A Multi-Factor Dynamic Identity Authentication Method Based on Chinese Cryptographic Algorithm

Abstract

This invention discloses a multi-factor dynamic identity authentication method based on the national cryptographic algorithm, comprising: generating a public-private key pair and a symmetric key according to the national cryptographic algorithm; performing cryptographic operations on verification factors using the generated key and the SM3 national cryptographic algorithm; in the first authentication stage, the terminal generates a non-repeating random number, combines it with hash and XOR operations to generate a dynamic password, encrypts the dynamic password using a symmetric cryptographic algorithm, and simultaneously encrypts the symmetric key using an asymmetric cryptographic algorithm, sending it along with the encrypted dynamic password to the power distribution gateway for identity authentication; in the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it using the symmetric key, and sends it to the smart terminal for identity authentication. This invention can resist common attacks such as man-in-the-middle attacks, replay attacks, and impersonation attacks, and the method does not require the installation of additional hardware or the issuance of digital certificates, reducing costs and simplifying operation and maintenance.

Description

Technical Field

[0001] This invention relates to the field of power data transmission security technology, and in particular to a multi-factor dynamic identity authentication method based on national cryptographic algorithms. Background Technology

[0002] In recent years, power companies have vigorously promoted the construction of smart grids, and an increasing number of smart power terminals have been connected to the distribution network. However, with the continuous development of computer and communication technologies, and the increasing integration of power grids and information networks, while smart terminals bring advantages such as convenience, speed, and higher efficiency, they also introduce more security risks into the distribution network. Especially in 10kV and below medium and low voltage distribution network automation systems, for remote terminals such as feeders and distribution transformers that lack fiber optic communication capabilities, the use of public wireless communication methods (GPRS, CDMA, TD-SCDMA, etc.) exposes the distribution network to significant risks of external public network attacks, such as illegal eavesdropping, malicious tampering, and identity fraud. Therefore, ensuring the communication security of numerous smart distribution terminals, and thus maintaining the overall security and stability of the distribution network, is extremely important.

[0003] Secure and efficient identity authentication methods are playing an increasingly important role in power distribution networks, serving as the foundation and prerequisite for ensuring secure data transmission between terminals or between terminals and the master station. However, existing identity authentication solutions generally suffer from the following problems: (1) They require additional hardware carriers, such as TPM trusted security chips or USB hardware media, for smart terminals or power distribution master stations. (2) They require CA certification centers to issue corresponding digital certificates to power distribution master stations and all smart terminals, increasing the difficulty of management and maintenance. (3) They are susceptible to malicious attacks such as man-in-the-middle attacks and impersonation attacks, resulting in low authentication security and posing significant security risks to the power distribution network. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a multi-factor dynamic identity authentication method based on national cryptographic algorithms to solve the problems of current methods requiring additional hardware carriers for smart terminals or power distribution stations; requiring CA certification centers to issue corresponding digital certificates for power distribution stations and all smart terminals, which are difficult to manage and maintain; and being susceptible to malicious attacks such as man-in-the-middle attacks and impersonation attacks, resulting in low authentication security.

[0006] To solve the above technical problems,

[0007] This invention provides a multi-factor dynamic identity authentication method based on national cryptographic algorithms, comprising:

[0008] A public-private key pair and a symmetric key are generated based on the national cryptographic algorithm. The generated key and the SM3 national cryptographic algorithm are used to perform cryptographic operations on the verification factors, which include the terminal identity ID, hardware address MAC, and shared password value PW.

[0009] In the first authentication stage, the terminal generates a non-repeating random number, combines it with hash and XOR operations to generate a dynamic password, encrypts the dynamic password using a symmetric cryptography algorithm, and encrypts the symmetric key using an asymmetric cryptography algorithm. The encrypted dynamic password is then sent to the power distribution gateway for identity authentication.

[0010] In the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it with a symmetric key, and sends it to the smart terminal for identity authentication.

[0011] As a preferred embodiment of the multi-factor dynamic identity authentication method based on the national cryptographic algorithm described in this invention, wherein: in the generation of public-private key pairs and symmetric keys according to the national cryptographic algorithm, the national cryptographic algorithm is SM2 and SM4 algorithm.

[0012] As a preferred embodiment of the multi-factor dynamic identity authentication method based on the national cryptographic algorithm described in this invention, the method further includes: in the registration stage before the first authentication, the smart terminal to be registered encrypts the device information using an asymmetric cryptographic algorithm, sends the encrypted registration data to the power distribution gateway, the power distribution gateway decrypts the data and verifies the correctness of the data, and saves the registration data after the verification is successful.

[0013] As a preferred embodiment of the multi-factor dynamic identity authentication method based on the national cryptographic algorithm described in this invention, the step of sending encrypted registration data to the power distribution gateway, and the power distribution gateway decrypting the data and verifying its correctness, specifically includes:

[0014] The power distribution gateway generates a key pair using the SM2 national cryptographic algorithm and stores its public key K. P Send to the terminal, private key K S Store safely;

[0015] The terminal processes its own device hardware address (MAC) and shared password value (PW) using the SM3 national cryptographic algorithm, along with its terminal identity ID. i Use gateway public key K P The encrypted data is encrypted using the SM2 national cryptographic algorithm and then sent to the power distribution gateway for registration.

[0016] After receiving the terminal registration information, the power distribution gateway uses its own private key K S Decrypt based on ID i Verify if the same registered user exists in the list. If not, reply with a registration success message and save the ID. iAnd the corresponding validation factors H(MAC) and H(PW), denoted as H′(MAC) and H′(PW);

[0017] Here, H(x) represents the hash value obtained after performing a hash operation on data x using the SM3 algorithm.

[0018] As a preferred embodiment of the multi-factor dynamic identity authentication method based on national cryptographic algorithms described in this invention, in the first authentication stage, the terminal generates a non-repeating random number, combines it with hash and XOR operations to generate a dynamic password, encrypts the dynamic password using a symmetric cryptographic algorithm, and simultaneously encrypts the symmetric key using an asymmetric cryptographic algorithm. Both the encrypted dynamic password and the encrypted password are then sent to the power distribution gateway for identity authentication. Specifically, this includes...

[0019] The terminal generates a random number R1 and calculates... And H(H(MAC)||R1);

[0020] The SM4 national cryptographic algorithm is invoked to generate a symmetric key K, and the calculation result and ID are encrypted using key K. i And use the gateway's public key to encrypt key K, and send all the encrypted information to the gateway;

[0021] in, The symbol represents the XOR operation, and || represents the concatenation operation.

[0022] As a preferred embodiment of the multi-factor dynamic identity authentication method based on the national cryptographic algorithm described in this invention, the method further includes: in the first authentication, after receiving the encrypted data, the power distribution gateway uses its private key and symmetric key to decrypt it to obtain a dynamic password, finds the corresponding terminal and its stored verification factor based on the dynamic password, and further verifies the dynamic password by combining the verification factor.

[0023] As a preferred embodiment of the multi-factor dynamic identity authentication method based on national cryptographic algorithms described in this invention, in the first authentication stage, after receiving encrypted data, the power distribution gateway decrypts it using its private key and symmetric key to obtain a dynamic password. Based on the dynamic password, it locates the corresponding terminal and its stored verification factors. The dynamic password is then further verified using the verification factors. Specifically, this includes...

[0024] After receiving the encrypted authentication message, the power distribution gateway uses its own private key K S Decryption yields the symmetric key K;

[0025] The data is decrypted using the SM4 algorithm with the symmetric key K.

[0026] Power distribution gateway based on ID i Obtain the corresponding H′(PW) and H′(MAC), and calculate... It also verifies whether H(H(MAC)||R1) and H(H′(MAC)||R′1) are equal. If they are equal, the power distribution gateway passes the terminal authentication.

[0027] As a preferred embodiment of the multi-factor dynamic identity authentication method based on national cryptographic algorithms described in this invention, in the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it using a symmetric key, and sends it to the smart terminal for identity authentication. Specifically, this includes...

[0028] After authenticating the terminal, the power distribution gateway generates a random number R2 and calculates... The data is then encrypted using the SM4 algorithm with key K and sent to the terminal.

[0029] As a preferred embodiment of the multi-factor dynamic identity authentication method based on the national cryptographic algorithm described in this invention, the method further includes: in the second authentication, after the smart terminal receives the encrypted data, it uses a symmetric key to decrypt it to obtain a new dynamic password, verifies the new dynamic password according to the saved local data, and if the verification is correct, it passes the identity authentication of the power distribution gateway.

[0030] As a preferred embodiment of the multi-factor dynamic identity authentication method based on the national cryptographic algorithm described in this invention, in the second authentication, after receiving encrypted data, the smart terminal decrypts it using a symmetric key to obtain a new dynamic password, verifies the new dynamic password based on the stored local data, and if the verification is correct, the identity authentication of the power distribution gateway is passed. Specifically, this includes...

[0031] After receiving the encrypted data, the terminal calls the SM4 algorithm to decrypt the message;

[0032] The terminal calculates based on the stored R1 and H (MAC). It also verifies whether H(H′(MAC)||R2) is equal to H(H(MAC)||R′2). If they are equal, the terminal passes the authentication of the power distribution gateway.

[0033] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention is based on the SM2, SM3, and SM4 national cryptographic algorithms, combined with the terminal identity identifier ID. iThis method utilizes factors such as hardware address (MAC), shared password value (PW), and random numbers to generate dynamic passwords. It offers advantages such as multi-factor authentication, simple authentication methods, and high algorithm security, resisting common malicious attacks on distribution automation systems, including impersonation attacks, replay attacks, and man-in-the-middle attacks. This method eliminates the need for additional hardware on the distribution master station or intelligent terminals, reducing hardware costs, and avoids the difficulties of certificate management and maintenance by eliminating the need for PKI-based digital certificates. Furthermore, user authentication information is further encrypted using XOR and hash operations within the plaintext, effectively resisting key leakage attacks and preventing the leakage of user authentication information during communication. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0035] Figure 1 This is a schematic diagram of the overall process of a multi-factor dynamic identity authentication method based on national cryptographic algorithms according to an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of the registration phase of the dynamic identity authentication method in a multi-factor dynamic identity authentication method based on national cryptographic algorithms according to an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of the authentication stage of the dynamic identity authentication method in the multi-factor dynamic identity authentication method based on the national cryptographic algorithm according to an embodiment of the present invention. Detailed Implementation

[0038] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0039] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0040] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0041] This invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of this invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not adhering to the usual scale. Furthermore, the schematic diagrams are merely examples and should not be construed as limiting the scope of protection of this invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0042] Furthermore, in the description of this invention, it should be noted that the terms "upper," "lower," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used solely for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0043] Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" in this invention should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; similarly, they can refer to mechanical connections, electrical connections, or direct connections, or indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0044] Example 1

[0045] Reference Figure 1 As an embodiment of the present invention, a multi-factor dynamic identity authentication method based on national cryptographic algorithms is provided, comprising:

[0046] S1: Generate a public-private key pair and a symmetric key based on the national cryptographic algorithm. Use the generated key and the SM3 national cryptographic algorithm to perform cryptographic operations on the verification factors. The verification factors include the terminal identity ID, hardware address MAC, and shared password value PW.

[0047] Furthermore, in generating public-private key pairs and symmetric keys based on national cryptographic algorithms, the national cryptographic algorithms are SM2 and SM4.

[0048] S2: During the registration phase before the first authentication, the smart terminal to be registered encrypts the device information using an asymmetric cryptographic algorithm and sends the encrypted registration data to the power distribution gateway. After the power distribution gateway decrypts the data, it verifies the correctness of the data. After successful verification, the registration data is saved.

[0049] Furthermore, the encrypted registration data is sent to the power distribution gateway. After decrypting the data, the power distribution gateway verifies its correctness, specifically including...

[0050] The power distribution gateway generates a key pair using the SM2 national cryptographic algorithm and stores its public key K. P Send to the terminal, private key K S Store safely;

[0051] The terminal processes its own device hardware address (MAC) and shared password value (PW) using the SM3 national cryptographic algorithm, along with its terminal identity ID. i Use gateway public key K P The encrypted data is encrypted using the SM2 national cryptographic algorithm and then sent to the power distribution gateway for registration.

[0052] After receiving the terminal registration information, the power distribution gateway uses its own private key K S Decrypt based on ID i Verify if the same registered user exists in the list. If not, reply with a registration success message and save the ID. i And the corresponding validation factors H(MAC) and H(PW), denoted as H′(MAC) and H′(PW);

[0053] Here, H(x) represents the hash value obtained after performing a hash operation on data x using the SM3 algorithm.

[0054] S3: In the first authentication stage, the terminal generates a non-repeating random number, combines it with hash and XOR operations to generate a dynamic password, encrypts the dynamic password using a symmetric cryptography algorithm, and encrypts the symmetric key using an asymmetric cryptography algorithm. The encrypted dynamic password is then sent to the power distribution gateway for identity authentication.

[0055] Furthermore, the first certification phase specifically includes,

[0056] The terminal generates a random number R1 and calculates... And H(H(MAC)||R1);

[0057] The SM4 national cryptographic algorithm is invoked to generate a symmetric key K, and the calculation result and ID are encrypted using key K. i And use the gateway's public key to encrypt key K, and send all the encrypted information to the gateway;

[0058] in, The symbol represents the XOR operation, and || represents the concatenation operation.

[0059] It should be noted that, as x represents the value obtained by performing a bitwise XOR operation on x and y; x||y represents the value obtained by concatenating x and y in sequence.

[0060] Furthermore, in the first authentication step, after receiving the encrypted data, the power distribution gateway uses its private key and symmetric key to decrypt it and obtain the dynamic password. Based on the dynamic password, it locates the corresponding terminal and its stored verification factor. The dynamic password is then further verified using the verification factor, specifically including…

[0061] After receiving the encrypted authentication message, the power distribution gateway uses its own private key K S Decryption yields the symmetric key K;

[0062] The data is decrypted using the SM4 algorithm with the symmetric key K.

[0063] Power distribution gateway based on ID i Obtain the corresponding H′(PW) and H′(MAC), and calculate... It also verifies whether H(H(MAC)||R1) and H(H′(MAC)||R′1) are equal. If they are equal, the power distribution gateway passes the terminal authentication.

[0064] It should be noted that the first authentication stage mentioned above is either authenticating the terminal's identity or terminating the identity authentication process.

[0065] S4: In the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it with a symmetric key, and sends it to the smart terminal for identity authentication.

[0066] Furthermore, specifically including,

[0067] After authenticating the terminal, the power distribution gateway generates a random number R2 and calculates... The data is then encrypted using the SM4 algorithm with key K and sent to the terminal.

[0068] Furthermore, in the second authentication process, after receiving the encrypted data, the smart terminal uses a symmetric key to decrypt it to obtain a new dynamic password. It then verifies the new dynamic password based on the stored local data. If the password is verified to be correct, the authentication of the power distribution gateway is passed.

[0069] Furthermore, specifically including,

[0070] After receiving the encrypted data, the terminal calls the SM4 algorithm to decrypt the message;

[0071] The terminal calculates based on the stored R1 and H (MAC). It also verifies whether H(H′(MAC)||R2) is equal to H(H(MAC)||R′2). If they are equal, the terminal passes the authentication of the power distribution gateway.

[0072] Example 2

[0073] Reference Figure 2-3 This is an embodiment of the present invention, which provides a practical operation scenario logic for a multi-factor dynamic identity authentication method based on national cryptographic algorithms.

[0074] like Figure 2 The diagram shown illustrates the registration phase between the smart terminal and the power distribution gateway, including:

[0075] The terminal initiates a registration request to the power distribution gateway.

[0076] S101: The power distribution gateway generates a key pair using the SM2 national cryptographic algorithm and stores its public key K. P Send the private key K to the terminal. S Store safely. Note that E in this solution... KP (x) means using the SM2 algorithm via public key K. P The encrypted data D obtained by performing encryption operations on plaintext x KS (x) means using the SM2 algorithm via private key K S The plaintext data obtained after decrypting the ciphertext x.

[0077] S102: The terminal receives the public key K from the power distribution gateway. P Save the data. Process the device's MAC address and shared password value PW using the SM3 national cryptographic algorithm to obtain H(MAC) and H(PW), respectively. Then, combine these with the terminal identification ID. i Use gateway public key K P Encrypted using the SM2 national cryptographic algorithm, we get R = E KP (ID i H(MAC), H(PW)) are sent to the power distribution gateway.

[0078] S103: After receiving R, the power distribution gateway uses its own private key K S Decryption, that is, through D KS (R) Retrieve ID i H(MAC), H(PW), and then based on ID i Verify if the same registered user exists in the list. If not, reply with a registration success message and save the ID. iAnd the corresponding validation factors, that is, H(MAC) and H(PW) are labeled as H′(MAC) and H′(PW) respectively.

[0079] like Figure 3 The diagram shown illustrates the authentication process between the smart terminal and the power distribution gateway, including:

[0080] The terminal or power distribution gateway sends an authentication request message.

[0081] S201: The terminal generates a random number R1 and calculates... And H(H(MAC)||R1). Then the terminal calls the SM4 national cryptographic algorithm and generates a symmetric key K, which is then encrypted and calculated to obtain... Simultaneously, the symmetric key K is encrypted using the SM2 algorithm to obtain E. KP (K), then m, E KP (K) are sent together to the power distribution gateway, where E K (x) means the encrypted data obtained by performing symmetric encryption operation on plaintext x using the SM4 algorithm and symmetric key K.

[0082] S202: After receiving the authentication message, the power distribution gateway first uses its own private key K S Decrypting E KP (K) yields the symmetric key K, i.e., K = D KS (E KP (K)), then use the symmetric key K to decrypt m, i.e., D. K (m), to obtain ID i , H(H(MAC)||R1). The power distribution gateway is based on ID. i Obtain the corresponding H′(PW) and H′(MAC), and calculate Then, it verifies whether H(H(MAC)||R1) and H(H′(MAC)||R′1) are equal. If they are equal, the power distribution gateway passes the terminal authentication; if they are not equal, the authentication process is aborted. The above symbol D... K (m) means the plaintext data obtained after decrypting the ciphertext x using the SM4 algorithm and the symmetric key K.

[0083] S203: The power distribution gateway generates a random number R2 and calculates... And H(H′(MAC)||R2), then encrypted using the SM4 algorithm to obtain Send M to the terminal.

[0084] S204: After receiving M, the terminal then calls the SM4 algorithm to decrypt message M, i.e., D. K (M), obtained And H(H′(MAC)||R2). Then, based on R1 and H(MAC) stored in the terminal, calculate Then, verify whether H(H′(MAC)||R2) is equal to H(H(MAC)||R′2). If they are equal, the terminal passes the authentication of the power distribution gateway; if they are not equal, the authentication process is terminated.

[0085] S205: Terminal Computing The data is sent to the distribution gateway, which then uses the SM4 algorithm and symmetric key K to decrypt it to obtain the desired result. And verify its relationship with If the identities are equal, then two-way authentication is successful, and both parties can conduct secure data communication.

[0086] Example 3

[0087] Referring to Table 1-2, which illustrates one embodiment of the present invention, and in conjunction with the above embodiments, it can be seen that the multi-factor dynamic identity authentication method based on national cryptographic algorithms provided by the present invention does not require additional hardware carriers for the distribution master station or intelligent terminals, thus reducing hardware costs. It also eliminates the need to install PKI-based digital certificates, avoiding difficulties in certificate management and maintenance. Furthermore, the dynamic identity authentication method provided by the present invention has the following theoretical basis regarding security for common malicious attacks on distribution automation systems, such as impersonation attacks, replay attacks, and man-in-the-middle attacks.

[0088] If an attacker wants to impersonate the power distribution master station, they must have the gateway private key K. S Only then can the symmetric key K be obtained to decrypt message m. Even if an attacker can brute-force the data contained in m, without the verification factor H′(PW), they cannot extract the correct random number R′1 from the message, and thus cannot generate the correct verification message M. Even if R′1 is stolen, without H′(MAC), the correct verification message M cannot be generated, therefore the attacker cannot pass the verification of the smart terminal.

[0089] If an attacker wants to impersonate a smart terminal, there is no terminal identification ID. i Without the corresponding MAC address, it is impossible to impersonate a registered end user in the power distribution gateway. Even if an attacker steals the ID... i MAC addresses cannot generate a correct hash H(PW) because they lack a shared hash value H(PW) for the password value PW. Therefore, the power distribution gateway is based on The attacker will calculate an incorrect R′1, making H(H(MAX)||R1)=H(H′(MAX)||R′1) no longer true, thus preventing the attacker from passing the power distribution gateway's verification.

[0090] As can be seen from the implementation process of the two-way authentication phase, when the smart terminal or power distribution gateway sends the authentication message, a random number R1 or R2 is introduced, thus giving the scheme a dynamic verification password. Even if the authentication message is intercepted by an attacker, since it cannot be deciphered and the value of the random number is only modified, the expired fixed message can only be replayed. The correct authentication message is non-repeating data based on the dynamic password, so the smart terminal or power distribution gateway can easily identify malicious attacks. Therefore, the dynamic authentication method provided by this invention can resist replay attacks.

[0091] In the dynamic identity authentication method provided by this invention, the authentication information stored on the terminal or gateway is encrypted and transmitted using a highly secure national cryptographic algorithm, and all communication data in the network is encrypted ciphertext. Therefore, even if an attacker acts as a man-in-the-middle to communicate with both the smart terminal and the power distribution gateway without the knowledge of either party, it is difficult for them to decrypt the plaintext information from the network communication data and correctly reply with the authentication message. Consequently, the attacker cannot obtain the negotiated key between the two parties after identity authentication. Furthermore, the user authentication information in the encrypted plaintext is further encrypted using XOR and hash operations, effectively resisting key leakage attacks and preventing the leakage of user authentication information during communication. Therefore, the dynamic identity authentication method provided by this invention can resist man-in-the-middle attacks.

[0092] Referring to Table 1, an embodiment of the present invention provides a multi-factor dynamic identity authentication method based on the national cryptographic algorithm. To verify its beneficial effects, a comparison of three schemes is provided based on the above-described process.

[0093]

[0094] As shown in Table 1 above, using this invention can avoid installing additional hardware carriers or digital certificates, and it also has the characteristics of resisting malicious attacks such as impersonation attacks, replay attacks, and man-in-the-middle attacks, thus verifying the beneficial effects of this invention.

[0095] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A multi-factor dynamic identity authentication method based on national cryptographic algorithms, characterized in that, include: A public-private key pair and a symmetric key are generated based on the national cryptographic algorithm. The generated key and the SM3 national cryptographic algorithm are used to perform cryptographic operations on the verification factors, which include the terminal identity ID, hardware address MAC, and shared password value PW. In the first authentication stage, the terminal generates a non-repeating random number, combines it with hash and XOR operations to generate a dynamic password, encrypts the dynamic password using a symmetric cryptography algorithm, and encrypts the symmetric key using an asymmetric cryptography algorithm. The encrypted dynamic password is then sent to the power distribution gateway for identity authentication. In the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it with a symmetric key, and sends it to the smart terminal for identity authentication. In the first authentication phase, after receiving the encrypted data, the power distribution gateway decrypts it using its private key and symmetric key to obtain the dynamic password. Based on the dynamic password, it locates the corresponding terminal and its stored verification factor. The dynamic password is then further verified using the verification factor, specifically including… After receiving the encrypted authentication message, the power distribution gateway uses its own private key. Decryption yields the symmetric key ; Using symmetric keys Data is decrypted using the SM4 algorithm; According to the power distribution gateway Obtain the corresponding and Calculations yielded and verify and If they are equal, the power distribution gateway will pass the terminal's identity authentication. In the second authentication phase, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it using a symmetric key, and sends it to the smart terminal for identity authentication. Specifically, this includes... After authenticating the terminal, the power distribution gateway generates a random number. ,calculate and Then, the key is used via the SM4 algorithm. Encrypt the data and send it to the terminal; In the second authentication process, after receiving the encrypted data, the smart terminal decrypts it using a symmetric key to obtain a new dynamic password. It then verifies the new dynamic password against stored local data. If the password is correct, the authentication of the power distribution gateway is successful, specifically including: After receiving the encrypted data, the terminal calls the SM4 algorithm to decrypt the message; The terminal based on the stored and Calculations yielded and verify and If they are equal, the terminal passes the authentication of the power distribution gateway.

2. The multi-factor dynamic identity authentication method based on the national cryptographic algorithm as described in claim 1, characterized in that, In the process of generating public-private key pairs and symmetric keys based on national cryptographic algorithms, the national cryptographic algorithms are SM2 and SM4 algorithms.

3. The multi-factor dynamic identity authentication method based on the national cryptographic algorithm as described in claim 1 or 2, characterized in that, It also includes a registration phase prior to the first authentication, where the smart terminal to be registered encrypts the device information using an asymmetric cryptographic algorithm, sends the encrypted registration data to the power distribution gateway, the power distribution gateway decrypts the data and verifies its correctness, and saves the registration data after successful verification.

4. The multi-factor dynamic identity authentication method based on the national cryptographic algorithm as described in claim 3, characterized in that, The process of sending encrypted registration data to the power distribution gateway, and then the power distribution gateway decrypting the data and verifying its correctness, specifically includes: The power distribution gateway generates a key pair using the SM2 national cryptographic algorithm and then sends its public key to the key pair. Send to the terminal, private key Store safely; The terminal will send its own device hardware address Shared password value The SM3 national cryptographic algorithm is used for calculation and processing, along with the terminal identity identifier. Use gateway public key The encrypted data is encrypted using the SM2 national cryptographic algorithm and then sent to the power distribution gateway for registration. After receiving the terminal registration information, the power distribution gateway uses its own private key. Decrypt according to Verify if the same registered user exists in the list. If not, reply with a registration success message and save. and corresponding verification factors , Marked as , ; in, Indicates data The hash value obtained after performing a hash operation using the SM3 algorithm.

5. The multi-factor dynamic identity authentication method based on the national cryptographic algorithm as described in claim 4, characterized in that, In the first authentication phase, the terminal generates a non-repeating random number, combines it with hash and XOR operations to generate a dynamic password, encrypts the dynamic password using a symmetric cryptography algorithm, and simultaneously encrypts the symmetric key using an asymmetric cryptography algorithm. Both the encrypted dynamic password and the encrypted password are sent to the power distribution gateway for identity authentication. Specifically, this includes... Terminal generates random numbers ,calculate as well as ; Call the SM4 national cryptographic algorithm and generate a symmetric key. Using a key Encryption calculation results and And encrypt the key using the gateway's public key. The encrypted information is sent to the gateway. in, This represents the XOR operation. This indicates a join operation.

6. The multi-factor dynamic identity authentication method based on the national cryptographic algorithm as described in claim 5, characterized in that, It also includes the following: In the first authentication, after the power distribution gateway receives the encrypted data, it uses the private key and symmetric key to decrypt it to obtain the dynamic password. Based on the dynamic password, it finds the corresponding terminal and its stored verification factor, and further verifies the dynamic password by combining the verification factor.

Images