CN110545289B - Error data injection attack defense method based on mixed homomorphic encryption - Google Patents

Abstract

The invention discloses a mixed homomorphic encryption-based error data injection attack defense method, which comprises the steps of firstly constructing an attack vector to obtain the influence of a system state estimation result so as to obtain an object needing encryption protection, and rewriting a static Kalman filtering state estimation algorithm iteration process to obtain an iteration form supporting a mixed homomorphic encryption process; then designing a quantization and mapping method from a real number domain to a plaintext space to adapt to homomorphic encryption operation, and respectively designing communication protocols for executing an addition homomorphic algorithm and a multiplication homomorphic algorithm; and finally, defining different groups participating in the state estimation algorithm, designing calculation tasks required to be executed by the different groups, and further designing an encryption state estimation protocol for ensuring the data security in the calculation and communication processes. The protocol solves the problem that the reliability and the accuracy of the calculation result from the plain text domain to the cipher text domain are difficult to guarantee, considers the requirement of each party on data confidentiality, and can effectively resist the injection attack of error data in an information physical system.

Description

False data injection attack defense method based on hybrid homomorphic encryption

technical field

The invention relates to the field of cyber-physical system security, in particular to the defense against wrong data injection attack of system state estimation.

Background technique

With the development of information technology, the pace of traditional industrial systems towards informatization and intelligence has accelerated, and an open, efficient and reliable information-physical fusion system has gradually formed. Due to the deep integration of information technology and physical technology, various security problems faced by information systems have gradually penetrated into physical systems. In particular, the introduction of more and more smart instruments, general-purpose computers, and general-purpose communication protocols makes the originally closed physical system possible to be attacked from information systems. In 2015, the Ukrainian power grid was attacked by a "dark energy virus".

System state estimation is an indispensable functional module in cyber-physical systems to estimate the real state of the system based on the noisy measurement data collected by the Supervisory Control System for Data Acquisition (SCADA). For example, in power systems, state estimation is the basis for optimal power flow, fault analysis, and economic dispatch. The process of state estimation is shown in Fig. 1, which includes three parts. The sensing part measures the industrial field data and transmits it to the estimator through the public network. The estimator (usually located in the control center) executes the estimation algorithm in combination with the system model, and judges whether the measurement data has bad data according to the estimation result. Finally, the estimator will estimate the result. It is transmitted to the units that need to be applied, such as controllers, fault analysis departments, etc. However, a large body of work has shown that the structure of state estimation is extremely vulnerable to attacks, such as data hijacking or tampering of communication channels. Bad data injection attacks constructed by attackers can arbitrarily change the measurements while bypassing bad data detectors in state estimation algorithms.

At present, a large number of studies only consider that the measurement data is stolen and attacked during the transmission process, and rarely analyze the security of the estimator. In fact, the estimator is more threatened. The attacker can gain more system knowledge by targeting the estimator. First, estimators are generally provided by third-party manufacturers, which may have backdoors or vulnerabilities. Secondly, the estimator collects industrial field data, system state estimation results and system model parameters. Since these data directly reflect the operating status and physical characteristics of the system, they are extremely important to the system side. Therefore, the intrusion estimator can obtain a comprehensive system information to perform more stealthy attacks. In addition, as the scale of the system increases, in order to achieve real-time control and monitoring, the system side may outsource the task of state estimation to a third-party server or cloud service provider, making the key data of the system side more likely to be stolen and utilized. Using these data, attackers can construct a strong concealment error data injection attack strategy, causing huge physical damage and economic losses to the system. Therefore, it is especially important to protect the data in the estimator.

The use of encryption technology to ensure data security has always been a hot research topic in the field of security. At present, most researches mainly focus on how to protect the data security in the communication channel, and there is a lack of research on the data security in the computing unit. The advantage of communication data encryption is that it can realize lightweight transmission of data, but the disadvantage is that it needs to distribute secret keys in real time and establish a trusted secret key management center. Moreover, it cannot guarantee that the data participates in the operation in the ciphertext state. In the computing unit, such as the estimator, all the data involved in the operation are still in the state of plaintext. In recent years, some works have adopted the idea of secure multi-party computation to realize the state estimation algorithm in the ciphertext domain. However, the computation protocol is complicated and extra complicated communication process needs to be added. The invention adopts the hybrid homomorphic encryption scheme, and combines the homomorphic characteristics of addition and multiplication to realize the full ciphertext operation of the state estimation process, and at the same time guarantees the data security in the communication channel and the estimator.

SUMMARY OF THE INVENTION

In order to realize the protection of system measurement data and system model parameters, and to solve the problem that the existing method cannot realize the ciphertext domain operation or the communication load is large, the present invention provides a state estimation operation process performed in a full ciphertext state, with additional traffic The encryption estimation algorithm with few operation results and effective results can protect the key data in the communication channel and the estimator at the same time, so as to resist the concealed error data injection attack.

The technical scheme adopted by the present invention to solve the technical problem is: a method for defending against wrong data injection based on hybrid homomorphic encryption, the method comprises the following steps:

(1) Combined with the physical dynamic model of the system, the parameters that the attacker must obtain to execute the attack are given, and then the attack vector is constructed to obtain the influence of the system state estimation result, and then the objects that need to be encrypted and protected are obtained: system model parameters, measured values and state estimation result;

(2) Rewrite the iterative process of the static Kalman filter state estimation algorithm to obtain an iterative form that can support the encryption and decryption process of hybrid homomorphic encryption; the iterative process of the state estimation algorithm is rewritten as follows:

H∈R^n×l，l＝n+m，r(t)∈R^n×l，

表示t时刻的状态估计结果，

表示t-1时刻的状态估计结果，y(t)表示t时刻的测量值，A表示系统矩阵，C表示测量矩阵，K表示静态卡尔曼增益，

表示系统参数的计算结果，n表示状态维数，m表示测量维数，包含系统模型参数的矩阵H和系统状态信息r(t)是需要被加密保护的对象，其中，系统状态信息包括测量值和状态估计结果。in,

H∈R ^n×l , l=n+m, r(t)∈R ^n×l ,

represents the state estimation result at time t,

Represents the state estimation result at time t-1, y(t) represents the measurement value at time t, A represents the system matrix, C represents the measurement matrix, K represents the static Kalman gain,

Represents the calculation result of the system parameters, n represents the state dimension, m represents the measurement dimension, the matrix H containing the system model parameters and the system state information r(t) are the objects that need to be encrypted and protected, wherein the system state information includes the measured value and state estimation results.

(3) Design the quantization and mapping method from the real number field to the plaintext space, and quantify and map the system model parameters and system state information after rewriting the iterative process of the state estimation algorithm from the real number field to the plaintext space, so as to adapt to the homomorphic encryption operation; The quantization method from the real number field to the plaintext space is described as:

For the matrix H of system model parameters: use quantization error cancellation, that is, for each element in H, first convert it to fractional form, and then multiply the matrix by the common denominator of all elements, that is:

为矩阵H的量化结果，α为公分母。in,

is the quantization result of matrix H, and α is the common denominator.

For system state information r(t): adopt the parameter random quantization method, for an element r _i (t) in r(t), if r _i (t)∈[μ _k , μ _k+1 ), μ _k , If μ _k+1 is an integer, the quantization result is based on the following probability distribution:

表示r_i(t)的量化结果，0≤p≤1。Among them, Pr( ) represents the probability value,

Indicates the quantization result of ri (t), _0≤p≤1 .

The mapping of the quantization result to the plaintext space M of the cryptographic algorithm is:

表示映射结果，

表示实数x的量化结果，f_m(·)表示映射函数，N为密码算法的取模参数。in,

represents the mapping result,

represents the quantization result of the real number x, f _m (·) represents the mapping function, and N is the modulo parameter of the cryptographic algorithm.

(4) Encrypt the mapping result in step (3) using the public key of the additive homomorphic encryption scheme to obtain ciphertext data of system model parameters, measured values and state estimation results; and according to the system model parameters, measured values and Confidentiality of the state estimation results, respectively design the communication protocol for the additive homomorphic algorithm and the multiplicative homomorphic algorithm, and use the ciphertext data as the input of the communication protocol for the additive homomorphic algorithm and the multiplicative homomorphic algorithm;

(5) Define three groups of data providers, core algorithm executors and state estimation result application parties participating in the state estimation algorithm, and use the communication protocol of the additive homomorphic algorithm and the multiplicative homomorphic algorithm to design the state estimation algorithm of different groups in the ciphertext domain The computing tasks that need to be performed in;

(6) Combining the above steps, design an encrypted state estimation protocol that ensures the complete confidentiality of the data in the calculation and communication process.

Further, in the step (1), the attacker can construct the following attack vector to realize the stealth attack of the bad data detector:

Y ^a ≡{y ^a (τ)|y ^a (τ)=CA ^τ-t Ky ^a (t), τ≥t}

Among them, t is the attack start time, τ is the attack duration, C∈R ^m×n , A∈R ^n×n and K∈R ^n×m are the system parameters, Y ^a is the attack vector sequence, y ^a (τ) ∈R ^m represents the attack vector, that is, the wrong data injected into the measurement value, y ^a (t) ∈ R ^m represents the initial attack vector; further, the influence on the system state estimation result is:

表示真实的状态估计结果，X^a是有攻击下状态估计结果的序列，

是有攻击情形下时刻τ的状态估计结果，T∈R^m×m是一个对角矩阵，如果第i个测量值被篡改，则T_ii＝1，否则，T_ii＝0。in,

represents the real state estimation result, X ^a is the sequence of state estimation results under attack,

is the state estimation result at time τ under attack situation, T∈R ^m×m is a diagonal matrix, if the i-th measurement value is tampered with, then T _ii =1, otherwise, T _ii =0.

Further, in the step (4), the multiplication homomorphic algorithm is:

为解密算法，sk₁为解密秘钥，⊙为对应于明文乘法的密文域运算，

为加密算法，pk₁为加密秘钥，m₁∈M，m₂∈M为原始明文；in,

is the decryption algorithm, sk ₁ is the decryption key, ⊙ is the ciphertext domain operation corresponding to the plaintext multiplication,

is the encryption algorithm, pk ₁ is the encryption key, m ₁ ∈ M, m ₂ ∈ M is the original plaintext;

The additive homomorphic algorithm described is:

为对应明文加法的密文域运算。in,

It is the ciphertext field operation corresponding to plaintext addition.

Further, in the step (5), the calculation tasks required to be performed by the three groups of the data provider, the core algorithm executor and the state estimation result application party are specifically: the data provider is responsible for the measurement value and the system model parameter. The addition homomorphic scheme is used for encryption, and it is sent to the core algorithm executor, that is, the encryption estimator. The encryption estimator executes the addition homomorphic algorithm based on the ciphertext domain data, and sends the operation result C ₁ to the estimation result application side. The estimation result application party decrypts and restores C ₁ , encrypts it using the multiplication homomorphic scheme, and sends C ₂ to the encrypted estimator; the encrypted estimator executes the multiplication homomorphic algorithm, and sends the operation result C ₃ to the state estimation result application The application side _of the state estimation result decrypts and restores C3 to obtain the state estimation result. The application side of the state estimation result encrypts the state estimation result with the public key of the additive homomorphic encryption scheme, and feeds it back to the encryption estimator for iterative operation. .

Further, in the described step (6), the designed encryption state estimation protocol is:

表示安全加法操作(同态加法)；⊙表示安全乘法操作(同态乘法)；⊙^h表示模指数运算；pk₁和sk₁表示乘法同态密码算法的公钥和私钥；pk₂和sk₂表示加法同态密码算法的公钥和私钥；f_q表示实数量化算法；f_m表示整数映射算法；M为明文空间；

表示在乘法同态加密下的数据；

表示在加法同态加密下的数据；→表示数据映射；→表示数据传输；C_*表示密文；

为加密估计器计算的中间结果，V(t)为状态估计结果应用方计算的中间结果，d为一个随机变量；

是矩阵

中第i行第j列的元素；d^-1表示d的模逆。

表示初始状态的估计结果，

表示*的量化结果，

表示*的映射结果，Enc(*)_pk1表示*被加法同态方案的加密算法，Enc(*)_pk2表示*被乘法同态方案的加密算法，

表示*的估计结果，Dec(*)_sk1表示*被加法同态方案的解密算法，Dec(*)_sk2表示*被乘法同态方案的解密算法，

表示整数恢复算法；f_q ^-1表示整数恢复成实数。

为t时刻经复原和返回后的状态估计结果的映射结果。Among them, note:

represents a secure addition operation (homomorphic addition); ⊙ represents a secure multiplication operation (homomorphic multiplication); ⊙ ^h represents a modular exponential operation; pk ₁ and sk ₁ represent the public and private keys of the multiplicative homomorphic cryptographic algorithm; pk ₂ and sk ₂ represents the public key and private key of the additive homomorphic encryption algorithm; f _q represents the real number quantization algorithm; f _m represents the integer mapping algorithm; M represents the plaintext space;

Represents data under multiplicative homomorphic encryption;

Represents data under additive homomorphic encryption; →represents data mapping; →represents data transmission; C _* represents ciphertext;

is the intermediate result calculated by the encryption estimator, V(t) is the intermediate result calculated by the state estimation result application side, and d is a random variable;

is the matrix

The element in the i-th row and the j-th column; d ^-1 represents the modular inverse of d.

represents the estimated result of the initial state,

represents the quantization result of *,

Represents the mapping result of *, Enc(*) _pk1 represents the encryption algorithm of the added homomorphic scheme, Enc(*) _pk2 represents the encryption algorithm of the multiplication homomorphic scheme,

Represents the estimation result of *, Dec(*) _sk1 represents the decryption algorithm of the added homomorphic scheme, Dec(*) _sk2 represents the decryption algorithm of the multiplication homomorphic scheme,

Indicates the integer recovery algorithm; f _q ^-1 indicates that the integer is recovered to a real number.

is the mapping result of the restored and returned state estimation result at time t.

Further, the fuzzy operation is based on the following multiplication blind principle:

b(ax)mod L=bmod L

where ax≡1mod L, that is, x=a ^-1 mod L

Further, in the security state estimation protocol, the encryption results of communication channel data and system model parameters can directly participate in the state estimation algorithm, and the validity of the estimation results can be guaranteed.

The beneficial effects of the present invention are: for the state estimation process of the cyber-physical system, considering that the estimator or the communication channel is hijacked by the attacker, trying to obtain the key data of the system to perform destructive error data injection attack, adopting encryption technology to ensure data security, That is, it will not be stolen and tampered with; after the introduction of the homomorphic encryption algorithm, it solves the problem that various operations of the state estimation algorithm whose input is ciphertext is difficult to perform, and realizes the secure addition and multiplication of the ciphertext domain; all parties involved in the state estimation process The definition and task division are carried out. Using the hybrid homomorphic encryption scheme, the designed encryption state estimation protocol can ensure that it is difficult for any party and external attackers to obtain measurement data, system model parameters and state estimation results at the same time. The design process of the encryption state estimation protocol is simple, and the obtained state estimation algorithm based on hybrid homomorphic encryption can effectively estimate the state of the system, and the communication volume of the participating parties is small. Compared with the traditional encryption method, it can resist the wrong data injection attack that directly invades the estimator, and strengthens the security of the cyber-physical system.

Description of drawings

Figure 1 is a frame diagram of state estimation;

Fig. 2 is the schematic flow chart of encryption state estimation protocol calculation;

Figure 3 is a diagram of the IEEE 9-bus system model;

Figure 4 is a comparison diagram of the leading node voltage estimation results under the encryption-based state estimation protocol and the state estimation algorithm without encryption;

FIG. 5 is a comparison diagram of the fluctuation of the power generation voltage based on the encrypted state estimation protocol and the state estimation algorithm without encryption;

Fig. 6 is a statistical result graph of the difference between state estimation results based on an encrypted state estimation protocol and an unencrypted state estimation algorithm;

Fig. 7 is the output state estimation error covariance change situation diagram based on the encryption state estimation protocol;

Detailed ways

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

As shown in Fig. 1, a kind of wrong data injection attack defense method based on hybrid homomorphic encryption provided by the present invention comprises the following steps:

In step 1, the dynamic process of the cyber-physical system is modeled, and the following equations are obtained:

可控，(A，C)可观。基于以上系统动态模型，采用卡尔曼滤波算法可以得到状态估计结果：Among them, x(t)∈R ⁿ , y(t)∈R ^m , A∈R ^n×n , C∈R ^m×n , w(t)∈R ⁿ , v(t)∈R ^m represent independent White Gaussian noise, i.e. w(t)～N(0,Q), v(t)～N(0,E), Q∈Rn ^×n and R∈Rm ^×m represent the covariance of the noise. The initial state x(0) follows a Gaussian distribution with zero mean.

Controllable, (A, C) considerable. Based on the above system dynamic model, the Kalman filter algorithm can be used to obtain the state estimation results:

P _∞ =AP _∞ A ^T +Q-AP _∞ C ^T (CP _∞ C ^T +R) ^-1 CP _∞ A ^T

K=P _∞ C ^T (CP _∞ C ^T +E) ^-1

是状态估计结果，K∈R^n×m表示卡尔曼增益矩阵，P_∞∈R^n×n表示稳态卡尔曼滤波的状态估计误差协方差矩阵。in,

is the state estimation result, K∈R ^n×m represents the Kalman gain matrix, and P _∞ ∈R ^n×n represents the state estimation error covariance matrix of the steady-state Kalman filter.

Further, for the system dynamic model given above, consider the wrong data injection attack:

y'(t)=Cx(t)+Ty ^a (t)+v(t)

Among them, y ^a (t) ∈ R ^m represents the wrong data injected by the attacker, T ∈ R ^m×m represents the diagonal matrix, and the diagonal elements are 0 or 1. If the i-th measurement value is attacked, then T _ii = 1, otherwise, T _ii =0. Based on the steady-state Kalman filter algorithm, it is derived that if the attacker injects the attack sequence:

Y ^a ≡{y ^a (τ)|y ^a (τ)=CA ^τ-t Ky ^a (t), τ≥t}

Among them, t represents the attack start time, τ represents the attack duration, Y ^a represents the attack vector sequence, and ^ya (τ)∈R ^m represents the attack vector. Then the impact on the system state estimation result is:

是时刻τ状态估计结果的影响。where X ^a is the influence sequence of the state estimation result,

is the influence of the state estimation result at time τ.

Further, in order to make the steady-state Kalman filter algorithm meet the homomorphic encryption operation framework, the iterative process in the state estimation algorithm is rewritten as follows:

H∈R^n×l，l＝n+m，r(t)∈R^n×l。需要强调的是，包含系统模型参数的矩阵H和包含系统状态信息的r(t)是需要被加密保护的对象。in,

H∈Rn ^×l , l=n+m, r(t)∈Rn ^×l . It should be emphasized that the matrix H containing system model parameters and r(t) containing system state information are objects that need to be encrypted and protected.

Further, since the encryption algorithm can only be executed in the non-negative integer plaintext space, it is necessary to quantify and map all the real numbers involved in the operation:

The method for quantizing the real number to an integer is:

For the system model parameter H: use the quantization error cancellation method, that is, for each element in H, first convert it to fractional form, and then multiply the matrix by the common denominator of all elements, that is:

为矩阵H的量化结果，α为公分母。in,

is the quantization result of matrix H, and α is the common denominator.

For the system state parameter r(t): adopt the parameter random quantization method, that is, for an element r _i (t) in r(t), if r _i (t)∈[μ _k , μ _k+1 ), μ _k , μ _k+1 is an integer, σ=μ _k+1 - μ _k is a quantization parameter, then the quantization result is based on the following probability distribution form:

表示r_i(t)的量化结果，0≤p≤1。Among them, Pr( ) represents the probability value,

Indicates the quantization result of ri (t), _0≤p≤1 .

The mapping method from the integer space to the plaintext space of the cryptographic algorithm is:

表示映射结果，f_m(·)表示映射函数，N为密码算法的取模参数。in,

represents the mapping result, f _m (·) represents the mapping function, and N is the modulo parameter of the cryptographic algorithm.

Further, since the variables participating in the state estimation algorithm are all quantized, they need to be restored in the output of the algorithm. The quantification and restoration methods of the variables are as follows:

Table 1 Parameter quantization and restoration

Further, the iterative process of state estimation based on the quantization results is obtained:

In the final output, restore it to:

Further, tasks are divided among the three parties involved in the state estimation process. The data provider is responsible for encrypting the original measurement data (data with noise) and system model parameters, and sending them to the core algorithm executor, that is, the encryption estimator. It is sent to the estimation result applying party, and the estimation result applying party decrypts the data and obtains the final state estimation result.

Further, the described safe multiplication is:

为解密算法，sk₁为解密秘钥，⊙为密文域运算，

为加密算法，pk₁为加密秘钥，m₁∈M，m₂∈M为原始明文。所述的安全加法为：in,

is the decryption algorithm, sk ₁ is the decryption key, ⊙ is the ciphertext domain operation,

is the encryption algorithm, pk ₁ is the encryption key, m ₁ ∈ M, m ₂ ∈ M is the original plaintext. Said safe addition is:

Further, in order to ensure the security of the interactive data between the encryption estimator (the core algorithm executor) and the estimation result application party, a multiplication blind method is adopted, that is,

为加密估计器(核心算法执行方)计算的中间结果，d为一个随机变量，⊙表示乘法同态运算。in,

is the intermediate result calculated by the encryption estimator (executor of the core algorithm), d is a random variable, and ⊙ represents the multiplication homomorphic operation.

Further, when performing the additive homomorphic operation in the encrypted estimator, the random variable d is removed, i.e.

是矩阵

中第i行的元素，⊙^h表示模指数运算，d^-1表示d的模逆。in,

is the matrix

The element in row i, ⊙ ^h represents the modular exponential operation, and d ^-1 represents the modular inverse of d.

As shown in Figure 2, based on the idea of multi-party secure computing, the designed encryption state estimation protocol is:

表示安全加法操作(同态加法)；⊙表示安全乘法操作(同态乘法)；⊙^h表示模指数运算；pk₁和sk₁表示乘法同态密码算法的公钥和私钥；pk₂和sk₂表示加法同态密码算法的公钥和私钥；f_q表示实数量化算法；f_m表示整数映射算法；M为明文空间；

表示在乘法同态加密下的数据；

表示在加法同态加密下的数据；→表示数据映射；→表示数据传输；C_*表示密文；

为加密估计器计算的中间结果，V(t)为状态估计结果应用方计算的中间结果，d为一个随机变量；

是矩阵

中第i行第j列的元素；d^-1表示d的模逆。

表示初始状态的估计结果，

表示*的量化结果，

表示*的映射结果，Enc(*)_pk1表示*被加法同态方案的加密算法，Enc(*)_pk2表示*被乘法同态方案的加密算法，

表示*的估计结果，Dec(*)_sk1表示*被加法同态方案的解密算法，Dec(*)_sk2表示*被乘法同态方案的解密算法，

表示整数恢复算法；

表示整数恢复成实数。

为t时刻经复原和返回后的状态估计结果的映射结果。Among them, note:

represents a secure addition operation (homomorphic addition); ⊙ represents a secure multiplication operation (homomorphic multiplication); ⊙ ^h represents a modular exponential operation; pk ₁ and sk ₁ represent the public and private keys of the multiplicative homomorphic cryptographic algorithm; pk ₂ and sk ₂ represents the public key and private key of the additive homomorphic encryption algorithm; f _q represents the real number quantization algorithm; f _m represents the integer mapping algorithm; M represents the plaintext space;

Represents data under multiplicative homomorphic encryption;

Represents data under additive homomorphic encryption; →represents data mapping; →represents data transmission; C _* represents ciphertext;

is the intermediate result calculated by the encryption estimator, V(t) is the intermediate result calculated by the state estimation result application side, and d is a random variable;

is the matrix

The element in the i-th row and the j-th column; d ^-1 represents the modular inverse of d.

represents the estimated result of the initial state,

represents the quantization result of *,

Represents the mapping result of *, Enc(*) _pk1 represents the encryption algorithm of the added homomorphic scheme, Enc(*) _pk2 represents the encryption algorithm of the multiplication homomorphic scheme,

Represents the estimation result of *, Dec(*) _sk1 represents the decryption algorithm of the added homomorphic scheme, Dec(*) _sk2 represents the decryption algorithm of the multiplication homomorphic scheme,

Represents an integer recovery algorithm;

Indicates that integers are restored to real numbers.

is the mapping result of the restored and returned state estimation result at time t.

The fuzzy operation is based on the following multiplication blind principle:

b(ax)mod L=bmod L

where ax≡1mod L, that is, x=a ^-1 mod L.

Example

This embodiment uses the IEEE 9-bus system in PowerWorld to perform algorithm verification, and the IEEE 9-bus system is shown in FIG. 3 . Considering the voltage control problem, its dynamic model is approximated as:

其中，ρ∈(0，1)，x(0)为参考电压。系统状态估计算法的迭代过程为：Among them, the system state x(t) represents the voltage value of the dominant node, and the control variable u(t) represents the voltage value of the power generation node. usually,

Among them, ρ∈(0,1), x(0) is the reference voltage. The iterative process of the system state estimation algorithm is as follows:

further,

的量化参数为：σ^x＝σ^y＝0.01。In the simulation process, the multiplication homomorphic algorithm adopts RSA, its key length is 512 bits, the public key parameter e=65537, and the public key and private key are generated according to the RSA algorithm rules. The additive homomorphic algorithm adopts Paillier, and its key length is 512 bits. Measured value y(t) and system state estimation result

The quantization parameter is: σ ^x =σ ^y =0.01.

In order to verify the validity of the output result of the encryption state estimation protocol, Fig. 4 shows the variation of the difference between the voltage of the dominant node and the reference voltage. Compared with the state estimation algorithm without encryption, the performance of the estimation algorithm based on the encrypted state estimation protocol is better. Both algorithms start to converge after about 20 iterations. At 20 iterations, the estimated results of the two algorithms have the largest deviation from the reference value by 0.0225 (dominant node 5, encrypted) and 0.0202 (dominant node 5, no encryption) , 0.0157 (lead node 6, encrypted) and 0.0168 (lead node 6, no encryption), 0.0138 (lead node 8, encrypted) and 0.0123 (lead node 8, no encryption). Figure 5 shows the voltage change of the power generation node. Comparing the encrypted and unencrypted state estimation algorithms, after 20 iterations, the difference between the output control parameters of the two is at most 0.0024 (power generation node 1) and 0.0153 (power generation node 2). and 0.0101 (generating node 3).

Comparing the output results of the two state estimation algorithms (encrypted and non-encrypted), Figure 6 shows the statistical results of the voltage difference between the output nodes (dominant node and power generation node). The results show that the difference between the output results is almost 0, indicating that the state estimation algorithm based on the encryption state estimation protocol is effective.

Further, based on the encrypted state estimation protocol, Fig. 7 shows the fluctuation of the state estimation error covariance. During 500 iterations, the upper bound of the second norm of the state estimation error covariance is 0.001. It shows that the stability of the state estimation algorithm based on the encrypted state estimation protocol is guaranteed.

Claims (4)

1. A method for defending against error data injection attacks based on hybrid homomorphic encryption is characterized by comprising the following steps:

(1) combining with a system physical dynamic model, providing parameters which must be obtained by an attacker for executing attack, further constructing an attack vector, obtaining the influence of a system state estimation result, and further obtaining an object needing encryption protection as follows: system model parameters, measurement values and state estimation results;

(2) rewriting a static Kalman filtering state estimation algorithm iteration process to obtain an iteration form capable of supporting a mixed homomorphic encryption process; the state estimation algorithm iteration process is rewritten as follows;

wherein,

H∈R^n×l，l＝n+m，r(t)∈R^n×l，

indicating the result of the state estimation at time t,

representing the state estimation result at the time t-1, y (t) representing the measured value at the time t, A representing a system matrix, C representing a measurement matrix, K representing a static Kalman gain,

representing the result of a calculation of system parameters, n representing the state dimension, m representing the measurement dimension, including system model parametersA matrix H of numbers and system state information r (t) are objects needing to be encrypted and protected, wherein the system state information comprises measured values and state estimation results;

(3) designing a quantization and mapping method from a real number domain to a plaintext space, quantizing and mapping system model parameters and system state information rewritten in the iterative process of a state estimation algorithm to the plaintext space from the real number domain to adapt to homomorphic encryption operation; the quantization method from the real number domain to the plaintext space is as follows;

for the matrix of system model parameters H: quantization error elimination is used, i.e. for each element in H, it is first converted to fractional form and then the matrix is multiplied by the common denominator of all elements, i.e.:

wherein,

is the quantization result of the matrix H, alpha is a common denominator;

for system state information r (t): using a parameter random quantization method for one element r in r (t)_i(t) if r_i(t)∈[μ_k，μ_k+1)，μ_k，μ_k+1Is an integer, the quantization result is according to the following probability distribution form:

wherein Pr (-) represents a probability value,

is represented by r_i(t) as a result of the quantization, p is not less than 0 and not more than 1;

the mapping of the quantization result to the cryptographic algorithm plaintext space M is:

wherein,

the result of the mapping is represented by,

representing the result of quantization of a real number x, f_m(. -) represents a mapping function, N is a modulus parameter of the cryptographic algorithm;

(4) encrypting the mapping result in the step (3) by adopting a public key of an addition homomorphic encryption scheme to obtain ciphertext data of system model parameters, measurement values and state estimation results; respectively designing communication protocols for executing the addition homomorphic algorithm and the multiplication homomorphic algorithm according to the confidentiality of system model parameters, measured values and state estimation results, and taking ciphertext data as the input of the communication protocols for the addition homomorphic algorithm and the multiplication homomorphic algorithm;

(5) defining three groups of a data provider, a core algorithm executor and a state estimation result application party participating in a state estimation algorithm, and designing calculation tasks required to be executed by different groups in a ciphertext domain state estimation algorithm by using a communication protocol of an addition homomorphic algorithm and a multiplication homomorphic algorithm;

(6) integrating the steps, designing an encryption state estimation protocol for ensuring the data security in the calculation and communication processes; the designed encryption state estimation protocol is provided with a data provider, a core algorithm executor and a state estimation result applier;

the data provider performs the following processes:

and (3) quantification:

mapping:

encryption:

the data provider will provide

Transmitting the data to a core algorithm executing party, wherein the core algorithm executing party is an encryption estimator and executes the following processes:

inputting:

for 0 ≦ T ≦ T: and (3) calculating:

fuzzy operation parameters: let d be { d ═ d_i|d_iE.m, i ═ 1, …, n }, such that

The kernel algorithm executing party is to

And transmitting the data to a state estimation result application party, and executing the following processes by the state estimation result application party:

and (3) decryption:

encryption:

the application side of the state estimation result will

Transmitted back to the kernel algorithm executing party and then processed by the kernel algorithmThe executive side executes the following processes:

elimination of blur parameters:

obtaining:

the kernel algorithm executing party is to

And then transmitting the data to a state estimation result application party, and then executing the following processes by the state estimation result application party:

and (3) decryption:

and (3) restoration:

and returning:

state estimation result application side will result

Transmitting back to the kernel algorithm executing party;

wherein,

representing a safe addition operation, namely homomorphic addition; an indication of a secure multiply operation, being a homomorphic multiply; an^hRepresenting a modular exponential operation; pk₁And sk₁A public key and a private key representing a multiplicative homomorphic cryptographic algorithm; pk₂And sk₂A public key and a private key representing an additive homomorphic cryptographic algorithm; f. of_qRepresenting a real number quantization algorithm; f. of_mRepresents an integer mapping algorithm; m is a plaintext space;

representing data under multiplicative homomorphic encryption;

representing data under additive homomorphic encryption; → denotes data mapping; → data transfer; c_*Representing a ciphertext;

v (t) is an intermediate result calculated by a state estimation result application party, and d is a random variable;

is a matrix

Row i and column j; d^-1Represents the modulo inverse of d;

the result of the estimation representing the initial state,

the result of the quantification is shown as,

the result of the mapping, Enc_pk1Encryption algorithm representing a homomorphic scheme added, Enc_pk2An encryption algorithm representing a homomorphic scheme to be multiplied,

the result of estimation, Dec +_sk1Decryption algorithm, Dec (#) representing an additively homomorphic scheme_sk2A decryption algorithm representing a homomorphic scheme multiplied,

represents an integer recovery algorithm;

representing the restoration of an integer to a real number;

the mapping result of the state estimation result after the recovery and the return at the time t;

wherein the fuzzy operation is based on the following multiplicative fuzzy principle:

b(ax)mod L＝b mod L

where ax ≡ 1mod L, i.e. x ≡ a^-1mod L。

2. The method for defending against false data injection attack based on hybrid homomorphic encryption as claimed in claim 1, wherein in step (1), an attacker can construct the following attack vector to realize the hidden attack of the bad data detector:

Y^a≡{y^a(τ)|y^a(τ)＝CA^τ-tKy^a(t)，τ≥t}

wherein t represents attack start time, tau represents attack duration, and C epsilon R^m×n，A∈R^n×nAnd K ∈ R^n×mDenotes the system parameter, Y^aRepresenting a sequence of attack vectors, y^a(τ)∈R^mRepresenting an attack vector, i.e. error data, y, injected into the measurement^a(t)∈R^mRepresenting an initial attack vector; further, the influence on the system state estimation result is:

wherein,

representing the true state estimation result, X^aIs a sequence of state estimation results under attack,

is the state estimation result of the time tau under the attack situation, and T epsilon R^m×mIs a diagonal matrix, T if the ith measurement is tampered with_ii1, otherwise, T_ii＝0。

3. The method for defending against false data injection attack based on hybrid homomorphic encryption according to claim 1, wherein in the step (4), the multiplicative homomorphic algorithm is:

wherein,

for the decryption algorithm, sk₁For a decrypted key, an operation corresponding to a ciphertext domain of a plaintext multiplication,

for the encryption algorithm, pk₁For encrypting a key, m₁∈M，m₂E is M as an original plaintext;

the addition homomorphic algorithm comprises the following steps:

wherein,

a ciphertext domain operation corresponding to a plaintext addition.

4. The method for defending against false data injection attack based on hybrid homomorphic encryption as claimed in claim 1, wherein in the step (5), the computing tasks required to be performed by the three groups of the data provider, the core algorithm executor and the state estimation result applier are specifically: the data provider is responsible for encrypting the measured value and the system model parameter by adopting an addition homomorphic scheme and transmitting the encrypted measured value and the system model parameter to a core algorithm executing party, namely an encryption estimator, the encryption estimator executes an addition homomorphic algorithm based on the ciphertext domain data and then sends an operation result C₁Transmitted to the estimation result application side, and the state estimation result application side sends C₁Decrypting and recovering, encrypting by adopting a multiplication homomorphism scheme, and converting C into C₂Sending to the encryption estimator; the encryption estimator executes a multiplication homomorphic algorithm to obtain an operation result C₃Sending the state estimation result to a state estimation result application party; state estimation result application side C₃And decrypting and recovering to obtain a state estimation result, encrypting the state estimation result by adopting a public key of an addition homomorphic encryption scheme by a state estimation result application party, and feeding back to the encryption estimator for iterative operation.

Images