Currently, China is vigorously promoting urbanization, which has put forward higher requirements for urban lighting. Due to the significant proportion of electricity consumption of urban street lights in the total electricity consumption of urban public utilities, energy-saving work of street lights is an inevitable direction for the development of urban management. Article 5 of the Notice of the General Office of the State Council on Deepening the National Energy Conservation Action, which was implemented on August 1, 2008, states: "Control the lighting of street lights and landscape lights, and reasonably turn on and off street lights while ensuring the safety of vehicles and pedestrians.". Traditional street light control systems have drawbacks such as inability to be remotely controlled, inability to automatically and remotely identify faulty street lights, and high manual workload. The intelligent street light control system can remotely control any street light within the range, and can remotely identify faulty street lights, greatly improving the response time for repairing faulty street lights. In addition, the intelligent street light control system can provide flexible and diverse control solutions for different lighting needs based on various electrical parameters and operating conditions of the lighting system, thereby making urban street light lighting more energy-efficient.






Informatization is a double-edged sword, which not only promotes intelligent control of street lights but also brings potential safety hazards to them. Street light safety belongs to the category of municipal and industrial control safety. When the street light control system is attacked, the social impact is also difficult to estimate. 2. At the same time, considering that smart street lights also belong to the field of electricity, the intelligent construction of street lights is an extension of smart grid construction. Therefore, this article applies the safety protection experience in smart grid construction to the field of smart street lights, providing support for the intelligent construction of street lights.






1. Introduction to Intelligent Street Light System 1.1 System Topology Diagram The intelligent street light system can be divided into three parts: the main station layer, communication layer, and terminal layer. The composition framework is shown in.






The main station layer of the intelligent street light system is composed of the main station management system, which includes the main station server, geographic information system, and monitoring center. The server is responsible for storing and managing information about streetlights; The monitoring center sends instructions to the centralized controller through the server to control each street light in real-time, while regularly polling to check whether each street light is working properly; Geographic Information System (GIS) is an embedded city map that provides intuitive monitoring and rapid positioning of the online status, lighting status, and alarm status of all local devices. It can accurately locate and quickly handle various abnormal situations in the first time.






Construct a communication channel between the collector and the master station using communication methods such as Opportunistic Mesh (OPM).






The terminal layer is responsible for collecting all control information of street lights in accordance with municipal planning. It communicates with each street light control submodule through methods such as Zigbee, GPRS, or OPM. Each control module is responsible for collecting street light control information and sending it to the concentrator.






The main function of the intelligent street light system is to provide targeted solutions for street lights. Xie Daping (1984-), master's degree, engineer. Research directions: network security, chip security, cloud security, power grid security, and other related work. Email: Xiedapinggmail.com Communication Layer Terminal Layer Intelligent Street Light System Topology Diagram "Three Remote" Control of Street Light Equipment. The so-called "three remotes" refer to "remote control", "remote signaling", and "telemetry".






The functions are divided into two main parts: automatic control and manual control.






Up the mountain/Shibai.






The controller automatically reports its online status and the lighting status of local street lights to the monitoring computer through regular inspections. Street light management personnel can use the built-in electronic map function of this system to monitor the current status of the equipment through monitoring computers, and quickly locate the faulty equipment on the map to troubleshoot in the shortest possible time.






1.2 Workflow The workflow between the main station and the concentrator is transmitted through GPRS, power line carrier, and other methods. And currently, all messages are transmitted in plaintext using the public network.






Considering the linear characteristics of the street light network, in order to reduce costs, the workflow between the concentrator and the street light control module is usually transmitted through wireless communication methods such as Zigbee and OPM, and all messages are transmitted in plaintext.






2 Security Risks 2.1 The use of public networks for communication between the main station and concentrator. When transmitting data and control messages between the concentrator and the main station, there is a risk of security risks, including tampering and theft of the transmitted data.






For the downlink, when the main station sends control messages to the concentrator, if tampered with by someone, it may cause instantaneous and continuous abnormal lighting in the entire area. This poses a great threat to urban safety, while reducing residents' satisfaction with the city and causing social panic.






For the uplink, when the concentrator needs to report the current street light information to the main station, if it is tampered with by someone, it may cause incorrect scheduling by the backend control center, resulting in waste of government resources.






The security between the concentrator and the street light control module is similar to that between the concentrator and the main station, but it also faces greater security threats. The security of wireless communication methods such as Zigbee/OPM is facing significant threats, making the communication information between the street light control module and the concentrator more susceptible to theft and tampering. With the acceleration of smart city construction, video surveillance provides security for every citizen, while also improving the efficiency of public security organs in handling cases and providing richer evidence. The effectiveness of ordinary video surveillance depends on the quality of street lighting. If criminals destroy the street lights at the pre selected crime scene before committing the crime, the video surveillance system will fail.






3 Security Technologies 3.1 Encryption and Decryption Technologies Encryption and decryption technologies are usually divided into symmetric encryption algorithms and asymmetric encryption algorithms.






Symmetric encryption is a single key cryptography system, where the encryption key is equal to the decryption key or can be derived from each other; According to the length of each encryption, it is divided into sequence cipher (stream cipher) and group cipher. The symmetric encryption algorithm used in this scheme is the block cipher algorithm.






The asymmetric key encryption system adopts a dual key encryption system, which is a type of cryptographic algorithm that uses a public key for encryption and a private key for decryption. It is computationally infeasible to obtain a private key from a known public key. The commonly used RSA and ECC symmetric encryption algorithms.






Compared with RSA (see Table 1), ECC has the following absolute advantages: strong resistance to attacks. The same key length has much stronger resistance to attacks.






Low computational complexity and fast processing speed.






Low bandwidth requirements. When encrypting and decrypting long messages, the above two types of cryptographic systems have the same bandwidth requirements, but when applied to short messages, the ECC bandwidth requirements are much lower.






Table 1: Comparison of Security Module Lengths for RSA and ECC. Attack Time ECC (Million Instructions Executed by Key Computer/s. MIPS Year is expressed as running at million times/s for 1 year).






The algorithm has the same security as the 1023bitRSA algorithm, using internationally recognized security generators such as Security Builder and BSAFE3. Tested, as shown in Table 2, the performance of ECC algorithm is superior to RSA algorithm.






The functional security generator key exchange for generating signature authentication keys has the same security, using internationally recognized security generators SercurityBuilder 1.2 and BSAFE3. Conduct testing. As shown in Table 2, the performance of ECC algorithm is superior to that of RSA algorithm.






Due to the wireless transmission method used between street light terminals, the asymmetric algorithm used in this scheme is SM2 (a similar ECC algorithm developed by the China Commercial Cryptography Bureau) or ECC algorithm, while the symmetric algorithm is SM1 (National Commercial Cryptography Algorithm) or AES algorithm.






3.2 Digital signature technology or endpoint denial authentication technology, as defined in the IS07498-2 standard, is: data attached to a data unit, or a cryptographic transformation made to a data unit. This data and transformation allows the receiver of the data unit to confirm the integrity of the source and data unit, and protect the data, Preventing forgery by others (such as recipients) is a digital string that can only be generated by the sender of the information and cannot be forged by others. This digital string is also an effective proof of the authenticity of the information sent by the sender.






Digital signatures can only use asymmetric encryption algorithms, and in this scheme, ECDSA is used as the digital signature mechanism.






The hash function hash function H is an open function that maps an arbitrarily long message to a shorter, fixed length value H (M). H (M), also known as hash value or message, is a function of all bits in a message, providing the ability for error detection.






4 Security Solutions 4.1 In order to achieve remote intelligent security control of street lights, it is necessary to prevent information from being tampered with and eavesdropped. For the consideration of municipal safety, industrial level safety standards are required, so when using safety algorithms, it is recommended to promote the use of domestically produced safety algorithms. Encrypt the data using the SM1 algorithm and sign the data using the SM2 algorithm.






There are two implementation schemes for the security protection of the terminal control module: ① software implementation, which integrates the corresponding security algorithms into the MCU; ② Hardware implementation, which uses security chips to implement encryption and decryption algorithms. The high-speed cryptographic algorithm engine within the security chip can greatly improve efficiency, while ensuring that the key will not be plaintext in the firmware, which is an advantage of hardware implementation over software implementation. The solution using security chips not only provides security factors, but also performance factors. Because the street light control module considers cost factors, the main control MCU used is an 8-bit low-end MCU. If security algorithms are run on it, only a better and more expensive MCU can be selected. The price of ESAM is lower. Therefore, on the basis of performance and cost, ESAM is chosen as the implementation method of coprocessor. In this plan, we use hardware implementation to build the overall security protection network.






4.2 The security architecture is shown as follows, with the addition of a key management system and a security chip distribution system at the main site layer. The key management system includes a password machine and a password server, which realize functions such as key generation and key security detection; The security chip distribution system is equipped with the initial key and other functions for filling security chips. The data received by the main station is decrypted or verified using a key management server, and the data sent externally is encrypted or accompanied by signature information.






In addition, a key management system and a security chip distribution system have been added to the main site layer.






The key management system includes a password machine and a password server, which realize functions such as key generation and key security detection. In the key management system of State Grid, a three-level key management mechanism is adopted, which is the national power grid level, provincial level, and municipal level. Both the national power grid level and provincial level have the authority to generate root keys. According to the needs of business applications, corresponding partial keys are downloaded into the operator card and password machine, as shown in.






In the intelligent street light management system, due to the practical application being based on cities or districts, a hierarchical key management mechanism is adopted, that is, only a root key is generated to achieve the generation and distribution of passwords, as shown in. At the same time, the Shamir threshold five in three mechanism is used to generate the root password. The implementation method of the five in three mechanism is to randomly select the parameters of one quadratic curve as the root key, select 5 points on the curve, and assign these 5 points to 5 managers respectively. Only when at least 3 managers among the 5 managers provide their own managed points can the parameters of the curve be restored and the root key be obtained.






Random number leadership seed, national network level root key, first level decentralized code, business root key, operator card cipher machine, third level key management system, security chip distribution system, initial key for filling security chips, and other functions. The data received by the main site layer is decrypted or verified using a key management server, and the data sent externally is encrypted or accompanied by signature information.






Embed security chips into the security control module at the terminal layer, as shown in the logic. The metering chip is responsible for measuring current and voltage; Clock chip R Ding C, responsible for clock synchronization; Wireless acquisition module, which can choose Zigbee or OPM to achieve wireless information transmission; Relay realizes control of street light switches and other functions; In addition, in combination with practical applications, corresponding sensors should be added. The security chip implements data security protection and decrypts and verifies the received data; Encrypt and add signature information to the sent data.






4.3 Workflow The main station system is equipped with a data encryption cipher machine, with security encryption modules embedded in each concentrator terminal and control node, providing security protection for the uplink and downlink of communication.






For the uplink, the street light control node encrypts the collected data using ESAM and sends the encrypted data to the concentrator via power line or wireless. The encrypted data is then transmitted to the main station system through the public network. The main station system needs to transmit the data to the data encryption machine for data decryption, and the decrypted data can only be processed for subsequent data processing.






For the downlink, when the main station system needs to issue control data, it needs to be sent to the data encryption cipher machine for data encryption. After the data is transmitted to the concentrator terminal, the concentrator terminal then sends it to the controller. The controller uses a security chip to decrypt the data before it can enter subsequent data processing.






The use of secure chips for data encryption and signature ensures the security and integrity of data transmission.






4.4 Security Level Classification: Choose different security protection levels for different applications and provide different security protection, as shown in Table 3. Table 3 Security Level Classification: Encryption Signature High, Medium, and Low Note: Y represents selection; N represents not selecting.






Choose a high security encryption method for the overall street light control information issued by the management center; For single light control and active reporting of abnormal information, select the medium safe level.






4. Security analysis: In terms of security algorithm selection, the symmetric algorithm selects the 128 bit SM1 algorithm, the asymmetric algorithm selects the 256 bit SM2 algorithm, and the hash algorithm selects the SHA256 algorithm, as shown in Table 4. The protection level algorithm selection algorithm for the security scheme is listed in Table 4. Based on the analysis in Table 4, the security level of the symmetric asymmetric hash algorithm is 128 bits, which meets the standards of financial and industrial security levels.






By piloting 168 street lights in a park, adding security has no impact on the overall system performance. In this key management scheme, when three out of five managers lose their managed sub keys, the root key cannot be recovered, leading to the risk of the entire key management system crashing. For this special situation, the solution is to randomly select the quadratic curve again, generate the root key, and then remotely update the key of each control module security chip with super administrator privileges, thereby solving the security risk.






4.6 Performance analysis: The average communication speed can reach 4Mb/s or even higher. Through experimental simulation testing, the encryption speed of the 128 bit SM1 algorithm is 53.56kb/s, and the decryption speed is 55.65kb/s; The signature speed of the 256 bit SM2 algorithm is 184.5ms/time, and the verification speed is relatively low compared to the current information collected from street lights. Considering future scalability, the security chip has no impact on the performance of the original street light control module.






In conclusion, the intelligent street light control security technology based on security chips can solve the current intelligent street light control system