CN104038931B - Adapted electrical communication system and its communication means based on LTE network - Google Patents

Abstract

The invention discloses a power distribution and utilization communication system based on an LTE network and a communication method thereof. The method comprises: a power distribution and utilization terminal sends communication data encrypted by a session key to a network access point device; the network access point device Use the session key to decrypt the communication data, and perform L2TP encapsulation on the decrypted communication data according to the L2TP tunnel configuration negotiation result, and send the L2TP data packet generated by the encapsulation to the master server; the master server configures the negotiation result according to the L2TP tunnel , and parse out the communication data from the received L2TP data packet. Among them, the session key is generated by the network access point device according to the public key, private key and key negotiation parameters; the L2TP tunnel configuration negotiation result is generated by the network access point device according to Sent first and third tunnel configuration parameters generated. The application of the invention can improve the safety and reliability of the power distribution communication system.

Description

Power distribution and utilization communication system and communication method based on LTE network

technical field

The invention relates to the technical field of smart grids, in particular to an LTE network-based power distribution communication system and a communication method thereof.

Background technique

As the development direction of the future power grid, the smart grid is based on an integrated, high-speed two-way communication network to achieve the goals of reliability, safety, economy, high efficiency, environmental friendliness and safe use of the power grid. In practical application, the smart grid mainly includes the power distribution business and the smart power service system, which can be collectively referred to as the power distribution business of the smart grid. Among them, the power distribution business mainly involves the real-time monitoring and control of power distribution terminals such as substations, pole-mounted switches, and distribution transformers in the power system by the main station in the power system; The master station of the power system collects, monitors and releases business data on the power consumption terminals located on the user side in the power system; power distribution terminals and power consumption terminals can be collectively referred to as power distribution terminals, and the bidirectional Communication has high requirements for real-time and reliable security of communication.

At present, the two-way communication between the power distribution terminal and the main station can be realized by deploying the power system's own wired network between the power distribution terminal and the main station to form a power distribution communication system. However, since power consumption terminals are distributed in the entire power distribution network along the direction of low-voltage power lines, the number of nodes is far greater than the number of power distribution terminal nodes, and there are still scattered nodes, and some nodes are difficult to deploy wired networks. The communication system has the disadvantages of high network construction cost and high network construction complexity.

In order to reduce the cost and complexity of network construction, a power distribution and utilization communication system by introducing a non-power system own network is proposed, which mainly includes: power distribution and utilization terminals, wireless access network base stations, and master stations; Among them, the wireless access network base station mainly refers to 2G (the second-generation wireless telephone technology, second-generation mobile communication technology), 3G (the3rd generation telecommunication, third-generation mobile communication technology), LTE (long term evolution, long-term evolution ) and other wireless access network base stations. In practical applications, the communication process of the above-mentioned power distribution communication system mainly includes: after the power distribution terminal establishes a connection with the wireless access network base station, it accesses the wireless access network through the base station and establishes a connection with the main station. The base station and the wireless access network realize the data communication with the main station. However, there are wireless access network security issues in the above-mentioned communication process. For example, the key algorithm of the 2G network is easily cracked, resulting in the possibility of eavesdropping on the communication; due to the lack of authentication of the base station, the 3G network may be deceived by a fake base station; and Although LTE has a double-layer encryption system, that is, it can perform double-layer encryption on the base station, the transmission protocol between the base station and the master station, but the encryption for the base station at the non-access layer is optional, and it may not be enabled in practice, resulting in configuration Power-consuming terminals are vulnerable to intrusion and mandatory conversion attacks common to radio access networks. That is to say, the security of the existing power distribution and consumption communication system introduced by the non-power system's own network faces many risks and low reliability.

To sum up, the existing power distribution communication system has the disadvantages of high network construction cost, high complexity, and low security. Therefore, it is necessary to provide an Two-way communication between safe and reliable power distribution communication system.

Contents of the invention

Embodiments of the present invention provide an LTE network-based power distribution and utilization communication system and a communication method thereof, which are used to improve the safety and reliability of the power distribution and utilization communication system.

According to one aspect of the present invention, a communication method of an LTE network-based power distribution communication system is provided, including:

The power distribution terminal sends a session request carrying key negotiation parameters to the network access point device;

After receiving the session request, the network access point device generates a session key according to the public key, the pre-stored private key, and the key negotiation parameters and returns it to the power distribution terminal;

After receiving the session key, the power distribution terminal sends a Layer 2 Tunneling Protocol L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key to the network access point device;

The network access point device receives the L2TP tunnel establishment request, parses and decrypts the first tunnel configuration parameter from it, and obtains the second tunnel configuration parameter from the master station server; according to the first tunnel configuration parameter and the second tunnel configuration parameter , generating an L2TP tunnel configuration negotiation result and sending it to the master station server, and returning a response message that the tunnel is established successfully to the power distribution terminal;

After receiving the response information that the tunnel is successfully established, the power distribution terminal sends the communication data encrypted by the session key to the network access point device;

The network access point device uses the session key to decrypt the communication data, and according to the L2TP tunnel configuration negotiation result, L2TP-encapsulates the decrypted communication data and sends it to the master station server;

The master station server parses the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result.

Preferably, the power distribution terminal sends a session request carrying key negotiation parameters to the network access point device, specifically including:

The power distribution terminal sends the session request carrying the key negotiation parameters encrypted by the public key to the network access point device; and

After receiving the session request, the network access point device generates a session key according to the public key, the pre-stored private key, and the key negotiation parameters, specifically including:

The network access point device parses the key negotiation parameters encrypted by the public key from the session request, and uses the pre-stored private key to decrypt the key negotiation parameters encrypted by the public key to obtain the key negotiation parameters ; Generate a session key according to the public key, the private key, and the key negotiation parameters according to a preset Long Term Evolution LTE encryption algorithm.

Preferably, the public key is specifically identification information of the network access point device; and

Before generating the session key according to the public key, the pre-stored private key and the key negotiation parameters, it further includes:

After receiving the session request, the network access point device sends its own identification information to the private key generator;

The private key generator receives the identification information sent by the network access point device, and finds out the private key corresponding to the received identification information from the private key library storing the identification information of each access point of the LTE network, and searches The obtained private key is sent to the network access point device.

Preferably, the network access point device receives the L2TP tunnel establishment request, parses and decrypts the first tunnel configuration parameters from it, and obtains the second tunnel configuration parameters from the main station server, specifically including:

After analyzing the first tunnel configuration parameter encrypted by the session key from the L2TP tunnel establishment request, the network access point device uses the session key to decrypt the first tunnel configuration parameter, and decrypts the decrypted second tunnel configuration parameter A tunnel configuration parameter is encapsulated in the L2TP tunnel connection request and sent to the master station server;

The master station server parses out the first tunnel configuration parameter from the L2TP tunnel connection request, and sends an L2TP tunnel connection response carrying the second tunnel configuration parameter corresponding to the first tunnel configuration parameter to the network access point device information;

The network access point device parses out the second tunnel configuration parameters from the L2TP tunnel connection response information.

Preferably, after the power distribution terminal receives the session key, before returning the response information that the tunnel establishment is successful to the power distribution terminal, it further includes:

The power distribution terminal sends an Internet security protocol IPSec tunnel establishment request carrying the third tunnel configuration parameters encrypted by the session key to the network access point device;

The network access point device receives the IPSec tunnel establishment request, parses and decrypts the third tunnel configuration parameter therefrom, and obtains the fourth tunnel configuration parameter from the main station server; according to the third tunnel configuration parameter and the fourth tunnel configuration parameter , generating an IPSec tunnel configuration negotiation result and sending it to the master station server; and

After sending the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result to the master station server, return a response message indicating that the tunnel is established successfully to the power distribution terminal; and

According to the L2TP tunnel configuration negotiation result, the decrypted communication data is L2TP encapsulated and then sent to the master station server, specifically including:

The network access point device performs L2TP encapsulation and IPSec encapsulation on the decrypted communication data according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result, and sends the L2TP/IPSec data packet generated by the encapsulation to the main station server ;as well as

The master station server parses the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result, specifically including:

The master server parses the communication data from the received L2TP/IPSec data packet according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result.

Preferably, the network access point device receives the IPSec tunnel establishment request, parses and decrypts the third tunnel configuration parameter therefrom, and acquires the fourth tunnel configuration parameter from the main station server, specifically including:

After analyzing the third tunnel configuration parameter encrypted by the session key from the IPSec tunnel establishment request, the network access point device uses the session key to decrypt the third tunnel configuration parameter, and decrypts the decrypted third tunnel configuration parameter. The three tunnel configuration parameters are encapsulated in the IPSec tunnel connection request and sent to the master server;

The master station server parses the third tunnel configuration parameter from the IPSec tunnel connection request, and sends an IPSec tunnel connection response carrying the fourth tunnel configuration parameter corresponding to the third tunnel configuration parameter to the network access point device information;

The network access point device parses out the fourth tunnel configuration parameter from the IPSec tunnel connection response information.

According to another aspect of the present invention, there is also provided a power distribution and utilization communication system based on an LTE network, including: a power distribution and utilization terminal, a network access point device, and a master station server; wherein,

The power distribution terminal is used to send a session request carrying key negotiation parameters to the network access point device; after receiving the session key from the network access point device, send the session key to the network access point device Send an L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key; after receiving a response message that the tunnel is successfully established from the network access point device, send the communication data encrypted by the session key to to the network access point device;

The network access point device is configured to, after receiving the session request from the power distribution terminal, generate a session key according to the public key, the pre-stored private key, and the key negotiation parameters, and send the session key to the power distribution terminal. The terminal returns; receiving the L2TP tunnel establishment request from the power distribution terminal, parsing and decrypting the first tunnel configuration parameter, and obtaining the second tunnel configuration parameter from the master station server; according to the first tunnel configuration parameter , and the second tunnel configuration parameters, generate an L2TP tunnel configuration negotiation result and send it to the master station server, and return a response message that the tunnel is successfully established to the power distribution terminal; receive the session information sent by the power distribution terminal After the key-encrypted communication data, use the session key to decrypt the communication data, and according to the L2TP tunnel configuration negotiation result, perform L2TP encapsulation on the decrypted communication data and send it to the master station server;

The master station server is configured to parse out the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result.

Preferably, the system further includes: a private key generator; and

The public key is specifically identification information of the network access point device; and

The power distribution terminal is specifically configured to send the session request carrying the key negotiation parameters encrypted by the public key to the network access point device; and

The network access point device is specifically configured to, after receiving the session request from the power distribution terminal, send its own identification information to the private key generator, and receive from the private key generator a private key corresponding to the identification information; parsing the key negotiation parameters encrypted by the public key from the session request, and using the private key pair corresponding to the identification information received from the private key generator The key negotiation parameters encrypted by the public key are decrypted to obtain the key negotiation parameters; according to the public key, the private key and the key negotiation parameters, according to the preset long-term evolution LTE encryption algorithm, a session is generated key; and

The private key generator is configured to, after receiving the identification information sent by the network access point device, find out the key corresponding to the received identification information from the private key library storing the identification information of each access point of the LTE network. private key, and send the found private key to the network access point device.

Preferably, the network access point device is specifically configured to parse out the first tunnel encrypted by the session key from the L2TP tunnel establishment request after receiving the L2TP tunnel establishment request from the power distribution terminal. Configure parameters, use the session key to decrypt the first tunnel configuration parameters, and encapsulate the decrypted first tunnel configuration parameters in the L2TP tunnel connection request and send them to the main station server; receive the L2TP from the main station server After the tunnel connection response information, parse out the second tunnel configuration parameters from the L2TP tunnel connection response information; and

The master station server is specifically configured to, after receiving the L2TP tunnel connection request from the network access point device, parse the first tunnel configuration parameter from the L2TP tunnel connection request, and send the first tunnel configuration parameter to the network access point device with L2TP tunnel connection response information of the second tunnel configuration parameter corresponding to the first tunnel configuration parameter.

Preferably, the power distribution terminal is further configured to send an IPSec tunnel establishment request carrying third tunnel configuration parameters encrypted by the session key to the network access point device; and

The network access point device is further configured to parse and decrypt the third tunnel configuration parameter from the IPSec tunnel establishment request sent by the power distribution terminal, and obtain the fourth tunnel configuration parameter from the main station server ; According to the third tunnel configuration parameter and the fourth tunnel configuration parameter, generate an IPSec tunnel configuration negotiation result and send it to the master station server; and send the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result to the master station server After the main station server, return the response information that the tunnel is successfully established to the power distribution terminal; use the session key to decrypt the communication data encrypted by the session key received from the power distribution terminal; according to the The L2TP tunnel configuration negotiation result, the IPSec tunnel configuration negotiation result, perform L2TP encapsulation and IPSec encapsulation on the decrypted communication data, and send the L2TP/IPSec data packet generated by the encapsulation to the master station server; and

The master station server is further configured to parse out the communication data from the received L2TP/IPSec data packet according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result.

In the technical solution of the embodiment of the present invention, a shared session key is set between the power distribution terminal and the network access point device in advance to ensure the communication security between the power distribution terminal and the network access point device; at the same time, the The L2TP tunnel and IPSec tunnel are set up between the network access point device and the main station server, and the transmission mode and content of the communication data transmitted between the network access point device and the main station server are protected by double encryption to ensure network access communication security between the point device and the master server. Compared with the existing power distribution and utilization communication system, the power distribution and utilization terminal system provided by the present invention communicates through the communication data transmission channel encrypted by the session key and protected by the L2TP tunnel and the IPSec tunnel, which has higher security and reliability .

Description of drawings

FIG. 1 is a schematic structural diagram of a power distribution communication system according to an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a method for sharing a session key according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for establishing a data transmission tunnel according to an embodiment of the present invention;

FIG. 4 is a schematic flow chart of a communication method of the power distribution communication system according to an embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be described in further detail below with reference to the accompanying drawings and preferred embodiments. However, it should be noted that many of the details listed in the specification are only for readers to have a thorough understanding of one or more aspects of the present invention, and these aspects of the present invention can be implemented even without these specific details.

As used herein, terms such as "module" and "system" are intended to include computer-related entities such as, but not limited to, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a module may be, but is not limited to being limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. For example, both an application running on a computing device and the computing device could be modules. One or more modules can reside within a process and/or thread of execution.

The inventors of the present invention found that the low security and reliability of the existing power distribution and utilization communication system mainly lies in the lack of authentication and encryption of the base station and the air interface of the wireless access network. Therefore, the inventors of the present invention consider that an access point base station of the LTE network can be added between the power distribution terminal and the main station, and through the authentication of the access point base station, the connection between the power distribution terminal and the access point base station authentication transmission between the access point base station and the main station server through L2TP (Layer2Tunneling Protocol, Layer 2 Tunneling Protocol) tunnel configuration and IPSec (Internet Protocol Security, Internet Security Protocol) tunnel configuration for the communication data transmitted The transmission mode and content are double-layer encrypted transmission, so as to improve the security and reliability of the communication between the power distribution terminal and the main station in the power distribution communication system.

The technical scheme of the present invention will be described in detail below in conjunction with the accompanying drawings.

An embodiment of the present invention provides a power distribution and utilization communication system based on an LTE network, as shown in FIG.

Among them, the power distribution terminal 101 can send a session request carrying key negotiation parameters to the network access point device 102; after receiving the session request, the network access point device 102 can key negotiation parameters, generate a session key, and return the generated session key to the power distribution terminal 101. Specifically, the power distribution terminal 101 may send the session request carrying the key negotiation parameters encrypted by the public key to the network access point device 102 . Then, the network access point device 102 can parse out the key negotiation parameters encrypted by the public key from the session request, and use the pre-stored private key to pair the key negotiation parameters encrypted by the public key received from the power distribution terminal 101 Decrypt to obtain the key negotiation parameters; and according to the public key, private key and key negotiation parameters, according to the preset LTE encryption algorithm, generate a session key and send it to the power distribution terminal 101 . Wherein, the public key is specifically the identification information of the network access point device 102; the private key in the network access point device 102 is pre-stored information corresponding to its own identification information. In this way, the key negotiation between the power distribution terminal 101 and the network access point device 102 is completed, and the subsequent power distribution terminal 101 can encrypt the pre-uploaded communication data through the shared session key, ensuring the power distribution Security of data transmission between the terminal 101 and the network access point device 102 . Moreover, when the key negotiation is completed between the power distribution terminal 101 and the network access point device 102, the authentication connection between the power distribution terminal 101 and the network access point device 102 is also completed, so that the power distribution terminal 101 and the network access point device 102 101 can access the LTE network through the network access point device 102; and then send the communication data to be uploaded to the main station server 103 through the LTE network. Specifically, the LTE encryption algorithm may be selected from multiple algorithms allowed by the LTE network system.

More preferably, the power distribution communication system in the embodiment of the present invention further includes: a private key generator 104 .

Wherein, the private key generator 104 is used for storing identification information of each access point of the LTE network, and private keys respectively corresponding to each identification information. Specifically, after receiving the session request sent by the power distribution terminal 101 , the network access point device 102 sends its own identification information to the private key generator 104 . In this way, after receiving the identification information sent by the network access point device 102, the private key generator 104 can find out the key corresponding to the received identification information from the private key library storing the identification information of each access point of the LTE network. private key, and send the found private key to the network access point device 102.

Further, after receiving the returned session key from the network access point device 102, the power distribution and utilization terminal 101 sends to the network access point device 102 an L2TP tunnel establishment message carrying the first tunnel configuration parameters encrypted by the session key. ask. Then, after receiving the L2TP tunnel establishment request, the network access point device 102 can parse and decrypt the first tunnel configuration parameter therefrom, and obtain the second tunnel configuration parameter from the master station server 103; according to the first tunnel configuration parameter, and The second tunnel configuration parameter generates an L2TP tunnel configuration negotiation result and sends it to the master station server 103 , and returns a response message indicating that the tunnel is established successfully to the power distribution terminal 101 . Specifically, after receiving the L2TP tunnel establishment request sent by the power distribution terminal 101, the network access point device 102 can parse out the first tunnel configuration parameter encrypted by the session key from the L2TP tunnel establishment request; The key decrypts the first tunnel configuration parameters, and encapsulates the decrypted first tunnel configuration parameters in the L2TP tunnel connection request and sends it to the main station server 103 . After receiving the L2TP tunnel connection request sent by the network access point device 102, the master station server 103 parses out the first tunnel configuration parameter, and sends to the network access point device 102 the information carrying the first tunnel configuration parameter and the first tunnel configuration parameter. The L2TP tunnel connection response information of the second tunnel configuration parameter corresponding to the first tunnel configuration parameter. After receiving the L2TP tunnel connection response information sent by the main station server 103, the network access point device 102 can parse out the second tunnel configuration parameters; generate the L2TP tunnel configuration negotiation result according to the first tunnel configuration parameters and the second tunnel configuration parameters ; After sending the generated L2TP tunnel configuration negotiation result to the master station server 103, and returning a response message indicating that the tunnel is established successfully to the power distribution terminal. In this way, the establishment of the L2TP tunnel connection between the network access point device 102 and the main station server 103 in the LTE network is completed. Wherein, the first and second tunnel configuration parameters are specifically used to limit the transmission bandwidth, transmission rate and other parameters, so that the L2TP tunnel configuration negotiation result generated according to the first and second tunnel configuration parameters can be used for power distribution terminal 101 and the network The data transmission mode between the access point devices 102 is controlled. For example, the L2TP tunnel configuration negotiation result may be set as the minimum value, or maximum value, or average value of the limit values for the same parameter in the first tunnel configuration parameter and the second tunnel configuration parameter.

In this way, the communication data received from the power distribution terminal 101 can be subsequently uploaded to the main station server 103 through the L2TP tunnel in the LTE network according to the L2TP tunnel configuration negotiation result. Specifically, after the power distribution terminal 101 in the power distribution communication system receives the response information returned by the network access point device 102 indicating that the tunnel is successfully established, it can send the communication data encrypted by the session key to the network access point device 102. point device 102 . After receiving the communication data encrypted by the session key sent by the power distribution terminal 101, the network access point device 102 may use the session key to decrypt the communication data encrypted by the session key received from the power distribution terminal 101, Decrypt the communication data; perform L2TP encapsulation on the decrypted communication data according to the L2TP tunnel configuration negotiation result, and send the L2TP data packet generated by encapsulation to the master server 103 . In this way, the master station server 103 can analyze the received L2TP data packet according to the L2TP tunnel configuration negotiation result, and analyze the communication data pre-uploaded by the power distribution terminal 101 therefrom.

Based on the above-mentioned power distribution communication system, it can be seen that before the power distribution communication system based on the LTE network in the embodiment of the present invention communicates, it is necessary to realize in advance that the power distribution terminal and the network access point device share the session key. Key, its specific process, as shown in Figure 2, can include the following steps:

S201: The power distribution terminal sends a session request carrying key negotiation parameters to the network access point device.

Specifically, before the power distribution terminal 101 in the power distribution communication system accesses the LTE network through the network access point device 102, it can use the identification information of the network access point device 102 as a public key, and use the public key to encrypt the key Negotiate parameters, and send the session request carrying the key negotiation parameters encrypted by the public key to the network access point device 102. Wherein, the network access point device 102 is specifically an access point of the LTE network; the public key is specifically identification information of the network access point device 102 .

S202: After receiving the session request, the network access point device sends its own identification information to the private key generator.

Specifically, after the network access point device 102 in the power distribution communication system receives the session request carrying the key negotiation parameters encrypted by the public key sent by the power distribution terminal 101 in the system, in order to decrypt the The key negotiation parameter in the session request may send its own identification information to the private key generator 104 to obtain the private key.

S203: The private key generator receives the identification information sent by the network access point device, and finds the key corresponding to the identification information of the network access point device from the private key library storing the identification information of each access point of the LTE network. The private key is sent to the network access point device.

Then, the private key generator 104 in the power distribution and utilization communication system can receive the identification information sent by the network access point device, and find out from the private key library that stores the identification information of each access point of the LTE network. The access point device 102 receives the private key corresponding to the identification information, and sends the found private key to the network access point device 102 . Specifically, the private key generator 104 compares the received identification information with the identification information of each access point of the LTE network in the private key storehouse, finds out the same identification information as the received identification information from the private key storehouse, and sends The private key corresponding to the identification information is sent to the network access point device 102 . Wherein, the private key generator 104 preliminarily uses the identification information of the access point as a public key for each access point in the LTE network, and sets a corresponding private key for the public key. The specific implementation method for the private key generator 104 to set a pair of corresponding public key and private key can adopt technical means known to those skilled in the art, and will not be repeated here.

In fact, if the same identification information as the received identification information is found from the private key store, it indicates that the network access point device corresponding to the identification information is an access point of the LTE network, that is, the power distribution terminal 101 can access the LTE network through the network access point device 102 . Correspondingly, if the identification information identical to the received identification information cannot be found from the private key store, it indicates that the network access point device is not an access point of the LTE network, then the power distribution and utilization terminal 101 can select other The network access point device of the access point of the LTE network realizes the access of the LTE network.

S204: The network access point device parses the key negotiation parameters encrypted by the public key from the session request, and uses the private key to decrypt the key negotiation parameters encrypted by the public key to obtain the key negotiation parameters; according to the public key, The private key and key negotiation parameters are generated and sent to the power distribution terminal after the session key is generated.

Specifically, the network access point device 102 in the power distribution communication system may use the private key received from the private key generator 104 to decrypt the key negotiation parameters encrypted by the public key received from the power distribution terminal 101, Obtain the key negotiation parameters; and according to the public key (ie, the identification information of the network access point device 102), the private key and the key negotiation parameters, according to the preset LTE encryption algorithm, generate a session key, and use the generated session key The key is sent to the slave power distribution terminal 101. For example, the network access point device 102 can use the private key to encrypt the generated session key, and send the encrypted session key to the power distribution terminal 101; then, the power distribution terminal 101 can use the public key (that is, the network access The identification information of the point device 102) is decrypted to obtain the session key, and the session key is shared between the power distribution terminal 101 and the network access point device 102. In this way, the subsequent data transmitted between the power distribution terminal 101 and the network access point device 102 can be encrypted and decrypted using the session key, so as to ensure the communication security between the power distribution terminal 101 and the network access point device 102 . Wherein, the LTE encryption algorithm may specifically be selected from algorithms allowed by the LTE network system.

Based on the above power distribution communication system, it can also be seen that the LTE network-based power distribution communication system in the embodiment of the present invention needs to pre-establish the data between the network access point device and the master station server before performing communication. The specific flow of the transmission tunnel, as shown in Figure 3, may include the following steps:

S301: After receiving the session key, the power distribution terminal sends an L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key to the network access point device.

Specifically, in order to establish a secure communication channel with the main station server 103 through the network access point device 102, the power distribution terminal 101 can configure the data transmission tunnel to be established between the network access point device and the main station server Limit the parameters. Specifically, after determining the session key shared with the network access point device 102, the power distribution terminal 101 can use the session key to define the parameters of the first tunnel configuration parameter for the data transmission tunnel to be established. Encryption is performed, and the L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key is sent to the network access point device 102 .

S302: After analyzing the first tunnel configuration parameter encrypted by the session key from the L2TP tunnel establishment request, the network access point device decrypts the first tunnel configuration parameter by using the session key, and decrypts the decrypted first tunnel configuration parameter It is encapsulated in the L2TP tunnel connection request and sent to the master server.

Specifically, after receiving the L2TP tunnel establishment request sent by the power distribution terminal 101, the network access point device 102 parses out the first tunnel configuration parameter encrypted by the session key, and uses the shared session key to decrypt the first tunnel configuration parameter. For tunnel configuration parameters, the decrypted first tunnel configuration parameters are encapsulated in the L2TP tunnel connection request and sent to the master server 103 .

S303: The master station server parses out the first tunnel configuration parameter from the L2TP tunnel connection request, and sends an L2TP tunnel connection response carrying the second tunnel configuration parameter corresponding to the first tunnel configuration parameter to the network access point device information.

Specifically, the main station server 103 receives the L2TP tunnel connection request sent by the network access point device 102, and parses out the first tunnel configuration parameter; according to the first tunnel configuration parameter, determines the second tunnel configuration parameter corresponding to the first tunnel configuration parameter Tunnel configuration parameters, and the determined second tunnel configuration parameters are encapsulated in the L2TP tunnel connection response information and sent to the network access point device 102.

S304: The network access point device parses out the second tunnel configuration parameter from the L2TP tunnel connection response information, generates the L2TP tunnel configuration negotiation result according to the first tunnel configuration parameter and the second tunnel configuration parameter, and sends it to the main station server, and Return the response information that the tunnel is established successfully to the power distribution terminal.

Specifically, after receiving the L2TP tunnel connection response information sent by the master server 103, the network access point device 102, according to the decrypted first tunnel configuration parameters and the second tunnel configuration parameters parsed from the L2TP tunnel connection response information, , generating an L2TP tunnel configuration negotiation result, and sending the generated L2TP tunnel configuration negotiation result to the master server 103 . In this way, the establishment of the L2TP tunnel connection between the network access point device 102 and the main station server 103 in the LTE network is completed. Then, the power distribution terminal 101 can pass through the network access point device 102, the LTE network, and the main station server in sequence. The station server 103 accesses the intranet of the power system. Among them, according to the specific implementation method of establishing the L2TP tunnel according to the first and second tunnel configuration parameters, the L2TP tunnel configuration negotiation result can be set as the minimum value of the same parameter limit value among the first tunnel configuration parameter and the second tunnel configuration parameter, Or the maximum value, or the average value, can also adopt technical means known to those skilled in the art, and will not be described in detail here. In this way, the communication data transmitted through the L2TP tunnel can be encrypted and transmitted according to the L2TP tunnel configuration negotiation result, thereby ensuring the security and reliability of the transmission process.

In practical applications, before the power distribution terminal 101 in the power distribution communication system sends the L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key to the network access point device 102, it may also pass the network The access point device 102 and the LTE network send user authentication information including the user name and authentication password of the power distribution terminal to the authentication server set at the main station of the power system. Then, the authentication server authenticates the received user authentication information, and if the authentication is passed, returns the server address of the master server 103 to the network access point device 102 through the LTE network. In this way, the network access point device 102 can send the L2TP tunnel connection request carrying the first tunnel configuration parameters to the master station server 103 in the power distribution communication system according to the received address. Then, the master server 103 responds to the received L2TP tunnel connection request.

The inventors of the present invention found that the negotiation result of the L2TP tunnel configuration is essentially a tunnel transmission protocol, which defines and controls the message transmission mode between the network access point device 102 and the main station server 103, but does not control the transmitted data Encryption protection.

Therefore, as a more optimal implementation manner, the inventors of the present invention consider that the encryption of transmitted data can be realized by collaborating with other security protocols. For example, the network access point device 102 can generate an IPSec tunnel configuration negotiation result according to the third tunnel configuration parameter sent by the power distribution terminal 101 and the fourth tunnel configuration parameter sent by the master station server 103, and transfer the generated IPSec tunnel configuration The tunnel configuration negotiation result is sent to the master station server 103 . Wherein, the third tunnel configuration parameter may specifically include the user name and password of the power distribution terminal 101, the session key shared between the power distribution terminal 101 and the network access point device 102; the fourth tunnel configuration parameter may specifically include the master station The server address of the server 103 and the intranet address assigned by the main station server 103 to the power distribution terminal 101 according to the user name and password of the power distribution terminal 101 . In this way, through the IPSec tunnel configuration negotiation results generated according to the third and fourth tunnel configuration parameters, the power distribution terminal 101 and the main station server 103 at both ends of the IPSec tunnel can be authenticated, and the communication between the two can also be verified. The transmitted data is encrypted to ensure the privacy of the transmitted data and greatly improve the security of the transmitted data.

Specifically, after receiving the session key returned by the network access point device 102, the power distribution and utilization terminal 101, in addition to sending to the network access point device 102 an L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key In addition, an IPSec tunnel establishment request carrying the third tunnel configuration parameters encrypted by the session key may also be sent to the network access point device 102; the network access point device 102 receives the IPSec tunnel establishment request sent by the power distribution terminal 101 Finally, parse the third tunnel configuration parameters encrypted by the session key, and use the session key to decrypt the third tunnel configuration parameters, encapsulate the decrypted third tunnel configuration parameters in the IPSec tunnel connection request, and send the IPSec tunnel The connection request is sent to the master station server 103 . Then, after receiving the IPSec tunnel connection request sent by the network access point device 102, the main station server 103 can parse out the third tunnel configuration parameter from the IPSec tunnel connection request, and determine the fourth tunnel configuration parameter corresponding to the third tunnel configuration parameter. Tunnel configuration parameters; and sending IPSec tunnel connection response information carrying fourth tunnel configuration parameters to the network access point device 102 . In this way, the network access point device 102 can receive the IPSec tunnel connection response information sent by the master station server 103, and parse out the fourth tunnel configuration parameter from the IPSec tunnel connection response information; Four tunnel configuration parameters, generate an IPSec tunnel configuration negotiation result and send it to the master station server 103 .

In this way, after sending both the generated L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result to the master station server 103 , the network access point device 102 can return a response message indicating that the tunnel is established successfully to the power distribution terminal 101 . Then, after receiving the response message that the tunnel is established successfully, the power distribution terminal 101 sends the communication data encrypted by the session key to the network access point device 102 . The network access point device 102 uses the session key to decrypt the communication data encrypted by the session key received from the power distribution terminal 101, and decrypts the communication data; and according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result, the The decrypted communication data is encapsulated by L2TP and IPSec, and the L2TP/IPSec data packet generated by encapsulation is sent to the master server 103 . In this way, the main station server 103 can analyze the communication data from the received L2TP/IPSec data packet according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result. In this way, through the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result, the communication data can be encrypted while also controlling the transmission mode of the communication data, which greatly enhances the connection between the network access point device 102 and the main station server 103. communication security.

Based on the above power distribution communication system, the predetermined session key, the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result, the embodiment of the present invention also provides a communication method for a power distribution communication system based on an LTE network, Its specific process, as shown in Figure 4, may include the following steps:

S401: The power distribution terminal sends a session request carrying key negotiation parameters to the network access point device.

Specifically, the power distribution terminal 101 may send the session request carrying the key negotiation parameters encrypted by the public key to the network access point device 102 .

S402: After receiving the session request, the network access point device generates a session key according to the public key, the pre-stored private key, and the key negotiation parameters and returns it to the power distribution terminal.

Specifically, the network access point device 102 parses the key negotiation parameters encrypted by the public key from the session request, and uses the pre-stored private key to decrypt the key negotiation parameters encrypted by the public key to obtain the key negotiation parameters ; According to the public key, private key and key negotiation parameters, according to the preset long-term evolution LTE encryption algorithm, generate a session key and send it to the power distribution terminal 101 ; For the specific implementation method of generating the session key by the network access point device 102, reference may be made to the above steps S201-S204.

S403: After receiving the session key, the power distribution terminal sends an L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key to the network access point device.

Specifically, after receiving the session key returned by the network access point device 102, the power distribution terminal 101 sends to the network access point device 102 an L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key.

More preferably, the power distribution terminal 101 may also send an IPSec tunnel establishment request carrying the third tunnel configuration parameters encrypted with the session key to the network access point device 102 .

S404: The network access point device receives the L2TP tunnel establishment request, parses and decrypts the first tunnel configuration parameter from it, and obtains the second tunnel configuration parameter from the master station server; according to the first tunnel configuration parameter and the second tunnel configuration parameter , generate an L2TP tunnel configuration negotiation result and send it to the master server, and return a response message indicating that the tunnel is established successfully to the power distribution terminal.

Specifically, for a specific implementation method for the network access point device 102 to generate the L2TP tunnel configuration negotiation result, reference may be made to the above steps S301-S304.

More preferably, the network access point device 102 receives the IPSec tunnel establishment request sent by the power distribution terminal 101, parses and decrypts the third tunnel configuration parameter from it, and obtains the fourth tunnel configuration parameter from the main station server; according to the third The tunnel configuration parameter and the fourth tunnel configuration parameter generate the IPSec tunnel configuration negotiation result and send it to the main station server; 101 returns the response information that the tunnel is established successfully. For the specific implementation method of generating the IPSec tunnel configuration negotiation result by the network access point device, reference may be made to the above steps S301-S304.

S405: After receiving the response information that the tunnel is established successfully, the power distribution terminal sends the communication data encrypted by the session key to the network access point device.

Specifically, after receiving the response information returned by the network access point device 102 indicating that the tunnel is successfully established, the power distribution terminal 101 in the power distribution communication system can send the communication data encrypted by the session key to the power distribution communication system. A network access point device 102 in the system. Wherein, the session key is a session key shared between the power distribution terminal 101 and the network access point device 102 .

S406: The network access point device decrypts the communication data by using the session key, performs L2TP encapsulation on the decrypted communication data according to the L2TP tunnel configuration negotiation result, and sends the L2TP data packet generated by encapsulation to the main station server.

Specifically, after the network access point device 102 in the power distribution communication system receives the communication data encrypted by the session key sent by the power distribution terminal 101, it uses the session key to decrypt the communication data, and negotiates according to the L2TP tunnel configuration. As a result, L2TP encapsulation is performed on the decrypted communication data to generate an L2TP packet, and the generated L2TP packet is sent to the master server 103 through the LTE network.

More preferably, in addition to sharing the L2TP tunnel configuration negotiation result, the network access point device 102 and the main station server can also share the IPSec tunnel configuration negotiation result. Therefore, the network access point device 102 can also configure the negotiation result according to the L2TP tunnel configuration. According to the negotiation result of the IPSec tunnel configuration, L2TP encapsulation and IPSec encapsulation are performed on the communication data decrypted by the session key to generate an L2TP/IPSec data packet, and the L2TP/IPSec data packet generated by encapsulation is sent to the main station server 103.

S407: The master station server parses the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result.

Specifically, after the master station server 103 receives the L2TP data packet sent by the network access point device 102 through the LTE network, it can perform the L2TP data packet received according to the L2TP tunnel configuration negotiation result received from the network access point device 102 in advance. By analyzing, the communication data pre-uploaded by the power distribution terminal 101 is obtained.

More preferably, the main station server 103 can also receive the L2TP/IPSec data packet sent by the network access point device 102, and analyze the received L2TP/IPSec data packet according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result, from which Analyze the communication data uploaded by the power distribution terminal 101

In the technical solution of the present invention, a shared session key can be set between the power distribution terminal and the network access point device in advance to ensure the communication security between the power distribution terminal and the network access point device; The L2TP tunnel and IPSec tunnel are set up between the access point device and the main station server, and the transmission mode and content of the communication data transmitted between the network access point device and the main station server are protected by double encryption, ensuring that the network access point The communication between the device and the master server is secured. In this way, the power distribution terminal system provided by the present invention communicates through the communication data transmission channel encrypted by the session key and protected by the L2TP tunnel and the IPSec tunnel. Compared with the existing power distribution communication system, it has higher security. reliability.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as: ROM/RAM, Diskettes, CDs, etc.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications should also be It is regarded as the protection scope of the present invention.

Claims (10)

1. A communication method of a distribution and utilization communication system based on an LTE network, characterized in that, comprising: The power distribution terminal sends a session request carrying key negotiation parameters to the network access point device; After receiving the session request, the network access point device generates a session key according to the public key, the pre-stored private key, and the key negotiation parameters and returns it to the power distribution terminal; After receiving the session key, the power distribution terminal sends a Layer 2 Tunneling Protocol L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key to the network access point device; The network access point device receives the L2TP tunnel establishment request, parses and decrypts the first tunnel configuration parameter from it, and obtains the second tunnel configuration parameter from the master station server; according to the first tunnel configuration parameter and the second tunnel configuration parameter , generating an L2TP tunnel configuration negotiation result and sending it to the master station server, and returning a response message that the tunnel is established successfully to the power distribution terminal; After receiving the response information that the tunnel is successfully established, the power distribution terminal sends the communication data encrypted by the session key to the network access point device; The network access point device uses the session key to decrypt the communication data, and according to the L2TP tunnel configuration negotiation result, L2TP-encapsulates the decrypted communication data and sends it to the master station server; The master station server parses the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result. 2. The method according to claim 1, wherein the power distribution terminal sends a session request carrying key negotiation parameters to the network access point device, specifically comprising: The power distribution terminal sends the session request carrying the key negotiation parameters encrypted by the public key to the network access point device; and After receiving the session request, the network access point device generates a session key according to the public key, the pre-stored private key, and the key negotiation parameters, specifically including: The network access point device parses the key negotiation parameters encrypted by the public key from the session request, and uses the pre-stored private key to decrypt the key negotiation parameters encrypted by the public key to obtain the key negotiation parameters ; Generate a session key according to the public key, the private key, and the key negotiation parameters according to a preset Long Term Evolution LTE encryption algorithm. 3. The method according to claim 1, wherein the public key is specifically identification information of the network access point device; and Before generating the session key according to the public key, the pre-stored private key and the key negotiation parameters, it further includes: After receiving the session request, the network access point device sends its own identification information to the private key generator; The private key generator receives the identification information sent by the network access point device, and finds out the private key corresponding to the received identification information from the private key library storing the identification information of each access point of the LTE network, and searches The obtained private key is sent to the network access point device. 4. The method according to claim 1, wherein the network access point device receives the L2TP tunnel establishment request, parses and decrypts the first tunnel configuration parameter therefrom, and obtains the second tunnel configuration parameter from the master station server. Tunnel configuration parameters, including: After analyzing the first tunnel configuration parameter encrypted by the session key from the L2TP tunnel establishment request, the network access point device uses the session key to decrypt the first tunnel configuration parameter, and decrypts the decrypted second tunnel configuration parameter A tunnel configuration parameter is encapsulated in the L2TP tunnel connection request and sent to the master station server; The master station server parses out the first tunnel configuration parameter from the L2TP tunnel connection request, and sends an L2TP tunnel connection response carrying the second tunnel configuration parameter corresponding to the first tunnel configuration parameter to the network access point device information; The network access point device parses out the second tunnel configuration parameters from the L2TP tunnel connection response information. 5. The method according to claim 1, wherein after the power distribution terminal receives the session key, before returning the response information that the tunnel is established successfully to the power distribution terminal, further include: The power distribution terminal sends an Internet security protocol IPSec tunnel establishment request carrying the third tunnel configuration parameters encrypted by the session key to the network access point device; The network access point device receives the IPSec tunnel establishment request, parses and decrypts the third tunnel configuration parameter therefrom, and obtains the fourth tunnel configuration parameter from the main station server; according to the third tunnel configuration parameter and the fourth tunnel configuration parameter , generating an IPSec tunnel configuration negotiation result and sending it to the master station server; and After sending the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result to the master station server, return a response message indicating that the tunnel is established successfully to the power distribution terminal; and According to the L2TP tunnel configuration negotiation result, the decrypted communication data is L2TP encapsulated and then sent to the master station server, specifically including: The network access point device performs L2TP encapsulation and IPSec encapsulation on the decrypted communication data according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result, and sends the L2TP/IPSec data packet generated by the encapsulation to the main station server ;as well as The master station server parses the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result, specifically including: The master server parses the communication data from the received L2TP/IPSec data packet according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result. 6. The method according to claim 5, wherein the network access point device receives the IPSec tunnel establishment request, parses and decrypts the third tunnel configuration parameter therefrom, and obtains the fourth tunnel configuration parameter from the main station server. Tunnel configuration parameters, including: After analyzing the third tunnel configuration parameter encrypted by the session key from the IPSec tunnel establishment request, the network access point device uses the session key to decrypt the third tunnel configuration parameter, and decrypts the decrypted third tunnel configuration parameter. The three tunnel configuration parameters are encapsulated in the IPSec tunnel connection request and sent to the master server; The master station server parses the third tunnel configuration parameter from the IPSec tunnel connection request, and sends an IPSec tunnel connection response carrying the fourth tunnel configuration parameter corresponding to the third tunnel configuration parameter to the network access point device information; The network access point device parses out the fourth tunnel configuration parameter from the IPSec tunnel connection response information. 7. A power distribution and utilization communication system based on an LTE network, comprising: a power distribution terminal, a network access point device, and a master server; wherein, The power distribution terminal is used to send a session request carrying key negotiation parameters to the network access point device; after receiving the session key from the network access point device, send the session key to the network access point device Send an L2TP tunnel establishment request carrying the first tunnel configuration parameters encrypted by the session key; after receiving a response message that the tunnel is successfully established from the network access point device, send the communication data encrypted by the session key to to the network access point device; The network access point device is configured to, after receiving the session request from the power distribution terminal, generate a session key according to the public key, the pre-stored private key, and the key negotiation parameters, and send the session key to the power distribution terminal. The terminal returns; receiving the L2TP tunnel establishment request from the power distribution terminal, parsing and decrypting the first tunnel configuration parameter, and obtaining the second tunnel configuration parameter from the master station server; according to the first tunnel configuration parameter , and the second tunnel configuration parameters, generate an L2TP tunnel configuration negotiation result and send it to the master station server, and return a response message that the tunnel is successfully established to the power distribution terminal; receive the session information sent by the power distribution terminal After the key-encrypted communication data, use the session key to decrypt the communication data, and according to the L2TP tunnel configuration negotiation result, perform L2TP encapsulation on the decrypted communication data and send it to the master station server; The master station server is configured to parse out the communication data from the received L2TP data packet according to the L2TP tunnel configuration negotiation result. 8. The system of claim 7, further comprising: a private key generator; and The public key is specifically identification information of the network access point device; and The power distribution terminal is specifically configured to send the session request carrying the key negotiation parameters encrypted by the public key to the network access point device; and The network access point device is specifically configured to, after receiving the session request from the power distribution terminal, send its own identification information to the private key generator, and receive from the private key generator a private key corresponding to the identification information; parsing the key negotiation parameters encrypted by the public key from the session request, and using the private key pair corresponding to the identification information received from the private key generator The key negotiation parameters encrypted by the public key are decrypted to obtain the key negotiation parameters; according to the public key, the private key and the key negotiation parameters, according to the preset long-term evolution LTE encryption algorithm, a session is generated key; and The private key generator is configured to, after receiving the identification information sent by the network access point device, find out the key corresponding to the received identification information from the private key library storing the identification information of each access point of the LTE network. private key, and send the found private key to the network access point device. 9. The system according to claim 7, wherein the network access point device is specifically configured to parse out the L2TP tunnel establishment request from the L2TP tunnel establishment request after receiving the L2TP tunnel establishment request from the power distribution terminal The first tunnel configuration parameter encrypted by the session key is decrypted by the session key to obtain the first tunnel configuration parameter, and the decrypted first tunnel configuration parameter is encapsulated in an L2TP tunnel connection request and sent to the master station The server; after receiving the L2TP tunnel connection response information from the main station server, parse the second tunnel configuration parameter from the L2TP tunnel connection response information; and The master station server is specifically configured to, after receiving the L2TP tunnel connection request from the network access point device, parse the first tunnel configuration parameter from the L2TP tunnel connection request, and send the first tunnel configuration parameter to the network access point device with L2TP tunnel connection response information of the second tunnel configuration parameter corresponding to the first tunnel configuration parameter. 10. The system according to claim 7, wherein the power distribution terminal is further configured to send an IPSec packet carrying the third tunnel configuration parameters encrypted by the session key to the network access point device. a tunnel establishment request; and The network access point device is further configured to parse and decrypt the third tunnel configuration parameter from the IPSec tunnel establishment request sent by the power distribution terminal, and obtain the fourth tunnel configuration parameter from the main station server ; According to the third tunnel configuration parameter and the fourth tunnel configuration parameter, generate an IPSec tunnel configuration negotiation result and send it to the master station server; and send the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result to the master station server After the main station server, return the response information that the tunnel is successfully established to the power distribution terminal; use the session key to decrypt the communication data encrypted by the session key received from the power distribution terminal; according to the The L2TP tunnel configuration negotiation result, the IPSec tunnel configuration negotiation result, perform L2TP encapsulation and IPSec encapsulation on the decrypted communication data, and send the L2TP/IPSec data packet generated by the encapsulation to the master station server; and The master station server is further configured to parse out the communication data from the received L2TP/IPSec data packet according to the L2TP tunnel configuration negotiation result and the IPSec tunnel configuration negotiation result.