Power industry internet lightweight identity authentication method based on implicit certificate

Abstract

The invention discloses a power industry internet lightweight identity authentication method based on an implicit certificate, identity authentication between equipment and an edge gateway is realized by introducing the implicit certificate, different from a traditional explicit certificate, the implicit certificate does not directly contain a public key of the equipment, and the implicit certificate does not directly contain the public key of the equipment. The authentication is completed by embedding certificate information in the data instead of the data, so that the storage, verification and transmission expenses of the certificate are remarkably reduced through the design; meanwhile, an authentication mode that the device and the edge gateway mutually verify the identity of each other is adopted, and a challenge-response mechanism is added in the authentication process, that is, the device and the edge gateway ensure the freshness of the message by exchanging challenge values so as to prevent an attacker from replaying an old message. Through mutual authentication, unauthorized equipment can be prevented from pretending to be a legal node, so that the communication security is improved, and a challenge-response mechanism can resist a replay attack, so that the communication security is further improved.

Description

Technical Field

[0001] The present invention relates to the field of power industry Internet network security technology, and specifically to a power industry Internet lightweight identity authentication method based on implicit certificates. Background Art

[0002] With the rapid development of the power industry Internet, the deep integration of the power system and the Internet has promoted the intelligent upgrade of the power industry. The power industry Internet is widely used in various links such as power generation, transmission, distribution and consumption, realizing the intelligent management of the entire power production process. In this context, power terminal equipment (such as smart meters, sensors, protection relays, etc.) collects power data in real time and collaborates with edge gateways and cloud servers to realize intelligent scheduling, accurate prediction and efficient management of energy production and consumption; therefore, in order to ensure the security of data transmission in the power system, identity authentication technology has become a key protection method for the network security of the power industry Internet.

[0003] At present, the existing identity authentication schemes mainly adopt identity authentication technology based on symmetric cryptography. Although the scheme based on symmetric cryptography has low computational overhead and is suitable for resource-constrained power terminal equipment, its security strength is insufficient and it is difficult to meet the advanced security requirements of the power industry Internet such as countering replay attacks. At the same time, the existing identity authentication schemes mainly rely on explicit certificates (such as X.509) when implemented, which have high overhead in the storage, verification and transmission process. Especially in the power industry Internet, due to the large number of terminal devices, the burden of certificate management and verification is more significant. Therefore, it will lead to large communication and computing overheads, and it is difficult to operate efficiently on resource-constrained power terminal equipment. Therefore, based on the above-mentioned shortcomings, how to provide a lightweight identity authentication method for the power industry Internet based on implicit certificates that is highly secure and can reduce computing and communication overheads has become an urgent problem to be solved. Summary of the Invention

[0004] The technical problem to be solved by the present invention is the problem of device identity authentication in the electric power industrial Internet. The purpose is to provide a lightweight identity authentication method for the electric power industrial Internet based on implicit certificates, which solves the problems of low security and high communication and computing overhead in traditional technologies.

[0005] The present invention is achieved through the following technical solutions: In the first aspect, a lightweight identity authentication method for the power industry Internet based on implicit certificates is provided, including: The trusted proxy server receives a first registration request sent by the power device and a second registration request sent by the edge gateway; The trusted proxy server generates a first implicit certificate and a second implicit certificate according to the first registration request and the second registration request respectively, and generates first registration reply information and second registration reply information based on the first implicit certificate and the second implicit certificate respectively and sends the first registration reply information to the power device and the second registration reply information to the edge gateway; The power device generates a first challenge value and generates an authentication request based on the first registration reply information, the first challenge value and device identity information and sends the authentication request to the edge gateway; The edge gateway performs identity verification on the power device based on the authentication request and judges whether the identity verification is passed; If yes, the edge gateway generates a second challenge value and generates authentication reply information based on the second registration reply information, the second challenge value and the authentication request and sends the authentication reply information to the power device; The power device performs identity and key verification on the edge gateway based on the authentication reply information, and after the identity and key verification is passed, calculates a second restored challenge value based on the authentication reply information, encrypts the second restored challenge value to obtain authentication confirmation information and sends the authentication confirmation information to the edge gateway; The edge gateway decrypts the authentication confirmation information to obtain the second restored challenge value, and when it is judged that the second restored challenge value is the same as the second challenge value, completes the identity verification with the power device to establish a secure communication link with the power device.

[0006] Based on the above disclosure, after receiving the registration request sent by the power device and the edge gateway, the trusted proxy server in the application generates the implicit certificate of the power device and the edge gateway respectively, and generates the registration reply information of the power device and the edge gateway based on the implicit certificate; then, the power device generates a first challenge value and generates an authentication request based on the first registration reply information, the first challenge value and the device identity information of the power device and sends the authentication request to the edge gateway; at this time, the edge gateway can perform identity verification on the power device based on the authentication request sent by the power device, generate a second challenge value after the identity verification is passed, generate authentication reply information based on the second challenge value, the authentication request and the registration reply information returned by the trusted proxy server and send the authentication reply information to the power device; then, the power device can perform identity and key verification on the edge gateway based on the authentication reply information, calculate a second restored challenge value after the verification is passed, encrypt the second restored challenge value to obtain authentication confirmation information and send the authentication confirmation information to the edge gateway; the edge gateway can decrypt the authentication confirmation information to obtain the second restored challenge value; finally, the edge gateway can verify whether the second restored challenge value obtained by decryption is the same as the second challenge value generated by the edge gateway, and when they are the same, complete the identity verification with the power device to establish a secure communication link with the power device.

[0007] Through the above design, the lightweight identity authentication method for the power industrial Internet provided by the present invention realizes identity authentication between the device and the edge gateway by introducing implicit certificates. Unlike traditional explicit certificates, implicit certificates do not directly contain the public key of the device, but complete authentication by embedding certificate information in the data. In this way, this design significantly reduces the storage, verification and transmission overhead of the certificate, and is particularly suitable for deployment in resource-constrained power terminal devices. Therefore, the use of implicit certificates not only improves the efficiency of certificate management, but also reduces communication and computing overhead. At the same time, the present invention adopts an authentication method in which the device and the edge gateway mutually verify each other's identity, and adds a challenge-response mechanism during the authentication process, that is, the device and the edge gateway ensure the freshness of the message by exchanging challenge values ​​to prevent attackers from replaying old messages. Based on this, mutual authentication can prevent unauthorized devices from impersonating legitimate nodes, thereby improving communication security, and the challenge-response mechanism can resist replay attacks, avoid the synchronization problems caused by the traditional timestamp mechanism, and further improve communication security. Therefore, the present invention provides an identity authentication method for the power industrial Internet with high security and the ability to reduce computing and communication overhead, which is very suitable for large-scale application and promotion.

[0008] In one possible design, the first registration request is generated by the power device after receiving the global public parameters sent by the trusted proxy server, wherein the first registration request includes device identity information and registration parameters of the power device, and the global public parameters include a finite field and a base point of an elliptic curve; The trusted proxy server generates a first implicit certificate according to the first registration request, including: generating a first random number and a second random number, wherein both the first random number and the second random number belong to the finite field; generating the first implicit certificate based on the second random number, the base point, and the registration parameter; Correspondingly, generating first registration reply information based on the first implicit certificate includes: Generate an identity code according to the first implicit certificate and the device identity information; Generate intermediate key information based on the identity code, the first random number, and the second random number; The first registration reply information is generated using the first implicit certificate and the intermediate key information.

[0009] In one possible design, generating the first implicit certificate based on the second random number, the base point, and the registration parameter includes: Generate the first implicit certificate according to the following formula (1); (1) In the above formula (1), represents the first implicit certificate, represents the registration parameters, represents the second random number, represents the base point; Accordingly, generating intermediate key information based on the identity code, the first random number, and the second random number includes: According to the following formula (2), the intermediate key information is generated; (2) In the above formula (2), represents the intermediate key information, represents the first random number, represents the identity code, ,in, represents a hash function, Indicates the device identity information.

[0010] In one possible design, the first registration reply information includes: a first implicit certificate, wherein the power device generates an authentication request based on the first registration reply information, the first challenge value, and the device identity information and sends it to the edge gateway, including: Acquire global public parameters sent by the trusted proxy server, wherein the global public parameters include a proxy public key of the trusted proxy server and a base point of an elliptic curve; Generate a first private key according to the first registration reply information, and generate a first public key according to the first private key and the base point; Performing a registration correctness check based on the first public key, the first implicit certificate, and the proxy public key, and determining whether the registration correctness check passes; If yes, obtain the gateway identity information of the edge gateway and generate a third random number; generating a request parameter according to the third random number and the base point; generating an authentication factor based on the first private key, the first implicit certificate, the request parameter, the first challenge value, the device identity information, and the gateway identity information; The authentication request is generated using the device identity information, the request parameters, the first challenge value, the authentication factor, and the first implicit certificate.

[0011] In one possible design, the first registration reply message further includes intermediate key information, wherein generating the first private key based on the first registration reply message includes: Generate the first private key according to the device identity information, the first implicit certificate and the intermediate key information and in accordance with formula (3); (3) In the above formula (3), represents the first private key, represents a hash function, Indicates the device identity information, represents the first implicit certificate, represents the intermediate key information, represents a fourth random number, and the fourth random number is generated when the electric power device generates the first registration request; Accordingly, performing a registration correctness check based on the first public key, the first implicit certificate, and the proxy public key, and determining whether the registration correctness check passes, includes: Calculate a verification parameter based on the proxy public key, the first implicit certificate, and the device identity information according to the following formula (4); (4) In the above formula (4), represents the verification parameter, represents the proxy public key; Determining whether the verification parameter is equal to the proxy public key; If so, the registration correctness check is determined to have passed.

[0012] In one possible design, generating an authentication factor based on the first private key, the first implicit certificate, the request parameters, the first challenge value, the device identity information, and the gateway identity information includes: Generate an authentication code according to the first implicit certificate, the request parameter, the first challenge value, the device identity information, and the gateway identity information; Based on the authentication code, the first private key and the third random number, and in accordance with the following formula (5), generate the authentication factor; (5) In the above formula (5), represents the authentication factor, represents the third random number, represents the authentication code, Represents the first private key.

[0013] In one possible design, the authentication request includes: device identity information of the power device, request parameters, a first challenge value, an authentication factor, and a first implicit certificate; The edge gateway performs identity verification on the power device based on the authentication request, including: obtaining gateway identity information, a first public key sent by the power device, and a global public parameter sent by the trusted proxy server, wherein the global public parameter includes a base point of an elliptic curve; According to the gateway identity information, the device identity information, the request parameter, the first implicit certificate and the first challenge value, an authentication check code is calculated; Based on the authentication factor and the base point, a first check value is calculated, and a second check value is calculated using the request parameter, the authentication check code and the first public key; determine whether the first check value is equal to the second check value; If yes, it is determined that the power device identity verification is passed.

[0014] In one possible design, the second registration reply information includes a second implicit certificate, and the authentication request includes a request parameter and a first challenge value; The edge gateway generates authentication reply information based on the second registration reply information, the second challenge value and the authentication request, and sends the authentication reply information to the power device, including: receiving a global public parameter sent by the trusted proxy server, wherein the global public parameter includes a base point of an elliptic curve and a finite field; generating a fifth random number, wherein the fifth random number belongs to the finite field; According to the fifth random number and the base point, an intermediate parameter is generated; Based on the fifth random number and the request parameter, a first shared key is generated; Using the second challenge value, the first shared key and the intermediate parameter, a first reply information is generated; According to the second registration reply information, a second public key of the edge gateway is generated; According to the second public key, the second implicit certificate, the intermediate parameter, the first reply information, the first challenge value and the first shared key, a second reply information is generated; Using the second public key, the second implicit certificate, the intermediate parameter, the first reply information and the second reply information, the authentication reply information is composed.

[0015] In one possible design, the authentication reply information includes a second implicit certificate, an intermediate parameter, a second reply information, a first reply information and a second public key of the edge gateway; The power device performs identity and key verification on the edge gateway according to the authentication reply information, including: Acquire global public parameters sent by the trusted proxy server, wherein the global public parameters include a proxy public key of the trusted proxy server; Calculating identity authentication parameters according to the second implicit certificate and the proxy public key; Determining whether the identity authentication parameter is the same as the second public key; If yes, then calculating a second shared key based on the intermediate parameters; Calculating verification information based on the second public key, the second implicit certificate, the intermediate parameter, the first reply information, the first challenge value, and the second shared key; Determining whether the verification information is the same as the second reply information; If so, it is determined that the edge gateway identity and key verification are successful.

[0016] In one possible design, the authentication reply information includes: intermediate parameters, wherein the second restored challenge value is encrypted to obtain authentication confirmation information and sent to the edge gateway, including: Calculating a second shared key based on the intermediate parameters; generating a first session key based on the second restoration challenge value, the first challenge value, and the second shared key; Get the gateway identity information of the gateway device; The first session key, the device identity information, the gateway identity information and the second restoration challenge value are encrypted using an AES encryption function to obtain the authentication confirmation information.

[0017] Secondly, a lightweight identity authentication system for the power industry internet based on implicit certificates is provided, including: The trusted proxy server is configured to receive a first registration request sent by the power device and a second registration request sent by the edge gateway; The trusted proxy server is further configured to generate a first implicit certificate and a second implicit certificate respectively according to the first registration request and the second registration request, and to generate a first registration reply message and send it to the power device, and to generate a second registration reply message and send it to the edge gateway based on the first implicit certificate and the second implicit certificate; The power device is configured to generate a first challenge value, and generate an authentication request based on the first registration reply information, the first challenge value, and the device identity information, and send the authentication request to the edge gateway; The edge gateway is used to authenticate the power equipment based on the authentication request and determine whether the authentication is successful; If yes, the edge gateway is configured to generate a second challenge value, and based on the second registration reply information, the second challenge value and the authentication request, generate an authentication reply message and send it to the power device; The power device is further configured to perform identity and key verification on the edge gateway according to the authentication reply information, and after the identity and key verification are passed, calculate a second restoration challenge value based on the authentication reply information, encrypt the second restoration challenge value, obtain authentication confirmation information, and send it to the edge gateway; The edge gateway is also used to decrypt the authentication confirmation information to obtain a second restored challenge value, and when it is determined that the second restored challenge value is the same as the second challenge value, complete the identity authentication with the power device to establish a secure communication link with the power device.

[0018] In the third aspect, a lightweight identity authentication device for the electric power industry Internet based on implicit certificates is provided. Taking the device as an electronic device as an example, it includes a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect or any possible design of the first aspect.

[0019] In a fourth aspect, a storage medium is provided, on which instructions are stored. When the instructions are run on a computer, the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect or any possible design of the first aspect is executed.

[0020] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, causes the computer to execute the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect or any possible design of the first aspect.

[0021] Compared with the prior art, the present invention has the following advantages and beneficial effects: (1) The present invention implements identity authentication between devices and edge gateways by introducing implicit certificates. Unlike traditional explicit certificates, implicit certificates do not directly contain the public key of the device. Instead, authentication is completed by embedding certificate information in the data. This design significantly reduces the storage, verification, and transmission overhead of certificates, and is particularly suitable for deployment in resource-constrained power terminal devices. Therefore, the use of implicit certificates not only improves the efficiency of certificate management, but also reduces communication and computing overhead.

[0022] (2) The present invention adopts an authentication method in which the device and the edge gateway mutually verify each other's identity, and adds a challenge-response mechanism in the authentication process, that is, the device and the edge gateway ensure the freshness of the message by exchanging challenge values ​​to prevent attackers from replaying old messages. Based on this, mutual authentication can prevent unauthorized devices from impersonating legitimate nodes, thereby improving communication security, and the challenge-response mechanism can resist replay attacks, avoid the synchronization problems brought about by the traditional timestamp mechanism, and further improve the security of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the examples. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be considered as limiting the scope. A person of ordinary skill in the art can also derive other relevant drawings based on these drawings without inventive effort. In the drawings: Figure 1 A schematic diagram of the steps of a lightweight identity authentication method for the power industry internet based on implicit certificates provided in an embodiment of the present invention; Figure 2 A schematic diagram comparing the running time of the method provided by an embodiment of the present invention and a traditional identity authentication method; Figure 3 A schematic diagram of the structure of a lightweight identity authentication system for the power industry internet based on implicit certificates provided by an embodiment of the present invention; Figure 4 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and accompanying drawings. The exemplary embodiments of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention. It should be understood that although the terms "first," "second," and so on may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, a first unit can be referred to as a second unit, and similarly, a second unit can be referred to as a first unit without departing from the scope of the exemplary embodiments of the present invention.

[0025] Example: See also Figure 1As shown, the lightweight identity authentication method of the electric power industrial Internet based on implicit certificates provided in this embodiment realizes identity authentication between devices and edge gateways by introducing implicit certificates. Unlike traditional explicit certificates, implicit certificates do not directly contain the public key of the device, but complete the authentication by embedding certificate information in the data. In this way, this design significantly reduces the storage, verification and transmission overhead of certificates. At the same time, the present invention adopts an authentication method in which devices and edge gateways verify each other's identities, and adds a challenge-response mechanism in the authentication process, that is, devices and edge gateways ensure the freshness of messages by exchanging challenge values ​​to prevent attackers from replaying old messages. Therefore, mutual authentication can prevent unauthorized devices from impersonating legitimate nodes, thereby improving communication security, and the challenge-response mechanism can resist replay attacks, thereby further improving communication security; thus, the present method provides an identity authentication method for the electric power industry Internet that is highly secure and can reduce computing and communication overheads, and is therefore very suitable for large-scale application and promotion; for example, the present method can be, but is not limited to, run on a trusted proxy server, electric power equipment (i.e., electric power equipment terminal) and an edge gateway side. It can be understood that the aforementioned execution subject does not constitute a limitation on the embodiments of the present application. Accordingly, the operation steps of the present method can be, but are not limited to, as shown in the following steps S1 to S7.

[0026] S1. The trusted proxy server receives a first registration request sent by the power device and a second registration request sent by the edge gateway. In specific applications, the first registration request is generated by the power device after receiving the global public parameters sent by the trusted proxy server. Of course, the second registration request is generated by the edge gateway after receiving the aforementioned global public parameters. Among them, the global public parameters are system parameters (i.e., system initial parameters) provided by the trusted proxy server for identity authentication of the power device and the edge gateway. As the management and maintenance entity of the entire system, the trusted proxy server is mainly responsible for processing the identity registration of the power device and the edge gateway, issuing implicit certificates, and generating necessary key materials to ensure that the devices can securely access the power system.

[0027] Optionally, the specific process of generating global public parameters by using the public trusted proxy server is shown in the following steps 1 to 4.

[0028] Step 1: The trusted proxy server obtains the coefficients of an elliptic curve , the base point of the elliptic curve and a finite field ; Among them, the coefficients, base points and finite fields of the aforementioned elliptic curve are all preset parameters.

[0029] Step 2: The trusted proxy server obtains the hash function In this embodiment, Represents an input of any byte length, wherein, in specific applications, different types of hash functions can be selected according to actual use, and are not limited here; thus, after obtaining the relevant parameters of the aforementioned hash function and the aforementioned elliptic curve, the proxy private key and proxy public key of the trusted proxy server can be calculated based on this, as shown in the third step below.

[0030] Step 3: The trusted proxy server generates the first random number , as its own proxy private key, and calculate the proxy public key based on the proxy private key ,in, ,and .

[0031] After calculating the proxy public key and proxy private key, the global public parameters can be formed. The process is shown in the fourth step below. Step 4: Trusted proxy server uses elliptic curve coefficients , base point , finite fields , hash function and proxy public key to form global public parameters, which are then sent to power equipment and edge gateways.

[0032] In this way, after the power device and the edge gateway receive the global public parameters sent by the trusted proxy server, they can generate their own registration requests based on this; among them, since the registration request generation process of the power device and the edge gateway is the same, the following uses the power device as an example to explain, as shown in the following steps (1) and (2).

[0033] Step (1): The power device generates a fourth random number , and generate registration parameters based on the fourth random number and the base point in the global public parameter In this embodiment, ,and .

[0034] After obtaining the registration parameters, the device identity information can be obtained so as to be subsequently combined to generate the first registration request. The process is shown in the following step (2).

[0035] Step (2): The power device obtains its own device identity information, and uses the device identity information and registration parameters to form the first registration request.

[0036] Thus, through the aforementioned steps (1) and (2), a first registration request can be generated; of course, for the edge gateway, a different random number is generated and the gateway identity information is used to form a second registration request. The generation process is the same as that of the first registration request and will not be repeated here.

[0037] In this embodiment, after the power device and the edge gateway generate their own registration requests and send them to the trusted proxy server, the trusted proxy server can generate the power device and the edge gateway's respective implicit certificates based on the received registration requests, and generate registration reply information of the power device and the edge gateway based on the implicit certificates; wherein, the generation process of the implicit certificate and the registration reply information is shown in the following step S2.

[0038] S2. The trusted proxy server generates a first implicit certificate and a second implicit certificate according to the first registration request and the second registration request, respectively, and generates a first registration reply message based on the first implicit certificate and the second implicit certificate and sends it to the power device, and generates a second registration reply message and sends it to the edge gateway. In specific applications, after receiving the first registration request, the trusted proxy server will perform a registration check on the power device, that is, it will determine whether the device identity information in the first registration request exists in the registration list of the system. If so, the first registration request of the power device is rejected (indicating that the power device has been registered). Otherwise, the first implicit certificate is generated based on the first registration request. Similarly, when the second registration request is received, a registration check will also be performed, and its process is the same as the registration check of the power device, which will not be repeated here.

[0039] Furthermore, the following uses power equipment as an example to illustrate the generation process of the first implicit certificate, which may be but is not limited to the following steps S21 to S22.

[0040] S21. Generate a first random number and a second random number, where both the first random number and the second random number belong to the finite field. In this embodiment, the first random number is generated when generating the global public parameter, which has been described above. When generating the first implicit certificate, a second random number is also generated to combine the first registration request and the aforementioned base point to generate the first implicit certificate. The generation process of the first implicit certificate is described in step S22 below.

[0041] S22. Generate the first implicit certificate based on the second random number, the base point, and the registration parameter. In a specific application, the first implicit certificate may be generated by, for example but not limited to, the following formula (1).

[0042] (1) In the above formula (1), represents the first implicit certificate, represents the registration parameters, represents the second random number, wherein, .

[0043] Thus, by the aforementioned formula (1), the first implicit certificate of the power device can be generated; similarly, the generation process of the second implicit certificate of the edge gateway is the same as that of the first implicit certificate, and only the registration parameters in the second registration request need to be used, and the generation process will not be described one by one here.

[0044] After obtaining the implicit certificates of the power device and the edge gateway, the respective registration reply information of the two can be generated; wherein, the power device is still taken as an example for illustration, and the generation process of the corresponding first registration reply information can be but not limited to the following steps S23-S25.

[0045] S23. Generating identity code according to the first implicit certificate and the device identity information; in a specific application, the generation formula of the identity code is as follows: wherein, represents the device identity information, represents the first implicit certificate, represents a hash function; thus, after generating the identity code, the intermediate key information can be generated in combination with the first and second random numbers in the aforementioned step S21, and the process is shown in the following step S24.

[0046] S24. Generating intermediate key information based on the identity code, the first random number and the second random number; in the present embodiment, the intermediate key information can be but not limited to generated by using the following formula (2).

[0047] (2) In the aforementioned formula (2), represents the intermediate key information, represents the first random number, represents the identity code, wherein, represents a hash function, represents the device identity information.

[0048] After generating the intermediate key information based on the aforementioned formula (2), the first registration reply information can be generated in combination with the aforementioned first implicit certificate, and the process is shown in the following step S25.

[0049] S25. Generating the first registration reply information by using the first implicit certificate and the intermediate key information; in the present embodiment, the first registration reply information contains the aforementioned first implicit certificate and the intermediate key information.

[0050] ​In a specific implementation, the generation process of the second registration reply information is the same as that of the first registration reply information, that is, the gateway identity code of the edge gateway is obtained by using the gateway identity information and the second implicit certificate of the edge gateway; then, the intermediate key information of the gateway is generated by combining the gateway identity code and using the above formula (2); finally, the second registration reply information can be composed by combining the gateway identity code.

[0051] In this way, through the foregoing steps S21-S25, the trusted proxy server can generate the registration reply information containing the respective implicit certificates of the power device and the edge gateway, and deliver the registration reply information to the power device and the edge gateway; thus, the power device and the edge gateway can perform identity authentication according to the respective registration reply information, and the process is shown in the following steps S3-S7.

[0052] S3. The power device generates a first challenge value, and generates an authentication request according to the first registration reply information, the first challenge value, and device identity information, and sends the authentication request to the edge gateway; in a specific application, the first challenge value is generated after the registration correctness verification is passed, so that the authentication request is generated by means of the first challenge value, the first registration reply information, and the device identity information.

[0053] The generation process of the authentication request can be, but is not limited to, shown in the following steps S31-S37.

[0054] S31. Obtain the global public parameter sent by the trusted proxy server, wherein the global public parameter includes the proxy public key of the trusted proxy server and the base point of the elliptic curve; in the present embodiment, the global public parameter is delivered by the trusted proxy server before the identity authentication, and the delivery process can be referred to the following first step to fourth step, which will not be described here.

[0055] After obtaining the global public parameter, the power device can calculate its own private key and public key according to the first registration reply information, and the process is shown in the following step S32.

[0056] S32. Generate a first private key according to the first registration reply information, and generate a first public key according to the first private key and the base point; in a specific application, for example, the first private key can be generated by using the device identity information of the power device in combination with the first implicit certificate and the intermediate key information in the first registration reply information.

[0057] Optionally, for example, the first private key can be obtained by using the following formula (3).

[0058] (3) In the above formula (3), represents the first private key, represents a hash function, Indicates the device identity information, represents the first implicit certificate, represents the intermediate key information, represents a fourth random number; in this embodiment, the fourth random number is generated when the power equipment generates the first registration request, as can be seen in the aforementioned step (1).

[0059] Thus, according to the above formula (3), after calculating the first private key of the power equipment, the first public key can be generated based on it. ,in, , where Indicates the base point in the global public parameters.

[0060] After the private key and public key of the power device itself are calculated based on the aforementioned step S32, a registration correctness check can be performed, and the process is shown in the following step S33.

[0061] S33. Perform a registration correctness check based on the first public key, the first implicit certificate, and the proxy public key, and determine whether the registration correctness check passes. In a specific implementation, for example, but not limited to, a verification parameter may be calculated based on the proxy public key, the first implicit certificate, and the device identity information according to the following formula (4).

[0062] (4) In the above formula (4), represents the verification parameter, Represents the proxy public key.

[0063] Thus, after obtaining the verification parameter based on the above formula (4), it can be determined whether the verification parameter is equal to the proxy public key, that is, Is it established? If so, it is determined that the registration correctness check has passed. At this time, the first private key and the first public key generated above are accepted, and then the following step S34 is executed; otherwise, it is determined that the registration correctness check has not passed, and the generation process of the first public key and the first private key above needs to be executed again.

[0064] After completing the registration correctness verification and passing the verification, it is necessary to use the aforementioned first private key, first challenge value, first implicit certificate and other information to generate an authentication request to send to the edge gateway for identity authentication. The specific generation process of the authentication request is shown in the following steps S34 to S37.

[0065] S34. If so, obtain the gateway identity information of the edge gateway and generate a third random number; in this embodiment, the power device may send an identity acquisition request to the edge gateway, and after the edge gateway obtains the identity acquisition request, it may return its corresponding gateway identity information to the power device; At the same time, the third random number generated ; In this way, after obtaining the third random number, the request parameters can be generated in combination with the base point in the aforementioned global public parameters, and the process is shown in the following step S35.

[0066] S35. Based on the third random number and the base point, a request parameter is generated; in this embodiment, the request parameter The calculation formula is: ; In this way, after obtaining the request parameters, the aforementioned first private key, the first implicit certificate and the first challenge value can be combined to generate an authentication factor, so that an authentication request can be generated based on the authentication factor subsequently; wherein, the generation process of the authentication factor can be but is not limited to as shown in the following step S36.

[0067] S36. Generate an authentication factor based on the first private key, the first implicit certificate, the request parameters, the first challenge value, the device identity information, and the gateway identity information. In this embodiment, for example, but not limited to, first generate an authentication code based on the first implicit certificate, the request parameters, the first challenge value, the device identity information, and the gateway identity information; and then generate the authentication factor based on the authentication code, the first private key, and the third random number.

[0068] Optionally, one of the following methods for generating a public authentication code is as follows:

[0069] Where, Indicates the authentication code, represents the device identity information, the first implicit certificate, the request parameter, the first challenge value and the gateway identity information in sequence, Represents a hash function.

[0070] In this way, after the authentication code is generated, the first private key and the third random number can be combined and the authentication factor can be generated according to the following formula (5).

[0071] (5) In the above formula (5), represents the authentication factor, represents the third random number, represents the authentication code, Represents the first private key.

[0072] In this embodiment, after the authentication factor of the power device is generated through the aforementioned step S36, the request parameter, the first challenge value and the first implicit certificate can be combined to generate an authentication request, and the process is shown in the following step S37.

[0073] S37. Using the device identity information, the request parameters, the first challenge value, the authentication factor and the first implicit certificate, the authentication request is generated; in this embodiment, the authentication request is .

[0074] Therefore, based on the aforementioned steps S31 to S37, after the power device generates an authentication request containing device identity information, request parameters, a first challenge value, an authentication factor and a first implicit certificate, it can be sent to the edge gateway so that the edge gateway can perform identity authentication of the power device based on the authentication request, and then return authentication reply information to the power device after the identity authentication is passed; wherein, the edge gateway's identity authentication process for the power device is shown in the following step S4.

[0075] S4. The edge gateway authenticates the power device based on the authentication request and determines whether the authentication is successful. In a specific implementation, the edge gateway may, for example, but not limited to, perform steps S41 to S45 to authenticate the power device.

[0076] S41. Obtaining gateway identity information, a first public key sent by the power device, and global public parameters sent by the trusted proxy server, wherein the global public parameters include a base point of an elliptic curve.

[0077] After obtaining the gateway identity information, the authentication verification code can be calculated in combination with the aforementioned authentication request, and the process is shown in the following step S42.

[0078] S42 based on the gateway identity information, the device identity information, the request parameters, the first implicit certificate and the first challenge value, calculate the authentication verification code; in this embodiment, the authentication verification code The calculation formula is: In this way, after calculating the authentication check code, the authentication factor in the authentication request and the first public key sent by the power device can be combined to perform identity authentication, and the process is shown in the following steps S43 to S45.

[0079] S43. Calculate a first check value based on the authentication factor and the base point, and calculate a second check value using the request parameters, the authentication check code, and the first public key. In a specific application, the calculation formulas for the first check value and the second check value are: , , where In turn, they represent the first check value and the second check value, represents the authentication factor, Indicates the request parameters. The authentication verification code and the first public key are represented in sequence.

[0080] In this way, after the first check value and the second check value are calculated, it can be determined whether they are the same, wherein the determination process is shown in the following step S43.

[0081] S44. Determine whether the first check value is equal to the second check value. In this embodiment, if the two are equal, it is determined that the power device identity authentication is passed, that is, the authentication request is legal, and step S45 is executed below. Otherwise, the edge gateway rejects the request and ends the authentication process.

[0082] S45. If yes, it is determined that the power equipment identity verification is passed.

[0083] Thus, through the aforementioned steps S41 to S45, the identity authentication of the power device is completed, and after determining that the identity authentication is passed, the edge gateway can generate an authentication reply message and send it to the power device. The process is shown in the following step S5.

[0084] S5. If yes, the edge gateway generates a second challenge value and, based on the second registration reply information, the second challenge value, and the authentication request, generates an authentication reply message and sends it to the power device. In specific applications, the edge gateway calculates the first shared key and the reply message and returns the authentication reply in combination with the corresponding second implicit certificate. The process is shown in the following steps S51 to S58.

[0085] S51. Receive global public parameters sent by the trusted proxy server, wherein the global public parameters include a base point of an elliptic curve and a finite field.

[0086] S52. Generate a fifth random number, where the fifth random number belongs to the finite field.

[0087] In this embodiment, after obtaining the global public parameter and the fifth random number, the intermediate parameter can be calculated based on them, and the process is shown in the following step S53.

[0088] S53. Based on the fifth random number and the base point, an intermediate parameter is generated; in the specific implementation, an example intermediate parameter The calculation formula is: , where Represents the fifth random number; in this way, after obtaining the intermediate parameter, the first shared key can be calculated, and the process is shown in the following step S54.

[0089] S54 based on the fifth random number and the request parameters, generating a first shared key; in this embodiment, the first shared key for: , where Indicates request parameters.

[0090] After the first shared key is generated based on the aforementioned step S54, the first reply information can be generated in combination with the intermediate parameters in the authentication request sent by the power device, and the process is shown in the following step S55.

[0091] S55. Generate a first reply message using the second challenge value, the first shared key, and the intermediate parameter. In this embodiment, the first reply message may be generated using, but not limited to, the following formula (6).

[0092] (6) In the above formula (6), Indicates the first reply information, represents the second challenge value, represents the intermediate parameter, represents the first shared key, Represents a hash function.

[0093] In this way, after the edge gateway generates the first reply information based on the aforementioned formula (6), it needs to combine the second registration reply information returned by the trusted proxy server to generate its own second public key, so as to subsequently generate the second reply information based on the second public key, the first shared key and the first challenge value in the authentication request; wherein, the generation process of the second public key is shown in the following step S56.

[0094] S56. Generate a second public key of the edge gateway based on the second registration reply information; in this embodiment, the generation process of the second public key is the same as the generation process of the first public key, that is, first generate the second private key of the edge gateway based on the second registration reply information, and then, combine the base point in the global public parameters to generate the second public key. The process can be referred to the aforementioned step S32 and will not be repeated here.

[0095] After obtaining the second public key, a second reply message can be generated, and the process is shown in the following step S57.

[0096] S57. Generate a second reply message based on the second public key, the second implicit certificate, the intermediate parameter, the first reply message, the first challenge value, and the first shared key. In this embodiment, the second reply message may be generated using, but is not limited to, the following formula (7).

[0097] (7) In the above formula (7), represents the second reply information, represents the second public key, represents the second implicit certificate, represents the first challenge value, represents a hash function.

[0098] After generating the second reply information based on the foregoing formula (7), the authentication reply information can be generated in combination with the first reply information, the second implicit certificate, the intermediate parameter, the second public key, and the like, and the process is shown in the following step S58.

[0099] S58. The authentication reply information is composed of the second public key, the second implicit certificate, the intermediate parameter, the first reply information, and the second reply information; in a specific application, the authentication reply information is: .

[0100] Therefore, through the foregoing steps S51-S58, the edge gateway can generate the authentication reply information according to the authentication request, the second implicit certificate, and the second challenge value of the edge gateway, and send the authentication reply information to the power device; then, the power device performs identity and key verification on the edge gateway according to the authentication reply information, and the process is shown in the following step S6.

[0101] S6. The power device performs identity and key verification on the edge gateway according to the authentication reply information, and after the identity and key verification is passed, calculates a second restored challenge value based on the authentication reply information, encrypts the second restored challenge value to obtain authentication confirmation information, and sends the authentication confirmation information to the edge gateway; in a specific implementation, identity and key verification of the edge gateway can be completed by, for example but not limited to, the following steps S61-S67.

[0102] S61. Obtain the global public parameter sent by the trusted proxy server, wherein the global public parameter includes the proxy public key of the trusted proxy server; in this embodiment, the generation process of the proxy public key can be referred to the third step in the foregoing step S1, and the process is not described here.

[0103] After obtaining the proxy public key, the identity verification parameter can be calculated in combination with the second implicit certificate in the authentication reply information, and the process is shown in the following step S62.

[0104] S62. Calculate the identity verification parameter according to the second implicit certificate and the proxy public key; in this embodiment, the identity verification parameter is: ; in the formula, represents the second implicit certificate, represents gateway identity information, Represents the proxy public key.

[0105] After the identity authentication parameter is calculated, it can be determined whether it is the same as the second public key, and the process is shown in the following step S63.

[0106] S63. Determine whether the authentication parameter is the same as the second public key; in this embodiment, if the authentication parameter is the same as the second public key, it indicates that the edge gateway identity is correct and the authentication is determined to be successful; then, key verification can be performed, and the process is shown in steps S64 to S67 below.

[0107] S64. If so, based on the intermediate parameters, calculate the second shared key; in specific applications, the second shared key for: ,in, Represent the third random number and the intermediate parameter in sequence; in this way, after calculating the second shared key, the verification information can be generated based on the second public key, the intermediate parameter, the second implicit certificate and the first reply information in the authentication reply information, and combined with its own first challenge value. The process is shown in the following step S65.

[0108] S65 based on the second public key, the second implicit certificate, the intermediate parameter, the first reply information, the first challenge value and the second shared key, calculate the verification information; in this embodiment, example verification information for: .

[0109] In this way, after the verification information is calculated, it can be determined whether the verification information is the same as the second reply information, and the process is shown in the following step S66.

[0110] S66. Determine whether the verification information is the same as the second reply information; in this embodiment, if the two are the same, it is determined that the key verification is successful, and the process is shown in step S67 below.

[0111] S67. If so, it is determined that the edge gateway identity and key verification have passed. In specific applications, if the verification information and the second reply information are different, the power device will reject the authentication reply information of the edge gateway and end the authentication process. At the same time, if the identity and key verification pass, the following step S7 is executed. Of course, if the identity authentication fails in the aforementioned step S63, the authentication reply information of the edge gateway also needs to be rejected.

[0112] In this way, through the aforementioned steps S61 to S67, the power device can complete the identity and key verification of the edge gateway, and then, based on the authentication reply information, restore the second challenge value generated in the edge gateway. The process is as follows: the power device uses the second shared key, the first reply information in the authentication reply information and the intermediate parameters, and generates the second restored challenge value according to the following formula (8).

[0113] (8) In the above formula (8), represents the second restoration challenge value; It represents the first reply information, the intermediate parameter and the second shared key in sequence.

[0114] After obtaining the second restored challenge value based on the aforementioned formula (8), the power device may encrypt the second restored challenge value to obtain authentication confirmation information, as shown in the following steps S68 to S610.

[0115] S68. Generate a first session key based on the second restored challenge value, the first challenge value, and the second shared key. In this embodiment, the first session key may be generated using, for example but not limited to, the following formula (9).

[0116] (9) In the above formula (9), Represents the first session key.

[0117] After the first session key is generated based on the above formula (9), the first session key, the device identity information, the gateway identity information and the second restoration challenge value may be encrypted, as shown in the following steps S69 and S610.

[0118] S69. Obtain gateway identity information of the gateway device.

[0119] S610. Use an AES encryption function to encrypt the first session key, the device identity information, the gateway identity information, and the second restoration challenge value to obtain the authentication confirmation information. In a specific application, the authentication confirmation information can be generated by, for example but not limited to, using the following formula (10).

[0120] (10) In the above formula (10), Indicates authentication confirmation information. Represents the AES encryption function.

[0121] Therefore, through the aforementioned steps S61 to S610, the power device can generate an authentication confirmation message (i.e., authentication confirmation information) containing a second restored challenge value; then, the power device sends it to the edge gateway, and the edge gateway can decrypt it to obtain the second restored challenge value, and use it to compare the challenge value, and then determine whether the identity authentication with the power device can be passed based on the comparison result; wherein, the decryption process of the edge gateway is shown in the following step S7.

[0122] S7. The edge gateway decrypts the authentication confirmation information to obtain the second restored challenge value, and when it is determined that the second restored challenge value is the same as the second challenge value, completes the identity authentication with the power device to establish a secure communication link with the power device; in this embodiment, for example, the edge gateway can, but is not limited to, first obtain the first challenge value of the power device (which can be obtained from the authentication request of the power device received by it); then, based on the first shared key, the second challenge value and the first challenge value, generate a second session key; finally, use the second session key and adopt the AES decryption function to decrypt the authentication confirmation information to obtain the second restored challenge value after decryption.

[0123] For example, but not limited to, the following formula (11) may be used to generate the second session key.

[0124] (11) In the above formula (11), Represents the second session key.

[0125] Similarly, the decryption formula for the second restoration challenge value is: (12) In formula (12), Represents the AES decryption function.

[0126] In this way, after the edge gateway decrypts and obtains the second restored challenge value through the aforementioned formula (12), it can determine whether the second restored challenge value is the same as the second challenge value generated by itself. If they are the same, it means that both parties have completed mutual authentication and established a secure session key. At this time, a secure communication link can be established with the power equipment, that is, the aforementioned two session keys are used to carry out data communication, that is, encrypted upload of power data; otherwise, the edge gateway rejects the authentication confirmation information sent by the power equipment and re-executes the authentication process.

[0127] In addition, this embodiment verifies the efficiency of the operation of this solution through experiments, wherein the method provided by this embodiment is compared with the traditional identity authentication method. The comparison diagram is shown in FIG. Figure 2 As shown,Figure 2 The experimental results shown show that the running time of both the device and the edge gateway is lower than that of traditional technologies and significantly lower than that of existing solutions. At the same time, the experiments also show that the total communication volume and message interaction rounds are also lower than those of existing solutions. Therefore, this design makes the solution particularly suitable for practical application scenarios of the power industrial Internet. In addition, this embodiment verifies its strong security through formal methods (such as the ProVerif tool) and informal analysis. Specifically, this embodiment can achieve secure mutual authentication, ensuring that the device and the edge gateway can verify each other's identity and prevent unauthorized devices from impersonating legitimate nodes. In addition, the authentication method provided by this implementation provides forward security. Even if an attacker obtains the device's long-term key or current session key, they cannot decrypt past communication content. By introducing a challenge-response mechanism (such as using a random number nonce), the solution effectively resists replay attacks and avoids synchronization issues caused by traditional timestamp mechanisms. At the same time, the aforementioned analysis also shows that the solution can also resist various typical security threats such as man-in-the-middle attacks and privileged insider attacks, ensuring communication security in the power industrial Internet environment.

[0128] Therefore, the lightweight identity authentication method for the power industry Internet based on implicit certificates described in detail in the above steps S1 to S7 has the following beneficial effects: (1) The present invention introduces implicit certificate technology when performing identity authentication. Unlike traditional explicit certificates (such as X.509), implicit certificates do not directly contain the public key of the device. Instead, the public key is derived from the certificate information and the public information of the trusted agent. This design significantly reduces the storage, verification and transmission overhead of the certificate, and is particularly suitable for deployment in resource-constrained power terminal equipment. Therefore, the use of implicit certificates not only improves the efficiency of certificate management, but also reduces communication and computing overhead, providing an efficient and secure solution for identity authentication in the power industry Internet.

[0129] (2) In the identity authentication process in the power industrial Internet, the present invention introduces a challenge-response mechanism (such as using a random number Nonce) to resist replay attacks, thereby avoiding the synchronization problem caused by the traditional timestamp mechanism. That is, during the authentication process, the device and the edge gateway ensure the freshness of the message by exchanging challenge values ​​(Nonce) to prevent attackers from replaying old messages. In this way, this mechanism not only enhances the security of communication, but also reduces the dependence on time synchronization. Therefore, it is also very suitable for scenarios where time synchronization may be difficult in the power system.

[0130] (3) The present invention provides a lightweight identity authentication protocol that only relies on hash operations, XOR operations and a small amount of elliptic curve modular multiplication operations to complete identity authentication. In this way, the complex bilinear pairing or intensive elliptic curve operations in traditional public key cryptography are avoided. Through this design, while ensuring high security, the computing and communication overheads are significantly reduced, which is particularly suitable for resource-constrained power terminal equipment. Therefore, the design of the lightweight protocol provided by the present invention enables the solution to operate efficiently in the power industrial Internet environment and meet strict security requirements at the same time.

[0131] like Figure 3 As shown, the second aspect of this embodiment provides a hardware system for implementing the power industry internet lightweight identity authentication method based on implicit certificates described in the first aspect of the embodiment, including: The trusted proxy server is used to receive a first registration request sent by the power device and a second registration request sent by the edge gateway.

[0132] The trusted proxy server is also used to generate a first implicit certificate and a second implicit certificate respectively according to the first registration request and the second registration request, and based on the first implicit certificate and the second implicit certificate, generate a first registration reply message and send it to the power device, and generate a second registration reply message and send it to the edge gateway.

[0133] The power device is configured to generate a first challenge value, and generate an authentication request based on the first registration reply information, the first challenge value, and the device identity information, and send the request to the edge gateway.

[0134] The edge gateway is used to authenticate the power equipment based on the authentication request and determine whether the authentication is successful.

[0135] If so, the edge gateway is used to generate a second challenge value, and based on the second registration reply information, the second challenge value and the authentication request, generate authentication reply information and send it to the power device.

[0136] The power equipment is also used to perform identity and key verification on the edge gateway according to the authentication reply information, and after the identity and key verification are passed, calculate the second restoration challenge value based on the authentication reply information to encrypt the second restoration challenge value, obtain authentication confirmation information and send it to the edge gateway.

[0137] The edge gateway is also used to decrypt the authentication confirmation information to obtain a second restored challenge value, and when it is determined that the second restored challenge value is the same as the second challenge value, complete the identity authentication with the power device to establish a secure communication link with the power device.

[0138] The working process, working details and technical effects of the system provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0139] like Figure 4 As shown, the third aspect of this embodiment provides a lightweight identity authentication device for the electric power industry Internet based on implicit certificates. Taking the device as an electronic device as an example, it includes: a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect of the embodiment.

[0140] For example, the memory may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, first-in first-out memory (FIFO), and / or first-in last-out memory (FILO). Specifically, the processor may include one or more processing cores, such as a quad-core processor or an octal-core processor. The processor may be implemented in at least one of the following hardware forms: a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), or a PLA (Programmable Logic Array). Furthermore, the processor may include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in a standby state.

[0141] In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed on the display screen. For example, the processor may be, but is not limited to, a microprocessor of the STM32F105 series, a reduced instruction set computer (RISC) microprocessor, an X86 architecture processor, or a processor with an integrated embedded neural network processing unit (NPU). The transceiver may be, but is not limited to, a Wireless Fidelity (WIFI) wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee protocol (a low-power local area network protocol based on the IEEE802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver, and / or a 5G transceiver. In addition, the device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0142] The working process, working details and technical effects of the electronic device provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0143] The fourth aspect of this embodiment provides a storage medium that stores instructions for the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect of the embodiment, that is, the storage medium stores instructions, and when the instructions are run on a computer, the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect of the embodiment is executed.

[0144] The storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive and / or a memory stick, and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0145] The working process, working details and technical effects of the storage medium provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0146] The fifth aspect of this embodiment provides a computer program product containing instructions, which, when executed on a computer, enables the computer to execute the lightweight identity authentication method for the electric power industry Internet based on implicit certificates as described in the first aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0147] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A lightweight identity authentication method for the power industry Internet based on implicit certificates, characterized in that: include: The trusted proxy server receives a first registration request sent by the power device and a second registration request sent by the edge gateway; The trusted proxy server generates a first implicit certificate and a second implicit certificate according to the first registration request and the second registration request, and generates a first registration reply message and sends it to the power device, and generates a second registration reply message and sends it to the edge gateway based on the first implicit certificate and the second implicit certificate; The power device generates a first challenge value, and generates an authentication request based on the first registration reply information, the first challenge value and the device identity information, and sends the request to the edge gateway; The edge gateway authenticates the power equipment based on the authentication request and determines whether the authentication is successful; If yes, the edge gateway generates a second challenge value, and based on the second registration reply information, the second challenge value and the authentication request, generates an authentication reply message and sends it to the power device; The power device performs identity and key verification on the edge gateway based on the authentication reply information. After the identity and key verification are passed, the power device calculates a second restoration challenge value based on the authentication reply information, encrypts the second restoration challenge value, obtains authentication confirmation information, and sends it to the edge gateway. The edge gateway decrypts the authentication confirmation information to obtain the second restored challenge value, and when it is determined that the second restored challenge value is the same as the second challenge value, completes the identity authentication with the power device to establish a secure communication link with the power device.

2. The method according to claim 1, characterized in that The first registration request is generated by the power device after receiving the global public parameters sent by the trusted proxy server, wherein the first registration request includes device identity information and registration parameters of the power device, and the global public parameters include a finite field and a base point of an elliptic curve; The trusted proxy server generates a first implicit certificate according to the first registration request, including: generating a first random number and a second random number, wherein both the first random number and the second random number belong to the finite field; generating the first implicit certificate based on the second random number, the base point, and the registration parameter; Correspondingly, generating first registration reply information based on the first implicit certificate includes: Generate an identity code according to the first implicit certificate and the device identity information; Generate intermediate key information based on the identity code, the first random number, and the second random number; The first registration reply information is generated using the first implicit certificate and the intermediate key information.

3. The method according to claim 2, characterized in that Generating the first implicit certificate based on the second random number, the base point, and the registration parameter includes: Generate the first implicit certificate according to the following formula (1); （1） In the above formula (1), represents the first implicit certificate, represents the registration parameters, represents the second random number, represents the base point; Accordingly, generating intermediate key information based on the identity code, the first random number, and the second random number includes: According to the following formula (2), the intermediate key information is generated; （2） In the above formula (2), represents the intermediate key information, represents the first random number, represents the identity code, ,in, represents a hash function, Indicates the device identity information.

4. The method according to claim 1, wherein The first registration reply information includes: a first implicit certificate, wherein the power device generates an authentication request based on the first registration reply information, the first challenge value and the device identity information and sends it to the edge gateway, including: Acquire global public parameters sent by the trusted proxy server, wherein the global public parameters include a proxy public key of the trusted proxy server and a base point of an elliptic curve; Generate a first private key according to the first registration reply information, and generate a first public key according to the first private key and the base point; Performing a registration correctness check based on the first public key, the first implicit certificate, and the proxy public key, and determining whether the registration correctness check passes; If yes, obtain the gateway identity information of the edge gateway and generate a third random number; generating a request parameter according to the third random number and the base point; generating an authentication factor based on the first private key, the first implicit certificate, the request parameter, the first challenge value, the device identity information, and the gateway identity information; The authentication request is generated using the device identity information, the request parameters, the first challenge value, the authentication factor, and the first implicit certificate.

5. The method according to claim 4, characterized in that The first registration reply message also includes: intermediate key information, wherein generating a first private key according to the first registration reply message includes: Generate the first private key according to the device identity information, the first implicit certificate and the intermediate key information and in accordance with formula (3); （3） In the above formula (3), represents the first private key, represents a hash function, Indicates the device identity information, represents the first implicit certificate, represents the intermediate key information, represents a fourth random number, and the fourth random number is generated when the electric power device generates the first registration request; Accordingly, performing a registration correctness check based on the first public key, the first implicit certificate, and the proxy public key, and determining whether the registration correctness check passes, includes: Calculate a verification parameter based on the proxy public key, the first implicit certificate, and the device identity information according to the following formula (4); （4） In the above formula (4), represents the verification parameter, represents the proxy public key; Determining whether the verification parameter is equal to the proxy public key; If so, the registration correctness check is determined to have passed.

6. The method according to claim 5, characterized in that Generating an authentication factor based on the first private key, the first implicit certificate, the request parameter, the first challenge value, the device identity information, and the gateway identity information, including: Generate an authentication code according to the first implicit certificate, the request parameter, the first challenge value, the device identity information, and the gateway identity information; Based on the authentication code, the first private key and the third random number, and in accordance with the following formula (5), generate the authentication factor; （5） In the above formula (5), represents the authentication factor, represents the third random number, represents the authentication code, Represents the first private key.

7. The method according to claim 1, characterized in that The authentication request includes: device identity information of the power device, request parameters, a first challenge value, an authentication factor and a first implicit certificate; The edge gateway authenticates the power equipment based on the authentication request, including: Obtaining gateway identity information, a first public key sent by the power device, and global public parameters sent by the trusted proxy server, wherein the global public parameters include a base point of an elliptic curve; Calculating an authentication verification code based on the gateway identity information, the device identity information, the request parameters, the first implicit certificate, and the first challenge value; Calculating a first check value based on the authentication factor and the base point, and calculating a second check value using the request parameter, the authentication check code, and the first public key; Determining whether the first check value is equal to the second check value; If so, it is determined that the power equipment identity authentication has passed.

8. The method according to claim 1, characterized in that The second registration reply information includes: a second implicit certificate, and the authentication request includes: a request parameter and a first challenge value; The edge gateway generates authentication response information based on the second registration response information, the second challenge value, and the authentication request and sends it to the power device, including: Receiving global public parameters sent by the trusted proxy server, wherein the global public parameters include a base point of an elliptic curve and a finite field; generating a fifth random number, wherein the fifth random number belongs to the finite field; generating an intermediate parameter according to the fifth random number and the base point; generating a first shared key based on the fifth random number and the request parameter; Generate first reply information using the second challenge value, the first shared key, and the intermediate parameter; Generate a second public key of the edge gateway according to the second registration reply information; Generate a second reply message according to the second public key, the second implicit certificate, the intermediate parameter, the first reply message, the first challenge value and the first shared key; The authentication reply information is composed using the second public key, the second implicit certificate, the intermediate parameter, the first reply information and the second reply information.

9. The method according to claim 1, characterized in that The authentication reply information includes: a second implicit certificate, an intermediate parameter, a second reply information, a first reply information and a second public key of the edge gateway; The power equipment verifies the identity and key of the edge gateway based on the authentication response information, including: Acquire global public parameters sent by the trusted proxy server, wherein the global public parameters include a proxy public key of the trusted proxy server; Calculating identity authentication parameters according to the second implicit certificate and the proxy public key; Determining whether the identity authentication parameter is the same as the second public key; If yes, then calculating a second shared key based on the intermediate parameters; Calculating verification information based on the second public key, the second implicit certificate, the intermediate parameter, the first reply information, the first challenge value, and the second shared key; Determining whether the verification information is the same as the second reply information; If so, it is determined that the edge gateway identity and key verification are successful.

10. The method according to claim 1, characterized in that The authentication reply information includes: intermediate parameters, wherein the second restored challenge value is encrypted, and authentication confirmation information is obtained and sent to the edge gateway, including: Calculating a second shared key based on the intermediate parameters; generating a first session key based on the second restoration challenge value, the first challenge value, and the second shared key; Get the gateway identity information of the gateway device; The first session key, the device identity information, the gateway identity information and the second restoration challenge value are encrypted using an AES encryption function to obtain the authentication confirmation information.

Images