Electric power WLAN security reinforcement method, system and device based on trusted computing

Abstract

The invention discloses an electric power WLAN security reinforcement method, system and device based on trusted computing, and relates to the technical field of electric power WLAN security, the method comprises the following steps: respectively presetting a trusted platform control module TPCM and corresponding components on an electric power wireless terminal, an electric power wireless access point and an electric power authentication server to form a ternary three-layer architecture; certificate application and distribution of equipment are carried out according to the three-element three-layer architecture, the equipment is managed and controlled in a unified mode through an electric power authentication server, and the equipment comprises an electric power wireless terminal and an electric power wireless access point; and carrying out trusted access authentication on the equipment which obtains the certificate, including bidirectional identity authentication based on a ternary three-layer architecture, platform identity and integrity evaluation based on attributes and key negotiation based on a national cryptographic algorithm, so as to realize access of the trusted power wireless terminal to the trusted power wireless access point. According to the method, collusion attacks can be prevented, platform configuration information cannot be leaked, and sensitive information can be effectively prevented from being intercepted by attackers or untrusted intermediate equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of power wireless local area network security, and in particular to a power WLAN (Wireless Local Area Network) security reinforcement method, system and equipment based on trusted computing. Background Art

[0002] Existing wireless LAN technologies mainly include the international wireless network technology WI-FI standard and China's independently designed Wireless LAN Authentication and Privacy Infrastructure (WAPI). WI-FI standards are widely used in daily life, basic industry and other scenarios. While bringing convenience, they also increase security risks. WI-FI standards assume that the network is trustworthy, only the terminal is untrustworthy. Therefore, it is usually determined by AP (Access Point, wireless access point) One-way authentication terminal, the terminal has no right to authenticate AP , there is access fraud AP In addition, all terminals share the same password, which, once leaked or cracked, will greatly threaten the security of user privacy data.

[0003] WAPI is a wireless network security protocol designed to address the security flaws of international WI-FI standards. WAPI uses digital certificates as device identity verification and introduces third-party AS (Authentication Server, authentication server), realize the terminal and AP Two-way identity authentication between terminals and counterfeit AP In addition, WAPI is used by terminals and AP Key negotiation between devices encrypts transmitted data, preventing information tampering and protecting the confidentiality of communications. WAPI effectively addresses some of the security risks inherent in Wi-Fi. During the construction of new power systems, WAPI has been gradually applied to transform and upgrade local area networks (LANs) in various power business scenarios, establishing multiple demonstration areas and pilot sites.

[0004] However, WAPI assumes that the authentication server AS is completely trustworthy, but there is no effective measure to ensure it. AS and malicious terminals, can easily forge identification results, thereby bypassing legitimate AP , forming a conspiracy attack. At the same time, the WAPI authentication process does not evaluate the terminal, APThe platform's credibility is compromised, creating the risk of legitimate identities accessing untrusted platforms. Identity certificate information and intermediate keys are stored directly on the platform. Once an attacker compromises the platform, they can steal relevant private information and launch identity authentication attacks. Furthermore, the WAPI identity authentication and key negotiation process typically contains plaintext identity certificates, temporary public keys, and authentication results, making them easily intercepted by attackers over insecure network channels. Summary of the Invention

[0005] The purpose of the present invention is to address the problems in the above-mentioned prior art and provide a power WLAN security reinforcement method, system and device based on trusted computing, which can ensure the security and trustworthiness of the device itself and prevent conspiracy attacks; STA (Station, wireless device or terminal device) access to trusted AP , and will not leak platform configuration information; and prevent private information such as certificate information and intermediate keys from being stolen or misused by attackers; by designing symmetric encryption and decryption methods, sensitive information in the entire access authentication process is encrypted, which can effectively prevent sensitive information from being intercepted by attackers or untrusted intermediate devices.

[0006] In order to achieve the above object, the present invention has the following technical solutions: In a first aspect, a method for strengthening power WLAN security based on trusted computing is provided, comprising: Power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Pre-installed trusted platform control module TPCM and corresponding components, forming a ternary three-layer architecture; According to the three-tier three-layer architecture, the device certificate application and distribution are carried out by the power identification server. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; Conduct trusted access authentication for devices that have obtained certificates, including two-way identity authentication based on a ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on national secret algorithms, to achieve trusted power wireless terminals. STA Access to a trusted power wireless access point AP .

[0007] As a preferred solution, in the power wireless terminal STA Pre-installed trusted platform control module TPCM and corresponding components, the power wireless terminal STA As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trust control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0008] As a preferred solution, in the power wireless access point AP Pre-installed trusted platform control module TPCM and corresponding components, the power wireless access point AP As an access controller, it is deployed in a specified geographic location and includes the following components: The wireless communication component, as the network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0009] As a preferred solution, in the power identification server AS Pre-installed trusted platform control module TPCM and corresponding components, the power identification server AS As a policy manager, it is deployed in headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party. The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying identity proof keys. AIK The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power identification server trusted platform control module And the trusted management center component, as the integrity measurement verifier, is located in the integrity measurement layer and is responsible for receiving, verifying and evaluating the power wireless terminal STA and power wireless access points AP The integrity measure of .

[0010] As a preferred solution, the certificate application and distribution of the device is carried out according to the three-element three-layer architecture, and the power identification server AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP , including the following steps: Let G, G T for p bilinear cyclic group of order, g 、 h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, Represents a bilinear map, symbol The device's identity certificate is defined as: SM2 Public Key With identity certificate SM2 Private Key , subscript device Unified representation of power wireless terminal STA and power wireless access points AP Equipment; Power Identification Server AS According to safety parameter 1 λ , derived root certificate SM2 Public Key With root certificate SM2 Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, and internet protocol IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package identity certificate key AIK Public key, endorsement key EK Certificate, platform certificate, and conformance certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, cs It is a collection of configuration information and the component configuration metric is calculated as follows: H = SM3 (cs 1|| cs 2||…|| cs k ), as a platform attribute, where SM3 () indicates proceed SM3 Algorithm processing; submit the above information to the power identification server AS ; Power Identification Server AS Sign the received device identity information and platform information to generate a device identity certificate , device platform certificate ;Evaluate cs i Satisfied security properties , ps is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that the power operation is performed; Power Identification Server AS Calculate temporary key seed ,Will( u , ps , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory NVM Internal, where For power identification server MAC address, For each device MAC address, is a temporary key random number, u is the attribute certificate verification parameter, ps is a set of security attributes, For root certificates SM2 public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate SM2Public Key Verify device identity certificate , device platform certificate The correctness of the device attribute certificate is verified and the following equation is established. If it is established, the device attribute certificate Correct, otherwise re-apply for the certificate:

[0011]

[0012] Where, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ps is the exponential power operation, g 、 is the generator of G, Represents a bilinear map e As the bottom, security attribute set ps is the exponential power operation, Represented by bilinear mapping e As the base, configure information collection cs The power operation for exponentiation.

[0013] As a preferred solution, the two-way identity authentication based on the ternary three-layer architecture includes the following steps: Power Wireless Access Point AP Through the uncontrolled port to the power wireless terminal STA Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express Uplink SM4 between STA and AS Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device identity certificate Via device identity certificate Get, get the ciphertext ; and useSTA Device identity certificate SM2 Private Key sign, STA Device identity certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following:

[0014] Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the random number of the first power wireless terminal To confirm that it is the reply to the message sent by itself; if the check passes, the calculation , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to obtain ciphertext ,in AP Device identity certificate Via device identity certificate obtain; and use AP Device identity certificate SM2 Private Key sign, AP Device identity certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To the power identification server AS Send a certificate authentication request message, which includes the following:

[0015] Power Identification Server AS After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get STA Device identity certificate and APDevice identity certificate ,verify and The signature in the power wireless terminal is used to verify the STA and power wireless access points AP Legitimacy of identity; then use STA Device identity certificate SM2 Public Key and AP Device identity certificate SM2 Public Key Verify signatures separately and , to verify the power wireless terminal STA and power wireless access points AP Hold your own identity certificate private key, STA Device identity certificate SM2 Public Key and AP Device identity certificate SM2 Public key and Both are derived from the device's identity certificate SM2 Public Key Obtain, and generate corresponding certificate authentication results according to the above certificate authentication process and ; Then generate the first power authentication server random number ,calculate and , where express STA and AS Downward SM4 Temporary symmetric key, express STA Temporary key seed, express AP and AS Downward SM4 Temporary symmetric key, express AP Temporary key seed, encrypted to obtain ciphertext and , express STA Certificate authentication results, express AP Certificate authentication result; send to the power wireless access point AP Send a certificate authentication response message, which includes the following formula:

[0016] Power Wireless Access Point AP After receiving the certificate authentication response message, check the random number of the first power authentication server To prevent replay attacks; if the check passes, send the power wireless terminal STA Send an authentication response message, which includes the following:

[0017] Then power wireless access point AP calculate , decrypt ,get ; If the power wireless terminal STA If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point AP If the identity certificate authentication is passed, the platform assessment will continue, otherwise access to the power wireless access point will be denied. AP .

[0018] As a preferred solution, the attribute-based platform identity and integrity assessment includes the following steps: Power wireless terminal STA Generate a second power wireless terminal random number , perform attribute proof calculation and generate STA Component property signature ;calculate , encrypt the first power identification server random number 、 STA Device platform certificate and STA Component property signature , STA Device platform certificate Device platform certificate Get, get the ciphertext ; To power wireless access point AP Send a platform evaluation request message, which includes the following formula:

[0019] Power Wireless Access Point AP After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the power wireless access point [[ID=1Z38]]APGenerate a random number for the second power wireless access point , perform attribute proof calculation and generate AP Component property signature ;calculate , encrypt the first power identification server random number 、 AP Device platform certificate and AP Component property signature , AP Device platform certificate Device platform certificate Get, get the ciphertext ; To the power identification server AS Send a platform authentication request message, which includes the following formula:

[0020] Power Identification Server AS After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get STA Device platform certificate , AP Device platform certificate , STA Component property signature , AP Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal STA and power wireless access points AP The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminals STA and power wireless access points AP The integrity of the respective platforms; generated according to the above process STA Platform evaluation results and AP Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get ciphertext and ; To power wireless access point APSend a platform authentication response message, which includes the following formula:

[0021] Power Wireless Access Point AP After receiving the platform authentication response message, check the random number of the second power authentication server To prevent replay attacks; if the check passes, generate a third power wireless access point random number , SM2 Temporary public key and SM2 Temporary private key and to the power wireless terminal STA Send a platform assessment response message, which includes the following formula:

[0022] Then calculate , decrypt ,get If the power wireless terminal STA If the platform identity and integrity assessments are both passed, key negotiation will continue. Otherwise, the power wireless terminal STA will be denied access. Power wireless terminal STA After receiving the platform evaluation response message, check the random number of the second power authentication server and the third power wireless access point random number , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point AP If the platform identity and integrity assessments are both passed, key negotiation will continue; otherwise, access to the power wireless access point will be denied. AP .

[0023] As a preferred solution, the attribute proof calculation includes the following steps: Device generates random numbers N And the random numbers r1 and r2 used for blind calculation; random numbers N Random number taken from the second power wireless terminal With the second power wireless access point random number ; use Calculating Commitment Value , where the superscript of the parameter indicates the power operation, the random number is calculated as follows N Calculating Commitment Value Signature value ; The device performs blind calculations, making the blind value , where Indicates that Z Defined as the value behind, Represent the first blinding parameter , the second blinding parameter and the third blinding parameter , the superscript in the parameter indicates that the power operation is performed; The first evidence value is calculated as follows: Second evidence value , the superscript in the parameter indicates that the power operation is performed; Generate component property signatures .

[0024] As a preferred solution, the attribute verification algorithm includes the following steps: Verify the signature value , to verify authenticity; Calculate whether the following equation holds:

[0025]

[0026] Where, represents a bilinear map, Indicates whether it is established. The first bilinear pairing T For the bottom, - ps is the exponential power operation, ps is a set of security attributes, The first bilinear pairing T For the bottom, is the exponential power operation, cs For configuration information collection, H Configure metrics for components, g 、 is the generator of G, Represent the first evidence value and the second evidence value respectively; If the above equation does not hold, the attribute verification fails, otherwise the platform configuration attribute is used to verify the attribute. For the index, query the revocation list. If it is not in the list, the verification passes. If it is in the list, the verification fails.

[0027] As a preferred solution, the key negotiation based on the national secret algorithm includes the following steps: Power wireless terminal STA Generate a random number for the third power wireless terminal , SM2 Temporary public key and SM2Temporary private key ; Then calculate the power wireless terminal base key seed as follows , calculate the power wireless terminal base key according to the following formula , calculate the power wireless terminal base key confirmation serial number according to the following formula , where Indicates the base key of the power wireless terminal, Power wireless terminal STA of MAC address, Indicates a power wireless access point AP of MAC address; then power the wireless access point AP Send a key negotiation request message. The key negotiation request message includes the following formula:

[0028] Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, calculate the base key seed of the power wireless access point according to the following formula , calculate the base key of the power wireless access point according to the following formula , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point and power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key USK , use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then generate a random number for the fourth power wireless access point Calculate the random number using the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK encryption to get the ciphertext ; Then send power wireless terminal STA Send a key negotiation response message, which includes the following formula:

[0029] Power wireless terminal STA After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request issued by oneself; if the check passes, calculate according to the following formula and use the first 128 bits of the result as the unicast key USK , use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then use MEK Ciphertext Decrypt and get M_ID and MSK ; Then power the wireless access point AP Send a key negotiation confirmation message, which includes the following formula:

[0030] Power Wireless Access Point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response sent by yourself; check M_ID To confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

[0031] In a second aspect, a power WLAN security reinforcement system based on trusted computing is provided, including: Trusted adapter module, used for power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Pre-installed trusted platform control module TPCM and corresponding components, forming a ternary three-layer architecture; The certificate distribution module is used to apply for and distribute device certificates according to the three-tier architecture. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; The trusted access authentication module is used to authenticate the trusted access of the device that has obtained the certificate, including two-way identity authentication based on the ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on the national secret algorithm, to achieve trusted power wireless terminal STA Access to a trusted power wireless access point AP .

[0032] As a preferred solution, the trusted adapter module is installed in the power wireless terminalSTA Pre-installed trusted platform control module TPCM and corresponding components, the power wireless terminal STA As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trust control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0033] As a preferred solution, the trusted adapter module is installed at the power wireless access point AP Pre-installed trusted platform control module TPCM and corresponding components, the power wireless access point AP As an access controller, it is deployed in a specified geographic location and includes the following components: The wireless communication component, as the network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0034] As a preferred solution, the trusted adapter module is installed on the power identification server AS Pre-installed trusted platform control module TPCM and corresponding components, the power identification server AS As a policy manager, it is deployed in headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party. The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying identity keys. AIK The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power identification server trusted platform control module And the trusted management center component, as the integrity measurement verifier, is located in the integrity measurement layer and is responsible for receiving, verifying and evaluating the power wireless terminal STA and power wireless access points AP The integrity measure of .

[0035] As a preferred solution, when the certificate distribution module applies for and distributes certificates for devices according to the ternary three-layer architecture, G, G T for p bilinear cyclic group of order, g 、 h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, Represents a bilinear map, symbol Represents the identity certificate of the derived device defined as; SM2 Public Key With identity certificate SM2 Private Key , subscript device Unified representation of power wireless terminal STA and power wireless access points AP Equipment; Power Identification Server AS According to safety parameter 1 λ , derived root certificate SM2 Public Key With root certificate SM2 Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, and internet protocol IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package identity certificate key AIK Public key, endorsement key EK Certificate, platform certificate, and conformance certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, csIt is a collection of configuration information and the component configuration metric is calculated as follows: H = SM3 ( cs 1|| cs 2||…|| cs k ), as a platform attribute, where SM3 () indicates proceed SM3 Algorithm processing; submit the above information to the power identification server AS ; Power Identification Server AS Sign the received device identity information and platform information to generate a device identity certificate , device platform certificate ;Evaluate cs i Satisfied security properties , ps is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that the power operation is performed; Power Identification Server AS Calculate temporary key seed ,Will( u , ps , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory NVM Internal, where For power identification server MAC address, For each device MAC address, is a temporary key random number, u is the attribute certificate verification parameter, ps is a set of security attributes, For root certificates SM2 public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate SM2 Public Key Verify device identity certificate , device platform certificate The correctness of the device attribute certificate is verified and the following equation is established. If it is established, the device attribute certificate Correct, otherwise re-apply for the certificate:

[0036]

[0037] Where, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ps is the exponential power operation, g 、 is the generator of G, Represents a bilinear map e As the bottom, security attribute set ps is the exponential power operation, Represented by bilinear mapping e As the base, configuration information collection cs The power operation for exponentiation.

[0038] As a preferred solution, when the trusted access authentication module performs two-way identity authentication based on the ternary three-layer architecture, the power wireless access point AP Through the uncontrolled port to the power wireless terminal STA Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express Uplink SM4 between STA and AS Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device identity certificate Via device identity certificate Get, get the ciphertext ; and use STA Device identity certificate [[ID=2Z54]]SM2 Private Key sign, STA Device identity certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following:

[0039] Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the random number of the first power wireless terminal To confirm that it is the reply to the message sent by itself; if the check passes, the calculation , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to obtain ciphertext ,in AP Device identity certificate Via device identity certificate obtain; and use AP Device identity certificate SM2 Private Key sign, AP Device identity certificate SMZ Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To the power identification server AS Send a certificate authentication request message, which includes the following:

[0040] Power Identification Server AS After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, calculate and , decrypted to getSTA Device identity certificate and AP Device identity certificate ,verify and The signature in the power wireless terminal is used to verify the STA and power wireless access points AP Legitimacy of identity; then use STA Device identity certificate SM2 Public Key and AP Device identity certificate SM2 Public Key Verify signatures separately and , to verify the power wireless terminal STA and power wireless access points AP Hold your own identity certificate private key, STA Device identity certificate SM2 Public Key and ​ Device identity certificate ​ Public key and Both are derived from the device's identity certificate ​ Public Key Obtain, and generate corresponding certificate authentication results according to the above certificate authentication process and ; Then generate the first power authentication server random number ,calculate and , where express ​ and ​ Downward ​ Temporary symmetric key, express ​ Temporary key seed, express ​ and ​ Downward ​ Temporary symmetric key, express ​ Temporary key seed, encrypted to obtain ciphertext and , express ​ Certificate authentication results, express ​ Certificate authentication result; send to the power wireless access point ​ Send a certificate authentication response message, which includes the following formula:

[0041] Power Wireless Access Point​ After receiving the certificate authentication response message, check the random number of the first power authentication server To prevent replay attacks; if the check passes, send the power wireless terminal ​ Send an authentication response message, which includes the following:

[0042] Then power wireless access point ​ calculate , decrypt ,get ; If the power wireless terminal ​ If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. ​ Access; Power wireless terminal ​ After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point ​ If the identity certificate authentication is passed, the platform assessment will continue, otherwise access to the power wireless access point will be denied. ​ .

[0043] As a preferred solution, the trusted access authentication module performs attribute-based platform identity and integrity assessment through the power wireless terminal ​ Generate a second power wireless terminal random number , perform attribute proof calculation and generate ​ Component property signature ;calculate , encrypt the first power identification server random number 、 ​ Device platform certificate and ​ Component property signature , ​ Device platform certificate Device platform certificate Get, get the ciphertext ; To power wireless access point ​ Send a platform evaluation request message, which includes the following formula:

[0044] Power Wireless Access Point ​ After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the power wireless access point ​ Generate a random number for the second power wireless access point , perform attribute proof calculation and generate ​ Component property signature ;calculate , encrypt the first power identification server random number 、 ​ Device platform certificate and ​ Component property signature , ​ Device platform certificate Device platform certificate Get, get the ciphertext ; To the power identification server ​ Send a platform authentication request message, which includes the following formula:

[0045] Power Identification Server ​ After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get ​ Device platform certificate , ​ Device platform certificate , ​ Component property signature , ​ Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal ​ and power wireless access points ​ The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminals ​ and power wireless access points ​ The integrity of the respective platforms; generated according to the above process ​ Platform evaluation results and ​ Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get ciphertext and ; To power wireless access point ​ Send a platform authentication response message, which includes the following formula:

[0046] Power Wireless Access Point ​ After receiving the platform authentication response message, check the random number of the second power authentication server To prevent replay attacks; if the check passes, generate a third power wireless access point random number , ​ Temporary public key and ​ Temporary private key and to the power wireless terminal ​ Send a platform assessment response message, which includes the following formula:

[0047] Then calculate , decrypt ,get If the power wireless terminal ​ If the platform identity and integrity assessments are both passed, key negotiation will continue. Otherwise, the power wireless terminal STA will be denied access. Power wireless terminal ​ After receiving the platform evaluation response message, check the random number of the second power authentication server and the third power wireless access point random number , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point ​ If the platform identity and integrity assessments are both passed, key negotiation will continue; otherwise, access to the power wireless access point will be denied. ​ .

[0048] As a preferred solution, the trusted access authentication module performs key negotiation based on the national secret algorithm through the power wireless terminal ​ Generate a random number for the third power wireless terminal , ​ Temporary public key and ​ Temporary private key ; Then calculate the power wireless terminal base key seed as follows , calculate the power wireless terminal base key according to the following formula , calculate the power wireless terminal base key confirmation serial number according to the following formula , where Indicates the base key of the power wireless terminal, Power wireless terminal ​ of ​ address, Indicates a power wireless access point ​ of ​ address; then power the wireless access point ​ Send a key negotiation request message. The key negotiation request message includes the following formula:

[0049] Power Wireless Access Point ​ After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, calculate the base key seed of the power wireless access point according to the following formula , calculate the base key of the power wireless access point according to the following formula , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point and power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key ​ , use the last 128 bits of the result as the multicast key ​ Encryption key ​ ; Then generate a random number for the fourth power wireless access point Calculate the random number using the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK encryption to get the ciphertext ; Then send power wireless terminal ​ Send a key negotiation response message, which includes the following formula:

[0050] Power wireless terminal ​ After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request issued by oneself; if the check passes, calculate according to the following formula and use the first 128 bits of the result as the unicast key ​ , use the last 128 bits of the result as the multicast key ​ Encryption key ​ ; Then use ​ Ciphertext Decrypt and get ​ and ​ ; Then power the wireless access point ​ Send a key negotiation confirmation message, which includes the following formula:

[0051] Power Wireless Access Point ​ After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response sent by yourself; check ​ To confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

[0052] According to a third aspect, an electronic device is provided, including a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement the power WLAN security reinforcement method based on trusted computing.

[0053] In a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the power WLAN security reinforcement method based on trusted computing is implemented.

[0054] Compared with the prior art, the first aspect of the present invention has at least the following beneficial effects: Aiming at the problems of untrusted equipment, unassessed platform, insecure storage of private information and plain text transmission of sensitive information in the existing wireless LAN authentication process, the power WLAN security reinforcement method based on trusted computing of the present invention is to respectively ​ , Power Wireless Access Point ​ Power Identification Server ​ Pre-installed trusted platform control module ​ And the corresponding components, to ensure the security and reliability of the device itself, and to effectively prevent collusion attacks. The method of the present invention can ensure the trustworthiness of the access platform on the basis of the legality of the identity through two-way identity authentication based on the ternary three-layer architecture. The method of the present invention designs an attribute-based platform identity and integrity assessment, which can effectively prevent the leakage of platform configuration information. The method of the present invention designs a key negotiation based on the national secret algorithm, and encrypts and stores certificates, keys, etc. in the trusted platform control module. ​Internally, it is physically isolated from the device body, which improves the security of private information and can prevent private information such as certificate information and intermediate keys from being stolen or misused by attackers, thereby preventing identity authentication attacks. The method of the present invention encrypts and protects sensitive information in the entire access authentication process by encrypting and transmitting sensitive information such as certificates and public keys, which can effectively prevent sensitive information from being intercepted by attackers or untrusted intermediate devices, improve the confidentiality of communication, have forward security, can prevent replay attacks and man-in-the-middle attacks, and ensure the trustworthiness of the power wireless terminal. ​ Access to a trusted power wireless access point ​ ,By simplifying the key negotiation process, the access authentication efficiency can be improved.

[0055] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0057] ​ This is an overall flow chart of a method for strengthening power WLAN security based on trusted computing according to an embodiment of the present invention; ​ A schematic diagram of a three-tiered network connection architecture formed in accordance with an embodiment of the present invention; ​ Flowchart of certificate application and distribution according to an embodiment of the present invention; ​ This is a flow chart of performing trusted access authentication on a device that has obtained a certificate according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0059] In the related prior art, for example, the patent application with publication number CN111935717A discloses "Authentication method, device and computer equipment of WAPI system". This authentication method only determines the identity of the wireless terminal by identifying the identity certificate.​ and wireless access points ​ The legitimacy of wireless terminals is not considered ​ and wireless access points ​ The device platform is invaded by attackers, resulting in the platform being untrustworthy, which may lead to untrustworthy wireless terminals. ​ Access a wireless access point ​ , or wireless terminal ​ Accessing an untrusted wireless access point AP Secondly, during the verification process, identity certificates, basic media access control MAC , check bytes and other sensitive information are transmitted in plain text, which may be stolen or tampered with.

[0060] For example, the patent application with publication number CN108601024A discloses a “lightweight identity authentication and platform identification evaluation method”. This method verifies the platform configuration PCR (Platform Configuration Register) value and the platform integrity measurement log to achieve access requester AR and access controller AC The platform authentication evaluation between the two platforms has the disadvantages of low proof efficiency and easy leakage of platform configuration. Secondly, in the lightweight platform trusted authentication evaluation method, only the controller is accessed. AC Evaluate access requesters AR platform integrity, and access requesters AR Access controller not evaluated AC Platform integrity, there is access requester AR Accessing an Untrusted Access Controller AC risk.

[0061] See also Figure 1 The embodiment of the present invention proposes a power WLAN security reinforcement method based on trusted computing, including: S1, respectively in the power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Pre-installed trusted platform control module TPCM and corresponding components, forming a ternary three-layer architecture; S2, according to the three-layer architecture, the device certificate application and distribution are carried out by the power identification server. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; S3. Conduct trusted access authentication for devices that have obtained certificates, including two-way identity authentication based on a ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on national secret algorithms, to achieve trusted power wireless terminals. STA Access to a trusted power wireless access point AP .

[0062] See also Figure 2 , Figure 2 The ternary three-layer architecture formed in step 1 of the embodiment of the present invention is shown. In a possible implementation, in the power wireless terminal STA Pre-installed trusted platform control module ​ and corresponding components, the power wireless terminal ​ As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trust control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0063] Power Wireless Access Points ​ Pre-installed trusted platform control module ​ and corresponding components, the power wireless access point ​ As an access controller, it is deployed in a specified geographic location and includes the following components: The wireless communication component, as the network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0064] Power Identification Server​ Pre-installed trusted platform control module ​ and corresponding components, the power identification server ​ As a policy manager, it is deployed in headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party. The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying identity keys. ​ The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power identification server trusted platform control module And the trusted management center component, as the integrity measurement verifier, is located in the integrity measurement layer and is responsible for receiving, verifying and evaluating the power wireless terminal ​ and power wireless access points ​ The integrity measure of .

[0065] See also ​ , ​ The process of applying for and distributing certificates according to an embodiment of the present invention is shown. Step S2 applies for and distributes certificates to devices according to the ternary three-layer architecture, including the following steps: Let G, G T for p bilinear cyclic group of order, g 、 h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, Represents a bilinear map, symbol Represents the identity certificate of the derived device defined as; ​ Public Key With identity certificate ​ Private Key , subscript ​ Unified representation of power wireless terminal ​ and power wireless access points ​ Equipment; Power Identification Server ​ According to safety parameter 1 λ , derived root certificate ​ Public Key With root certificate ​ Private Key , generate a temporary key random number ; Temporary key random number Trusted Platform Control Module ​ True random number generator in ​ Generated for power identification server ​ Calculate temporary key seed ).

[0066] Device packaging location, user name, device name, device type, and internet protocol ​ Address, Media Access Control ​ Address and identity certificate public key as identity information; package identity certificate key ​ Public key, endorsement key ​ Certificate, platform certificate, and conformance certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, ​ It is a collection of configuration information and the component configuration metric is calculated as follows: H = ​ ( ​ 1|| ​ 2||…|| ​ k ), as a platform attribute, where ​ () indicates proceed ​ Algorithm processing; submit the above information to the power identification server ​ ; Power Identification Server ​ Sign the received device identity information and platform information to generate a device identity certificate , device platform certificate ;Evaluate ​ i Satisfied security properties , ​ is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that the power operation is performed; Power Identification Server ​ Calculate temporary key seed ,Will( u , ​ , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory ​ Internal, where For power identification server ​ address, For each device ​ address, is a temporary key random number, u is the attribute certificate verification parameter, ​ is a set of security attributes, For root certificates ​ public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate ​ Public Key Verify device identity certificate , device platform certificate The correctness of the device attribute certificate is verified and the following equation is established. If it is established, the device attribute certificate Correct, otherwise re-apply for the certificate:

[0067]

[0068] Where, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ​ is the exponential power operation, g 、 is the generator of G, Represents a bilinear map e As the bottom, security attribute set ​ is the exponential power operation, Represented by bilinear mapping e As the base, configuration information collection ​ The power operation for exponentiation.

[0069] See also ​ , ​The following is a flow chart showing the trusted access authentication process for a device that has obtained a certificate according to an embodiment of the present invention. The two-way identity authentication based on the ternary three-layer architecture includes the following steps: Power Wireless Access Point ​ Through the uncontrolled port to the power wireless terminal ​ Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal ​ After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express ​ Temporary symmetric key, for ​ Temporary key seed, Indicates connection, ​ () indicates proceed ​ Algorithm processing, encryption and , ​ Device identity certificate Via device identity certificate Get, get the ciphertext ; and use ​ Device identity certificate ​ Private Key sign, ​ Device identity certificate ​ Private Key By deriving the device's identity certificate ​ Private Key Get, get signature information after signing ; To power wireless access point ​ Send an authentication request message, which includes the following:

[0070] Power Wireless Access Point ​ After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the random number of the first power wireless terminal To confirm that it is the reply to the message sent by itself; if the check passes, the calculation , express ​ and ​ Uplink ​ Temporary symmetric key, for ​Temporary key seed, encrypted to obtain ciphertext ,in ​ Device identity certificate Via device identity certificate obtain; and use ​ Device identity certificate ​ Private Key sign, ​ Device identity certificate ​ Private Key By deriving the device's identity certificate ​ Private Key Get, get signature information after signing ; To the power identification server ​ Send a certificate authentication request message, which includes the following:

[0071] Power Identification Server ​ After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get ​ Device identity certificate and ​ Device identity certificate ,verify and The signature in the power wireless terminal is used to verify the ​ and power wireless access points ​ Legitimacy of identity; then use ​ Device identity certificate ​ Public Key and ​ Device identity certificate ​ Public Key Verify signatures separately and , to verify the power wireless terminal ​ and power wireless access points ​ Hold your own identity certificate private key, ​ Device identity certificate ​ Public Key and ​ Device identity certificate ​ Public key and Both are derived from the device's identity certificate ​ Public Key Obtain, and generate corresponding certificate authentication results according to the above certificate authentication process and ; Then generate the first power authentication server random number ,calculate and , where express ​ and ​ Downward ​ Temporary symmetric key, express ​ Temporary key seed, express ​ and ​ Downward ​ Temporary symmetric key, express ​ Temporary key seed, encrypted to obtain ciphertext and , express ​ Certificate authentication results, express ​ Certificate authentication result; send to the power wireless access point ​ Send a certificate authentication response message, which includes the following formula:

[0072] Power Wireless Access Point ​ After receiving the certificate authentication response message, check the random number of the first power authentication server To prevent replay attacks; if the check passes, send the power wireless terminal ​ Send an authentication response message, which includes the following:

[0073] Then power wireless access point ​ calculate , decrypt ,get ; If the power wireless terminal ​ If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. ​ Access; Power wireless terminal ​ After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point ​ If the identity certificate authentication is passed, the platform assessment will continue, otherwise access to the power wireless access point will be denied. ​ .

[0074] Attribute-based platform identity and integrity assessment includes the following steps: Power wireless terminal ​ Generate a second power wireless terminal random number , perform attribute proof calculation and generate ​ Component property signature ;calculate , encrypt the first power identification server random number 、 ​ Device platform certificate and ​ Component property signature , ​ Device platform certificate Device platform certificate Get, get the ciphertext ; To power wireless access point ​ Send a platform evaluation request message, which includes the following formula:

[0075] Power Wireless Access Point ​ After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the power wireless access point ​ Generate a random number for the second power wireless access point , perform attribute proof calculation and generate ​ Component property signature ;calculate , encrypt the first power identification server random number 、 ​ Device platform certificate and ​ Component property signature , ​ Device platform certificate Device platform certificate Get, get the ciphertext ; To the power identification server ​ Send a platform authentication request message, which includes the following formula:

[0076] Power Identification Server ​ After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get​ Device platform certificate , ​ Device platform certificate , ​ Component property signature , ​ Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal ​ and power wireless access points ​ The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminals ​ and power wireless access points ​ The integrity of the respective platforms; generated according to the above process ​ Platform evaluation results and ​ Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get ciphertext and ; To power wireless access point ​ Send a platform authentication response message, which includes the following formula:

[0077] Power Wireless Access Point ​ After receiving the platform authentication response message, check the random number of the second power authentication server To prevent replay attacks; if the check passes, generate a third power wireless access point random number , ​ Temporary public key and ​ Temporary private key and to the power wireless terminal ​ Send a platform assessment response message, which includes the following formula:

[0078] Then calculate , decrypt ,get If the power wireless terminal ​ If the platform identity and integrity assessments are both passed, key negotiation will continue. Otherwise, the power wireless terminal STA will be denied access. Power wireless terminal ​After receiving the platform evaluation response message, check the random number of the second power authentication server and the third power wireless access point random number , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point ​ If the platform identity and integrity assessments are both passed, key negotiation will continue; otherwise, access to the power wireless access point will be denied. ​ .

[0079] ​ For an asymmetric encryption algorithm, there will be a public key and a private key; ​ A digest algorithm is an algorithm that maps data of any length into a hash value (or digest, message digest) of fixed length. ​ It is a symmetric encryption algorithm, which uses a common key for encryption and decryption. ​ algorithm, ​ Algorithms and ​ All algorithms are national commercial encryption algorithms.

[0080] Furthermore, in one possible implementation, the attribute proof calculation of the embodiment of the present invention includes the following steps: Device generates random numbers N And the random numbers r1 and r2 used for blind calculation; random numbers N Random number taken from the second power wireless terminal With the second power wireless access point random number ; use Calculating Commitment Value , where the superscript of the parameter indicates the power operation, the random number is calculated as follows N Calculating Commitment Value Signature value ; The device performs blind calculations, making the blind value , where Indicates that Z Defined as the value behind, Represent the first blinding parameter , the second blinding parameter and the third blinding parameter , the superscript in the parameter indicates that the power operation is performed; The first evidence value is calculated as follows: Second evidence value , the superscript in the parameter indicates that the power operation is performed; Generate component property signatures .

[0081] In one possible implementation, the attribute verification algorithm of the embodiment of the present invention includes the following steps: Verify the signature value , to verify authenticity; Calculate whether the following equation holds:

[0082]

[0083] Where, represents a bilinear map, Indicates whether it is established. The first bilinear pairing T For the bottom, - ​ is the exponential power operation, ​ is a set of security attributes, The first bilinear pairing T For the bottom, is the exponential power operation, ​ For configuration information collection, H Configure metrics for components, g 、 is the generator of G, Represent the first evidence value and the second evidence value respectively; If the above equation does not hold, the attribute verification fails, otherwise the platform configuration attribute is used to verify the attribute. For the index, query the revocation list. If it is not in the list, the verification passes. If it is in the list, the verification fails.

[0084] Key negotiation based on the national encryption algorithm includes the following steps: Power wireless terminal ​ Generate a random number for the third power wireless terminal , ​ Temporary public key and ​ Temporary private key ; Then calculate the power wireless terminal base key seed as follows , calculate the power wireless terminal base key according to the following formula , calculate the power wireless terminal base key confirmation serial number according to the following formula , where Indicates the base key of the power wireless terminal, Power wireless terminal ​ of ​ address, Indicates a power wireless access point ​ of ​ address; then power the wireless access point ​Send a key negotiation request message. The key negotiation request message includes the following formula:

[0085] Power Wireless Access Point ​ After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, calculate the base key seed of the power wireless access point according to the following formula , calculate the base key of the power wireless access point according to the following formula , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point and power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key ​ , use the last 128 bits of the result as the multicast key ​ Encryption key ​ ; Then generate a random number for the fourth power wireless access point Calculate the random number using the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK encryption to get the ciphertext ; Then send power wireless terminal ​ Send a key negotiation response message, which includes the following formula:

[0086] Power wireless terminal ​ After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request issued by oneself; if the check passes, calculate according to the following formula and use the first 128 bits of the result as the unicast key ​ , use the last 128 bits of the result as the multicast key ​ Encryption key ​ ; Then use ​ Ciphertext Decrypt and get​ and ​ ; Then power the wireless access point ​ Send a key negotiation confirmation message, which includes the following formula:

[0087] Power Wireless Access Point ​ After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response sent by yourself; check ​ To confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

[0088] The embodiment of the present invention introduces a trusted platform control module ​ and corresponding management components, which improves the security of each device and can effectively prevent collusion attacks; the embodiment of the present invention designs a three-dimensional three-layer architecture, which further ensures the trustworthiness of the access platform on the basis of legal identity; the embodiment of the present invention designs an attribute-based platform identity and integrity assessment method, which can effectively prevent the leakage of platform configuration information; the embodiment of the present invention encrypts and stores certificates, keys, etc. in the trusted platform control module ​ Internally, it is physically isolated from the device body, which improves the security of privacy information, thereby preventing identity authentication attacks; the embodiment of the present invention designs a method based on device media access control ​ The symmetric encryption and decryption method of addresses and random numbers encrypts and transmits sensitive information such as certificates and public keys, improves the confidentiality of communications, has forward security, and can prevent replay attacks and man-in-the-middle attacks; the method of the embodiment of the present invention simplifies the key negotiation process and improves access authentication efficiency.

[0089] Another embodiment of the present invention further provides a power WLAN security reinforcement system based on trusted computing, including: Trusted adapter module, used for power wireless terminal ​ , Power Wireless Access Point ​ Power Identification Server ​ Pre-installed trusted platform control module ​ and corresponding components, forming a ternary three-layer architecture; The certificate distribution module is used to apply for and distribute device certificates according to the three-tier architecture. ​ Unified management and control, equipment including power wireless terminals ​ and power wireless access points ​ ; The trusted access authentication module is used to authenticate the trusted access of the device that has obtained the certificate, including two-way identity authentication based on the ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on the national secret algorithm, to achieve trusted power wireless terminal ​ Access to a trusted power wireless access point ​ .

[0090] In a possible implementation, the trusted adaptation module is installed in the power wireless terminal. ​ Pre-installed trusted platform control module ​ and corresponding components, the power wireless terminal ​ As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trust control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0091] In a possible implementation, the trusted adapter module is installed at the power wireless access point. ​ Pre-installed trusted platform control module ​ and corresponding components, the power wireless access point ​ As an access controller, it is deployed in a specified geographic location and includes the following components: The wireless communication component, as the network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for performing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module The terminal trusted management and control component, as the integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0092] In a possible implementation, the trusted adapter module is installed on the power authentication server. ​Pre-installed trusted platform control module ​ and corresponding components, the power identification server ​ As a policy manager, it is deployed in headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party. The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying identity keys. ​ The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power identification server trusted platform control module And the trusted management center component, as the integrity measurement verifier, is located in the integrity measurement layer and is responsible for receiving, verifying and evaluating the power wireless terminal ​ and power wireless access points ​ The integrity measure of .

[0093] In a possible implementation, when the certificate distribution module applies for and distributes certificates for devices according to the ternary three-layer architecture, G, G T for p bilinear cyclic group of order, g 、 h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, Represents a bilinear map, symbol Represents the identity certificate of the derived device defined as; ​ Public Key With identity certificate ​ Private Key , subscript ​ Unified representation of power wireless terminal ​ and power wireless access points ​ Equipment; Power Identification Server ​ According to safety parameter 1 λ , derived root certificate ​ Public Key With root certificate ​ Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, and internet protocol ​ Address, Media Access Control ​Address and identity certificate public key as identity information; package identity certificate key ​ Public key, endorsement key ​ Certificate, platform certificate, and conformance certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, ​ It is a collection of configuration information and the component configuration metric is calculated as follows: H = ​ ( ​ 1|| ​ 2||…|| ​ k ), as a platform attribute, where ​ () indicates proceed ​ Algorithm processing; submit the above information to the power identification server ​ ; Power Identification Server ​ Sign the received device identity information and platform information to generate a device identity certificate , device platform certificate ;Evaluate ​ i Satisfied security properties , ​ is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that the power operation is performed; Power Identification Server ​ Calculate temporary key seed ,Will( u , ​ , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory ​ Internal, where For power identification server ​ address, For each device ​ address, is a temporary key random number,u is the attribute certificate verification parameter, ​ is a set of security attributes, For root certificates ​ public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate ​ Public Key Verify device identity certificate , device platform certificate The correctness of the device attribute certificate is verified and the following equation is established. If it is established, the device attribute certificate Correct, otherwise re-apply for the certificate:

[0094]

[0095] Where, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ​ is the exponential power operation, g 、 is the generator of G, Represents a bilinear map e As the bottom, security attribute set ​ is the exponential power operation, Represented by bilinear mapping e As the base, configure information collection ​ The power operation for exponentiation.

[0096] In a possible implementation, when the trusted access authentication module performs bidirectional identity authentication based on the ternary three-layer architecture, the power wireless access point ​ Through the uncontrolled port to the power wireless terminal ​ Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal ​ After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express ​Temporary symmetric key, for ​ Temporary key seed, Indicates connection, ​ () indicates proceed ​ Algorithm processing, encryption and , ​ Device identity certificate Via device identity certificate Get, get the ciphertext ; and use ​ Device identity certificate ​ Private Key sign, ​ Device identity certificate ​ Private Key By deriving the device's identity certificate ​ Private Key Get, get signature information after signing ; To power wireless access point ​ Send an authentication request message, which includes the following:

[0097] Power Wireless Access Point ​ After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the random number of the first power wireless terminal To confirm that it is the reply to the message sent by itself; if the check passes, the calculation , express ​ and ​ Uplink ​ Temporary symmetric key, for ​ Temporary key seed, encrypted to obtain ciphertext ,in ​ Device identity certificate Via device identity certificate obtain; and use ​ Device identity certificate ​ Private Key sign, ​ Device identity certificate ​ Private Key By deriving the device's identity certificate ​ Private Key Get, get signature information after signing ; To the power identification server ​ Send a certificate authentication request message, which includes the following:

[0098] Power Identification Server ​ After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get ​ Device identity certificate and ​ Device identity certificate ,verify and The signature in the power wireless terminal is used to verify the ​ and power wireless access points ​ Legitimacy of identity; then use ​ Device identity certificate ​ Public Key and ​ Device identity certificate ​ Public Key Verify signatures separately and , to verify the power wireless terminal ​ and power wireless access points ​ Hold your own identity certificate private key, ​ Device identity certificate ​ Public Key and ​ Device identity certificate ​ Public key and Both are derived from the device's identity certificate ​ Public Key Obtain, and generate corresponding certificate authentication results according to the above certificate authentication process and ; Then generate the first power authentication server random number ,calculate and , where express ​ and ​ Downward ​ Temporary symmetric key, express ​ Temporary key seed, express ​ and ​ Downward ​ Temporary symmetric key, express ​ Temporary key seed, encrypted to obtain ciphertext and , express​ Certificate authentication results, express ​ Certificate authentication result; send to the power wireless access point ​ Send a certificate authentication response message, which includes the following formula:

[0099] Power Wireless Access Point ​ After receiving the certificate authentication response message, check the random number of the first power authentication server To prevent replay attacks; if the check passes, send the power wireless terminal ​ Send an authentication response message, which includes the following:

[0100] Then power wireless access point ​ calculate , decrypt ,get ; If the power wireless terminal ​ If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. ​ Access; Power wireless terminal ​ After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point ​ If the identity certificate authentication is passed, the platform assessment will continue, otherwise access to the power wireless access point will be denied. ​ .

[0101] In a possible implementation, the trusted access authentication module performs attribute-based platform identity and integrity assessment through the power wireless terminal. ​ Generate a second power wireless terminal random number , perform attribute proof calculation and generate ​ Component property signature ;calculate , encrypt the first power identification server random number 、 ​ Device platform certificate and ​ Component property signature , ​ Device platform certificate Device platform certificate Get, get the ciphertext ; To power wireless access point ​ Send a platform evaluation request message, which includes the following formula:

[0102] Power Wireless Access Point ​ After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the power wireless access point ​ Generate a random number for the second power wireless access point , perform attribute proof calculation and generate ​ Component property signature ;calculate , encrypt the first power identification server random number 、 ​ Device platform certificate and ​ Component property signature , ​ Device platform certificate Device platform certificate Get, get the ciphertext ; To the power identification server ​ Send a platform authentication request message, which includes the following formula:

[0103] Power Identification Server ​ After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted to get ​ Device platform certificate , ​ Device platform certificate , ​ Component property signature , ​ Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal ​ and power wireless access points ​ The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminals ​ and power wireless access points ​The integrity of the respective platforms; generated according to the above process ​ Platform evaluation results and ​ Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get ciphertext and ; To power wireless access point ​ Send a platform authentication response message, which includes the following formula:

[0104] Power Wireless Access Point ​ After receiving the platform authentication response message, check the random number of the second power authentication server To prevent replay attacks; if the check passes, generate a third power wireless access point random number , ​ Temporary public key and ​ Temporary private key and to the power wireless terminal ​ Send a platform assessment response message, which includes the following formula:

[0105] Then calculate , decrypt ,get If the power wireless terminal ​ If the platform identity and integrity assessments are both passed, key negotiation will continue. Otherwise, the power wireless terminal STA will be denied access. Power wireless terminal ​ After receiving the platform evaluation response message, check the random number of the second power authentication server and the third power wireless access point random number , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point ​ If the platform identity and integrity assessments are both passed, key negotiation will continue; otherwise, access to the power wireless access point will be denied. ​ .

[0106] In a possible implementation, the trusted access authentication module performs key negotiation based on the national secret algorithm through the power wireless terminal. ​ Generate a random number for the third power wireless terminal , ​Temporary public key and ​ Temporary private key ; Then calculate the power wireless terminal base key seed as follows , calculate the power wireless terminal base key according to the following formula , calculate the power wireless terminal base key confirmation serial number according to the following formula , where Indicates the base key of the power wireless terminal, Power wireless terminal ​ of ​ address, Indicates a power wireless access point ​ of ​ address; then power the wireless access point ​ Send a key negotiation request message. The key negotiation request message includes the following formula:

[0107] Power Wireless Access Point ​ After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, calculate the base key seed of the power wireless access point according to the following formula , calculate the base key of the power wireless access point according to the following formula , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point and power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key ​ , use the last 128 bits of the result as the multicast key ​ Encryption key ​ ; Then generate a random number for the fourth power wireless access point Calculate the random number using the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK encryption to get the ciphertext ; Then send power wireless terminal ​ Send a key negotiation response message, which includes the following formula:

[0108] Power wireless terminal ​ After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request issued by oneself; if the check passes, calculate according to the following formula and use the first 128 bits of the result as the unicast key ​ , use the last 128 bits of the result as the multicast key ​ Encryption key ​ ; Then use ​ Ciphertext Decrypt and get ​ and ​ ; Then power the wireless access point ​ Send a key negotiation confirmation message, which includes the following formula:

[0109] Power Wireless Access Point ​ After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response sent by yourself; check ​ To confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

[0110] Another embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement the power WLAN security reinforcement method based on trusted computing.

[0111] Another embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores at least one instruction. When the at least one instruction is executed by a processor, the power WLAN security reinforcement method based on trusted computing is implemented.

[0112] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form. The computer-readable storage medium may include: any entity or device, medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory, random access memory, electric carrier signal, telecommunication signal and software distribution medium that can carry the computer program code. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals. For ease of explanation, the above content only shows the part related to the embodiment of the present invention. For specific technical details not disclosed, please refer to the method part of the embodiment of the present invention. The computer-readable storage medium is non-transitory and can be stored in a storage device formed by various electronic devices, and can implement the execution process recorded in the method of the embodiment of the present invention.

[0113] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0114] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. ​ a process or multiple processes and / or boxes ​ A device that provides the functions specified in a block or multiple blocks.

[0115] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0116] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A method for strengthening the security of power WLAN based on trusted computing, characterized in that: include: Power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Trusted Platform Control Module TPCM and corresponding components, forming a ternary three-layer architecture; According to the three-layer architecture, the device certificate application and distribution are carried out by the power identification server. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; Conduct trusted access authentication for certified devices, including two-way identity authentication based on a ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on national secret algorithms, to achieve trusted power wireless terminals STA Access to a trusted power wireless access point AP .

2. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: In power wireless terminal STA Trusted Platform Control Module TPCM and corresponding components, the power wireless terminal STA As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

3. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: Powering Wireless Access Points AP Trusted Platform Control Module TPCM and corresponding components, the power wireless access point AP As an access controller, it is deployed in a specified geographical location and includes the following components: The wireless communication component, as a network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

4. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: Power Identification Server AS Trusted Platform Control Module TPCM and corresponding components, the power identification server AS As a policy manager, it is deployed in the headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party; The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying identity proof keys. AIK The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power Identification Server Trusted Platform Control Module and the trusted management center component, as the integrity measurement verifier, located in the integrity measurement layer, responsible for receiving, verifying and evaluating the power wireless terminal STA and Power Wireless Access Point AP The integrity metric of .

5. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: According to the three-layer architecture, the device certificate application and distribution are carried out by the power identification server. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP , including the following steps: Assume G, G T for p bilinear cyclic group of order, g , h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, represents a bilinear map, symbol The device's identity certificate is defined as: SM2 Public Key With identity certificate SM2 Private Key , subscript device Unified representation of power wireless terminal STA and power wireless access points AP Equipment; Power Identification Server AS According to safety parameter 1 λ , derived root certificate SM2 Public Key With root certificate SM2 Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, Internet interconnection protocol IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package identity certificate key AIK Public key, endorsement key EK Certificate, platform certificate and consistency certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, cs It is a collection of configuration information and calculates the component configuration metric value as follows H = SM3 ( cs 1|| cs 2||…|| cs k ), as the platform attribute, where SM3 () indicates proceed SM3 Algorithm processing; submit the above information to the power identification server AS ; Power Identification Server AS Sign the received device identity information and platform information to generate a device identity certificate , Equipment Platform Certificate ;Evaluate cs i Satisfied security properties , ps is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that a power operation is performed; Power Identification Server AS Calculate temporary key seed ,Will( u , ps , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory NVM Internal, in which For power identification server MAC address, For each device MAC address, is a temporary key random number, u is the attribute certificate verification parameter, ps is a set of security attributes, For root certificates SM2 Public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate SM2 Public Key Verify device identity certificate , Equipment Platform Certificate The correctness of the device attribute certificate is verified and the following equation is verified. If it is true, the device attribute certificate Correct, otherwise re-apply for the certificate: In the formula, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ps is the exponential power operation, g , is the generator of G, Represents a bilinear map e As the bottom, security attribute set ps is the exponential power operation, Represented by a bilinear map e As the base, configure the information collection cs Raises to the power of an exponent.

6. The power WLAN security reinforcement method based on trusted computing according to claim 5 is characterized in that: The two-way identity authentication based on the ternary three-layer architecture includes the following steps: Power Wireless Access Point AP Through the uncontrolled port to the power wireless terminal STA Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express Uplink SM4 between STA and AS Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device Identity Certificate Via device identity certificate Get, get the ciphertext ; and use STA Device Identity Certificate SM2 Private Key sign, STA Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following: Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the first power wireless terminal random number To confirm that it is a reply to the message sent by itself; if the check passes, then calculate , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to get ciphertext ,in AP Device Identity Certificate Via device identity certificate obtain; and use AP Device Identity Certificate SM2 Private Key sign, AP Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To the power identification server AS Send a certificate authentication request message, which includes the following: Power Identification Server AS After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, then calculate and , decrypted to get STA Device Identity Certificate and AP Device Identity Certificate ,verify and The signature in the power wireless terminal is used to verify the STA and power wireless access points AP Legitimacy of identity; subsequent use STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public Key Verify signatures separately and , to verify the power wireless terminal STA and power wireless access points AP Hold your own identity certificate private key, STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public key and Both are derived from the device's identity certificate SM2 Public Key Obtain, according to the above certificate authentication process respectively generate the corresponding certificate authentication results and ; Then generate a random number for the first power authentication server ,calculate and , where express STA and AS Downstream SM4 Temporary symmetric key, express STA Temporary key seed, express AP and AS Downstream SM4 Temporary symmetric key, express AP Temporary key seed, encrypted to get ciphertext and , express STA Certificate authentication result, express AP Certificate authentication result; to the power wireless access point AP Send a certificate authentication response message, which includes the following: Power Wireless Access Point AP After receiving the certificate authentication response message, check the random number of the first power authentication server to prevent replay attacks; if the check passes, the power wireless terminal STA Send an authentication response message, which includes the following: Then power the wireless access point AP calculate , decrypt ,get ; If the power wireless terminal STA If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point AP If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the access to the power wireless access point will be denied. AP .

7. The power WLAN security reinforcement method based on trusted computing according to claim 6 is characterized in that: The attribute-based platform identity and integrity assessment includes the following steps: Power wireless terminal STA Generate a second power wireless terminal random number , perform attribute proof calculation and generate STA Component property signature ;calculate , encrypt the first power authentication server random number , STA Device Platform Certificate and STA Component property signature , STA Device Platform Certificate Device platform certificate Get, get the ciphertext ; To power wireless access point AP Send a platform evaluation request message, which includes the following formula: Power Wireless Access Point AP After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the wireless access point is powered AP Generate a random number for the second power wireless access point , perform attribute proof calculation and generate AP Component property signature ;calculate , encrypt the first power authentication server random number , AP Device Platform Certificate and AP Component property signature , AP Device Platform Certificate Device platform certificate Get, get the ciphertext ; To the power identification server AS Send a platform authentication request message, which includes the following formula: Power Identification Server AS After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted separately to obtain STA Device Platform Certificate , AP Device Platform Certificate , STA Component property signature , AP Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal STA and power wireless access points AP The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminal STA and power wireless access points AP The integrity of the respective platform; generated according to the above process STA Platform evaluation results and AP Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get the ciphertext and ; To power wireless access point AP Send a platform authentication response message, which includes the following formula: Power Wireless Access Point AP After receiving the platform authentication response message, check the random number of the second power authentication server to prevent replay attacks; if the check passes, a third power wireless access point random number is generated , SM2 Temporary public key and SM2 Temporary private key , and to the power wireless terminal STA Send a platform assessment response message, which includes the following formula: Then calculate , decrypt ,get ; If the power wireless terminal STA If the platform identity and integrity assessment are passed, key negotiation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the platform evaluation response message, check the random number of the second power identification server And the third power wireless access point random number , to prevent replay attacks; if the check passes, then calculate , decrypt ,get ; If the power wireless access point AP If the platform identity and integrity assessments are both passed, key negotiation will continue, otherwise access to the power wireless access point will be denied. AP .

8. The method for strengthening the security of a power WLAN based on trusted computing according to claim 7 is characterized in that: The attribute proof calculation includes the following steps: Device generates random numbers N And the random numbers r1 and r2 used for blind calculation; random numbers N Random number taken from the second power wireless terminal With the second power wireless access point random number ; use Calculating Commitment Value , where the superscript of the parameter indicates the exponentiation operation, the random number is calculated as follows N Calculating Commitment Value The signature value ; The device performs blind calculations, and the blind value , where Indicates that Z Defined as the following value, Represent the first blinding parameters , the second blinding parameter and the third blinding parameter , the superscript in the parameter indicates that a power operation is performed; The first evidence value is calculated as follows: Second Evidence Value , the superscript in the parameter indicates that a power operation is performed; Generate component attribute signature .

9. The power WLAN security reinforcement method based on trusted computing according to claim 8 is characterized in that: The attribute verification algorithm comprises the following steps: Verify the signature value , to verify authenticity; Calculate whether the following equation holds: In the formula, represents a bilinear map, Indicates whether it is established. The first bilinear pairing T For the bottom, - ps is the exponential power operation, ps is a set of security attributes, The first bilinear pairing T For the bottom, is the exponential power operation, cs For configuration information collection, H Configure metrics for components, g , is the generator of G, Respectively represent the first evidence value and the second evidence value; If the above equation does not hold, the attribute verification fails. Otherwise, the platform configuration attribute is used to verify the attribute. For the index, query the revocation list. If it is not in the list, the verification passes. If it is in the list, the verification fails.

10. The method for strengthening the security of a power WLAN based on trusted computing according to claim 7, characterized in that: The key negotiation based on the national secret algorithm includes the following steps: Power wireless terminal STA Generate a random number for the third power wireless terminal , SM2 Temporary public key and SM2 Temporary private key ; Then calculate the power wireless terminal base key seed as follows: , calculate the base key of the power wireless terminal as follows: , calculate the power wireless terminal base key confirmation serial number as follows: , where Indicates the base key of the power wireless terminal, Power wireless terminal STA of MAC address, Indicates power wireless access point AP of MAC address; then send power to the wireless access point AP Send a key negotiation request message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, the base key seed of the power wireless access point is calculated according to the following formula , calculate the base key of the power wireless access point as follows: , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point And power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then generate a fourth power wireless access point random number Calculate the random number with the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK to encrypt the ciphertext ; Then send the power wireless terminal STA Send a key negotiation response message, which includes the following formula: Power wireless terminal STA After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request sent by itself; if the check passes, the following formula is used to calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then use MEK Ciphertext Decrypt it and get M_ID and MSK ; then power the wireless access point AP Send a key negotiation confirmation message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response issued by itself; check M_ID To confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

11. A power WLAN security reinforcement system based on trusted computing, characterized in that: include: Trusted adapter module, used for power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Trusted Platform Control Module TPCM and corresponding components, forming a ternary three-layer architecture; The certificate distribution module is used to apply for and distribute device certificates according to the three-layer architecture. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; The trusted access authentication module is used to perform trusted access authentication on devices that have obtained certificates, including two-way identity authentication based on a ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on national secret algorithms, to achieve trusted power wireless terminals. STA Access to a trusted power wireless access point AP .

12. The power WLAN security reinforcement system based on trusted computing according to claim 11 is characterized in that: The trusted adaptation module is in the power wireless terminal STA Trusted Platform Control Module TPCM and corresponding components, the power wireless terminal STA As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

13. The power WLAN security reinforcement system based on trusted computing according to claim 11 is characterized in that: The trusted adapter module is located at the power wireless access point AP Trusted Platform Control Module TPCM and corresponding components, the power wireless access point AP As an access controller, it is deployed in a specified geographical location and includes the following components: The wireless communication component, as a network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

14. The power WLAN security reinforcement system based on trusted computing according to claim 11, characterized in that: The trusted adapter module is located in the power identification server AS Trusted Platform Control Module TPCM and corresponding components, the power identification server AS As a policy manager, it is deployed in the headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party; The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying the identity key. AIK The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power Identification Server Trusted Platform Control Module and the trusted management center component, as the integrity measurement verifier, located in the integrity measurement layer, responsible for receiving, verifying and evaluating the power wireless terminal STA and Power Wireless Access Point AP The integrity metric of .

15. The power WLAN security reinforcement system based on trusted computing according to claim 11, characterized in that: When the certificate distribution module applies for and distributes certificates for devices according to the ternary three-layer architecture, G, G T for p bilinear cyclic group of order, g , h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, represents a bilinear map, symbol The device's identity certificate is defined as: SM2 Public Key With identity certificate SM2 Private Key , subscript device Unified representation of power wireless terminal STA and power wireless access points AP Equipment; Power Identification Server AS According to safety parameter 1 λ , from which the root certificate is derived SM2 Public Key With root certificate SM2 Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, Internet interconnection protocol IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package identity certificate key AIK Public key, endorsement key EK Certificate, platform certificate and consistency certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, cs It is a collection of configuration information and calculates the component configuration metric value as follows H = SM3 ( cs 1|| cs 2||…|| cs k ), as the platform attribute, where SM3 () indicates proceed SM3 Algorithmic processing; Submit the above information to the power identification server AS ; Power Identification Server AS Sign the received device identity information and platform information to generate a device identity certificate , Equipment Platform Certificate ; Evaluate cs i Satisfied security properties , ps is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that a power operation is performed; Power Identification Server AS Calculate temporary key seed ,Will( u , ps , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory NVM Internal, in which For power identification server MAC address, For each device MAC address, is a temporary key random number, u is the attribute certificate verification parameter, ps is a set of security attributes, For root certificates SM2 Public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate SM2 Public Key Verify device identity certificate , Equipment Platform Certificate The correctness of the device attribute certificate is verified and the following equation is verified. If it is true, the device attribute certificate Correct, otherwise re-apply for the certificate: In the formula, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ps is the exponential power operation, g , is the generator of G, Represents a bilinear map e As the bottom, security attribute set ps is the exponential power operation, Represented by a bilinear map e As the base, configure the information collection cs Raises the power to an exponent.

16. The power WLAN security reinforcement system based on trusted computing according to claim 15, characterized in that: When the trusted access authentication module performs two-way identity authentication based on the ternary three-layer architecture, the power wireless access point AP Through the uncontrolled port to the power wireless terminal STA Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express Uplink SM4 between STA and AS Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device Identity Certificate Via device identity certificate Get, get the ciphertext ; and use STA Device Identity Certificate SM2 Private Key sign, STA Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following: Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the random number of the first power wireless terminal To confirm that it is a reply to the message sent by oneself; If the check passes, then calculate , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to get ciphertext ,in AP Device Identity Certificate Via device identity certificate obtain; and use AP Device Identity Certificate SM2 Private Key sign, AP Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To the power identification server AS Send a certificate authentication request message, which includes the following: Power Identification Server AS After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, then calculate and , decrypted to get STA Device Identity Certificate and AP Device Identity Certificate ,verify and The signature in the power wireless terminal is used to verify the STA and power wireless access points AP Legitimacy of identity; subsequent use STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public Key Verify signatures separately and , to verify the power wireless terminal STA and power wireless access points AP Hold your own identity certificate private key, STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public key and Both are derived from the device's identity certificate SM2 Public Key Obtain, according to the above certificate authentication process respectively generate the corresponding certificate authentication results and ; Then generate the first power authentication server random number ,calculate and , where express STA and AS Downstream SM4 Temporary symmetric key, express STA Temporary key seed, express AP and AS Downstream SM4 Temporary symmetric key, express AP Temporary key seed, encrypted to get ciphertext and , express STA Certificate authentication result, express AP Certificate authentication result; to the power wireless access point AP Send a certificate authentication response message, which includes the following: Power Wireless Access Point AP After receiving the certificate authentication response message, check the random number of the first power authentication server to prevent replay attacks; if the check passes, the power wireless terminal STA Send an authentication response message, which includes the following: Then power the wireless access point AP calculate , decrypt ,get ; If the power wireless terminal STA If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point AP If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the access to the power wireless access point will be denied. AP .

17. The power WLAN security reinforcement system based on trusted computing according to claim 16, characterized in that: The trusted access authentication module performs attribute-based platform identity and integrity assessment through the power wireless terminal STA Generate a second power wireless terminal random number , perform attribute proof calculation and generate STA Component property signature ;calculate , encrypt the first power authentication server random number , STA Device Platform Certificate and STA Component property signature , STA Device Platform Certificate Device platform certificate Get, get the ciphertext ; To power wireless access point AP Send a platform evaluation request message, which includes the following formula: Power Wireless Access Point AP After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the wireless access point is powered AP Generate a random number for the second power wireless access point , perform attribute proof calculation and generate AP Component property signature ; calculate , encrypt the first power authentication server random number , AP Device Platform Certificate and AP Component property signature , AP Device Platform Certificate Device platform certificate Get, get the ciphertext ; To the power identification server AS Send a platform authentication request message, which includes the following formula: Power Identification Server AS After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted separately to obtain STA Device Platform Certificate , AP Device Platform Certificate , STA Component property signature , AP Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal STA and power wireless access points AP The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminal STA and power wireless access points AP The integrity of the respective platform; generated according to the above process STA Platform evaluation results and AP Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get the ciphertext and ; To power wireless access point AP Send a platform authentication response message, which includes the following formula: Power Wireless Access Point AP After receiving the platform authentication response message, check the random number of the second power authentication server to prevent replay attacks; if the check passes, a third power wireless access point random number is generated , SM2 Temporary public key and SM2 Temporary private key , and to the power wireless terminal STA Send a platform assessment response message, which includes the following formula: Then calculate , decrypt ,get ; If the power wireless terminal STA If the platform identity and integrity assessments are both passed, key negotiation will continue. Otherwise, the power wireless terminal STA will be denied access. Power wireless terminal STA After receiving the platform evaluation response message, check the random number of the second power identification server And the third power wireless access point random number , to prevent replay attacks; if the check passes, then calculate , decrypt ,get ; If the power wireless access point AP If the platform identity and integrity assessments are both passed, key negotiation will continue, otherwise access to the power wireless access point will be denied. AP .

18. The power WLAN security reinforcement system based on trusted computing according to claim 17, characterized in that: The trusted access authentication module performs key negotiation based on the national secret algorithm through the power wireless terminal STA Generate a random number for the third power wireless terminal , SM2 Temporary public key and SM2 Temporary private key ; Then calculate the power wireless terminal base key seed as follows: , calculate the base key of the power wireless terminal as follows: , calculate the power wireless terminal base key confirmation serial number as follows: , where Indicates the base key of the power wireless terminal, Power wireless terminal STA of MAC address, Indicates power wireless access point AP of MAC address; then send power to the wireless access point AP Send a key negotiation request message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; If the check passes, calculate the power wireless access point base key seed as follows , calculate the base key of the power wireless access point as follows: , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point And power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then generate a fourth power wireless access point random number Calculate the random number with the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK to encrypt the ciphertext ; Then send the power wireless terminal STA Send a key negotiation response message, which includes the following formula: Power wireless terminal STA After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request sent by itself; if the check passes, the following formula is used to calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then use MEK Ciphertext Decrypt it and get M_ID and MSK ; then power the wireless access point AP Send a key negotiation confirmation message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response issued by itself; check M_ID To confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

19. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the power WLAN security reinforcement method based on trusted computing as claimed in any one of claims 1 to 10.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the power WLAN security reinforcement method based on trusted computing as claimed in any one of claims 1 to 10 is implemented.

Images