CN108810023A - Safe encryption method, key sharing method and safety encryption isolation gateway - Google Patents

Abstract

The invention discloses a security encryption method, a key sharing method and a security encryption isolation gateway. The security encryption method includes the following steps: receiving a data packet on the downlink; inquiring whether there is a session of a receiver terminal receiving the data packet locally key; if there is no session key locally, query the key sharing server for the session key of the receiver terminal receiving the data packet; if the key sharing server does not have a session key, start the session key negotiation process; if Through the session key negotiation process, it is judged that the receiving terminal is a legitimate user, and the data packet is encrypted using the session key; MAC operation is performed on the encrypted data packet to obtain the MAC part of the data packet; and the encrypted data packet is And the MAC part of the data packet is encapsulated into a SAL protocol message. The security encryption method of the invention can effectively prevent attacks from external networks and virus infiltration, and has high security and reliability.

Description

Security encryption method, key sharing method and security encryption isolation gateway

technical field

The invention relates to the field of electric power information systems, in particular to a power-specific security encryption method, a key sharing method and a security encryption isolation gateway.

Background technique

The electricity information collection system (referred to as the electricity collection system) is a key business system in the electricity infrastructure of residents and enterprises, which includes: the master station of the collection system, communication channels, communication front-end and terminal equipment. The mining system is deployed centrally, and the terminal equipment is connected to the master station of the mining system through the operator's GPRS/CDMA/3G/4G wireless APN private network, 230 wireless private network, Beidou network and other wireless private networks and optical fiber dedicated channels. However, the master station of the adoption system is vulnerable to various attacks from the public network, so it is necessary to strengthen security protection in the access area of the master station of the adoption system to achieve network isolation, terminal identity authentication, and business protocols for the master station of the adoption system. Filtering and business message transmission protection, etc., so as to reduce the risk of intrusion at the access boundary of the main station system.

From a functional point of view, traditional security access gateway equipment mainly implements security authentication and access of terminals through the security channel layer, and establishes two-way encrypted tunnels to encrypt application system data. The security access gateway device of encryption algorithm SM1/SM2/SM3. At the same time, traditional security access gateway equipment generally does not have the function of network security isolation, nor can it meet the requirements of a large number of terminals in the mining system and high equipment performance (SM1 encryption rate 2.4Gbps, SM2 signature rate 20000TPS, SM2 signature rate 10000TPS , SM3 computing rate 8Gbps, terminal access capacity 600,000/set).

The information disclosed in this Background section is only for enhancing the understanding of the general background of the present invention and should not be taken as an acknowledgment or any form of suggestion that the information constitutes the prior art that is already known to those skilled in the art.

Contents of the invention

The purpose of the present invention is to provide a security encryption method dedicated to electric power, which can effectively prevent attacks from external networks and has high reliability.

Another object of the present invention is to provide a key sharing method and a secure encryption isolation gateway.

In order to achieve the above object, the present invention provides a power-specific security encryption method, comprising the following steps: receiving the data packet on the downlink; inquiring whether there is a session key of the receiver terminal receiving the data packet locally; session key, then query the key sharing server whether there is a session key of the receiver terminal receiving the data packet; if the key sharing server does not have a session key, start the session key negotiation process; if the session key negotiation process , to determine that the receiving terminal is a legitimate user, then use the session key to encrypt the data packet; perform a MAC operation on the encrypted data packet to obtain the MAC part of the data packet; and convert the encrypted data packet and the MAC part of the data packet Encapsulated into SAL protocol packets.

In a preferred embodiment, wherein, the session key negotiation process includes the following steps: sending a session establishment request message to the receiver terminal; judging the identity of the security gateway by the receiver terminal based on the session establishment request message; if it is judged that the security gateway is The legal security gateway sends a session establishment response message by the receiver terminal; the security gateway performs signature verification on the session establishment response message; if it judges that the receiver terminal is a legitimate user, then sends a key negotiation request message to the receiver terminal; And after receiving the key agreement request message, the receiver terminal sends a key agreement response message.

The present invention also provides a security encryption method dedicated to electric power, which includes the following steps: receiving the data packet on the uplink; performing head and tail verification and decapsulation on the data packet; querying whether there is a sender terminal locally sending the data packet session key; if there is no session key locally, query the key sharing server for the session key of the sender terminal that sends the data packet; if the key sharing server does not have a session key, start the session key negotiation process ; If it is determined that the sender terminal is a legal user through the session key negotiation process, then use the negotiated session key to decrypt the data packet; and send the decrypted data packet to the collection front end.

In a preferred embodiment, the session key negotiation process includes the following steps: sending a session establishment request message to the sender terminal; judging the identity of the security gateway by the sender terminal based on the session establishment request message; Gateway, the sender terminal sends a session establishment response message; the security gateway performs signature verification on the session establishment response message; if it is judged that the sender terminal is a legitimate user, it sends a key negotiation request message to the sender terminal; After receiving the key agreement request message, the sender terminal sends a key agreement response message.

In a preferred embodiment, if there is a session key of the sender terminal that sends the data packet locally, the following operations are performed: MAC calculation is performed on the decapsulated data packet; the calculated MAC is compared with the decapsulated data MAC in the packet; if the calculated MAC is the same as the MAC in the decapsulated data packet, then use the session key to decrypt the data packet; send the decrypted data packet to the collection front; if the calculated MAC If it is different from the MAC in the decapsulated data packet, an error response data packet is generated, and the error response data packet is sent to the acquisition front end.

The present invention also provides a security encryption isolation gateway, which is respectively connected to the acquisition front-end and communication front-end communication, the acquisition front-end is configured to receive data packets on the downlink, and the security encryption isolation gateway includes: an intranet processing unit ; the external network processing unit; and the isolation switching unit, the isolation switching unit is configured to: check whether there is a session key of the receiver terminal receiving the data packet locally; if there is no session key locally, then query the key sharing server for whether there is The session key of the receiving terminal receiving the data packet; if the key sharing server does not have a session key, start the session key negotiation process; if the receiving terminal is determined to be a legal user through the session key negotiation process, then control the cryptographic operation The unit uses the session key to encrypt the data packet; performs MAC operation on the encrypted data packet to obtain the MAC part of the data packet; and encapsulates the encrypted data packet and the MAC part of the data packet into a SAL protocol message.

The present invention also provides a security encryption isolation gateway, which is connected to the acquisition front-end and the communication front-end respectively. The communication front-end is configured to receive data packets on the uplink, and the security encryption isolation gateway includes: an intranet processing unit ; the external network processing unit; and the isolation switching unit, the isolation switching unit is configured to: perform head-to-tail verification and decapsulation on the data packet; query whether there is a session key of the sender terminal that sends the data packet locally; if there is no session locally Key, then query the key sharing server whether there is a session key of the sender terminal that sends the data packet; if the key sharing server does not have a session key, start the session key negotiation process; if via the session key negotiation process, If it is judged that the sender terminal is a legitimate user, then the data packet is decrypted by using the negotiated session key; and the decrypted data packet is sent to the acquisition front end.

In a preferred embodiment, if there is a session key of the sender terminal that sends the data packet locally, the following operations are performed: MAC calculation is performed on the decapsulated data packet; the calculated MAC is compared with the decapsulated data MAC in the packet; if the calculated MAC is the same as the MAC in the decapsulated packet, then use the session key to decrypt the packet; send the decrypted packet to the acquisition front; and if the computed If the MAC is different from the MAC in the decapsulated data packet, an error response data packet is generated, and the error response data packet is sent to the acquisition front end.

The present invention provides a power-specific security key sharing method, comprising the following steps: receiving a data packet on the downlink; inquiring whether there is a session key of the receiver terminal receiving the data packet locally; if there is no session key locally , then query the key sharing server whether there is a session key of the receiver terminal receiving the data packet; if the key sharing server does not have a session key, start the session key negotiation process; after completing the session key negotiation process, generate session key; and uploading the generated session key to a shared server in real time, wherein the shared server can share the stored session key to multiple different gateways.

Compared with the prior art, the power-specific security encryption method, key sharing method and security encryption isolation gateway of the present invention have the following advantages: the security encryption isolation gateway of the present invention is completely based on the national secret algorithm SM1/SM2/SM3, and adopts red The black isolation architecture and password-based isolation technology realize the logical isolation of the system's internal network and external network, effectively preventing attacks and virus penetration from the external network; preventing cross-network intrusion of illegal data through technologies such as protocol blocking, format checking, and protocol analysis; Build a secure channel between the gateway and the collection terminal, encrypt and encapsulate the data and calculate the message authentication code to provide the confidentiality and integrity of the transport layer; use a dedicated hardware cryptographic processing unit and a multi-core concurrent processor to provide massive terminal access support and high-speed reporting Text encryption and decryption processing; high reliability is provided through session key sharing and hierarchical key protection mechanisms. The secure encrypted isolation gateway of the present invention has significantly improved algorithm performance, security, reliability, availability, etc., has good business matching with the mining system, and can meet the business security requirements and performance requirements of the mining system.

Description of drawings

Fig. 1 is a method flowchart of a power-specific security encryption method according to a preferred embodiment of the present invention.

Fig. 2 is a method flowchart of a power-specific security encryption method according to another preferred embodiment of the present invention.

Fig. 3 is a method flowchart of a power-specific security key sharing method according to another preferred embodiment of the present invention.

Fig. 4 is a compositional logic diagram of a power-specific security encryption isolation gateway according to a preferred embodiment of the present invention.

Fig. 5 is a schematic diagram of the physical composition of an isolation card according to a preferred embodiment of the present invention.

Fig. 6 is a schematic diagram of a SAL encapsulation format according to a preferred embodiment of the present invention.

Fig. 7 is an information flowchart of terminal identity authentication and key agreement processing according to a preferred implementation manner of the present invention.

Fig. 8 is a schematic structural diagram of a key sharing system according to a preferred embodiment of the present invention.

Detailed ways

The specific embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific embodiments.

Unless expressly stated otherwise, throughout the specification and claims, the term "comprise" or variations thereof such as "includes" or "includes" and the like will be understood to include the stated elements or constituents, and not Other elements or other components are not excluded.

As shown in Figure 1, the security encryption method of a preferred embodiment of the present invention includes the following steps: Step 101: receive the data packet on the downlink; key; Step 103: If there is no session key locally, then query the key sharing server whether there is a session key of the receiver terminal receiving the data packet; Step 104: If the key sharing server does not have a session key, start the session key Key negotiation process; Step 105: If the receiving terminal is determined to be a legal user through the session key negotiation process, then use the session key to encrypt the data packet; Step 106: Perform MAC operation on the encrypted data packet to obtain the data packet the MAC part of the packet; and step 107: encapsulating the encrypted data packet and the MAC part of the data packet into a SAL protocol message.

In the above scheme, wherein, the session key negotiation process includes the following steps: sending a session establishment request message to the receiver terminal; judging the security gateway identity based on the session establishment request message by the receiver terminal; if it is judged that the security gateway is a legitimate security gateway, The session establishment response message is sent by the receiver terminal; the signature verification is performed on the session establishment response message by the security gateway; if it is determined that the receiver terminal is a legal user, a key negotiation request message is sent to the receiver terminal; and after receiving After the key agreement request message, the receiver terminal sends a key agreement response message.

As shown in Figure 2, the security encryption method of a preferred embodiment of the present invention comprises the following steps: Step 201: receive the data packet on the uplink; Step 202: carry out head and tail verification and decapsulation to the data packet; Step 203 : inquire whether there is a session key of the sender terminal sending the data packet locally; step 204: if there is no session key locally, then query the key sharing server whether there is a session key of the sender terminal sending the data packet; step 205 : If the key sharing server does not have a session key, then start the session key negotiation process; Step 206: If it is determined that the sender terminal is a legitimate user through the session key negotiation process, then use the negotiated session key to pair the data packet Decryption; Step 207: Send the decrypted data packet to the acquisition front end.

As shown in Figure 3, the present invention also provides a power-specific security key sharing method, the security key sharing method includes the following steps: Step 301: Receive the data packet on the downlink; Step 302: Query whether the local There is the session key of the receiver terminal receiving the data packet; step 303: if there is no session key locally, then query whether there is a session key of the receiver terminal receiving the data packet to the key sharing server; step 304: if the key If the shared server does not have a session key, then start the session key negotiation process; step 305: after completing the session key negotiation process, generate a session key; and step 306: upload the generated session key to the shared server in real time, wherein , the sharing server can share the stored session key to multiple different gateways.

As shown in Figure 4, the security encryption isolation gateway of an embodiment of the present invention is respectively connected with the acquisition front-end and the communication front-end communication, and the security encryption isolation gateway includes: an internal network processing unit; an external network processing unit; and an isolation exchange unit and Cryptographic processing unit. The external network processing unit is connected to the external network of the mining system, and the internal network processing unit is connected to the internal network of the mining system. The external network processing unit and the internal network processing unit are configured with dual network cards in different VLANs, and the application layer data payload is transmitted through the isolation switching unit in the middle. Therefore, the important internal network segments of the mining system are logically isolated from the external network, reducing the risk of border intrusion. The cryptographic operation unit of the power-specific security encryption isolation gateway provides cryptographic services based on the national secret algorithm, and based on this, realizes the identity authentication of the device to the collection terminal, the session key negotiation between the device and the collection terminal, and the communication between the device and the collection terminal. Sensitive message encryption.

The isolation switching unit is located between the internal network processing unit and the external network processing unit, and hardware is used to ensure the security isolation of the internal and external network; the password processing unit is located on the upper side of the isolation switching unit, and provides password services for the flow-through processing of the isolation switching unit; external network data Only after password verification and decryption processing by the password processing unit can it enter the internal network unit, effectively preventing the internal network from being attacked from the external network.

In order to realize the physical isolation of the internal and external networks, the internal and external networks and each network isolation interface are realized by isolation cards, which communicate with their respective backplanes through the PCIE8X interface; the isolation cards are forwarded interactively through the optical port, and the forwarding rate is 2.4Gbps; the isolation card adopts FPGA design, including: hardware DMA controller, isolated data storage area, isolated switch control unit, PCIE IP core. Fig. 5 is a schematic diagram of the physical composition of an isolation card according to an embodiment of the present invention. As shown in the figure, the isolation card includes: a hardware DMA controller 501 , an isolation data storage area 502 , an isolation exchange control unit 503 , and a PCIE IP core 504 .

A transport layer encryption channel is established between the gateway and the terminal to encapsulate, encrypt and protect the integrity of the power consumption information collection protocol that the collection server and the terminal interact to ensure that the application protocol and business data are invisible to the public network and prevent the use of the SAL protocol to station to attack. Fig. 6 is a schematic diagram of a SAL encapsulation format according to an embodiment of the present invention. As shown in Fig. 6, the steps of encapsulation and encryption are: SAL encapsulation; encryption processing; adding a SAL header and a SAL tail before and after the ciphertext; The text is checked for integrity. The steps of decryption and decapsulation are: check and calculate the header and trailer twice to verify the integrity of the message; decrypt the application data, and calculate and verify the CRC of the application data at the same time. Passing the verification not only indicates that the decryption is correct, but also indicates that the message comes from a legal terminal.

As shown in FIG. 7 , the terminal identity authentication and key negotiation processing in one embodiment of the present invention is specifically as follows: taking the uplink communication process as an example, when the terminal needs to send information to the intranet, the terminal first sends a login message 701, The acquisition device sends a login response message 702 after receiving the login message, and the terminal starts a handshake process after receiving the login response message 702 . The handshake process includes: sending a session establishment request message 703 to the sender terminal; judging the security gateway identity based on the session establishment request message by the sender terminal; if judging that the security gateway is a legitimate security gateway, sending a session establishment response message by the sender terminal 704; the security gateway performs signature verification on the session establishment response message; if it is determined that the sender terminal is a legitimate user, then send a key negotiation request message 705 to the sender terminal; and after receiving the key negotiation request message, The key negotiation response message 706 is sent by the sender terminal.

As shown in Figure 8, a key sharing system in a preferred embodiment of the present invention includes a gateway A, a gateway B, a terminal, and a key sharing server, wherein the terminal can negotiate a key with gateway A, and gateway A can use the The key is uploaded to the key sharing server. When gateway A is damaged, another gateway B can request a key from the key sharing server and verify the terminal. Through the key sharing mechanism, the "balanced distribution, backup sharing, invulnerability and persistence, and effective connection" of gateway services are realized, thereby improving the overall availability and reliability of the system.

The power-specific security encryption isolation gateway of the present invention adopts an independently designed ASIC hardware isolation card, and achieves physical isolation of the internal and external network through the isolation card. Multi-CPU, multi-core high-performance Xeon hardware platform, adopts multi-thread parallel operation mechanism in software architecture design to adapt to multi-core hardware platform, adopts thread pool, multi-buffer and asynchronous processing technologies to realize high-speed and large concurrent processing of business data.

The power-specific security encryption isolation gateway adopts the latest I/O technology, and utilizes the high-speed data exchange capability of PCIE GEN3 to achieve the data processing rate required by large concurrency. Among them: the network interface uses a 10-gigabit network card connected by optical fiber to communicate with the outside, and the isolation exchange unit adopts The PCIE GEN3X8 interface is connected to the internal and external network hosts to realize high-speed data transfer between the internal and external hosts. The cryptographic operation unit uses the PCIE GEN3X8 interface to connect with the internal computer to realize high-speed cryptographic operations and processing of large concurrent data.

The cryptographic operation unit adopts a parallel redundant design. Each intranet host is equipped with a multi-channel cryptographic operation unit. The scheduling algorithm designed for large concurrency is used to schedule the parallel operation of multiple cryptographic operation units to make full use of the hardware computing power of the cryptographic operation unit. The security encryption isolation device dedicated to electric power is equipped with multiple SM1 algorithm chips. At the same time, a software module for algorithm parallel call processing is developed on the cryptographic operation module. The algorithm chip works in an asynchronous call mode, and the algorithm parallel call processing module queries each algorithm chip in real time. According to the busyness and idleness, the algorithm operation is allocated according to the busyness, and at the same time, the corresponding relationship between the response message and the request message of the algorithm chip is maintained. Finally, through the cooperation of software and hardware, the local call of SM1 algorithm can reach about 3Gbits.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

The foregoing descriptions of specific exemplary embodiments of the present invention have been presented for purposes of illustration and description. These descriptions are not intended to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling others skilled in the art to make and use various exemplary embodiments of the invention, as well as various Choose and change. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims (9)

1. a kind of dedicated safe encryption method of electric power, which is characterized in that the safe encryption method includes the following steps：

Receive the data packet on downlink；

The local session key for whether having the receiving side terminal for receiving the data packet of inquiry；

If local without the session key, whether there is the reception for receiving the data packet to the inquiry of key shared server The session key of square terminal；

If the key shared server does not have the session key, start session key agreement flow；

If via the session key agreement flow, the receiving side terminal is judged for validated user, then uses session key The data packet is encrypted；

To carrying out MAC operation by encrypted data packet, the parts MAC of data packet are obtained；And

By it is described by the MAC partial encapsulations of encrypted data packet and the data packet be SAL protocol massages.

2. safe encryption method as described in claim 1, which is characterized in that wherein, the session key agreement flow includes Following steps：

Session establishment request message is sent to the receiving side terminal；

Security gateway identity is judged based on the session establishment request message by the receiving side terminal；

If it is determined that the security gateway is legitimate secure gateway, session establishment response message is sent by the receiving side terminal；

Signature verification is carried out to the session establishment response message by the security gateway；

If it is determined that the receiving side terminal is validated user, then key negotiation request message is sent to the receiving side terminal； And

After receiving the key negotiation request message, key negotiation response message is sent by the receiving side terminal.

3. a kind of dedicated safe encryption method of electric power, which is characterized in that the safe encryption method includes the following steps：

Receive the data packet in uplink；

The data packet verify and decapsulate end to end；

The local session key for whether having the sending side terminal for sending the data packet of inquiry；

If local without the session key, whether there is the transmission for sending the data packet to the inquiry of key shared server The session key of square terminal；

If the key shared server does not have the session key, start session key agreement flow；

If via the session key agreement flow, described sender terminal is judged for validated user, then using by negotiating The data packet is decrypted in obtained session key；And

It is preposition that data packet after decryption is sent to acquisition.

4. safe encryption method as claimed in claim 3, which is characterized in that the session key agreement flow includes following step Suddenly：

Session establishment request message is sent to described sender terminal；

Security gateway identity is judged based on the session establishment request message by described sender terminal；

If it is determined that the security gateway is legitimate secure gateway, session establishment response message is sent by described sender terminal；

Signature verification is carried out to the session establishment response message by the security gateway；

If it is determined that described sender terminal is validated user, then key negotiation request message is sent to described sender terminal； And

After receiving the key negotiation request message, key negotiation response message is sent by described sender terminal.

5. safe encryption method as claimed in claim 3, which is characterized in that if local have the hair for sending the data packet The session key of the side's of sending terminal then executes following operation：

MAC calculating is carried out to the data packet after decapsulation；

Compare the MAC in the data packet after calculated MAC and decapsulation；

If the MAC calculated is identical as the MAC in the data packet after decapsulation, using the session key to the data Packet is decrypted；

It is preposition that data packet after decryption is sent to acquisition；And

If the MAC in data packet after the MAC calculated and decapsulation is differed, generation error response data packet, and will It is preposition that the errored response data packet is sent to acquisition.

6. a kind of dedicated safety encryption isolation gateway of electric power, which is characterized in that the safety encryption isolation gateway respectively with adopt Collect preposition and communicate preposition communication connection, the acquisition is preposition to be configured as receiving the data packet on downlink, the safety Gateway is isolated in encryption：

Intranet processing unit；

Outer net processing unit；With

Crosspoint is isolated, the isolation crosspoint is configured as：

The local session key for whether having the receiving side terminal for receiving the data packet of inquiry；

If local without the session key, whether there is the reception for receiving the data packet to the inquiry of key shared server The session key of square terminal；

If the key shared server does not have the session key, start session key agreement flow；

If via the session key agreement flow, judge that the receiving side terminal for validated user, then controls crypto-operation Unit is encrypted the data packet using session key；

To carrying out MAC operation by encrypted data packet, the parts MAC of data packet are obtained；And

By it is described by the MAC partial encapsulations of encrypted data packet and the data packet be SAL protocol massages.

7. a kind of dedicated safety encryption isolation gateway of electric power, which is characterized in that the safety encryption isolation gateway respectively with adopt Collect preposition and communicate preposition communication connection, the communication is preposition to be configured as receiving the data packet in uplink, the safety Gateway is isolated in encryption：

Intranet processing unit；

Outer net processing unit；With

Crosspoint is isolated, the isolation crosspoint is configured as：

The data packet verify and decapsulate end to end；

The local session key for whether having the sending side terminal for sending the data packet of inquiry；

If local without the session key, whether there is the transmission for sending the data packet to the inquiry of key shared server The session key of square terminal；

If the key shared server does not have the session key, start session key agreement flow；

If via the session key agreement flow, described sender terminal is judged for validated user, then using by negotiating The data packet is decrypted in obtained session key；And

It is preposition that data packet after decryption is sent to acquisition.

8. safety encryption isolation gateway as claimed in claim 7, which is characterized in that send the data packet if locally had Sending side terminal session key, then execute following operation：

MAC calculating is carried out to the data packet after decapsulation；

Compare the MAC in the data packet after calculated MAC and decapsulation；

If the MAC calculated is identical as the MAC in the data packet after decapsulation, using the session key to the data Packet is decrypted；

It is preposition that data packet after decryption is sent to acquisition；And

If the MAC in data packet after the MAC calculated and decapsulation is differed, generation error response data packet, and will It is preposition that the errored response data packet is sent to acquisition.

9. a kind of dedicated security key sharing method of electric power, which is characterized in that the security key sharing method includes as follows Step：

Receive the data packet on downlink；

The local session key for whether having the receiving side terminal for receiving the data packet of inquiry；

If local without the session key, whether there is the reception for receiving the data packet to the inquiry of key shared server The session key of square terminal；

If the key shared server does not have the session key, start session key agreement flow；

After completing the session key agreement flow, session key is generated；And

The session key generated is uploaded into the shared server in real time, wherein the shared server can will be deposited The session key of storage shares to multiple and different gateways.