A multiple authentication method and system

Abstract

The present invention discloses a multiple authentication method and system, and relates to the field of data security technology. The method is applied to a power system to be accessed, and in response to the acquired connection request, the encrypted digital certificate is sent to the pre-access object together with the first key and its arrangement order, and then the encrypted digital certificate of the pre-access object returned by the pre-access object is obtained to perform authentication after decryption, and then after the authentication is successful, the second key returned by the pre-access object is obtained, and it is verified whether the second key meets the preset conditions that the second key matches the corresponding first key and the return order is the same as the arrangement order of the first key. When the authentication fails or the second key does not meet the preset conditions, an authentication failure message is sent to the pre-access object, and the authentication process is terminated. Thereby solving the problem that the single authentication method is used on the power system, the security of the power system cannot be guaranteed, and the multiple authentication methods are used, which affects the experience of using electricity.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically, to a multiple authentication method and system. Background Art

[0002] Under the background of the new power system, the open and integrated business and data architecture has brought new risks to the security protection system. The number of security defense checkpoints has increased and the security boundary has expanded significantly. A large number of external non-trusted businesses and terminal businesses have accessed the company's core network through wired, wireless private networks, mobile phones, etc., resulting in a significant increase in the exposure of power system attacks. The risk of border security has increased exponentially, and the core network of municipal companies is facing threats. Therefore, effectively preventing unauthorized users from accessing the power system network, that is, effectively authenticating the pre-access objects that have pre-accessed the power system, and authorizing them to access the power system after the authentication is passed, can fundamentally reduce the possibility of attacks on the power system.

[0003] Authentication can be divided into single authentication and multiple authentication according to the level of authentication. In single authentication, both parties only need to authenticate once. In multiple authentication, both parties need to authenticate multiple times, and each authentication may be based on different purposes and for different objects. It is known that multiple authentication is more reliable than single authentication.

[0004] However, the current multiple authentication methods usually require repeated information exchange between the accessed network and the pre-accessed object, which results in low authentication efficiency and seriously affects the user experience of power systems that supply power to medical, government and residential households. Using single authentication on the power system makes it difficult to ensure the security of the power system. Summary of the invention

[0005] The purpose of the present invention is to provide a multiple authentication method and system to solve the problem that the use of a single authentication method on the power system cannot ensure the safety of the power system, while the use of multiple authentication methods affects the power usage experience.

[0006] In a first aspect, the present invention provides a multi-authentication method, applied to a power system to be connected, comprising:

[0007] Obtaining a connection request, where the connection request is an access application sent by a pre-access object to the power system;

[0008] In response to the connection request, sending the encrypted digital certificate, together with the first key generated based on the encryption rule and the arrangement order of the first key to the pre-access object;

[0009] Obtaining the encrypted digital certificate of the pre-access object returned by the pre-access object, and authenticating the digital certificate of the pre-access object after decryption;

[0010] If the authentication is successful, obtaining the second key returned by the pre-access object, and verifying whether the second key meets a preset condition, wherein the preset condition is that the second key matches the corresponding first key, and the return order of the second key is the same as the arrangement order of the first key;

[0011] If the authentication fails or the second key does not meet the preset condition, an authentication failure message is sent to the pre-access object, and the authentication process is terminated.

[0012] In a preferred solution, the method for generating the first key based on the encryption rule includes:

[0013] Determining a time to obtain the connection request;

[0014] Determine a target time period to which the acquisition moment belongs, wherein a plurality of target time periods respectively correspond to time periods of different frequencies during which the authentication process is terminated within a preset period;

[0015] Determine the number of the encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules;

[0016] Based on the number of the pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules;

[0017] Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

[0018] In a preferred solution, the number of encryption rules pre-selected based on the number of encryption rules selected, in a rule library pre-stored with a number of different encryption rules, selects a corresponding number of encryption rules, including:

[0019] Dividing the number of the pre-selected encryption rules according to a preset ratio;

[0020] Based on the divided quantity, according to the arrangement order of the rule sub-bases in the rule base, sequentially select a corresponding quantity of encryption rules in different rule sub-bases;

[0021] The arrangement order of the rule sub-base is arranged from low to high according to the complexity of the encryption rules pre-stored in the rule sub-base.

[0022] In a preferred embodiment, the initial division of the target time period is determined based on the historical moment data of the termination of the authentication process within the preset period, and the division of the target time period is continuously adjusted on the basis of the initial division as the moment and / or frequency of the termination of the authentication process changes.

[0023] In a preferred embodiment, the target time period includes at least: a first time period characterizing that the frequency of terminating the authentication process is greater than or equal to a preset frequency upper limit, a second time period characterizing that the frequency of terminating the authentication process is less than the preset frequency upper limit and greater than or equal to a preset frequency lower limit, and a third time period characterizing that the frequency of terminating the authentication process is less than the preset frequency lower limit.

[0024] In a preferred solution, the obtaining the second key returned by the pre-access object includes:

[0025] When the acquisition time belongs to the first time period, sequentially acquiring the second keys returned by the pre-access objects until all the second keys are acquired or the second keys do not meet the preset condition;

[0026] When the acquisition time belongs to the second time period, sequentially acquiring the second keys returned by the pre-access objects until the number of acquired second keys reaches a first preset number or the second keys do not meet the preset condition;

[0027] When the acquisition time belongs to the third time period, sequentially acquiring the second keys returned by the pre-access object until the number of the acquired second keys reaches a second preset number or the second keys do not meet the preset condition;

[0028] The first preset number is greater than the second preset number.

[0029] In a second aspect, the present invention provides another multi-authentication method, which is applied to a pre-access object that pre-accesses a power system, comprising:

[0030] Sending a connection request to the power system, wherein the connection request is an access application sent to the power system;

[0031] Receiving response information returned by the power system after responding to the connection request, the response information including: an encrypted digital certificate of the power system, a first key generated based on an encryption rule, and an arrangement order of the first key;

[0032] decrypting the digital certificate of the power system, and authenticating the decrypted digital certificate of the power system;

[0033] If the authentication is successful, the corresponding key master is selected in sequence from the pre-stored key master library according to the arrangement order of the first key, the corresponding first key is decrypted to generate a second key matching the first key, and the second key is sent to the power system;

[0034] If the authentication fails or the power system receives authentication failure information, the authentication process is terminated.

[0035] In a third aspect, the present invention provides a multi-authentication system, which is applied to a power system to be connected, comprising:

[0036] A collection unit, used to obtain a connection request, wherein the connection request is an access application sent by a pre-access object to the power system;

[0037] A first processing unit, configured to send, in response to the connection request, the encrypted digital certificate, together with a first key generated based on an encryption rule and an arrangement order of the first key to the pre-access object;

[0038] The second processing unit is used to obtain the encrypted digital certificate of the pre-access object returned by the pre-access object, and authenticate the digital certificate of the pre-access object after decryption; and when the authentication is successful, obtain the second key returned by the pre-access object, and verify whether the second key meets the preset conditions, the preset conditions are that the second key matches the corresponding first key, and the return order of the second key is the same as the arrangement order of the first key; and when the authentication fails or the second key does not meet the preset conditions, send authentication failure information to the pre-access object and terminate the authentication process.

[0039] In a fourth aspect, the present invention provides another multi-authentication system, which is applied to a pre-access object pre-accessing a power system, comprising:

[0040] A sending unit, configured to send a connection request to the power system, wherein the connection request is an access application sent to the power system;

[0041] A third processing unit is used to receive response information returned by the power system after responding to the connection request, wherein the response information includes: an encrypted digital certificate of the power system, a first key generated based on an encryption rule, and an arrangement order of the first key;

[0042] The fourth processing unit is used to decrypt the digital certificate of the power system and authenticate the decrypted digital certificate of the power system; and when the authentication is successful, the corresponding key master is selected in sequence from the pre-stored key master library according to the arrangement order of the first keys, and the corresponding first key is decrypted to generate a second key matching the first key, and send it to the power system; and when the authentication fails or the power system receives authentication failure information, the authentication process is terminated.

[0043] In a fifth aspect, the present invention provides an electronic device, the electronic device comprising:

[0044] processor;

[0045] a memory for storing instructions executable by the processor;

[0046] The processor is used to execute the multiple authentication method provided by the first aspect or the second aspect of the present invention.

[0047] In order to achieve the above-mentioned purpose, the present invention provides a multiple authentication method and system, which, after obtaining a connection request representing an access application sent by a pre-access object to a power system, responds to the connection request and sends the encrypted digital certificate, together with the first key generated based on the encryption rule and the arrangement order of the first key, to the pre-access object, so that the pre-access object can authenticate the digital certificate of the power system, and after the authentication is successful, the power system can receive the encrypted digital certificate of the pre-access object, so as to first determine whether the pre-access object is a device that can access the power system by authenticating the decrypted digital certificate of the pre-access object, and then further after the authentication is successful, by obtaining the second key returned by the pre-access object, and verifying whether the second key matches the corresponding first key, and whether the return order of the second key is the same as the arrangement order of the first key, to further authenticate the pre-access object; and when the authentication fails or the second key fails to match the corresponding first key and / or the return order is different from the arrangement order of the first key, an authentication failure message is sent to the pre-access object, and the authentication process is terminated. This transforms the multiple authentication between the power system and the pre-access object from the traditional continuous interaction between the two to a one-way transmission mainly in which the pre-access object transmits data to the power system, thereby effectively improving the authentication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The present invention is a flowchart of an existing multi-authentication method.

[0049] Figure 2 A flowchart of a multiple authentication method provided by an embodiment of the present invention.

[0050] Figure 3A flowchart of another multi-authentication method provided by an embodiment of the present invention.

[0051] Figure 4 A structural diagram of a multiple authentication system provided in an embodiment of the present invention.

[0052] Figure 5 A structural diagram of another multi-authentication system provided in an embodiment of the present invention.

[0053] Figure 6 A structural diagram of another multi-authentication system provided by an embodiment of the present invention.

[0054] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The present invention is further described in detail below through the accompanying drawings and specific embodiments.

[0056] It is understandable that authentication can be divided into single authentication and multiple authentication according to the level of authentication. In single authentication, both parties need to authenticate only once. In multiple authentication, both parties need to authenticate multiple times, and each authentication may be based on different purposes and for different objects. For example, in some communication systems, when a device enters the network, the network usually authenticates the device and user of the access user. Only when the access user uses a legitimate device and has a legitimate user identity, it is allowed to access the network, use network resources, and access the services provided by the network.

[0057] Figure 1 An existing multi-factor authentication method is shown. Figure 1 It can be seen that, with this authentication method, in the multiple authentications after the first authentication, the authentication encryption key of the next authentication is the master authorization key generated by the network according to the authentication encryption key of the previous authentication during the previous authentication process, and the user end and the network end then deduce it according to the master authorization key, that is, the user end and the network end complete the second authentication, and the authentication message exchanged between the user end and the network end during the authentication is encrypted using AEK1, and the network end randomly generates PAK2 according to a certain strategy, and sends it to the user end through the secure channel between the network end and the user end. After that, the user end and the network end deduce the AEK2 shared by both parties from PAK2 according to a certain strategy. That is, the user end and the network end repeat the above encryption and deduction steps until the multiple authentications are completed. In each authentication, the network end and the user end need to exchange the encrypted authentication message once, and then the network end randomly generates PAK and sends it to the user end. The entire authentication process requires the network end and the user end to interact continuously to complete, and the authentication efficiency is low.

[0058] In order to solve the above problems, the present invention provides a multiple authentication method that sends the encrypted digital certificate and key to the pre-access object together, and then directly performs subsequent authentication based on the key after the pre-access object and the power system confirm their identities. Thus, by transforming the data interaction between the power system and the pre-access object into a data transmission method that mainly outputs data from the pre-access object to the power system in one direction, the authentication efficiency of accessing the pre-access object using the multiple authentication method on the power system is improved.

[0059] The multiple authentication method provided by the present invention is executed on an electronic device, which may be a processor, controller, etc. configured in the power system, or an intelligent terminal such as a laptop computer, desktop computer, etc. remotely connected to the power system, or a server on the network side.

[0060] like Figure 2 As shown, the multiple authentication method provided by the embodiment of the present invention is applied to the power system to be connected, and mainly includes the following steps:

[0061] 110. Get the connection request.

[0062] The connection request is an access application sent by the pre-access object to the power system.

[0063] It is understandable that, since it is not ruled out that there are objects that penetrate the power system intranet by tampering or implanting malicious code, illegal access, etc. after accessing the power system, after obtaining the access application sent by the pre-access object to the power system, it is necessary to authenticate the pre-access object to improve the security of the power system.

[0064] In some possible embodiments, when the pre-access object pre-accesses the power system, it first sends an access application to the power system. For example, the act of opening the login interface and entering the account and password is equivalent to sending an access application to the power system.

[0065] 120. In response to the connection request, the encrypted digital certificate, together with the first key generated based on the encryption rule and the arrangement order of the first key, is sent to the pre-access object.

[0066] Specifically, the digital certificate for the device is issued by the device manufacturer, and the digital certificate for the user end is issued by the operator. The digital certificate identifies the relevant attributes of the device or user. By sending the digital certificate to the pre-access object, the pre-access object can determine whether it is the pre-access system based on the authentication of the digital certificate.

[0067] Furthermore, by encrypting the digital certificate, the information exposure of the power system equipment can be avoided, thereby improving the security of the authentication process.

[0068] Furthermore, by enabling the object to be accessed and the object to be pre-accessed to have adapted encryption rules and key masters, the object to be accessed and the object to be pre-accessed can form adapted keys, thereby determining each other's identities, that is, achieving mutual authentication.

[0069] Specifically, by responding to a connection request, the encrypted digital certificate, together with the first key generated based on the encryption rule and the arrangement order of the first key, is sent to the pre-access object. After the pre-access object authenticates the identity of the power system based on the digital certificate of the power system, it can directly perform subsequent authentication based on the first key, which effectively simplifies the authentication process, improves authentication efficiency, and thus improves user experience.

[0070] 130. Obtain the encrypted digital certificate of the pre-access object returned by the pre-access object, and authenticate the digital certificate of the pre-access object after decryption.

[0071] Specifically, when the pre-access object returns the encrypted digital certificate of the pre-access object, it means that the pre-access object has successfully authenticated the identity of the power system. Afterwards, by authenticating the digital certificate of the pre-access object after decryption, the power system can authenticate the identity of the pre-access object.

[0072] 140. If the authentication is successful, obtain the second key returned by the pre-access object, and verify whether the second key meets the preset condition, where the preset condition is that the second key matches the corresponding first key, and the return order of the second key is the same as the arrangement order of the first key.

[0073] Specifically, after the identity authentication of the pre-access object is successful, the second key returned by the pre-access object is continued to be obtained, and then the pre-access object can be further authenticated through double verification of whether the second key matches the corresponding first key and whether the return order of the second key is the same as the arrangement order of the first key, thereby improving the authentication accuracy.

[0074] 150. If the authentication fails or the second key does not meet the preset condition, an authentication failure message is sent to the pre-access object, and the authentication process is terminated.

[0075] In this embodiment, in response to a connection request, the encrypted digital certificate, together with the first key generated based on the encryption rule and the arrangement order of the first key, is sent to the pre-access object, and then the encrypted digital certificate of the pre-access object returned by the pre-access object is obtained, and the digital certificate of the pre-access object is authenticated after decryption. After the authentication is successful, the second key returned by the pre-access object is obtained, and it is verified whether the second key satisfies the preset conditions that the second key matches the corresponding first key and the return order of the second key is the same as the arrangement order of the first key. When the authentication fails or the second key does not meet the preset conditions, authentication failure information is sent to the pre-access object and the authentication process is terminated, so that the multiple authentication processes are simplified, while ensuring the authentication accuracy, thereby improving the user experience.

[0076] Based on the content of the above embodiment, the method for generating the first key based on the encryption rule includes:

[0077] Determine the time to obtain the connection request;

[0078] Determine the target time period to which the acquisition time belongs, where the multiple target time periods correspond to time periods with different frequencies of terminating the authentication process within a preset period;

[0079] Determine the number of encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules;

[0080] Based on the number of pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules;

[0081] Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

[0082] Specifically, by analyzing the historical data of the authentication process for accessing the power system, we can summarize the pattern of terminating the authentication process within a certain period of time, that is, the occurrence of authentication failure events. For example, taking days as the preset period, which time period has a high frequency of authentication failure events, which time period has a low frequency of authentication failure events, etc.

[0083] Furthermore, based on the analysis of historical data of the authentication process for accessing the power system, after summarizing the time periods corresponding to different frequencies of the termination of the authentication process within a preset period, the number of encryption rules determined can correspond to the frequency of the termination of the authentication process according to the relationship between the time of obtaining the connection request and the target time period. For example: when the time of obtaining the connection request belongs to a time period with a higher frequency of the termination of the authentication process, more encryption rules are selected to generate more first keys for authentication between the power system and the pre-access object, and when the time of obtaining the connection request belongs to a time period with a lower frequency of the termination of the authentication process, fewer encryption rules are selected to generate a small number of first keys for authentication between the power system and the pre-access object, thereby further improving the authentication efficiency and ensuring the authentication accuracy.

[0084] Based on the content of the above embodiment, based on the number of pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules, including:

[0085] dividing the number of pre-selected encryption rules according to a preset ratio;

[0086] Based on the divided quantity, according to the arrangement order of the rule sub-bases in the rule base, a corresponding quantity of encryption rules is selected in different rule sub-bases in sequence;

[0087] The arrangement order of the rule sub-base is arranged from low to high according to the complexity of the encryption rules pre-stored in the rule sub-base.

[0088] In this embodiment, the preset ratio can be determined based on the requirements for authentication accuracy and experiments, etc., and is not specifically limited here.

[0089] Furthermore, by dividing the number of pre-selected encryption rules according to a preset ratio, and then based on the divided number, according to the arrangement order of the rule sub-bases in the rule base, a corresponding number of encryption rules are selected in sequence in different rule sub-bases, and the arrangement order of the rule sub-bases is arranged from low to high according to the complexity of the encryption rules pre-stored in the rule sub-base. Therefore, the encryption rules selected based on the number of pre-selected encryption rules can be arranged in order from high to low in complexity, and the ratio of encryption rules of different complexities remains at the preset ratio. As a result, the difficulty of the first key is also arranged in order from high to low, which facilitates the pre-access object to quickly generate the second key and return it to the power system for verification.

[0090] Based on the content of the above embodiment, the initial division of the target time period is determined based on the historical time data of the termination authentication process within a preset period, and the division of the target time period is continuously adjusted on the basis of the initial division as the time and / or frequency of the termination authentication process changes.

[0091] In this embodiment, the initial division of the target time period is determined based on the historical moment data of the termination of the authentication process within a preset period, and is continuously adjusted on the basis of the initial division as the moment and / or frequency of the termination of the authentication process changes, thereby achieving continuous updating of the target time period, and thereby making the target time period as consistent as possible with the frequency distribution pattern of the termination of the authentication process within the preset period, thereby improving the accuracy of determining the number of pre-selected encryption rules based on the target time period, and thus improving the authentication accuracy.

[0092] Based on the content of the above embodiments, the target time period includes at least: a first time period characterizing that the frequency of termination of the authentication process is greater than or equal to the preset frequency upper limit, a second time period characterizing that the frequency of termination of the authentication process is less than the preset frequency upper limit and greater than or equal to the preset frequency lower limit, and a third time period characterizing that the frequency of termination of the authentication process is less than the preset frequency lower limit.

[0093] In this embodiment, by setting the target time period to include at least three of the first time period characterizing that the frequency of terminating the authentication process is greater than or equal to the preset frequency upper limit, the second time period characterizing that the frequency of terminating the authentication process is less than the preset frequency upper limit and greater than or equal to the preset frequency lower limit, and the third time period characterizing that the frequency of terminating the authentication process is less than the preset frequency lower limit, the number of pre-selected encryption rules determined based on the target time period can be more adaptable to the accuracy required for authentication.

[0094] Furthermore, the target time period can be further subdivided, but it is understandable that although the more detailed the target time period is divided, the more adaptable the number of pre-selected encryption rules determined based on the target time period is to the accuracy required for authentication, but when the target time period is divided to a certain extent, the change in the number determined based on it will become smaller and smaller. Therefore, the division of the target time period should be set based on actual applications.

[0095] Based on the content of the above embodiment, obtaining the second key returned by the pre-access object includes:

[0096] When the acquisition time belongs to the first time period, sequentially acquiring the second keys returned by the pre-access objects until all the second keys are acquired or the second keys do not meet the preset conditions;

[0097] When the acquisition time belongs to the second time period, sequentially acquiring the second keys returned by the pre-access objects until the number of acquired second keys reaches the first preset number or the second keys do not meet the preset condition;

[0098] When the acquisition time belongs to the third time period, sequentially acquiring the second keys returned by the pre-access objects until the number of acquired second keys reaches a second preset number or the second keys do not meet the preset condition;

[0099] The first preset number is greater than the second preset number.

[0100] In this embodiment, when the acquisition time belongs to the first time period, it indicates that the probability of failure of the current authentication is high. At this time, the second key returned by the pre-access object is sequentially obtained until all the second keys are obtained or the second key does not meet the preset conditions, so as to ensure that the entire authentication process is completed completely, thereby improving the accuracy of authentication, that is, improving the safety of the power system. When the acquisition time belongs to the second time period, it indicates that the probability of failure of the current authentication is average. At this time, the second key returned by the pre-access object is sequentially obtained until the number of second keys obtained reaches the first preset number or the second key does not meet the preset conditions, that is, compared with the acquisition time belonging to the first time period, a relatively small number of second keys are obtained for verification, which can simplify the authentication process to a certain extent, thereby improving the authentication efficiency while ensuring the accuracy of authentication, that is, improving the user experience. When the acquisition moment belongs to the third time period, it indicates that the probability of failure of the current authentication is low. At this time, the second keys returned by the pre-access object are sequentially acquired until the number of acquired second keys reaches a second preset number or the second keys do not meet the preset conditions. That is, compared with when the acquisition moment belongs to the first time period, a smaller amount of second keys is acquired for verification, which can further simplify the authentication process and improve the authentication efficiency while ensuring the authentication accuracy, that is, further improve the user experience.

[0101] Another multiple authentication method provided by an embodiment of the present invention is introduced below. It can be understood that this multiple authentication method corresponds to the multiple authentication method provided by the above embodiment. The multiple authentication method provided by the present invention is executed on an electronic device, which can be a processor, controller, etc. configured in a pre-access object, or a smart terminal such as a laptop computer, desktop computer remotely connected to the object to be accessed, or a server on the network side.

[0102] like Figure 3 As shown, another multiple authentication method provided by an embodiment of the present invention is applied to a pre-access object that pre-accesses a power system, including:

[0103] 210. Send a connection request to the power system;

[0104] The connection request is an access application sent to the power system.

[0105] 220. Receive response information returned by the power system after responding to the connection request, the response information including: an encrypted digital certificate of the power system, a first key generated based on an encryption rule, and an arrangement order of the first key;

[0106] 230. Decrypting the digital certificate of the power system and authenticating the decrypted digital certificate of the power system;

[0107] 240 If the authentication is successful, the corresponding key master is selected in sequence from the pre-stored key master library according to the arrangement order of the first key, the corresponding first key is decrypted to generate a second key matching the first key, and the second key is sent to the power system;

[0108] 250. If the authentication fails or the power system receives authentication failure information, the authentication process is terminated.

[0109] A multiple authentication system provided in an embodiment of the present invention is introduced below. The multiple authentication system described below can be considered as a module architecture for implementing the first multiple authentication method provided in an embodiment of the present invention; the content described below can be cross-referenced with the above.

[0110] Optional, see Figure 4 , Figure 4 : is a structural block diagram of a multi-authentication system provided by an embodiment of the present invention, the system is applied to a power system to be connected, and includes:

[0111] The collection unit 10 is used to obtain a connection request, where the connection request is an access application sent by the pre-access object to the power system;

[0112] The first processing unit 20 is used to send the encrypted digital certificate, the first key generated based on the encryption rule, and the arrangement order of the first key to the pre-access object in response to the connection request;

[0113] The second processing unit 30 is used to obtain the encrypted digital certificate of the pre-access object returned by the pre-access object, and authenticate the digital certificate of the pre-access object after decryption; and when the authentication is successful, obtain the second key returned by the pre-access object, and verify whether the second key meets the preset conditions, the preset conditions are that the second key matches the corresponding first key, and the return order of the second key is the same as the arrangement order of the first key; when the authentication fails or the second key does not meet the preset conditions, send authentication failure information to the pre-access object and terminate the authentication process.

[0114] Optional, see Figure 5 , Figure 5 is a structural block diagram of another multi-authentication system provided by an embodiment of the present invention. The system is based on Figure 4 Further improvements to the multi-factor authentication system shown, such as Figure 5 As shown, the system includes:

[0115] A generating unit 40, configured to determine a time to obtain a connection request;

[0116] Determine the target time period to which the acquisition time belongs, where the multiple target time periods correspond to time periods with different frequencies of terminating the authentication process within a preset period;

[0117] Determine the number of encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules;

[0118] Based on the number of pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules;

[0119] Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

[0120] Optionally, the generating unit 40 is specifically configured to:

[0121] dividing the number of pre-selected encryption rules according to a preset ratio;

[0122] Based on the divided quantity, according to the arrangement order of the rule sub-bases in the rule base, a corresponding quantity of encryption rules is selected in different rule sub-bases in sequence;

[0123] The arrangement order of the rule sub-base is arranged from low to high according to the complexity of the encryption rules pre-stored in the rule sub-base.

[0124] Optionally, the initial division of the target time period is determined based on historical moment data of the termination authentication process occurring within a preset period, and the division of the target time period is continuously adjusted on the basis of the initial division as the moment and / or frequency of the termination authentication process changes.

[0125] Optionally, the target time period includes at least: a first time period characterizing that the frequency of termination of the authentication process is greater than or equal to a preset frequency upper limit, a second time period characterizing that the frequency of termination of the authentication process is less than a preset frequency upper limit and greater than or equal to a preset frequency lower limit, and a third time period characterizing that the frequency of termination of the authentication process is less than a preset frequency lower limit.

[0126] Optionally, the second processing unit 30 is specifically configured to:

[0127] When the acquisition time belongs to the first time period, sequentially acquiring the second keys returned by the pre-access objects until all the second keys are acquired or the second keys do not meet the preset conditions;

[0128] When the acquisition time belongs to the second time period, sequentially acquiring the second keys returned by the pre-access objects until the number of acquired second keys reaches the first preset number or the second keys do not meet the preset condition;

[0129] When the acquisition time belongs to the third time period, sequentially acquiring the second keys returned by the pre-access objects until the number of acquired second keys reaches a second preset number or the second keys do not meet the preset condition;

[0130] The first preset number is greater than the second preset number.

[0131] Another multi-authentication system provided in an embodiment of the present invention is introduced below. The multi-authentication system described below can be considered as a module architecture for implementing the second multi-authentication method provided in an embodiment of the present invention; the content described below can be cross-referenced with the above.

[0132] Optional, see Figure 6 , Figure 6 : is a structural block diagram of another multi-authentication system provided by an embodiment of the present invention, the system is applied to a pre-access object pre-accessing a power system, and includes:

[0133] The sending unit 50 is used to send a connection request to the power system, where the connection request is an access application sent to the power system;

[0134] The third processing unit 60 is used to receive response information returned by the power system after responding to the connection request, the response information including: the encrypted digital certificate of the power system, the first key generated based on the encryption rule, and the arrangement order of the first key;

[0135] The fourth processing unit 70 is used to decrypt the digital certificate of the power system and authenticate the decrypted digital certificate of the power system; and when the authentication is successful, the corresponding key master is selected in sequence from the pre-stored key master library according to the arrangement order of the first key, and the corresponding first key is decrypted to generate a second key matching the first key, and send it to the power system; and when the authentication fails or the power system receives authentication failure information, the authentication process is terminated.

[0136] Below, reference Figure 7 To describe the electronic device provided by the embodiment of the present application, the electronic device provided by the embodiment may include: at least one processor 100, at least one communication interface 200, at least one memory 300 and at least one communication bus 400;

[0137] In the embodiment of the present invention, the number of the processor 100, the communication interface 200, the memory 300, and the communication bus 400 is at least one, and the processor 100, the communication interface 200, and the memory 300 communicate with each other through the communication bus 400; obviously, Figure 7 The communication connections shown for the processor 100, the communication interface 200, the memory 300, and the communication bus 400 are merely optional;

[0138] Optionally, the communication interface 200 may be an interface of a communication module, such as an interface of a GSM module; the processor 100 may be a central processing unit CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0139] The memory 300 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0140] The processor 100 is specifically used to execute the application program in the memory to implement the steps of the above-mentioned crane hoisting wire rope installation control method.

[0141] The above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. A multi-authentication method, applied to a power system to be connected, characterized in that: include: Obtaining a connection request, where the connection request is an access application sent by a pre-access object to the power system; In response to the connection request, sending the encrypted digital certificate, together with the first key generated based on the encryption rule and the arrangement order of the first key to the pre-access object; Obtaining the encrypted digital certificate of the pre-access object returned by the pre-access object, and authenticating the digital certificate of the pre-access object after decryption; If the authentication is successful, obtaining the second key returned by the pre-access object, and verifying whether the second key meets a preset condition, wherein the preset condition is that the second key matches the corresponding first key, and the return order of the second key is the same as the arrangement order of the first key; If the authentication fails or the second key does not meet the preset condition, sending authentication failure information to the pre-access object and terminating the authentication process; The method for generating the first key based on the encryption rule includes: Determining a time to obtain the connection request; Determine a target time period to which the acquisition moment belongs, wherein a plurality of target time periods respectively correspond to time periods of different frequencies during which the authentication process is terminated within a preset period; Determine the number of the encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules; Based on the number of the pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules; Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

2. The multi-authentication method according to claim 1, characterized in that: The method of selecting a corresponding number of encryption rules based on the number of pre-selected encryption rules from a rule base pre-stored with a number of different encryption rules comprises: Dividing the number of the pre-selected encryption rules according to a preset ratio; Based on the divided quantity, according to the arrangement order of the rule sub-bases in the rule base, sequentially select a corresponding quantity of encryption rules in different rule sub-bases; The arrangement order of the rule sub-base is arranged from low to high according to the complexity of the encryption rules pre-stored in the rule sub-base.

3. The multi-authentication method according to claim 2, characterized in that: The initial division of the target time period is determined based on the historical moment data of the termination of the authentication process within the preset period, and the division of the target time period is continuously adjusted on the basis of the initial division as the moment and / or frequency of the termination of the authentication process changes.

4. The multi-authentication method according to claim 3, characterized in that: The target time period includes at least: a first time period characterizing that the frequency of terminating the authentication process is greater than or equal to a preset frequency upper limit, a second time period characterizing that the frequency of terminating the authentication process is less than the preset frequency upper limit and greater than or equal to the preset frequency lower limit, and a third time period characterizing that the frequency of terminating the authentication process is less than the preset frequency lower limit.

5. The multi-authentication method according to claim 4, characterized in that: The obtaining of the second key returned by the pre-access object comprises: When the acquisition time belongs to the first time period, sequentially acquiring the second keys returned by the pre-access objects until all the second keys are acquired or the second keys do not meet the preset condition; When the acquisition time belongs to the second time period, sequentially acquiring the second keys returned by the pre-access objects until the number of acquired second keys reaches a first preset number or the second keys do not meet the preset condition; When the acquisition time belongs to the third time period, sequentially acquiring the second keys returned by the pre-access object until the number of the acquired second keys reaches a second preset number or the second keys do not meet the preset condition; The first preset number is greater than the second preset number.

6. A multiple authentication method, applied to a pre-access object pre-accessing a power system, characterized in that: include: Sending a connection request to the power system, wherein the connection request is an access application sent to the power system; Receiving response information returned by the power system after responding to the connection request, the response information including: an encrypted digital certificate of the power system, a first key generated based on an encryption rule, and an arrangement order of the first key; decrypting the digital certificate of the power system, and authenticating the decrypted digital certificate of the power system; If the authentication is successful, the corresponding key master is selected in sequence from the pre-stored key master library according to the arrangement order of the first key, the corresponding first key is decrypted to generate a second key matching the first key, and the second key is sent to the power system; If the authentication fails or the power system receives authentication failure information, terminating the authentication process; The method for generating the first key based on the encryption rule includes: Determining a time to obtain the connection request; Determine a target time period to which the acquisition moment belongs, wherein a plurality of target time periods respectively correspond to time periods of different frequencies during which the authentication process is terminated within a preset period; Determine the number of the encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules; Based on the number of the pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules; Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

7. A multi-authentication system, applied to a power system to be connected, characterized in that: include: A collection unit, used to obtain a connection request, wherein the connection request is an access application sent by a pre-access object to the power system; A first processing unit, configured to send, in response to the connection request, the encrypted digital certificate, together with a first key generated based on an encryption rule and an arrangement order of the first key to the pre-access object; A second processing unit, configured to obtain the encrypted digital certificate of the pre-access object returned by the pre-access object, and authenticate the digital certificate of the pre-access object after decryption; and when the authentication is successful, obtaining a second key returned by the pre-access object, and verifying whether the second key meets a preset condition, wherein the preset condition is that the second key matches the corresponding first key, and the return order of the second key is the same as the arrangement order of the first key; When the authentication fails or the second key does not meet the preset condition, sending authentication failure information to the pre-access object and terminating the authentication process; The method for generating the first key based on the encryption rule includes: Determining a time to obtain the connection request; Determine a target time period to which the acquisition moment belongs, wherein a plurality of target time periods respectively correspond to time periods of different frequencies during which the authentication process is terminated within a preset period; Determine the number of the encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules; Based on the number of the pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules; Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

8. A multi-authentication system, applied to a pre-access object of a pre-access power system, characterized in that: include: A sending unit, configured to send a connection request to the power system, wherein the connection request is an access application sent to the power system; A third processing unit is used to receive response information returned by the power system after responding to the connection request, wherein the response information includes: an encrypted digital certificate of the power system, a first key generated based on an encryption rule, and an arrangement order of the first key; a fourth processing unit, configured to decrypt the digital certificate of the power system and authenticate the decrypted digital certificate of the power system; and when the authentication is successful, sequentially select corresponding key masters from the pre-stored key master library according to the arrangement order of the first keys, decrypt the corresponding first keys to generate a second key matching the first key, and send the second key to the power system; and when the authentication fails or the power system receives authentication failure information, terminate the authentication process; The method for generating the first key based on the encryption rule includes: Determining a time to obtain the connection request; Determine a target time period to which the acquisition moment belongs, wherein a plurality of target time periods respectively correspond to time periods of different frequencies during which the authentication process is terminated within a preset period; Determine the number of the encryption rules pre-selected for the connection request based on the target time period to which the acquisition time belongs and the corresponding relationship between each target time period and the number of selected encryption rules; Based on the number of the pre-selected encryption rules, a corresponding number of encryption rules are selected from a rule base pre-stored with a number of different encryption rules; Based on the selected encryption rules, the first keys are generated sequentially according to the arrangement order of the selected encryption rules.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to execute the multiple authentication method described in any one of claims 1 to 5 or claim 6.

Images