing resources is very large. The computational complexity of symmetric encryption is only 0.1% of that of asymmetric encryption. If the subsequent application layer data transmission process also uses asymmetric encryption and decryption, the CPU performance overhead is too large, and the server cannot bear it at all. The experimental data given by Symantec shows that the CPU resources consumed by the asymmetric algorithm are more than 1000 times that of the symmetric algorithm when encrypting and decrypting the same number of files.

(2) The asymmetric encryption algorithm has restrictions on the length of the encrypted content, which cannot exceed the length of the public key. For example, the length of the commonly used public key is 2048 bits, which means that the content to be encrypted cannot exceed 256 bytes.

Therefore, asymmetric encryption and decryption (extremely consuming CPU resources) can only be used for symmetric key exchange or EPCA signature at present, and is not suitable for encryption and decryption of application layer content transmission.

It should be noted that the technical solution in this application uses both a symmetric encryption algorithm, such as encrypting or decrypting communication data by using a random number as an encryption key, and an asymmetric encryption algorithm, for example, by authenticating the private key pair. The public key of the management module is encrypted, and then the ciphertext of the public key of the management module is decrypted through the authentication public key.

This application describes an embodiment of a data encryption method applied to an electric energy meter from two different execution bodies, one with a metering module as the execution body, and the other with a management module as the execution body. The two processes correspond to each other.

FIG. 3 is a flowchart of a data encryption method applied to an electric energy meter according to an embodiment of the present application. As shown in Figure 3, the method is applied to a metering module, and specifically includes the following steps:

S10: Initiating an acquisition request to the management module to acquire the public key ciphertext of the management module; wherein, the public key ciphertext is obtained by encrypting the public key of the management module with the authentication private key of the authentication terminal.

S11: Decrypt the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module.

S12: Trigger the random number generator to generate random numbers.

S13: Encrypt the random number with the public key of the management module to obtain the random number ciphertext, and send it to the management module so that the management module decrypts the random number ciphertext through the private key of the management module to obtain the random number.

S14: When a communication data transmission request is generated, use a random number as an encryption key to encrypt or decrypt the communication data.

FIG. 4 is a schematic diagram of an algorithm packaging library provided by an embodiment of the present application. It should be noted that the various programs and related algorithms involved in this application document can be implemented by the LIB library. Specifically, the related algorithms in the LIB library are EPCA (Electric Power Company Digital Signature Certificate Authority: Electric Power Certificate Authority, EPCA for short) is private and is encapsulated as a LIB library after anti-decompilation and obfuscation treatment. EPCA provides the LIB library to electric energy meter manufacturers and provides API interface description files; the step-by-step steps are as follows:

1) Library function generation;

2) Anti-decompilation and obfuscation design processing of library functions;

3) The library function is encapsulated to form a .lib file (the LIB library in the full text is the .lib file);

4) The LIB library is released by EPCA to various electric energy meter manufacturers.

The management module supply manufacturer embeds the LIB library in the main control chip (MCU) or security chip of the management module. When the LIB library is used, the MCU of the management module directly calls the API functions in the LIB library; if the security chip inside the management module is used to embed the LIB library, the MCU of the management module communicates with the security chip through the physical data bus and calls the functions in the security chip. Embed API functions in the LIB library.

FIG. 5 is a schematic diagram of storing an asymmetric encryption key in an off-chip memory of an MCU according to an embodiment of the present application. A pair of asymmetric encryption keys are embedded in the management module, which are the public key KEY_M of the management module and the private key KEY_M' of the management module, which are generated by the management module manufacturer calling the asymmetric encryption algorithm key in the LIB library. The public key KEY_M of the management module and the private key KEY_M' of the management module are delivered to the management module during production, and the management module can store the asymmetric encryption key in the on-chip memory of the management module MCU or the on-chip of the MCU. In the external memory, and meet the following three points:

1) If the asymmetric encryption key is stored in the off-chip memory of the MCU, the MCU calls the out-of-order algorithm in the LIB library to execute the out-of-order algorithm for the key to be saved and saves it in the off-chip memory of the MCU. For example, if the public key of the management module is X and the private key of the management module is X' before the out-of-order algorithm is executed, after the out-of-order algorithm is executed, the public key of the management module in the off-chip memory becomes Y, and the management module The private key of the group becomes Y'. If Y and Y' are illegally intercepted, after Y' is encrypted or a digital signature is generated, Y cannot be decrypted correctly or the signature is verified successfully; after Y encryption, Y' cannot be decrypted correctly. When it needs to be used, after the MCU obtains Y and Y' in the off-chip memory through the bus, X and X' can be inversely calculated through the positive sequence algorithm.

2) If the asymmetric encryption key is stored in the off-chip memory of the MCU, the MCU calls the obfuscation algorithm in the LIB library to execute the obfuscation algorithm for the key to be saved and then saves it to the off-chip memory of the MCU. For example, if the public key is X and the private key is X' before the obfuscation algorithm is executed, after the obfuscation algorithm is executed, the public key in the memory becomes Y, and the private key becomes Y'. If Y and Y' are illegally intercepted, after Y' is encrypted or a digital signature is generated, Y cannot be decrypted correctly or the signature is verified successfully; after Y encryption, Y' cannot be decrypted correctly. When it needs to be used, after the MCU obtains Y and Y' in the off-chip memory through the bus, X and X' can be obtained through the operation of the obfuscation reduction algorithm.

3) If the asymmetric encryption key is stored in the on-chip memory of the MCU, the key can only be accessed through the MCU on-chip program or data bus, and the off-chip devices that do not support the MCU can read the encryption key through IO and peripheral bus. key.

The metering module supply manufacturer embeds the LIB library in the metering module main control chip or metering chip, SOC and other metering module accessory chips. When the encryption key synchronization and data encryption and decryption operations are performed between the two cores, if the metering module is used When the group's MCU is embedded in the LIB library, the MCU directly calls the API functions in the LIB library; if the measurement module's internal measurement chip, SOC and other measurement module accessory chips are used to embed the LIB library, the MCU communicates with the measurement chip or SOC through the physical data bus. After the accessory chip communicates, call the API function in the embedded LIB library of the accessory chip.

The authentication terminal refers to the device used by EPCA to communicate directly with the metering module or management module, which can be the encryption machine of the metering center, the meter inspection table, or the power main station equipment. The authentication public key is transmitted by the authentication terminal, so it is called the authentication public key of the authentication terminal in this application, which represents EPCA. The authentication public key is pre-stored in the metering module, and the authentication public key in the metering module includes: The initialization assignment operation is divided into two steps, namely:

1) During the production process of the metering module, the initial certification public key is the test key published by EPCA, and the key pairing is used in the verification process of the power supply energy meter;

2) After the supply verification of the metering module is completed, the authentication public key will be set as the official key during on-site operation. After leaving the factory, the authentication public key can only be set once in the life cycle of the IR46 electric energy meter metering module, which will be verified by EPCA. Set up in a safe environment such as a room.

The basic functions of the management module, the metering module and the authentication terminal are described in the above steps, and each step in the data encryption process will be described in detail below.

As mentioned above, the metering module has stored the authentication public key. The authentication terminal encrypts the public key of the management module through the authentication private key to obtain the public key ciphertext, and transmits it to the management module. This public key is secure. The management module stores the public key ciphertext corresponding to its public key. The metering module needs to generate subsequent encryption keys through the public key of the management module. Therefore, the metering module needs to know the public key of the management module, and The metering module has the authentication public key, and the public key ciphertext is encrypted by the authentication private key, so the metering module only needs to obtain the public key ciphertext to obtain the public key of the management module. Specifically, the metering module actively initiates an acquisition request to the management module. The corresponding content of the request is to acquire the public key ciphertext. After obtaining the public key ciphertext, the pre-stored authentication public key of the authentication terminal is used to obtain the ciphertext. After asymmetric decryption, the public key itself is obtained. It is understandable that since the third party cannot obtain the authentication public key of the authentication terminal, even if intercepted by the third party, the public key of the management module cannot be obtained, thus ensuring the security of the public key of the management module. Moreover, in this process, the asymmetric encryption method is used, which has high security performance, and the public key is much smaller than the communication data, so the time consumed in the encryption and decryption process is limited. , it will not significantly affect the efficiency of communication. It can be understood that, in order to reduce unnecessary communication, the metering module initiating an acquisition request to the management module is specifically: initiating an acquisition request when the metering module detects that it is powered on or detects that the management module is replaced.

A random number generator is added to the metering module. The function of the random number generator is to generate random numbers. The reason why we choose to generate random numbers instead of a fixed number is to consider that in the subsequent symmetric encryption process, the communication data can be guaranteed. safety. Because the random number is used as the encryption key in the symmetric encryption algorithm to encrypt the communication data symmetrically, the security of the random number needs to be ensured when it is transmitted to the management module. Therefore, after obtaining the random number, the metering module performs asymmetric encryption on the random number with the obtained public key of the management module to obtain the random number ciphertext. It is more secure to transmit random number ciphertext than to transmit random number directly. After the management module obtains the random number ciphertext, it asymmetrically decrypts the random number ciphertext through its private key, thereby obtaining the random number. So far, the management module and the metering module have realized the synchronization of the encryption keys. When a communication data transmission request is generated between the management module and the metering module, the two can encrypt or decrypt the communication data by using a random number as an encryption key. In one scenario, the management module is used as the sender and the metering module is used as the receiver. The management module encrypts the communication data with random numbers to obtain the ciphertext of the communication data, and then sends it to the measurement module. After obtaining the ciphertext of the communication data, the metering module decrypts it with a random number to obtain the plaintext of the communication data. It can be understood that, for the management module and the metering module, both can be used as a sender and a receiver, so correspondingly, both can encrypt and decrypt the communication data.

The data encryption method applied to the electric energy meter provided in this embodiment is implemented by the metering module, and specifically includes: initiating an acquisition request to the management module to acquire the public key ciphertext of the management module; after obtaining the public key ciphertext, Decrypt the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module. Then encrypt the random number generated by the random number generator with the public key of the management module to obtain the random number ciphertext, and send it to the management module, so that the management module can decrypt the random number ciphertext through the private key of the management module Obtain random numbers to synchronize encryption keys. Finally, when a communication data transmission request is generated, the communication data is encrypted or decrypted by using the random number as an encryption key. It can be seen that in this technical solution, the data volume of the public key and random number of the management module is small, so asymmetric encryption is performed on them, which can overcome the problem of large amount of calculation caused by asymmetric encryption, and is more secure. The communication data has a large amount of data, so it is symmetrically encrypted, and the encryption key used in the symmetrical encryption is a random number, which is randomly generated, so there is no need to manage a large database, so it can overcome the symmetry Encryption algorithms need to manage the problem of large databases.

On the basis of the above embodiment, as a preferred implementation manner, when the metering module acquires the public key ciphertext of the management module, it further includes:

Obtain the digital signature certificate of the management module;

The digital signature certificate is verified according to the authentication public key, and it is judged whether the verification is passed, and if yes, the process goes to step S11.

In this implementation, the metering module obtains the public key digital signature certificate of the management module when initiating the obtaining request. The role of the digital signature certificate is to verify the legitimacy of the management module. Specifically, the digital signature certificate is generated by the authentication terminal and sent to the management module.

Through the use of the digital signature certificate in this embodiment, the security of data transmission between the two-core communication can be further improved.

In order to make the solution more clear to those skilled in the art, the generation and issuance process of the digital signature certificate will be described. FIG. 6 is a schematic diagram of generating a digital signature certificate according to an embodiment of the present application.

1) The generation process of the digital signature certificate

During the supply verification process of the IR46 energy meter management module, EPCA performs the following steps in a safe environment such as the verification room:

S100: The authentication terminal obtains the public key (KEY_M) of the management module;

S101: The authentication terminal uses the authentication private key to encrypt the public key (KEY_M) of the management module to obtain the public key ciphertext C_KEY_M;

S102: The authentication terminal uses a hash function to perform a hash operation on the public key ciphertext C_KEY_M to generate a public key ciphertext digest;

S103: The authentication terminal then uses the authentication private key to invoke a digital signature algorithm on the public key ciphertext digest to encrypt the public key ciphertext digest to obtain a digital signature.

S104: The authentication terminal composes a digital signature certificate by using the public key ciphertext and the digital signature.

2) Issuing process of digital signature certificate

The issuance of the digital signature certificate is exclusively performed by the EPCA organization, and EPCA conducts security certification through the embedded security control module (ESAM) through the authentication terminal and the management module;

The authentication terminal sends the generated digital signature certificate of the management module to the management module after encrypting and signing by ESAM ciphertext and MAC;

The management module performs ESAM decryption and signature verification after receiving the ciphertext and MAC data;

If the decryption and signature verification of the management module is successful, the current digital signature certificate is received and stored in the non-volatile memory; otherwise, it is discarded and an error is reported.

FIG. 7 is a schematic diagram of digital signature verification performed by a metering module according to an embodiment of the present application. On the metering module side, the verification of the digital signature certificate needs to be verified by the authentication public key pre-stored by the metering module, including the following steps:

S110: Whether the metering module detects power-on or replacement of the management module, if so, enter S111;

S111: Obtain a digital signature certificate;

S112: Use the authentication public key to verify the digital signature certificate, and determine whether the verification is passed, if so, go to S113, otherwise, go to S114;

S113: Receive a digital signature certificate.

S114: An error is reported.

It is understandable that if the signature verification can be passed, it means that the public key ciphertext obtained together is also valid, and if the signature verification fails, it means that the public key ciphertext acquired together is also invalid, and is directly discarded. It can be understood that, if the signature verification is passed, it is sufficient to continue to perform S11 and subsequent steps, which will not be repeated in this embodiment.

On the basis of the above embodiment, when the communication data transmission request is to send data, it also includes:

Accumulate and check the communication data.

It should be noted that it is possible to perform accumulation and verification on the communication data first or to encrypt the communication data line, which does not affect the implementation of the solution of the present application.

For the key interactive data between the two cores, the types of communication data include: key parameters such as operating parameters, electrical energy, clock, instantaneous quantity, and operating state quantity. For example: Assume that the communication data of the sender is X, which becomes Y after symmetric encryption, but some data bits of Y are shifted due to bus interference during the transmission process, resulting in the ciphertext data received by the receiver. If Z is entered, when the receiver uses the same symmetric encryption algorithm and encryption key as the sender to decrypt, the correct data X cannot be obtained.

In order to solve this problem, we use the communication data to calculate the cumulative sum SUM, encrypt the communication data and SUM together and transmit it. When the server receives the ciphertext data, it decrypts and uses the plaintext communication data to recalculate the checksum CHECK_SUM, and compares Whether the SUM and CHECK_SUM are consistent, if they are consistent, receive the data, otherwise discard the data. In other embodiments, if there is an inconsistency, the sending end may also respond abnormally, and the sending end performs error-tolerant retransmission processing after receiving the abnormal response frame. A specific implementation is given below, and the steps include the following:

1) The sender calculates the cumulative sum (SUM) of the communication data (DATA), and the cumulative sum is the sum of the modulo 256 of all the bytes of the DATA, that is, the binary arithmetic sum of each byte, excluding the overflow value exceeding 256;

2) The sender calls the symmetric encryption algorithm in the LIB library and the encryption key encryption DATA and accumulated sum SUM of the symmetric encryption algorithm after dual-core synchronization;

3) The sender sends the encrypted ciphertext to the receiver;

4) After receiving the ciphertext, the receiving end invokes the encryption key of the symmetric encryption algorithm in the LIB library and the symmetric encryption algorithm after dual-core synchronization to decrypt the received ciphertext;

5) The receiver uses the decrypted data DATA to recalculate the accumulated sum (CHECK_SUM);

6) The receiving end compares whether the decrypted SUM is consistent with CHECK_SUM;

7) If the SUM is consistent with CHECK_SUM, the receiver receives the DATA and responds to the sender normally;

8) If the SUM and CHECK_SUM are inconsistent, the receiver discards the DATA and abnormally replies to the sender.

In other embodiments, after the sender receives the abnormal response from the receiver, it re-initiates the data retransmission mechanism of the previous frame, and the number of retransmissions may be determined according to the actual situation, for example, it may be 3 times.

It can be seen that, by accumulating and verifying the communication data, the problem that the communication data cannot be known due to errors in the transmission process can be prevented, and the accuracy of the data transmission can be improved.

The embodiments on the metering module side are described in detail in the above embodiments, and the present application also provides embodiments on the management module side. FIG. 8 is a flowchart of another data encryption method applied to an electric energy meter according to an embodiment of the present application. As shown in Figure 8, the method is applied to the management module, including:

S20: Send the public key ciphertext of the management module to the metering module according to the acquisition request initiated by the metering module; wherein, the public key ciphertext is obtained by encrypting the public key of the management module with the authentication private key of the authentication terminal;

S21: Receive the random number ciphertext sent by the metering module; wherein, the random number ciphertext is obtained by the metering module encrypting the random number generated by the random number generator with the public key of the management module, and the public key of the management module is The metering module decrypts the public key ciphertext with the authentication public key of the authentication terminal;

S22: Decrypt the random number ciphertext through the private key of the management module to obtain a random number;

S23: When a communication data transmission request is generated, use a random number as an encryption key to encrypt or decrypt the communication data.

It can be understood that the private key of the management module and the public key of the management module can be stored in either the on-chip memory or the off-chip memory. As a preferred implementation, when the private key of the management module and the public key of the management module When the group's public key is stored in off-chip memory, it also includes:

Encrypt the private key of the management module and the public key of the management module.

Since in the above embodiment, the management module, the authentication terminal, etc. involved are all described, so the description is not repeated in this embodiment.

The data encryption method applied to the electric energy meter provided in this embodiment is implemented by the management module, and specifically includes: sending the ciphertext of its public key to the metering module, and then receiving the random number ciphertext sent by the metering module, wherein the random number The ciphertext is obtained by encrypting the random number generated by the random number generator with the public key of the management module, and the public key of the management module is obtained by decrypting the ciphertext of the public key with the authentication public key of the authentication terminal by the metering module. . Finally, the random number ciphertext is decrypted by the private key of the management module to obtain a random number, and the random number is used as an encryption key to encrypt or decrypt the communication data. It can be seen that in this technical solution, the data volume of the public key and random number of the management module is small, so asymmetric encryption is performed on them, which can overcome the problem of large amount of calculation caused by asymmetric encryption, and is more secure. The communication data has a large amount of data, so it is symmetrically encrypted, and the encryption key used in the symmetrical encryption is a random number, which is randomly generated, so there is no need to manage a large database, so it can overcome the symmetry Encryption algorithms need to manage the problem of large databases.

FIG. 9 is a schematic diagram of interaction between a metering module and a management module according to an embodiment of the present application. Among them, both use the LIB library to keep the algorithms, programs, etc. used. In terms of memory, the metering module stores the authentication public key, and the management module stores the management module's public key, the management module's private key, and a digital signature certificate. During the key synchronization process, the metering module generates random numbers on the one hand, and on the other hand, obtains the digital signature certificate of the management module, and uses the authentication public key to verify the signature. After the verification is passed, the random number is encrypted using the public key of the management module. Obtain the random number ciphertext, the management module obtains the random number ciphertext, and decrypts it through the private key of the management module. If the decryption is successful, it means that the source of the random number is legitimate, cache the random number as the encryption key, and correctly respond to the metering module. After the metering module receives the correct response frame from the management module, the metering module also caches the current random number as an encryption key; if it is unsuccessful, it means that the source of the random number is invalid, and a warning will be prompted. In terms of data transmission, the metering module acts as the sender, and the management module acts as the receiver for communication data transmission.

FIG. 10 is a structural diagram of a data encryption device applied to an electric energy meter according to an embodiment of the present application. As shown in Figure 10, the device is applied to a metering module, and the device includes:

The request module 10 is used to initiate an acquisition request to the management module to obtain the public key ciphertext of the management module; wherein, the public key ciphertext is obtained by encrypting the public key of the management module with the authentication private key of the authentication terminal;

The decryption module 11 is used to decrypt the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module;

triggering module 12, used for triggering the random number generator to generate random numbers;

The encryption module 13 is used to encrypt the random number through the public key of the management module to obtain the random number ciphertext, and send it to the management module so that the management module decrypts the random number ciphertext through the private key of the management module to obtain a random number. number;

The transceiver module 14 is used for encrypting or decrypting the communication data by using a random number as an encryption key when a communication data transmission request is generated.

Since the embodiment of the apparatus part corresponds to the embodiment of the method part, for the embodiment of the apparatus part, please refer to the description of the embodiment of the method part, which will not be repeated here.

The data encryption device applied to the electric energy meter provided in this embodiment is realized by the metering module, and specifically includes: initiating an acquisition request to the management module to acquire the public key ciphertext of the management module; after obtaining the public key ciphertext, Decrypt the public key ciphertext with the authentication public key of the authentication terminal to obtain the public key of the management module. Then encrypt the random number generated by the random number generator with the public key of the management module to obtain the random number ciphertext, and send it to the management module, so that the management module can decrypt the random number ciphertext through the private key of the management module Obtain random numbers to synchronize encryption keys. Finally, when a communication data transmission request is generated, the communication data is encrypted or decrypted by using the random number as an encryption key. It can be seen that in this technical solution, the data volume of the public key and random number of the management module is small, so asymmetric encryption is performed on them, which can overcome the problem of large amount of calculation caused by asymmetric encryption, and is more secure. The communication data has a large amount of data, so it is symmetrically encrypted, and the encryption key used in the symmetrical encryption is a random number, which is randomly generated, so there is no need to manage a large database, so it can overcome the symmetry Encryption algorithms need to manage the problem of large databases.

FIG. 11 is a structural diagram of another data encryption device applied to an electric energy meter provided by an embodiment of the present application. As shown in Figure 11, the device is applied to a management module, and the device includes:

The sending module 20 is configured to send the public key ciphertext of the management module to the metering module according to the acquisition request initiated by the metering module; wherein, the public key ciphertext is obtained by encrypting the public key of the management module with the authentication private key of the authentication terminal ;

The receiving module 21 is used for receiving the random number ciphertext sent by the metering module; wherein, the random number ciphertext is obtained by encrypting the random number generated by the random number generator with the public key of the management module by the metering module, and the management module The public key is obtained by the metering module decrypting the public key ciphertext with the authentication public key of the authentication terminal;

The decryption module 22 is used for decrypting the random number ciphertext through the private key of the management module to obtain a random number;

The transceiver module 23 is configured to encrypt or decrypt the communication data by using a random number as an encryption key when a communication data transmission request is generated.

Since the embodiment of the apparatus part corresponds to the embodiment of the method part, for the embodiment of the apparatus part, please refer to the description of the embodiment of the method part, which will not be repeated here.

The data encryption device applied to the electric energy meter provided in this embodiment is implemented by the management module, and specifically includes: sending its public key ciphertext to the metering module, and then receiving the random number ciphertext sent by the metering module, wherein the random number The ciphertext is obtained by encrypting the random number generated by the random number generator with the public key of the management module, and the public key of the management module is obtained by decrypting the ciphertext of the public key with the authentication public key of the authentication terminal by the metering module. . Finally, the random number ciphertext is decrypted by the private key of the management module to obtain a random number, and the random number is used as an encryption key to encrypt or decrypt the communication data. It can be seen that in this technical solution, the data volume of the public key and random number of the management module is small, so asymmetric encryption is performed on them, which can overcome the problem of large amount of calculation caused by asymmetric encryption, and is more secure. The communication data has a large amount of data, so it is symmetrically encrypted, and the encryption key used in the symmetrical encryption is a random number, which is randomly generated, so there is no need to manage a large database, so it can overcome the symmetry Encryption algorithms need to manage the problem of large databases.

Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by the processor, the above-mentioned method embodiments (may be the method corresponding to the management module side, the method corresponding to the metering module side, or the management module side) are implemented. The steps described in the corresponding method on the module side and the metering module side).

It can be understood that, if the methods in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

The data encryption method, device and storage medium provided in the present application and applied to an electric energy meter are described in detail above. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of the present application, several improvements and modifications can also be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is no such actual relationship or sequence between operations. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

Claims (10)

1. A data encryption method applied to an electric energy meter is characterized in that the method is applied to a metering module and comprises the following steps:

initiating an acquisition request to a management module to acquire a public key ciphertext of the management module; the public key ciphertext is obtained by encrypting the public key of the management module through an authentication private key of an authentication terminal;

decrypting the public key ciphertext by using the authentication public key of the authentication terminal to obtain a public key of the management module;

triggering a random number generator to generate a random number;

encrypting the random number through a public key of the management module to obtain a random number ciphertext, and sending the random number ciphertext to the management module so that the management module decrypts the random number ciphertext through a private key of the management module to obtain the random number;

when a communication data transmission request is generated, communication data is encrypted or decrypted by using the random number as an encryption key.

2. The data encryption method according to claim 1, when obtaining the public key cryptograph of the management module, further comprising:

acquiring a digital signature certificate of the management module; the digital signature certificate is generated by the authentication terminal and is sent to the management module;

checking the digital signature certificate according to the authentication public key, and judging whether the digital signature certificate passes the checking;

if so, the step of decrypting the public key ciphertext by using the authentication public key of the authentication terminal to obtain the public key of the management module is carried out.

3. The data encryption method according to claim 2, wherein the encrypting the public key of the management module by the public key cryptograph through the authentication private key of the authentication terminal specifically comprises:

the authentication terminal acquires a public key of the management module;

the authentication terminal encrypts the public key of the management module through the authentication private key to obtain the public key ciphertext;

the generating, by the authentication terminal, the digital signature certificate specifically includes:

performing Hash operation on the public key ciphertext to obtain a public key ciphertext abstract;

encrypting the public key ciphertext abstract through the authentication private key to obtain the digital signature;

and forming a digital signature certificate through the public key ciphertext and the digital signature.

4. The data encryption method according to any one of claims 1 to 3, wherein when the communication data transmission request is transmission data, further comprising:

and accumulating and checking the communication data.

5. The data encryption method according to claim 1, wherein the sending the acquisition request to the management module specifically comprises: and initiating the acquisition request when the metering module detects power-on or detects replacement of the management module.

6. A data encryption method applied to an electric energy meter is characterized by being applied to a management module, and the method comprises the following steps:

sending the public key ciphertext of the management module to the metering module according to an acquisition request initiated by the metering module; the public key ciphertext is obtained by encrypting the public key of the management module through an authentication private key of an authentication terminal;

receiving a random number ciphertext sent by the metering module; the random number ciphertext is obtained by encrypting the random number generated by the random number generator by the metering module through the public key of the management module, and the public key of the management module is obtained by decrypting the public key ciphertext through the authentication public key of the authentication terminal by the metering module;

decrypting the random number ciphertext through a private key of the management module to obtain the random number;

when a communication data transmission request is generated, communication data is encrypted or decrypted by using the random number as an encryption key.

7. The data encryption method of claim 6, wherein when the private key of the management module and the public key of the management module are stored in an off-chip memory, further comprising:

and encrypting the private key of the management module and the public key of the management module.

8. The utility model provides a be applied to data encryption device of electric energy meter which characterized in that is applied to the measurement module, and the device includes:

the request module is used for initiating an acquisition request to the management module so as to acquire the public key ciphertext of the management module; the public key ciphertext is obtained by encrypting the public key of the management module through an authentication private key of an authentication terminal;

the decryption module is used for decrypting the public key ciphertext by using the authentication public key of the authentication terminal to obtain the public key of the management module;

the trigger module is used for triggering the random number generator to generate a random number;

the encryption module is used for encrypting the random number through the public key of the management module to obtain a random number ciphertext and sending the random number ciphertext to the management module so that the management module can decrypt the random number ciphertext through the private key of the management module to obtain the random number;

and the transceiving module is used for encrypting or decrypting the communication data by using the random number as an encryption key when the communication data transmission request is generated.

9. The utility model provides a be applied to data encryption device of electric energy meter which characterized in that is applied to the management module, and the device includes:

the sending module is used for sending the public key ciphertext of the management module to the metering module according to the acquisition request initiated by the metering module; the public key ciphertext is obtained by encrypting the public key of the management module through an authentication private key of an authentication terminal;

the receiving module is used for receiving the random number ciphertext sent by the metering module; the random number ciphertext is obtained by encrypting the random number generated by the random number generator by the metering module through the public key of the management module, and the public key of the management module is obtained by decrypting the public key ciphertext through the authentication public key of the authentication terminal by the metering module;

the decryption module is used for decrypting the random number ciphertext through a private key of the management module to obtain the random number;

and the transceiving module is used for encrypting or decrypting the communication data by using the random number as an encryption key when the communication data transmission request is generated.

10. A computer-readable storage medium, characterized in that a computer program is stored thereon, which, when being executed by a processor, carries out the steps of the data encryption method applied to an electric energy meter according to any one of claims 1 to 7.

Images