WO2024027070A1

WO2024027070A1 - Terminal device authentication method and system based on identification public key, and computer-readable storage medium

Info

Publication number: WO2024027070A1
Application number: PCT/CN2022/138445
Authority: WO
Inventors: 王继业; 姜琳; 朱朝阳; 周亮; 朱亚运; 张晓娟; 缪思薇; 曹靖怡; 蔺子卿; 胡柏吉; 王海翔; 宋小芹; 张梦迪; 应欢; 韩丽芳
Original assignee: 中国电力科学研究院有限公司
Priority date: 2022-08-03
Filing date: 2022-12-12
Publication date: 2024-02-08
Also published as: CN115001717B; CN115001717A

Abstract

The present application discloses a terminal device authentication method and system based on an identification public key, and a computer-readable storage medium, the method comprising: determining an access demand and the type of a terminal device, and confirming an identification fingerprint of the terminal device on the basis of the access demand and the type; generating a public key and a private key of the terminal device by means of an identification key generation algorithm and on the basis of the identification fingerprint; and performing, on the basis of the public key and the private key, signing and signature verification on a data message which is sent by the terminal device, and realizing the authentication of the terminal device on the basis of the signature verification result. The identification public key technique used in the present application serves as a lightweight key generation and management method, realizes the binding of a terminal device identifier and a public key, reduces construction costs and operation and maintenance costs of a key system, and is suitable for mass key management of a distributed power source.

Description

A terminal device authentication method, system and computer-readable storage medium based on identification public key

Cross-references to related applications

This application is filed based on the Chinese patent application with application number 202210924400.6, application date is August 3, 2022, and the invention name is "A terminal equipment authentication method and system based on identification public key", and requires the priority of this Chinese patent application The entire content of this Chinese patent application is hereby incorporated into this application as a reference.

Technical field

This application relates to the technical field of distributed power sources and their data transmission networks, and in particular to a terminal equipment authentication method, system and computer-readable storage medium based on an identification public key.

Background technique

The current secondary security protection solution for the power grid is a boundary security protection system based on horizontal isolation and vertical encryption. However, with the rapid development of distributed power sources and the open interaction of terminal equipment, the exposure surface of the power monitoring system has increased significantly, and the protection boundaries are blurred. Traditional boundary protection is difficult to ensure the safe access of distributed power sources.

Distributed power sources, such as distributed photovoltaics, can be connected to the dispatching organization through three methods: power dispatch data network, virtual private network (VPN) based on external public data network, and wireless network to achieve remote signaling, telemetry data, etc. The information is sent to the main station of the control agency, and it can receive remote control and remote adjustment commands issued by the main station of the control agency. When the distributed power source entity interacts with the power grid, it is necessary to perform identity authentication and access control on the terminal equipment to prevent attackers from forging or controlling the distributed power source entity to access the dispatching main station and implement network attacks on the power grid.

In the process of identity authentication, the existing power dispatching digital certificate system based on Public Key Infrastructure (PKI) relies on the costly Certificate Authority (Certificate Authority, CA) center, which is difficult to apply to large-scale distributed power supplies. Requirements for secure access of terminal equipment and data encryption and decryption.

At present, the mainstream solution for supporting equipment authentication in power systems is a security authentication solution based on PKI, which uses each device as the subject. Before starting work, you need to apply for the device's own device certificate, and use the certificate for identity authentication during interaction with the outside world. And the current electric power dispatching digital certificate system only provides digital certificate services for systems, users, key network equipment, and servers in the electric power dispatching production control area (I/II area), and provides secure Web services, reverse isolation devices, and vertical encryption for the three public dispatching areas. Devices, remote dial-up access systems, etc. provide confidentiality, integrity, and identity authentication services, and have not yet been involved in power station terminal security services.

When using PKI, the system can better ensure the trustworthiness of the identities of both communicating parties, but it is relatively time-consuming because the public key cryptography algorithm requires many operations. At the same time, since the certificates of each device require the same CA system for review, issuance and query, and certificate storage will occupy the space of the device, if the number of devices reaches tens of millions or more, system performance will be greatly affected. The communication between distributed power terminals has requirements such as narrow-band communication and low power consumption. At the same time, the terminals also have the characteristics of large number and wide area distribution. The massive number of network terminals greatly increases the difficulty of risk management and control of terminal equipment in secure access authentication. Therefore, the PKI security authentication scheme is not suitable for large-scale terminal equipment identity authentication in distributed power access scenarios. Distributed power terminal side connections The security risks of being attacked, counterfeited, and exploited when entering the area.

Therefore, a technology is needed to authenticate terminal devices based on identification public keys.

Contents of the invention

Embodiments of the present application provide a terminal device authentication method, system and computer-readable storage medium based on an identification public key to solve the problem of how to authenticate a terminal device based on an identification public key.

In order to solve the above problems, embodiments of the present application provide a terminal device authentication method based on an identification public key. The method includes:

Determine the access requirements and type of the terminal device, and confirm the identification fingerprint of the terminal device based on the access requirements and type;

Based on the identification fingerprint, generate the public key and private key of the terminal device through the identification key generation algorithm;

The data message sent by the terminal device is signed and verified based on the public key and the private key, and based on the signature verification result, the terminal device is authenticated.

In the above method, the identification fingerprint includes: the unique serial number of the terminal device, general parameters, product detection serial number, and the operating status of the embedded module.

In the above method, based on the identification fingerprint, the public key and private key of the terminal device are generated through the identification key generation algorithm, including:

The terminal device generates a random number, and generates a first random public key and a first random private key based on the random number and the identification fingerprint;

Send the first random public key and the identification fingerprint to the device key management center;

The device key management center performs operations on the first random public key and the identification fingerprint to obtain a mapping sequence;

Perform matrix operations based on the mapping sequence and the randomly generated second random public key and second random private key to generate the public key and private key of the terminal device;

The device key management center encrypts the private key through the first random public key and sends the encrypted private key to the terminal device;

The terminal device decrypts the encrypted private key through the first random private key to obtain the private key;

The device key management center publishes the public key.

In the above method, the terminal device generates a random number, generates a first random public key and a first random private key based on the random number and the identification fingerprint, and also includes:

The first random public key and the first random private key are generated through the SM9 algorithm based on the random number and the identification fingerprint.

In the above method, the device key management center operates on the first random public key and the identification fingerprint to obtain the mapping sequence, which also includes:

The device key management center performs a hash operation on the first random public key and the identification fingerprint to obtain 32 sets of mapping sequences.

In the above method, the data message sent by the terminal device is signed and verified based on the public key and private key, and the authentication of the terminal device is implemented based on the signature verification result, including:

The terminal device of the sender performs operations on the data message and the identification fingerprint to generate a first message digest; encrypts the first message digest using the private key of the terminal device to obtain a digital signature; The digital signature, the data message and the identification fingerprint are sent to the recipient;

The receiver performs operations on the data message and the identification fingerprint to obtain a second message digest; decrypts the digital signature through the public key of the terminal device to obtain a first message digest; and determines the first message digest. Whether the message digest and the second message digest are consistent, when the judgment result is consistent, the terminal device passes the authentication.

In the above method, after realizing the authentication of the terminal device, it also includes:

The terminal device uses the recipient's public key to encrypt the data plaintext based on the SM4 algorithm based on random numbers, and sends the encrypted data to the recipient;

The recipient uses its own private key to decrypt the received encrypted data using the SM4 algorithm to obtain the plain text of the data.

Based on another aspect of this application, this application provides a terminal device authentication system based on an identification public key. The system includes:

The determining part is configured to determine the access requirement and type of the terminal device, and confirm the identification fingerprint of the terminal device based on the access requirement and type;

The generation part is configured to generate the public key and private key of the terminal device through the identification key generation algorithm based on the identification fingerprint;

The verification part is configured to sign and verify the data message sent by the terminal device based on the public key and the private key, and implement authentication of the terminal device based on the signature verification result.

In the above device, the identification fingerprint includes: the unique serial number of the terminal device, general parameters, product detection serial number, and the operating status of the embedded module.

In the above device, the generation part is configured to generate the public key and private key of the terminal device through the identification key generation algorithm based on the identification fingerprint, and is also configured to:

The device key management center operates on the first random public key and the identification fingerprint to obtain a mapping sequence;

The device key management center publishes the public key.

In the above device, the generating part is configured to generate a random number through the terminal device, generate a first random public key and a first random private key based on the random number and the identification fingerprint, and is also configured to:

In the above device, the generating part is configured such that the device key management center operates on the first random public key and the identification fingerprint to obtain the mapping sequence, and is further configured as:

In the above device, the verification part is configured to sign and verify the data message sent by the terminal device based on the public key and private key, and implement authentication of the terminal device based on the signature verification result. It is also configured to:

The above-mentioned device also includes a transmission part configured to encrypt the data plaintext based on the SM4 algorithm based on random numbers through the terminal device using the public key of the recipient, and send the encrypted data to the recipient;

Based on another aspect of this application, this application provides a terminal device authentication system based on an identification public key. The system includes a memory and a processor; wherein, the memory is used to store executable instructions; the processor, Used to implement any of the above terminal device authentication methods based on the identification public key by executing executable instructions stored in the memory.

Based on another aspect of the present application, the present application provides a computer-readable storage medium that stores executable instructions, and the executable instructions cause the processor to implement any of the above-mentioned identification-based public statements when executed. Key-based terminal device authentication method.

Embodiments of the present application provide a terminal equipment authentication method, system and computer-readable storage medium based on an identification public key. The method includes: determining the access requirements and types of the terminal equipment, and confirming the access requirements and types of the terminal equipment based on the access requirements and types. Identification fingerprint; based on the identification fingerprint, the public key and private key of the terminal device are generated through the identification key generation algorithm; the data message sent by the terminal device is signed and verified based on the public key and private key, and based on the signature verification result, the Certification of terminal equipment. The identification public key technology used in the embodiment of this application serves as a lightweight key generation and management method to realize the binding of terminal device identification and public key, reducing the construction cost and operation and maintenance cost of the key system, and is suitable for distribution Massive key management for power supply. It provides a basis for identity authentication and secure communication of distributed power terminal equipment, realizes the safety of distributed power grid connection, and provides security guarantee for the company's new power system construction and the development and application of distributed power.

Description of the drawings

Exemplary embodiments of the present application may be more fully understood by reference to the following drawings:

Figure 1 is a flow chart of a terminal device authentication method based on an identification public key provided by an embodiment of the present application;

Figure 2 is a flow chart of a zero-trust secure access method based on an identification public key provided by an embodiment of the present application;

Figure 3 is a schematic diagram of the user private key and public key generation process of a power Internet of Things identification public key generation algorithm provided by the embodiment of the present application;

Figure 4 is a schematic diagram of a digital signature/signature verification process provided by the embodiment of this application;

Figure 5 is a schematic diagram of a data encryption transmission process provided by an embodiment of the present application;

Figure 6 is a structural diagram of a terminal device authentication system based on an identification public key provided by an embodiment of the present application;

Figure 7 is a second structural diagram of a terminal device authentication system based on an identification public key provided by an embodiment of the present application.

Detailed ways

Exemplary embodiments of the present application will now be described with reference to the accompanying drawings. However, the present application may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided so that this disclosure will be thorough and complete. application, and fully convey the scope of this application to those skilled in the art. The terminology used in the exemplary embodiments represented in the drawings does not limit the application. In the drawings, identical units/elements use the same reference numerals.

Unless otherwise defined, the terms (including scientific and technical terms) used herein have the commonly understood meaning to one of ordinary skill in the art. In addition, it is understood that terms defined in commonly used dictionaries should be understood to have consistent meanings in the context of their relevant fields and should not be understood as having an idealized or overly formal meaning.

Figure 1 is a flow chart of a terminal device authentication method based on an identification public key according to an embodiment of the present application.

In order to ensure the safe operation of distributed power sources and their data transmission networks, resist hackers, malicious codes, etc. who use distributed power sources in various forms to initiate malicious damage and attacks on the power grid monitoring system, as well as other illegal operations, and prevent the power system from being paralyzed and out of control. , and the resulting power grid system accident requires strengthening the security protection between distributed power sources and outdoor on-site collection terminals to ensure identity authentication, data encryption, and access control between terminals.

With the development of distributed power sources and the expansion of power Internet of Things applications, terminal certification requirements have gradually revealed the shortcomings of traditional public key infrastructure PKI certificate authentication technology in Internet of Things applications. Identity Public Key (IPK) is based on the mapping relationship between the identity pair matrix and realizes the relationship binding between the identity and the key, thereby replacing the public key with the identity and simplifying the management and distribution of massive public keys. The IPK signature is short, takes up less resources for storage and transmission, and is more suitable for narrowband frame communication of terminal devices. The storage resources required by IPK are only 1/10 of PKI, which is more suitable for edge computing terminals. In terminal applications, IPK lightweight key technology has more obvious application advantages than traditional PKI technology. It can achieve decentralized and efficient offline authentication, provide the best experience for the security of IoT terminals, and ensure distribution The terminals of the power supply are securely connected to prevent attacks from spreading from the terminals to the power grid and posing a threat to the safe and stable operation of the power grid.

In order to avoid relying on the complex and expensive power dispatch data certificate system based on public key infrastructure, this application chooses a lightweight identification public key cryptographic algorithm suitable for massive IoT terminals, so the cost is lower and more suitable for large-scale distributed deployment. Promote the application of power sources, ensure the security of distributed energy access, and promote energy transformation and the construction of new power systems.

This application analyzes the risks of distributed power Internet of Things terminal access, and proposes a distributed power secure access method based on identification public keys to achieve security authentication of distributed power terminal equipment and encrypted data transmission to ensure terminal access. The security and data transmission are not threatened by illegal intrusion, and the active defense capability of the power grid is improved.

The zero-trust secure access method based on identification public keys includes three steps. First, analyze the types of terminal equipment that need to interact with the power grid for distributed power supply access, and extract device fingerprints; secondly, design a power Internet of Things terminal identification key generation algorithm based on equipment fingerprints to generate terminal equipment public and private keys; finally, design a power IoT terminal identification key generation algorithm based on identification public keys. The distributed power supply secure access method includes terminal security authentication and data encrypted transmission. as shown in picture 2.

As shown in Figure 1, this embodiment of the present application provides a terminal device authentication method based on an identification public key. The method includes:

Step 101: Determine the access requirements and type of the terminal device, and confirm the identification fingerprint of the terminal device based on the access requirements and type.

In some embodiments, the identification fingerprint includes: the unique serial number of the terminal device, general parameters, product detection serial number, and embedded module running status.

The embodiment of this application determines the type of terminal equipment involved in the control according to the network security requirements of distributed power grid connection, and determines the device identification fingerprint with the goal of ensuring uniqueness and low redundancy.

(1) Network security requirements for distributed power grid connection

The interaction between distributed power sources and the dispatching master station requires the collection of real-time remote signaling, telemetry data information, electric energy measurement and other data information, which needs to meet the security protection requirements of the power monitoring system. Taking distributed photovoltaic grid connection as an example, the following requirements need to be met:

Distributed photovoltaic grid connection of 10 kV and above: The network communication between the data collection server of the distributed photovoltaic station control system and the outdoor on-site collection terminal (such as photovoltaic power generation unit measurement and control terminal, etc.) should adopt encryption authentication measures to achieve identity authentication, data Security measures such as encryption and access control prohibit the access of external equipment to prevent the security risks of a single wind turbine or photovoltaic power generation unit from spreading to the station control system.

Low voltage distributed photovoltaic grid connection

Distribution Internet of Things access: Distributed photovoltaic deployable converged terminals are connected to the power grid company's distribution Internet of Things platform. The data interaction between distributed photovoltaic converged terminals and the power grid company's distribution Internet of Things platform should have identity authentication, access control, data Encryption function.

Access to the power information collection system: The data interaction between the distributed photovoltaic energy controller and the power distribution Internet of Things platform of the power grid company should have identity authentication, access control, and data encryption functions.

Public network cloud platform access: The data interaction between distributed photovoltaic aggregators and the power grid company's public network cloud platform should have identity authentication, access control, and data encryption functions.

(2) Determine the device fingerprint type

Perception layer terminals such as photovoltaic power generation unit measurement and control terminals usually need to obtain a variety of data types, such as electrical quantity sensing, environmental quantity sensing, physical quantity sensing, behavioral quantity sensing, etc., covering a variety of sensors, video collectors, data collection equipment, etc. , depending on the complexity of its functions, the feature labels covered are also different, such as device numbers, performance parameters, and operating environment parameters.

Intelligent devices such as distributed photovoltaic energy controllers and distributed photovoltaic integration terminals also include communication modules, metering modules, control modules, etc., and these modules have their own numerous characteristic parameter information.

The extraction of device fingerprint feature information should not only fully reflect the characteristics of a device, but also be able to uniquely identify a device. It also needs to consider pressures such as device computing power and energy consumption. Therefore, in the embodiment of this application, through a multi-mark feature selection algorithm based on multi-variable mutual information, the feature subsets screened from multi-dimensional feature information are: device/module unique serial number, general parameters, product detection serial number, embedded module Operating status.

Among them, the device serial number/ID is the unique identifier assigned to the device by the manufacturer; device general parameters, such as type, name, model, function, etc.; embedded module running status, such as security status, storage status, etc., due to the module’s software The hardware design has the characteristics of high security, high security, and these states are not easily copied and have good uniqueness. This subset covers as much category information as possible with less redundancy.

Step 102: Based on the identification fingerprint, generate the public key and private key of the terminal device through the identification key generation algorithm.

In some embodiments, based on the identification fingerprint, the public key and private key of the terminal device are generated through an identification key generation algorithm, including:

The terminal device generates a random number, and generates a first random public key and a first random private key based on the random number and identification fingerprint;

Send the first random public key and identification fingerprint to the device key management center;

The device key management center operates the first random public key and the identification fingerprint to obtain the mapping sequence;

The device key management center publishes the public key.

In some embodiments, the terminal device generates a random number, generates a first random public key and a first random private key based on the random number and the identification fingerprint, and further includes:

The first random public key and the first random private key are generated through the SM9 algorithm based on the random number and identification fingerprint.

In some embodiments, the device key management center operates on the first random public key and the identification fingerprint to obtain the mapping sequence, which also includes:

The power Internet of Things identification public key generation algorithm provided by the embodiment of this application is based on IPK identification public key technology, using the SM9 algorithm to design an identification key pair generation method, and converts the existing public key system into a public key combined with the Internet of Things device identification. The system realizes the binding of identification and public key, combines the generation and distribution of keys, and realizes the key management of massive terminals. As a lightweight key generation and management method, it directly simplifies the key generation. complexity and management difficulty, while reducing the construction cost and operation and maintenance cost of the key system. The user private key and public key generation process of the power Internet of Things identification public key generation algorithm is shown in Figure 3.

The power Internet of Things identification public key generation algorithm process provided by the embodiment of this application is as follows:

The terminal device extracts fingerprint information and forms a fingerprint ID;

The random number s generated by the terminal device generates the user's random public and private key pair (r, R) according to the SM9 algorithm, and passes R and the fingerprint ID to the device key management center;

The device key management center performs a hash operation on the R and fingerprint ID sent by the device to obtain 32 sets of mapping sequences;

Perform matrix operations based on 32 sets of mapping sequences and randomly generated public keys and private keys to obtain the public key PSK (Pre-Shared Key) and the device's private key ISK (Identity Secure Key);

The device key management center then uses the encryption algorithm with R as the public key to encrypt the ISK to obtain the ciphertext and send it back to the device;

The device uses the random private key r to decrypt the ciphertext and obtain its own private key ISK;

The device key management center will publish the public key PSK, and other users can decrypt the ciphertext sent by the device based on the device's public key.

Through the above process, the device key management center cannot know the private key of the device, and other users cannot decrypt the ciphertext, ensuring the security of the private key and message.

In the identification public key generation process in the embodiment of this application, the SM9 national secret algorithm is used to generate the random public and private key pairs of the terminal, replacing ECC and other foreign algorithms. The performance is better and safer, the processing speed is fast, and the machine performance consumption is smaller. , get rid of the dependence on foreign cryptography technology, and realize the control of core information security technology from the cryptographic algorithm level.

Step 103: Sign and verify the data message sent by the terminal device based on the public key and private key, and implement authentication of the terminal device based on the signature verification result.

In some embodiments, the data message sent by the terminal device is signed and verified based on the public key and private key, and the authentication of the terminal device is implemented based on the signature verification result, including:

The sender's terminal device calculates the data message and the identification fingerprint to generate a first message digest; encrypts the first message digest with the private key of the terminal device to obtain a digital signature; sends the digital signature, data message and identification fingerprint to the recipient square;

The receiver calculates the data message and the identification fingerprint to obtain the second message digest; decrypts the digital signature through the public key of the terminal device to obtain the first message digest; determines whether the first message digest and the second message digest are consistent. When the results are consistent, the terminal device is authenticated.

The embodiment of this application implements terminal device identity authentication based on the digital signature of the identification public key. The identity authentication of the terminal device in this embodiment of the application is an important link in the secure access of distributed power sources. The embodiment of this application uses a lightweight identification key system. Basically, the digital signature of the terminal device is realized and the terminal identity is verified. When the distributed power terminal equipment and the control system transmit message data, in order to ensure that the message has not been tampered with, the message needs to be digitally signed and verified. The lightweight SM2 algorithm is used for signature verification from the edge side to the terminal side, using electricity. IoT identification public key generation algorithm for key management. The digital signature and signature verification process is shown in Figure 4.

Digital signature process: The sender's terminal device first splices the message and device identification and performs Hash function encryption to obtain the encrypted message digest; then inputs the encrypted message digest and the device private key ISK into the encryption algorithm for signature operation to obtain a digital signature. Put the obtained digital signature and the original message identifier into the data packet for transmission.

Signature verification process: When the recipient receives the data packet, it must first verify the digital signature information to ensure the authenticity of the data packet. Use the public key to decrypt the received signature information, and compare the decrypted message sequence with the transmitted message sequence. If the results are consistent, the signature is valid and the message has not been tampered with. Otherwise, the signature is invalid.

In the secure access process of distributed power terminal equipment, public and private keys are generated based on the power Internet of Things identification public key generation algorithm, and the message is digitally signed based on the SM2 algorithm. Key management and key management using the power Internet of Things identification public key generation algorithm are realized. The combination of SM2 digital signatures ensures that the relevant data is real data obtained from legal equipment, realizes the security authentication of distributed power terminal equipment, and prevents counterfeit attacks.

In some embodiments, after implementing the authentication of the terminal device, it also includes:

The receiver uses its own private key to decrypt the received encrypted data using the SM4 algorithm to obtain the plain text of the data.

The embodiment of this application implements secure transmission of terminal data based on SM4 encryption and decryption of the power Internet of Things identification public key. After collecting data information, the distributed power supply terminal equipment in the embodiment of the present application transmits the data obtained by the terminal to the power Internet of Things management platform. During the transmission process, the transmitted information data is encrypted to ensure that the information received by the recipient is safe and reliable.

For the encryption method of transmitted data, the embodiment of this application adopts the SM4 data encryption and decryption algorithm using the public and private keys generated by the power Internet of Things identification public key generation algorithm as the key to ensure its security. As an asymmetric elliptic curve encryption algorithm, SM4 encryption and decryption The speed is faster and the machine performance consumption is smaller. During the data encryption transmission process, as shown in Figure 5, the sender uses the receiver's public key to encrypt the message with SM4. Random numbers are used in the encryption process, so the same plaintext data has different encryption results every time; the receiver uses Its own private key performs SM4 decryption on the received encrypted data packets, calculates the plaintext of the transmitted message, and performs data verification to ensure the integrity of the data transmission process, solve the problem of data tampering during network transmission, and ensure that the business system receives The data is reliable, that is, data tampering attacks are prevented.

The distributed power terminal fingerprint extraction technology in the embodiment of this application determines the type of terminal involved in the control based on the network security requirements of distributed power grid connection, and determines the device fingerprint characteristics with the goal of ensuring uniqueness and low redundancy. The interaction between the distributed power supply and the dispatching master station in the embodiment of this application needs to meet the security protection requirements of the power monitoring system for identity authentication, access control, and data encryption. Sensing layer terminals such as photovoltaic power generation unit measurement and control terminals and smart devices such as distributed photovoltaic energy controllers contain numerous characteristic parameter information. The extraction of device fingerprint feature information should not only fully reflect the characteristics of a device, but also be able to uniquely identify a device. It also needs to consider pressures such as device computing power and energy consumption. Therefore, in the embodiment of this application, through a multi-mark feature selection algorithm based on multi-variable mutual information, the feature subsets screened from multi-dimensional feature information are: device/module unique serial number, general parameters, product detection serial number, embedded module Operating status.

The electric power Internet of Things identification public key generation algorithm designed in the embodiment of this application is developed on the basis of IPK identification public key technology. Based on the SM9 identification key pair generation method, the existing public key system is transformed into a combination of Internet of Things device identification. The public key system realizes the binding of identification and public key, combines the generation and distribution of keys, and provides ideas for massive key management. As a lightweight key generation and management method, it directly simplifies It reduces the complexity and management difficulty of key generation, uses the national secret algorithm to improve security and independent controllability, and at the same time reduces the construction cost and operation and maintenance cost of the key system.

The identity authentication of the terminal equipment in the embodiment of this application is an important link in the secure access of distributed power sources. The embodiment of this application implements the digital signature of the terminal equipment based on the lightweight identification key system to perform terminal identity verification. When the distributed power terminal equipment and the control system transmit message data, in order to ensure that the message has not been tampered with, the message is digitally signed and verified. The lightweight SM2 algorithm is used for signature verification from the edge side to the terminal side. The network identification public key generation algorithm performs key management to ensure that the relevant data is real data obtained from legal equipment, realizes the security authentication of distributed power terminal equipment, and prevents counterfeit attacks.

The application identification public key in the embodiment of this application brings high security: PKI is a security system using a single root key, and IPK is a combination of multiple algorithms based on a seed key, which is more suitable for distributed power control. Terminal security authentication can more effectively resist cloud computing and quantum computing attacks; the embodiments of this application have strong compatibility: IPK is compatible with mainstream security applications such as PKI, and integrates the original business security mechanisms without affecting the original business security mechanism. Business security mechanism to better meet the security construction and defense of distributed power sources; the embodiment of this application is highly disaster-tolerant: the IPK authentication process does not require the support of a central certificate (public key) library, which not only helps improve efficiency but also reduces Resource consumption, and the system will not be paralyzed due to central system failures and unexpected disasters, which is very suitable for distributed power grid-connected scenarios; the embodiments of this application are autonomously controllable: IPK lightweight key technology is independently controllable in China Control, supported by the national secret algorithm, can independently control the key without relying on a third party, and realize an active security defense mechanism in the process of distributed power grid connection; the applicability of the embodiments of this application is strong: IPK technology is very efficient in the management and distribution of keys , easy to use, simple to deploy, and fully meets the requirements of core security mechanisms such as terminal authentication and data transmission in the process of distributed power grid connection.

The distributed power supply secure access method based on the identification public key in the embodiment of this application creates significant economic benefits in terms of cost saving and risk prevention. (1) In terms of cost saving, the cost of the secure access method based on identification public keys is significantly lower than that of traditional power dispatch digital certificates. In large-scale deployment, the economic benefits are significant and the cost can be greatly reduced; (2) In terms of risk prevention At the same level, large-scale power outages caused by cyber attacks will bring great losses to social production. The secure access method of distributed power sources based on identification public keys is applied to the secure access of wind turbines and photovoltaic power stations. It can achieve data confidentiality, integrity and authenticity in the data transmission process between distributed power sources and grid control systems. This further protects the security of the power grid and reduces losses caused by power emergencies.

With the national strategic goal of "carbon peaking and carbon neutrality" proposed, the power grid is developing a new power system, and the proportion of new energy will increase significantly. It is particularly important to ensure the safety of new energy plants and stations entering the grid. The application of the secure access method of distributed power sources based on identification public keys improves the attack prevention capabilities of the vertical network boundary between new energy plants and main grid dispatching stations, avoids security threats to the power grid caused by access to distributed power sources, and ensures The stable operation of new energy power plants and the national grid provides reliable power supply for economic and social development. At the same time, because the secure access method of distributed power sources based on identification public keys improves the security of new energy plants and stations entering the network, it will definitely promote the integration of clean energy into the network, accelerate the construction of new energy plants and stations, promote the green transformation of energy, and help the country achieve Two-carbon target.

In some embodiments, FIG. 6 is a structural diagram 1 of a terminal device authentication system based on an identity public key provided according to an embodiment of the present application. The system includes:

The determination part 601 is configured to determine the access requirements and type of the terminal device, and confirm the identification fingerprint of the terminal device based on the access requirements and type;

The generation part 602 is configured to generate the public key and private key of the terminal device through the identification key generation algorithm based on the identification fingerprint;

In some embodiments, the generation part 602 is configured to generate the public key and private key of the terminal device through the identification key generation algorithm based on the identification fingerprint, and is also configured to:

The device key management center publishes the public key.

In some embodiments, the generation part 602 is configured to generate random numbers through the terminal device, generate the first random public key and the first random private key based on the random number and identification fingerprint, and is also configured to:

In some embodiments, the generation part 602 is configured for the device key management center to operate the first random public key and the identification fingerprint to obtain the mapping sequence, and is also configured to:

The verification part 603 is configured to sign and verify the data message sent by the terminal device based on the public key and private key, and implement authentication of the terminal device based on the signature verification result.

In some embodiments, the verification part 603 is configured to sign and verify the data message sent by the terminal device based on the public key and private key, and implement authentication of the terminal device based on the signature verification result. It is also configured to:

In some embodiments, the terminal device authentication system also includes a transmission part configured to encrypt the data plaintext using the SM4 algorithm based on random numbers through the terminal device using the public key of the recipient, and send the encrypted data to the recipient;

It should be noted that the terminal device authentication system 600 based on the identity public key provided by the embodiment of the present application corresponds to the terminal device authentication method 100 based on the identity public key provided by the embodiment of the present application, and will not be described again here.

In some embodiments, FIG. 7 is a structural diagram 2 of a terminal device authentication system based on an identification public key provided according to an embodiment of the present application. The system includes: communication interface 901, memory 902 and processor 903; various components are coupled together through a bus system 904. It can be understood that the bus system 904 is used to implement connection communication between these components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 904 in FIG. 9 . Among them, the communication interface 901 is used for receiving and sending signals during the process of sending and receiving information with other external network elements;

Memory 902 for storing executable instructions that can be run on the processor 903;

The processor 903 is configured to implement any terminal device authentication method based on the identification public key provided by the embodiments of this application when running the executable instructions.

Embodiments of the present application provide a computer-readable storage medium that stores executable instructions for causing the processor 903 to implement the terminal device authentication method based on the identification public key provided by the embodiments of the present application.

In some embodiments of the present application, the storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; it may also include one or any combination of the above memories. Various equipment.

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein. The solutions in the embodiments of this application can be implemented using various computer languages, such as the object-oriented programming language Java and the literal scripting language JavaScript.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Although some embodiments of the present application have been described, additional changes and modifications to these embodiments may be made by those skilled in the art once the basic inventive concepts are understood. Therefore, it is intended that the appended claims be construed to include the preferred embodiments and all changes and modifications that fall within the scope of this application.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and equivalent technologies, the present application is also intended to include these modifications and variations.

The application has been described with reference to a small number of embodiments. However, it is known to those skilled in the art that other embodiments than those disclosed above are equally within the scope of the present application, as defined by the appended patent claims.

Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless otherwise expressly defined therein. All references to "a//the [means, component, etc.]" are to be construed liberally to mean at least one instance of the means, component, etc., unless expressly stated otherwise. The steps of any method disclosed herein are not necessarily performed in the exact order disclosed unless explicitly stated.

Industrial applicability

The identification public key technology used in the embodiment of this application serves as a lightweight key generation and management method to realize the binding of terminal device identification and public key, reducing the construction cost and operation and maintenance cost of the key system, and is suitable for distribution Massive key management for power supply. It provides a basis for identity authentication and secure communication of distributed power terminal equipment, realizes the safety of distributed power grid connection, and provides security guarantee for the company's new power system construction and the development and application of distributed power.

Claims

A terminal device authentication method based on an identification public key, the method includes:

Determine the access requirements and type of the terminal device, and confirm the identification fingerprint of the terminal device based on the access requirements and type;

Based on the identification fingerprint, generate the public key and private key of the terminal device through the identification key generation algorithm;

Sign and verify the data message sent by the terminal device based on the public key and the private key, and implement authentication of the terminal device based on the signature verification result.
The method according to claim 1, wherein the identification fingerprint includes: the unique serial number of the terminal device, general parameters, product detection serial number, and embedded module operating status.
The method according to claim 1, wherein generating the public key and private key of the terminal device through an identification key generation algorithm based on the identification fingerprint includes:

The terminal device generates a random number, and generates a first random public key and a first random private key based on the random number and the identification fingerprint;

Send the first random public key and the identification fingerprint to the device key management center;

The device key management center performs operations on the first random public key and the identification fingerprint to obtain a mapping sequence;

Perform matrix operations based on the mapping sequence and the randomly generated second random public key and second random private key to generate the public key and private key of the terminal device;

The device key management center encrypts the private key through the first random public key and sends the encrypted private key to the terminal device;

The terminal device decrypts the encrypted private key through the first random private key to obtain the private key;

The device key management center publishes the public key.
The method according to claim 3, wherein the terminal device generates a random number, generates a first random public key and a first random private key based on the random number and the identification fingerprint, further comprising:

The first random public key and the first random private key are generated through the SM9 algorithm based on the random number and the identification fingerprint.
The method according to claim 3, wherein the device key management center operates on the first random public key and the identification fingerprint to obtain a mapping sequence, further comprising:

The device key management center performs a hash operation on the first random public key and the identification fingerprint to obtain 32 sets of mapping sequences.
The method according to claim 1, wherein the data message sent by the terminal device is signed and verified based on the public key and the private key, and the authentication of the terminal device is implemented based on the signature verification result, including:

The terminal device of the sender performs operations on the data message and the identification fingerprint to generate a first message digest; encrypts the first message digest using the private key of the terminal device to obtain a digital signature; The digital signature, the data message and the identification fingerprint are sent to the recipient;

The receiver performs operations on the data message and the identification fingerprint to obtain a second message digest; decrypts the digital signature through the public key of the terminal device to obtain a first message digest; and determines the first message digest. Whether the message digest and the second message digest are consistent, when the judgment result is consistent, the terminal device passes the authentication.
The method according to claim 1, wherein after realizing the authentication of the terminal device, it further includes:

The terminal device uses the recipient's public key to encrypt the data plaintext based on the SM4 algorithm based on random numbers, and sends the encrypted data to the recipient;

The recipient uses its own private key to decrypt the received encrypted data using the SM4 algorithm to obtain the plain text of the data.
A terminal device authentication system based on identification public key, the system includes:

The determining part is configured to determine the access requirement and type of the terminal device, and confirm the identification fingerprint of the terminal device based on the access requirement and type;

The generation part is used to generate the public key and private key of the terminal device through the identification key generation algorithm based on the identification fingerprint;

The verification part is configured to sign and verify the data message sent by the terminal device based on the public key and the private key, and implement authentication of the terminal device based on the signature verification result.
The system according to claim 8, wherein the identification fingerprint includes: the unique serial number of the terminal device, general parameters, product detection serial number, and embedded module operating status.
The system according to claim 8, wherein the generating part is configured to generate the public key and private key of the terminal device through an identification key generation algorithm based on the identification fingerprint, and is further configured to:

The terminal device generates a random number, and generates a first random public key and a first random private key based on the random number and the identification fingerprint;

Send the first random public key and the identification fingerprint to the device key management center;

The device key management center performs operations on the first random public key and the identification fingerprint to obtain a mapping sequence;

Perform matrix operations based on the mapping sequence and the randomly generated second random public key and second random private key to generate the public key and private key of the terminal device;

The device key management center encrypts the private key through the first random public key and sends the encrypted private key to the terminal device;

The terminal device decrypts the encrypted private key through the first random private key to obtain the private key;

The device key management center publishes the public key.
The system according to claim 10, wherein the generating part is configured to generate a random number through a terminal device, and generate a first random public key and a first random private key based on the random number and the identification fingerprint, and is further configured to for:

The first random public key and the first random private key are generated through the SM9 algorithm based on the random number and the identification fingerprint.
The system according to claim 10, wherein the generating part is configured for the device key management center to operate the first random public key and the identification fingerprint to obtain the mapping sequence, and is further configured to:

The device key management center performs a hash operation on the first random public key and the identification fingerprint to obtain 32 sets of mapping sequences.
The system according to claim 8, wherein the verification part is configured to sign and verify the data message sent by the terminal device based on the public key and the private key, and implement authentication of the terminal device based on the signature verification result. , also configured as:

The terminal device of the sender performs operations on the data message and the identification fingerprint to generate a first message digest; encrypts the first message digest using the private key of the terminal device to obtain a digital signature; The digital signature, the data message and the identification fingerprint are sent to the recipient;

The receiver performs operations on the data message and the identification fingerprint to obtain a second message digest; decrypts the digital signature through the public key of the terminal device to obtain a first message digest; and determines the first message digest. Whether the message digest and the second message digest are consistent, when the judgment result is consistent, the terminal device passes the authentication.
The system according to claim 8, further comprising a transmission part configured to encrypt the data plaintext using the SM4 algorithm based on random numbers through the public key of the recipient through the terminal device, and send the encrypted data to the recipient;

The recipient uses its own private key to decrypt the received encrypted data using the SM4 algorithm to obtain the plain text of the data.
A terminal device authentication system based on identification public key, the system includes a memory and a processor; wherein,

The memory is used to store executable instructions;

The processor is configured to implement the method according to any one of claims 1 to 7 by executing executable instructions stored in the memory.
A computer-readable storage medium stores executable instructions that cause a processor to implement the method according to any one of claims 1 to 7 when executed.