A kind of key management apparatus of metering automation system
Technical field
The invention mainly relates to measurement of power automatic technology and method, in more specific words it, the present invention relates to one kind
The key management method of Novel measuring automated system and the key management that secure encrypted transmission is carried out by way of key
Equipment.
Background technology
Current metering automation system data transmission is mainly carried out with clear data and password addend according to two methods.It is right
It is stored in the management of password using database.
It is primarily present following defect:Password is stored in database, administrator can be easy to view code data.
Password transmits in clear text manner substantially in transmission process, anyone can distort intercepted data, without being sent out
It is existing.The management of password is not classified, after the password in system obtains one, you can obtain all permissions.
Invention content
Present invention seek to address that defect in the prior art, using a kind of Novel measuring automated system key management
Equipment carries out secure encrypted transmission by way of key, and symmetric cryptographic algorithm with public key cryptosyst is combined, utilizes public key system
System is easy to the characteristic of encryption key distribution and the high efficiency of symmetric cryptographic algorithm.The hierarchical layered of key is carried out by key management system
Safety management.
In order to realize one of above-mentioned purpose of design, technical scheme of the present invention, propose a kind of key management apparatus, have three
Grade key management system, can carry out the key involved in application system unified, safe management.System uses three layer frames
Structure, i.e., it is and next to be passed in the form of cipher machine, in a manner of encipherment protection as the secondary master key needed for higher level generates next stage
Grade.
In order to realize above-mentioned purpose of design, the two of technical scheme of the present invention, it is proposed based on aforementioned management equipment a kind of close
Key management method, it is ensured that the safety of data message is sent, to prevent distorting and obtaining for unauthorized.
The designing scheme one of the present invention:A kind of key management apparatus of metering automation system, including mutually communicating connection
Level key management hardware group, the continuous data access system of further one outside of connection of the level key management hardware group
System wherein the level key management hardware group includes N number of level key management hardware, designs N number of level key management
Hardware is so that its etc. passes sequentially through data network and communicated connection.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, N-1 levels
Key management hardware includes at least encryption equipment N-1, Key Management server N-1 and client PC machine N-1.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, setting encryption
Machine N-1 is to receive the encrypted access session key group from last layer grade.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine N-1 is held to generate digital signature.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine N-1 is held further to generate discrete element N-1 and be back to encryption equipment N-1;
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is set
Management server N-1 is to connect the encryption equipment N-1 and client PC machine N-1, by the encrypted access session key group and number
Word signature is coupled or is generated random number L_N-1.
A kind of key management apparatus according to aforementioned metering automation system, the level key including mutually communicating connection
Hardware group is managed, the level key management hardware group further connects the continuous data access system of an outside, wherein institute
It states level key management hardware group and includes three level key management hardware:I grades of key management hardware, II grades of key management hardware
And III level key management hardware, design the I grades of key management hardware, II grades of key management hardware and III level key management
Hardware so that its etc. passes sequentially through data network and is communicated connection, wherein:
Pass through the data information of I grades of key management hardware acceptance external metrology data access arrangements;
By I grades of key management hardware access session key group is sent to II grades of key management hardware;
By II grades of key management hardware access session key group is sent to III level key management hardware.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, described I grades close
Key management hardware includes encryption equipment I, Key Management server I and client PC machine I, and wherein encryption equipment I is taken by key management
Business device I is connected to client PC machine I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I is to receive and read the digital signature from client PC machine I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I is to obtain the access session key group of encryption equipment I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I gives client PC machine I to return to an access session key.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I gives client PC machine I to return to a random number L_1.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine I is held to generate discrete element I and be back to encryption equipment I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, setting encryption
Machine I is to generate second-level access session key group.
It is II grades described in the preferred embodiment of the key management apparatus of metering automation system of the present invention according to aforementioned
Key management hardware includes encryption equipment II, Key Management server II and client PC machine II, wherein encryption equipment II pass through key
Management server II is connected to client PC machine II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, feature exists
In:Encryption equipment II is designed to receive the second-level access session key group or generation three-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, the encryption
Machine II is further provided with the storage device for storing the second-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II is to receive and read the digital signature from client PC machine II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II is to obtain the access session key group of encryption equipment II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II gives client PC machine II to return to an access session key.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II gives client PC machine II to return to a random number L_2.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine II is held to generate discrete element II and be back to encryption equipment II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, design encryption
Machine II is to generate three-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, the III level
Key management hardware includes encryption equipment III, Key Management server III and client PC machine III, and wherein encryption equipment III passes through
Key Management server III is connected to client PC machine III.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, design encryption
Machine III is to receive the second-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, the encryption
Machine III is further provided with the storage device for storing the three-level access session key group.
The designing scheme two of the present invention:A kind of key management method of metering automation system, the system comprises bases
Aforementioned key management apparatus, including:
1)Digital signature is sent to Key Management server N-1 by client PC machine N-1;
2)The digital signature is identified, and access encryption equipment N-1 to obtain N-1 grades of visits by Key Management server N-1
Ask session key group;
3)Key Management server N-1 returns to signed N-1 grades access session key group and a random number L_N-1 extremely
Client PC machine N-1;
4)Discrete element N- is generated according to N-1 grades of access session key groups and random number L_N-1 by client PC machine N-1
1, return to encryption equipment N-1;
5)N grades of access meetings are generated according to the N-1 grades of access session key group and discrete element N-1 by encryption equipment N-1
Key group is talked about, client PC machine N-1 is back to after being encrypted by a session key;
6)Encrypted N-1 grades of access session key group is sent to by n-th layer grade key management by client PC machine N-1
The encryption equipment N of hardware;
7)Encrypted N grades of access session key group is decrypted and stored by the encryption equipment N.
According to aforementioned, in a preferred embodiment of the invention, the encryption equipment N is further provided with storing the N
The storage device of grade access session key group.
Present application addresses the key management security problems in metering automation system, realize the generation of key, backup, divide
Hair, the lifecycle management for transmitting, deleting and destroying.Key transmission process all by dispersion, externally it is invisible.Using
Three-tier architecture that is, as the secondary master key needed for higher level generates next stage, and is transmitted by the form of cipher machine, in a manner of encipherment protection
To next stage.
Description of the drawings
The preferred embodiment of the present invention will be described in detail in the form of with reference to attached drawing, wherein
Fig. 1 is the structure principle chart of the key management apparatus in metering automation system of the present invention.
Specific embodiment
Embodiment one:
A kind of key management apparatus of metering automation system, the level key management hardware including mutually communicating connection
Group, the level key management hardware group further connects the continuous data access system of an outside, wherein the level is close
Key management hardware group includes N number of level key management hardware, designs N number of level key management hardware so that its grade is led to successively
It crosses data network and is communicated connection.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, N-1 levels
Key management hardware includes at least encryption equipment N-1, Key Management server N-1 and client PC machine N-1.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, setting encryption
Machine N-1 is to receive the encrypted access session key group from last layer grade.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine N-1 is held to generate digital signature.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine N-1 is held further to generate discrete element N-1 and be back to encryption equipment N-1;
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is set
Management server N-1 is to connect the encryption equipment N-1 and client PC machine N-1, by the encrypted access session key group and number
Word signature is coupled or is generated random number L_N-1.
A kind of key management apparatus according to aforementioned metering automation system, the level key including mutually communicating connection
Hardware group is managed, the level key management hardware group further connects the continuous data access system of an outside, wherein institute
It states level key management hardware group and includes three level key management hardware:I grades of key management hardware 10, II grades of key managements are hard
Part 20 and III level key management hardware 30 design the I grades of key management hardware 10, II grades of key management hardware 20 and III
Grade key management hardware 30 so that its etc. passes sequentially through data network and is communicated connection, wherein:
The data information of external metrology data access arrangement is received by I grades of key management hardware 10;
By I grades of key management hardware 10 access session key group is sent to II grades of key management hardware 20;
By II grades of key management hardware 20 access session key group is sent to III level key management hardware 30.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, described I grades close
Key management hardware 10 includes encryption equipment I, Key Management server I and client PC machine I, wherein encryption equipment I pass through key management
Server I is connected to client PC machine I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I is to receive and read the digital signature from client PC machine I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I is to obtain the access session key group of encryption equipment I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I gives client PC machine I to return to an access session key.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server I gives client PC machine I to return to a random number L_1.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine I is held to generate discrete element I and be back to encryption equipment I.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, setting encryption
Machine I is to generate second-level access session key group.
It is II grades described in the preferred embodiment of the key management apparatus of metering automation system of the present invention according to aforementioned
Key management hardware 20 includes encryption equipment II, Key Management server II and client PC machine II, and wherein encryption equipment II passes through close
Key management server II is connected to client PC machine II.
It is characterized in that:Design encryption equipment II is accessed with receiving the second-level access session key group or generation three-level
Session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, the encryption
Machine II is further provided with the storage device for storing the second-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II is to receive and read the digital signature from client PC machine II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II is to obtain the access session key group of encryption equipment II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II gives client PC machine II to return to an access session key.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, key is designed
Management server II gives client PC machine II to return to a random number L_2.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, client is set
PC machine II is held to generate discrete element II and be back to encryption equipment II.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, design encryption
Machine II is to generate three-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, the III level
Key management hardware 30 includes encryption equipment III, Key Management server III and client PC machine III, and wherein encryption equipment III leads to
It crosses Key Management server III and is connected to client PC machine III.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, design encryption
Machine III is to receive the second-level access session key group.
According to aforementioned, in the preferred embodiment of the key management apparatus of metering automation system of the present invention, the encryption
Machine III is further provided with the storage device for storing the three-level access session key group.
Embodiment two:
A kind of key management method of metering automation system, the system comprises according to aforementioned key management apparatus,
It includes:
1)Digital signature is sent to Key Management server N-1 by client PC machine N-1;
2)The digital signature is identified, and access encryption equipment N-1 to obtain N-1 grades of visits by Key Management server N-1
Ask session key group;
3)Key Management server N-1 returns to signed N-1 grades access session key group and a random number L_N-1 extremely
Client PC machine N-1;
4)Discrete element N- is generated according to N-1 grades of access session key groups and random number L_N-1 by client PC machine N-1
1, return to encryption equipment N-1;
5)N grades of access meetings are generated according to the N-1 grades of access session key group and discrete element N-1 by encryption equipment N-1
Key group is talked about, client PC machine N-1 is back to after being encrypted by a session key;
6)Encrypted N-1 grades of access session key group is sent to by n-th layer grade key management by client PC machine N-1
The encryption equipment N of hardware;
7)Encrypted N grades of access session key group is decrypted and stored by the encryption equipment N.
According to aforementioned, in a preferred embodiment of the invention, the encryption equipment N is further provided with storing the N
The storage device of grade access session key group.
It these are only the preferred embodiment of the present invention, be not the limitation to technical solution of the present invention.It is to be appreciated that one
Technology modification, replacement or the combination made based on the present invention are cut, should all be covered by the technology that appended claims of the present invention are advocated
In scope.