Secure access method and system for credible WLAN (Wireless Local Area Network) of transformer substation

Abstract

The invention belongs to the technical field of electric power communication, and particularly relates to a safe access method and system for a credible WLAN network of a transformer substation. The method comprises the following steps that: the portable access device initiates a data packet comprising a certificate authentication process and a key negotiation process to a wireless access controller AC; after the AC adds the local certificate to the data packet, forming a certificate authentication request packet and sending the certificate authentication request packet to a certificate server AS; after the certificate authentication request packet is verified and signed by the AS and the AC, the certificate authentication request packet is packaged into an access authentication response packet, and the access authentication response packet is transmitted back to the portable access device; and the portable access device analyzes and verifies the data in the access identification response group, and judges the legality of the wireless access controller AC and the legality of the access. Through peer-to-peer bidirectional identification of the portable access device and the AC, access safety, channel safety and data safety of the portable access device can be ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of electric power communication, and in particular relates to a method and system for securely accessing a trusted WLAN network of a substation. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] WAPI is my country's independently controllable wireless LAN security technology standard. It can build a wireless LAN with high security, flexible networking and wide coverage for substations. It is the best choice for trusted WLAN technology in the power industry.

[0004] At present, the wireless access devices of the trusted WLAN network in substations have a series of problems, such as limited deployment locations, complex installation, difficult wiring, and high risk of power supply. These problems make it difficult to meet the needs of application scenarios such as fault repair and rapid network construction.

[0005] On the other hand, after the wireless access device accesses the trusted WLAN network, it is necessary not only to ensure the secure access of the terminal and the secure transmission of data; but also to ensure how the portable trusted WLAN access device can securely access the trusted WLAN network;

[0006] If there is a lack of perfect access security authentication, the nodes in the network may be subject to unauthorized access and the risk of being attacked by hackers. In addition, portable trusted WLAN access devices are easily counterfeited, and this security threat may lead to information leakage, data tampering or network interruption. Summary of the invention

[0007] In order to overcome the above-mentioned deficiencies of the prior art, the present invention provides a method and system for secure access to a trusted WLAN network in a substation.

[0008] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0009] A first aspect of the present invention provides a method for securely accessing a trusted WLAN network in a substation, comprising:

[0010] The portable access device initiates access authentication to the wireless access controller AC. A two-way authentication method is used during the access authentication process. After being verified by the wireless access controller AC, the device is allowed to initiate link establishment. The portable access device initiates a data packet containing the certificate authentication and key negotiation process to the wireless access controller AC.

[0011] After the wireless access controller AC adds the local certificate to the data packet, it forms a certificate authentication request packet and sends it to the certificate server AS; after the certificate server AS verifies and signs the data in the certificate authentication request packet, it encapsulates it into a certificate authentication response packet and returns it to the wireless access controller AC;

[0012] After the wireless access controller AC verifies and signs the data in the certificate authentication response packet, it encapsulates it into an access authentication response packet and transmits it back to the portable access device; the portable access device parses and verifies the data in the access authentication response packet, determines the legitimacy of the wireless access controller AC and the legitimacy of this access, and if both parties are legal, completes authentication and negotiation to realize data transmission.

[0013] Furthermore, the wireless access controller AC allows the device to initiate link establishment after verifying the MAC whitelist.

[0014] Furthermore, before the portable access device initiates access authentication to the wireless access controller AC, the method further includes:

[0015] Import the trusted WLAN certificate issued by the certificate server AS into the portable access device and the wireless access controller AC, and configure relevant certificate authentication parameters;

[0016] Configure the MAC whitelist of portable access devices and the intercommunication parameters used by the wireless access controller AC for authentication with the certificate server AS on the wireless access controller AC.

[0017] Furthermore, the portable access device is authenticated using a digital certificate, and the digital certificate is uniquely bound to the device.

[0018] Furthermore, during the access authentication process of the portable access device, data transmission is encrypted using the national encryption algorithm SM4, and the national encryption algorithm SM4 and the digital certificate are both stored in the national encryption security chip.

[0019] Furthermore, the portable trusted WLAN access device adopts a three-band design, in which one band is used for trusted WLAN network access, and the other two bands are used for terminal access.

[0020] A second aspect of the present invention provides a secure access system for a trusted WLAN network in a substation, comprising a portable access device, a wireless access controller AC, and a certificate server AS;

[0021] The portable access device is used to initiate a connection request to the wireless access controller AC, and access the substation trusted WLAN network after authentication is completed; the certificate server AS is used to issue a trusted WLAN certificate to the portable access device and the wireless access controller AC; the wireless access controller AC is used to perform two-way authentication with the portable access device.

[0022] Furthermore, the portable access device includes a base, a support column and an AP device; the base is provided with a support column, the AP device is installed on the support column and connected to a battery provided in the base, and the AP device is used to initiate access authentication to a wireless access controller AC.

[0023] Furthermore, universal wheels are provided below the base, and a handle is provided above the base.

[0024] Furthermore, the portable access device also includes a solar panel connected to the battery, and the solar panel is arranged on a support column or a base, and the installation angle is adjustable.

[0025] One or more of the above technical solutions have the following beneficial effects:

[0026] (1) The present invention provides a complete set of security and authentication methods that can ensure the access security, channel security and data security of portable access devices. When a portable access device wants to access a trusted WLAN network, it needs to perform peer-to-peer bidirectional authentication with the wireless access controller AC in the trusted WLAN network to ensure that the device is legitimate and not counterfeited; at the same time, it can also ensure that the wireless access controller AC is legitimate and prevent the device from being hijacked.

[0027] (2) The portable access device provided by the present invention uses digital certificate authentication, and there is no need to enter a password, and there is no need to worry about password leakage; and the digital certificate is uniquely bound to the device to prevent the portable trusted WLAN access device from being counterfeited; the certificate is stored in a national security chip, which can ensure that it will not be stolen or changed, and the national SM4 encryption algorithm is used to ensure channel security.

[0028] (3) The portable access device provided by the present invention can support solar power supply and has the characteristics of easy carrying, quick installation, and flexible deployment. It is suitable for temporarily and quickly building a trusted WLAN network environment, providing convenience for the daily operation and maintenance and fault repair work of the trusted WLAN network.

[0029] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0031] Figure 1 This is a flow chart of a method for securely accessing a trusted WLAN network in a substation according to Example 1.

[0032] Figure 2 This is a structural diagram of a portable access device of Example 1.

[0033] Figure 3 This is a structural diagram of a portable access device from another perspective of Example 1.

[0034] In the figure, 1. base, 2. support column, 3. AP device, 4. universal wheel, 5. handle, 6. solar panel. DETAILED DESCRIPTION

[0035] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0036] Embodiment 1

[0037] like Figure 1 As shown, the present invention proposes a secure access method for a substation trusted WLAN network, comprising:

[0038] Step 1: Import the trusted WLAN certificate issued by the certificate server AS into the portable access device and the wireless access controller AC, and configure relevant certificate authentication parameters; configure the MAC whitelist of the portable access device and the intercommunication parameters used by the wireless access controller AC for authentication with the certificate server AS on the wireless access controller AC.

[0039] Step 2: The portable access device initiates access authentication to the wireless access controller AC and performs certificate authentication and key negotiation.

[0040] Step 3: The portable access device initiates a data packet containing the certificate authentication and key negotiation process to the wireless access controller AC; the wireless access controller AC adds the local certificate to the data packet, forms a certificate authentication request packet, and sends it to the certificate server AS;

[0041] Step 4: The certificate server AS verifies and signs the data in the certificate authentication request packet to determine whether the identities of the AC and the device are legitimate. It also signs the verification result, encapsulates it into a certificate authentication response packet, and transmits it back to the wireless access controller AC.

[0042] Step 6: The wireless access controller AC verifies and signs the data in the certificate authentication response packet, determines whether the identity of the device is legal, and performs signature verification on the access authentication response message, then encapsulates it into an access authentication response packet and transmits it back to the portable access device;

[0043] Step 7: The portable access device parses and verifies the data in the access authentication response packet, and determines the legitimacy of the wireless access controller AC and the legitimacy of this access based on the verification result. If both parties are legitimate, the authentication and negotiation are completed to realize data transmission.

[0044] In step 1, the configured relevant certificate authentication parameters mainly include MAC address and machine code; the purpose of authentication configuration parameters is to achieve unique binding between access device and digital certificate; digital certificates are usually divided into two types, one is universal, that is, any access device can be used; the other is uniquely bound to the access device and can only be used by the device. The present invention performs unique binding by configuring MAC address and machine code.

[0045] In step 2, a two-way authentication method is used in the access authentication process, that is, the AC authenticates the portable access device, and the portable access device also authenticates the AC. Only after both parties pass the authentication can a connection be established and communication be performed; specifically, the following are included:

[0046] The portable access device accesses the trusted WLAN network and initiates a connection request; after the AC verifies the MAC whitelist, the device is allowed to initiate link establishment, and the device initiates the certificate authentication and key negotiation process.

[0047] MAC whitelist is a network security measure that controls network access rights by allowing or prohibiting specific MAC addresses from accessing the network. MAC address is the physical address of a network device, and each device has a unique MAC address.

[0048] In step 3, the certificate authentication and key negotiation process includes: during the certificate authentication process, the portable access device reads its own parameters in real time through the program in the built-in security encryption chip, and sends its own parameters and certificate to the AC; after receiving it, the AC packages its own certificate together and sends it to the AS for comparison and verification.

[0049] As a further embodiment, the portable trusted WLAN access device supports the WAPI protocol and can access the trusted WLAN network. In addition, the device adopts a three-band design, one band is used for trusted WLAN network access, and two bands are used for terminal access.

[0050] Specifically: The device adopts a three-band design, namely 2.4GHZ, 5.2GHZ, and 5.8GHZ. The common 2.4G and 5.8G bands are used for terminal access, and the 5.2G band is used for trusted WLAN network access.

[0051] As a further embodiment, the portable access device uses a digital certificate for authentication, the digital certificate is uniquely bound to the device, and the digital certificate is stored in a national secret security chip. The national secret security chip is set in the AP device of the portable access device, and the national secret algorithm SM4 is stored in the national secret security chip to realize that the data transmission during the authentication process is encrypted using the national secret algorithm SM4.

[0052] Among them, the national encryption algorithm SM4 is used for encryption on the wireless air interface side of the device and the wireless side of the trusted WLAN. The sending end encrypts and the receiving end decrypts at both ends of the wireless side of the trusted WLAN to ensure channel security.

[0053] Embodiment 2

[0054] The present invention provides a secure access system for a trusted WLAN network in a substation, comprising a portable access device, a wireless access controller AC and a certificate server AS;

[0055] The portable access device is used to initiate a connection request to the wireless access controller AC, and after the two-way authentication is completed, it accesses the substation trusted WLAN network to realize data transmission;

[0056] The certificate server AS is used to issue a trusted WLAN certificate, import the trusted WLAN certificate into the portable access device and the wireless access controller AC, and configure relevant certificate authentication parameters;

[0057] The MAC whitelist of the device and the intercommunication parameters used by AC for authentication with AS are configured on the wireless access controller AC. The wireless access controller AC performs two-way authentication with the portable access device. After the two-way authentication is passed, data transmission is realized.

[0058] like Figure 2 , Figure 3 As shown, the portable access device includes a base 1, a support column 2 and an AP device 3; a universal wheel 4 is provided below the base 1 to facilitate the movement of the device; a handle 5 and a support column 2 are provided on the base 2, and the support column 2 is a retractable structure to facilitate the adjustment of the installation height of the AP device 3; the handle is provided on the base to facilitate the transportation of the device; the AP device 3 is installed on the support column 2 and connected to the battery provided in the base 1. The portable access device supports power supply modes such as solar power supply, battery power supply, and PoE power supply.

[0059] As a further embodiment, the portable access device also includes a solar panel 6, which is installed obliquely on the base 1, or installed on the upper part of the support column 2 through a bracket; by adjusting the installation angle of the solar panel 6, it is ensured that the angle of the solar panel 6 can absorb sufficient sunlight.

[0060] The solar panel 6 is installed on the upper part of the support column 2. Since the support column is a tubular structure, the output end of the solar panel 6 is connected to the input end of the battery arranged in the base through a connecting line inserted into the support column 2; the AP device 3 is installed below the solar panel 6 on the support column 2 to prevent it from blocking the solar panel 6; the AP device 3 is connected to the output end of the battery through a connecting line inserted into the support column 2.

[0061] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A secure access method for a substation trusted WLAN network, characterized in that: include: The portable access device initiates access authentication to the wireless access controller AC. A two-way authentication method is used during the access authentication process. After being verified by the wireless access controller AC, the device is allowed to initiate link establishment. The portable access device initiates a data packet containing the certificate authentication and key negotiation process to the wireless access controller AC. After the wireless access controller AC adds the local certificate to the data packet, it forms a certificate authentication request packet and sends it to the certificate server AS; after the certificate server AS verifies and signs the data in the certificate authentication request packet, it encapsulates it into a certificate authentication response packet and returns it to the wireless access controller AC; After the wireless access controller AC verifies and signs the data in the certificate authentication response packet, it encapsulates it into an access authentication response packet and transmits it back to the portable access device; the portable access device parses and verifies the data in the access authentication response packet, determines the legitimacy of the wireless access controller AC and the legitimacy of this access, and if both parties are legal, completes authentication and negotiation to realize data transmission.

2. A method for securely accessing a substation trusted WLAN network according to claim 1, characterized in that: The wireless access controller AC allows the device to initiate link establishment after verifying the MAC whitelist.

3. A method for securely accessing a substation trusted WLAN network according to claim 1, characterized in that: Before the portable access device initiates access authentication to the wireless access controller AC, the method further includes: Import the trusted WLAN certificate issued by the certificate server AS into the portable access device and the wireless access controller AC, and configure relevant certificate authentication parameters; Configure the MAC whitelist of portable access devices and the intercommunication parameters used by the wireless access controller AC for authentication with the certificate server AS on the wireless access controller AC.

4. A method for securely accessing a substation trusted WLAN network according to claim 1, characterized in that: The portable access device is authenticated using a digital certificate, which is uniquely bound to the device.

5. A method for secure access to a substation trusted WLAN network according to claim 4, characterized in that: During the access authentication process of the portable access device, data transmission is encrypted using the national secret algorithm SM4, and the national secret algorithm SM4 and the digital certificate are both stored in the national secret security chip.

6. A method for securely accessing a substation trusted WLAN network according to claim 1, characterized in that: The portable trusted WLAN access device adopts a three-band design, one of which is used for trusted WLAN network access, and the other two are used for terminal access.

7. A secure access system for a trusted WLAN network in a substation, characterized in that: It includes a portable access device, a wireless access controller AC and a certificate server AS; The portable access device is used to initiate a connection request to the wireless access controller AC, and access the substation trusted WLAN network after authentication is completed; the certificate server AS is used to issue a trusted WLAN certificate to the portable access device and the wireless access controller AC; the wireless access controller AC is used to perform two-way authentication with the portable access device.

8. A secure access system for a substation trusted WLAN network according to claim 7, characterized in that: The portable access device comprises a base, a support column and an AP device; the base is provided with a support column, the AP device is installed on the support column and connected to a battery arranged in the base, and the AP device is used to initiate access authentication to a wireless access controller AC.

9. A secure access system for a substation trusted WLAN network according to claim 8, characterized in that: Universal wheels are arranged below the base, and a handle is arranged above the base.

10. A secure access system for a substation trusted WLAN network according to claim 8, characterized in that: The portable access device also includes a solar panel connected to the battery. The solar panel is arranged on a supporting column or a base, and the installation angle is adjustable.

Images