A method and system for collaborative authentication of electrical equipment

Abstract

The present invention provides a method and system for collaborative authentication of electrical equipment, including: the first authentication channel node to which the electrical equipment is connected generates a first random number, the first authentication channel node obtains the first identity identifier of the accessed electrical equipment itself, hashes the first random number and the first identity identifier and further generates a registration request message; each second authentication channel node generates a different second random number, encrypts the second random number and the second identity identifier of the corresponding second authentication channel node and generates a registration feedback message; the first authentication channel node newly generates a third random number, splices the third random number and the encrypted second identity identifier data, encrypts them using the public key of the corresponding second authentication channel node, and sends them to the corresponding second authentication channel node; the corresponding second authentication channel node generates an authentication result message for the electrical equipment for judging whether all authentications are passed.

Description

Technical Field

[0001] The present invention relates to the technical field of electrical equipment authentication, and in particular to an electrical equipment collaborative authentication method and system. Background Art

[0002] Electrical equipment is everywhere in our lives, and different electrical equipment has different networking methods. In the prior art, the networking methods of electrical equipment include the following types: 1. Switch networking, which is connected through the switch's electro-optical signal interface and the corresponding switch or electrical equipment interface, where the connection methods include but are not limited to cascading, port aggregation connection and stacking connection. 2. PLC connection networking, which is a connection networking method that modulates the data signal onto a high-frequency carrier signal and then transmits it through the power line. 3. Fiber-optic communication networking, which uses optical fibers to connect the servers and corresponding electrical equipment inside the data center to form a fiber-optic network. 4. Wireless communication networking, which uses Wi-Fi, Zigbee, Bluetooth and other methods to network electrical equipment.

[0003] The above-mentioned different types of electrical equipment networking methods all have the problem of separate network access authentication. In other words, different networking methods only need to pass the authentication of the corresponding networking channel to build a systematic electrical equipment authentication method, but each networking channel authentication method cannot cooperate with other channels. For integrated electrical equipment, this will cause certain security risks. For example, during the switch networking authentication process, if there is a Trojan program that illegally tampers with the authentication process and causes the related electrical equipment to pass the illegal authentication, it may cause the corresponding authentication channel electrical equipment to be hijacked but cannot be discovered, because the difficulty of Trojan hijacking a single authentication channel is lower than that of hijacking multiple channels. Summary of the invention

[0004] One of the inventive purposes of the present invention is to provide a method and system for collaborative authentication of electrical equipment. The method and system utilize multi-channel collaborative authentication between electrical equipment and its associated equipment. After the electrical equipment is connected to the network, it is registered respectively through the MAC address of its own equipment and different nodes of multiple channels. After the registration is completed, multi-channel node encryption authentication of the corresponding electrical equipment is performed. If the nodes of each channel are authenticated, an authentication pass message is sent to the channel, otherwise the authentication of the corresponding electrical equipment fails. The multi-channel authentication of the electrical equipment can effectively avoid the electrical equipment safety problems caused by the hijacking of single-channel electrical equipment, thereby effectively improving the safety of the electrical equipment.

[0005] Another inventive object of the present invention is to provide a method and system for collaborative authentication of electrical equipment, wherein the method and system generate corresponding random numbers at the collaborative authentication channel nodes corresponding to each authentication channel, and each authentication channel generates a corresponding first authentication response message using its own different random numbers, authentication results and the public keys corresponding to other authentication channels, and the first authentication response message is sent to other authentication channel nodes. After parsing, each authentication channel node encrypts the previous authentication result, its own new random number and the public key of the next authentication channel to generate a new authentication response message and sends it to the next authentication channel node, until the authentication results of all authentication channels are passed, and then an authentication pass message is sent to the electrical equipment. Since only the authentication result information is transmitted between each channel node, and there is no related device address, private key and other information, the transmission of multi-channel node authentication information in the present invention is safe and reliable.

[0006] Another inventive object of the present invention is to provide a method and system for collaborative authentication of electrical equipment, wherein the method and system confirm the current authentication result at each authentication channel node. If the authentication of the current channel node fails, the encrypted authentication result information will no longer be sent to other authentication channel nodes, and an authentication failure message will be sent to the original authentication channel node, and the original authentication channel node will no longer perform the authentication operation of the corresponding electrical equipment.

[0007] In order to achieve at least one of the above-mentioned invention objects, the present invention further provides an electrical equipment collaborative authentication method, the method comprising:

[0008] The first authentication channel node connected to the electrical device generates a first random number, the first authentication channel node obtains the first identity identifier of the connected electrical device itself, hashes the first random number and the first identity identifier and further generates a registration request message;

[0009] The first authentication channel node sends the first registration request message to all other second authentication channel nodes, each second authentication channel node generates a different second random number, hashes and encrypts the second random number and the second identity of the corresponding second authentication channel node to obtain a registration feedback message, and returns the registration feedback message to the first authentication channel node;

[0010] The first authentication channel node stores the encrypted second identity data in the registration feedback message, and the second authentication channel node stores the encrypted first identity data in the registration request message;

[0011] The first authentication channel node newly generates a third random number, splices the third random number with the encrypted second identity identification data according to a preset rule, encrypts the third random number using the public key of the corresponding second authentication channel node, and sends the third random number to the corresponding second authentication channel node;

[0012] The corresponding second authentication channel node generates an authentication result message of the electrical device, and determines whether the currently connected electrical device has passed the authentication based on the authentication result messages of all the second authentication channel nodes.

[0013] According to one of the preferred embodiments of the present invention, the first authentication channel node and the second authentication channel node are respectively configured with a random number generator, the first random number S1 is generated by the random number generator of the first authentication channel node, and the MAC address of the electrical device connected to the first authentication channel node is obtained as M1 as the first identity identifier, the MAC address of the connected electrical device and the corresponding first random number are encrypted using a hash encryption algorithm to obtain first encrypted information PK1=hash(S1‖M1), and the first encrypted information PK1 is encapsulated into a registration request W1, and the registration request W1 is sent to all other second authentication channel nodes n that need collaborative authentication through the registration request W1, and the other second authentication channel nodes n save the first encrypted information PK1=hash(S1‖M1) in the registration request W1, and each second authentication channel node n generates corresponding registration feedback information R n To the first authentication channel node.

[0014] According to another preferred embodiment of the present invention, the registration feedback information R of each second authentication channel node n n The generation method includes: generating the second random number S2 by a random number generator of the second authentication channel node n, and generating the second random number S2 according to the second random number S2 and the second identity M of the second authentication channel node. n Perform hash encryption to obtain the second encrypted information PK n =hash(S2‖M n ), wherein the second random number S2 of each second authentication channel node n is different, and the second encrypted information PK n =hash(S2‖M n ) is encapsulated into the registration feedback information R of the second authentication channel node n n and sends the registration feedback information to the first authentication channel node, and the first authentication channel node saves the second encrypted information PK n =hash(S2‖M n ) completes the registration of the access device in all second authentication channel nodes n.

[0015] According to another preferred embodiment of the present invention, after completing the registration, the first authentication channel node generates an authentication request F1 for the connected electrical device, wherein the authentication request generation method comprises: obtaining the first encrypted information PK1=hash(S1||M1) and the second encrypted information PK stored by the first authentication channel node n =hash(S2‖M n ), and obtain the URL address of the corresponding second authentication channel node, the first authentication channel node generates a third random number S3, and obtains the public key G of each second authentication channel node n n , the third random number S3, the first authentication channel node saves the first encrypted information PK1 and the second encrypted information PK n Use the public key G corresponding to the second authentication channel node n Encryption is performed to obtain the third encrypted information PK3=G n (S3‖PK1‖PK n ), encapsulates the third encrypted information PK3 and the URL address of the corresponding second authentication channel node into an authentication request message F1, and sends the authentication request message F1 to the corresponding second authentication channel node n for authentication.

[0016] According to another preferred embodiment of the present invention, the authentication method of the second authentication channel node n includes: after the second authentication channel node n obtains the authentication request message F1, the second authentication channel node n stores the private key D n To parse the corresponding third encrypted information PK3=G n (S3‖PK1‖PK n ), obtain the corresponding first encrypted information PK1 and second encrypted information PK n , and the first encrypted information PK1 and the second encrypted information PK parsed from the third encrypted information PK3 n The corresponding second authentication channel node n is compared with the one stored during registration. If they are the same, the authentication is passed. Otherwise, the authentication fails. The corresponding second authentication channel node n generates the corresponding authentication result message F P .

[0017] According to another preferred embodiment of the present invention, if the authentication result message F generated by the second authentication channel node n P If it is a pass message, the authentication result message F P Send it to other second authentication channel nodes n in a certain order until the authentication result message F of all second authentication channel nodes n is received. P When all authentications are passed, an authentication permission message of the corresponding electrical device is sent to the first authentication channel node, and a communication connection is established between the electrical device and the first authentication channel node.

[0018] According to another preferred embodiment of the present invention, if the authentication result message F generated by the second authentication channel node n P If it is a pass message, the authentication result message F P Send it to the host computer. After the host computer obtains the authentication message of each authentication channel node n, it determines the authentication result message F of all authentication channel nodes n. P If all authentications are passed, an authentication permission message is generated by the host computer and sent to the first authentication channel node. The first authentication channel node establishes a communication connection with the corresponding electrical device according to the authentication permission message.

[0019] According to another preferred embodiment of the present invention, the first authentication channel node pre-acquires the URL address of each second authentication channel node n that requires collaborative authentication, and pre-configures the sequential sequence x of the URL address of each second authentication channel node n, encapsulates the sequential sequence x of the URL address of the second authentication channel node n into the authentication request message and sends it to the designated second authentication channel node n, and the designated second authentication channel node n sends authentication result messages to other authentication channel nodes in turn according to the sequential sequence x of the URL address. If one of the second authentication channel nodes fails in authentication, the authentication result message will no longer be sent to other second authentication channel nodes, and the authentication failure message will be directly sent to the corresponding first authentication channel node.

[0020] In order to achieve at least one of the above-mentioned invention purposes, the present invention further provides an electrical equipment collaborative authentication system, which executes the above-mentioned electrical equipment collaborative authentication method.

[0021] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the above-mentioned electrical equipment collaborative authentication method. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 Shown is a flow chart of a collaborative authentication method for electrical equipment according to the present invention. DETAILED DESCRIPTION

[0023] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0024] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the element may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0025] Combination Figure 1 The present invention discloses a method and system for collaborative authentication of electrical equipment, wherein the method mainly comprises the following steps:

[0026] First, it is necessary to determine the types and number of authentication channel nodes participating in collaborative authentication, where the authentication channel node types include but are not limited to switch gateway nodes, PLC control chip nodes, fiber optic communication nodes, wireless communication nodes, etc. The above different types of authentication channel nodes use the same or different communication methods to establish communication connections directly or indirectly.

[0027] The authentication channel node to which the electrical equipment is accessed is defined as the first authentication channel node, wherein the first authentication channel node needs to obtain the identity of the accessed electrical equipment itself, and store the identity of the accessed equipment itself in the first authentication channel node; after the first authentication channel node obtains the identity of the accessed equipment itself, it generates a corresponding random number, generates encryption information based on the identity of the accessed equipment itself and the corresponding random number, and generates a registration request for the first authentication channel node.

[0028] Define other authentication channel nodes participating in collaborative authentication as second authentication channel nodes, the first authentication channel node sends the registration request to the preset type and number of second authentication channel nodes respectively, after the second authentication channel node obtains the registration request, saves the encrypted information in the registration request, and encrypts its own second authentication channel node identity and a new random number, and generates new encrypted information in the second authentication channel node. And generate registration feedback information through the second authentication channel node, wherein the registration feedback information contains the encrypted information corresponding to the second authentication channel node. At this time, the first authentication channel node and the second authentication channel node respectively save the encrypted information from each other, and complete the registration of the corresponding device of the first authentication channel node in all second authentication channel nodes participating in collaborative authentication.

[0029] When the first authentication channel node completes the registration of each second authentication channel node, it further generates an authentication request, wherein the authentication request can be an authentication request automatically generated by the first authentication channel node when completing a task with certain permissions. In other words, the authentication process of the first authentication channel node accessing the device is not a one-time authentication to perform all permission tasks. The first authentication channel node performs multiple authentications on the authentication request of the access device according to the task type. The multiple authentication processes performed according to the task type can effectively avoid the security risks brought about by the access electrical equipment being hijacked by Trojans and other programs in different time periods after the authentication is completed, thereby timely discovering the hijacked electrical equipment information.

[0030] After the first authentication channel node sends the corresponding authentication request to other second authentication channel nodes, each second authentication channel node needs to verify whether the relevant encrypted message in the authentication request is consistent with the encrypted message stored in itself, and generate an authentication result message at the corresponding second authentication channel node, and determine whether it is necessary to generate an authentication permission message based on the authentication result type of the second authentication channel node, and send the authentication permission message to the corresponding first authentication channel node. The first authentication channel node can execute the access permission for the access electrical device or execute the corresponding authority task based on the authentication permission message.

[0031] Specifically, the present invention provides the following specific embodiments to illustrate the specific technical solutions and technical effects of the present invention: define the first authentication channel node as h, the other second authentication channel nodes participating in the collaborative authentication as n, and the electrical equipment connected to the corresponding first authentication channel node h as h y At this time, the electrical device h connected to the first authentication channel node h y The relevant identity M1 is obtained by the relevant processor of the first authentication channel node h; the electrical device h y The relevant identity identifier M1 may include but is not limited to the MAC address of the connected electrical device, and the MAC address of the connected electrical device is used to construct the first encrypted message PK1. The first authentication channel node h and all other second authentication channel nodes n are configured with a random number generator, wherein the random number generator may include but is not limited to a hardware random number generator (HRNG) and a pseudo-random number generator (PRNG), wherein the hardware random number generator uses the physical characteristics of the corresponding device to generate a truly random value, such as a true random value obtained based on the physical thermal noise or photoelectric effect of each authentication channel node hardware device. The pseudo-random number generator (PRNG) can generate a seemingly random sequence of values ​​based on a deterministic algorithm.

[0032] The first authentication channel node h obtains the electrical device h yAfter the relevant identity identifier M1 is obtained, the first random number S1 is generated by using the corresponding random number generator. The first authentication channel node h combines the identity identifier M1 and the first random number S1 and performs hash encryption to obtain the corresponding first encrypted information PK1=hash(S1||M1), and encapsulates the first encrypted information PK1 into a registration request W1. The registration request W1 is sent to all other second authentication channel nodes n that need collaborative authentication through the registration request W1. The other second authentication channel nodes n save the first encrypted information PK1=hash(S1||M1) in the registration request W1, and each second authentication channel node n generates corresponding registration feedback information R n To the first authentication channel node h. It should be noted that in the present invention, the second authentication channel node saves the first encrypted information PK1=hash(S1‖M1) for data comparison in the subsequent authentication process; wherein the first encrypted information PK1 is encapsulated into the registration request W1 and also includes the URL address information of the corresponding second authentication channel node n. In one of the preferred embodiments of the present invention, the first encrypted information PK1 can generate different registration request messages according to the URL address information of different second authentication channel nodes n, which are used to send the registration request messages to the corresponding second authentication channel nodes n respectively. The URL address information of the second authentication channel node n includes the access protocol (Protocol), domain name (Domain Name), port (Port) and path (Path) of different authentication channel nodes.

[0033] When the second authentication channel node n receives the registration request W1 and saves the first encrypted information PK1=hash(S1||M1) of the first authentication channel node, the second authentication channel node n obtains its own second identity M n , wherein the second authentication channel node n has its own second identity M n The MAC address information of the hardware related to the second authentication channel node may be used, but is not limited to the MAC address information. The random number generator of the second authentication channel node n is further used to generate the second random number S2. The random number generator of the second authentication channel node n is ... is used to generate the second random number S2. n Perform hash encryption to obtain the second encrypted information PK n =hash(S2‖M n ), wherein the second random number S2 of each second authentication channel node n is different, and the second encrypted information PK n =hash(S2‖M n ) is encapsulated into the registration feedback information R of the second authentication channel node n nand sends the registration feedback information to the first authentication channel node, and the first authentication channel node saves the second encrypted information PK n =hash(S2‖M n ) completes the registration of the access device in all second authentication channel nodes n. The registration feedback information R of the second authentication channel node n n It also includes the URL address information corresponding to the first authentication channel node.

[0034] Further, after completing the electrical device h connected to the first authentication channel node y After all the second authentication channel nodes assisting in authentication are registered, the following method is further used to perform the authentication process: the first authentication channel node generates an authentication request F1 for the connected electrical device, wherein the authentication request generation method includes: obtaining the first encrypted information PK1=hash(S1‖M1) and the second encrypted information PK stored by the first authentication channel node n =hash(S2‖M n ), and obtain the URL address of the corresponding second authentication channel node, the first authentication channel node generates a third random number S3, and obtains the public key G of each second authentication channel node n n , the third random number S3, the first authentication channel node saves the first encrypted information PK1 and the second encrypted information PK n Use the public key G corresponding to the second authentication channel node n Encryption is performed to obtain the third encrypted information PK3=G n (S3‖PK1‖PK n ), encapsulate the third encrypted information PK3 and the URL address of the corresponding second authentication channel node into an authentication request message F1, and send the authentication request message F1 to the corresponding second authentication channel node n for authentication. Since the third encrypted information adopts the public key G that has been published by the corresponding second authentication channel node n n The encryption operation is performed, so only the private key D corresponding to the second authentication channel node n is n Only then can the third encrypted information be decrypted.

[0035] Since the private key D of the second authentication channel node n Therefore, the third encrypted information PK3 is different according to the public key of the second authentication channel node, and the new third random number is used as the obfuscated encryption element. Therefore, the encrypted information of the authentication request F1 generated by the connected electrical device on different channels is different, which greatly increases the difficulty of the Trojan program to crack the key information on different channels.

[0036] Specifically, the authentication method of the second authentication channel node n includes: after the second authentication channel node n obtains the authentication request message F1, the second authentication channel node n uses the private key D stored in the second authentication channel node n itself to n To parse the corresponding third encrypted information PK3=G n (S3‖PK1‖PK n ), obtain the corresponding first encrypted information PK1 and second encrypted information PK n , and the first encrypted information PK1 and the second encrypted information PK parsed from the third encrypted information PK3 n The corresponding second authentication channel node n is compared with the one stored during registration. If they are the same, the authentication is passed. Otherwise, the authentication fails. The corresponding second authentication channel node n generates the corresponding authentication result message F P When the second authentication channel node n generates the corresponding authentication result message F P If the authentication result is authentication failure, an authentication failure message is sent to the corresponding first authentication channel node, and the corresponding authentication permission is no longer sent to the first authentication channel node. That is to say, in one of the preferred embodiments of the present invention, the authentication result message F of all second authentication channel nodes n is required. P An authentication permission message can be sent to the first authentication channel node h only if the authentication is passed.

[0037] Regarding the method of sending the authentication permission message, the present invention provides two solutions, one is to send it after all authentication results on the sequential chain of all authentication channel nodes have passed; the other is to upload the authentication result to the host computer, and if the host computer determines that the authentication results of all authentication channel nodes are all authenticated, the host computer sends the corresponding authentication permission data. Specifically, it includes the following steps:

[0038] If the authentication result message F generated by the second authentication channel node n P If it is a pass message, the authentication result message F P Send it to the host computer. After the host computer obtains the authentication message of each authentication channel node n, it determines the authentication result message F of all authentication channel nodes n. P If all are authenticated, the host computer generates an authentication permission message and sends it to the first authentication channel node, and the first authentication channel node establishes a communication connection with the corresponding electrical device according to the authentication permission message. The host computer may include but is not limited to a central control system of the electrical device.

[0039] If the authentication result message F generated by the second authentication channel node n P If it is a pass message, the authentication result message F PSend it to other second authentication channel nodes n in a certain order until the authentication result message F of all second authentication channel nodes n is received. P When all authentications are passed, an authentication permission message of the corresponding electrical device is sent to the first authentication channel node, and the electrical device and the first authentication channel node establish a communication connection. Specifically, the first authentication channel node pre-acquires the URL address of each second authentication channel node n that needs to be collaboratively authenticated, and the URL address includes the access protocol (Protocol), domain name (Domain Name), port (Port) and path (Path) of the corresponding second authentication channel node. And pre-configure the sequence sequence x of the URL address of each second authentication channel node n, encapsulate the sequence sequence x of the URL address of the second authentication channel node n into the authentication request message and send it to the designated second authentication channel node n, and the designated second authentication channel node n sends authentication result messages to other authentication channel nodes in turn according to the sequence sequence x of the URL address. If one of the second authentication channel nodes fails in authentication, it will no longer send authentication result messages to other second authentication channel nodes, and directly send authentication failure messages to the corresponding first authentication channel node.

[0040] The embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. The embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the functions defined in the method of the present application are executed. It should be noted that the computer-readable medium described in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of an electrical, magnetic, optical, electromagnetic, infrared segment, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wire segments, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may be of various types, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless segments, wire segments, optical cables, RF, etc., or any suitable combination thereof.

[0041] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0042] Those skilled in the art should understand that the embodiments of the present invention described and shown in the drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be deformed or modified in any way.

Claims

1. A method for collaborative authentication of electrical equipment, characterized in that: The method comprises: The first authentication channel node connected to the electrical device generates a first random number, the first authentication channel node obtains the first identity identifier of the connected electrical device itself, hashes the first random number and the first identity identifier and further generates a registration request message; The first authentication channel node sends the registration request message to all other second authentication channel nodes, each second authentication channel node generates a different second random number, hashes and encrypts the second random number and the second identity of the corresponding second authentication channel node to obtain a registration feedback message, and returns the registration feedback message to the first authentication channel node; The first authentication channel node stores the encrypted second identity data in the registration feedback message, and the second authentication channel node stores the encrypted first identity data in the registration request message; The first authentication channel node newly generates a third random number, splices the third random number with the encrypted second identity identification data according to a preset rule, encrypts the third random number using the public key of the corresponding second authentication channel node, and sends the third random number to the corresponding second authentication channel node; The corresponding second authentication channel node generates an authentication result message of the electrical device, and determines whether the currently connected electrical device has passed the authentication according to the authentication result messages of all the second authentication channel nodes; The first authentication channel node and the second authentication channel node are respectively configured with a random number generator, and the first random number S1 is generated by the random number generator of the first authentication channel node, and the MAC address of the electrical device connected to the first authentication channel node is obtained as M1 as the first identity identifier, and the MAC address of the connected electrical device and the corresponding first random number are encrypted using a hash encryption algorithm to obtain first encrypted information PK1=hash(S1‖M1), and the first encrypted information PK1 is encapsulated into a registration request W1, and the registration request W1 is sent to all other second authentication channel nodes n that need collaborative authentication through the registration request W1, and the other second authentication channel nodes n save the first encrypted information PK1=hash(S1‖M1) in the registration request W1, and each second authentication channel node n generates corresponding registration feedback information R n To the first authentication channel node; The registration feedback information R of each second authentication channel node n n The generation method includes: generating the second random number S2 by a random number generator of the second authentication channel node n, and generating the second random number S2 according to the second random number S2 and the second identity M of the second authentication channel node. n Perform hash encryption to obtain the second encrypted information PK n =hash(S2‖M n ), wherein the second random number S2 of each second authentication channel node n is different, and the second encrypted information PK n =hash(S2‖M n ) is encapsulated into the registration feedback information R of the second authentication channel node n n and sends the registration feedback information to the first authentication channel node, and the first authentication channel node saves the second encrypted information PK n =hash(S2‖M n ) completing the registration of the access device on all second authentication channel nodes n; After registration is completed, the first authentication channel node generates an authentication request F1 for the connected electrical device, wherein the authentication request generation method includes: obtaining the first encrypted information PK1=hash(S1||M1) and the second encrypted information PK stored by the first authentication channel node n =hash(S2‖M n ), and obtain the URL address of the corresponding second authentication channel node, the first authentication channel node generates a third random number S3, and obtains the public key G of each second authentication channel node n n , the third random number S3, the first authentication channel node saves the first encrypted information PK1 and the second encrypted information PK n Use the public key G corresponding to the second authentication channel node n Encryption is performed to obtain the third encrypted information PK3=G n (S3‖PK1‖PK n ), encapsulate the third encrypted information PK3 and the URL address of the corresponding second authentication channel node into an authentication request message F1, and send the authentication request message F1 to the corresponding second authentication channel node n for authentication; The authentication method of the second authentication channel node n includes: after the second authentication channel node n obtains the authentication request message F1, the second authentication channel node n uses the private key D stored in the second authentication channel node n itself to authenticate the authentication request message F1. n To parse the corresponding third encrypted information PK3=G n (S3‖PK1‖PK n ), obtain the corresponding first encrypted information PK1 and second encrypted information PK n , and the first encrypted information PK1 and the second encrypted information PK parsed from the third encrypted information PK3 n The corresponding second authentication channel node n is compared with the one stored during registration. If they are the same, the authentication is passed. Otherwise, the authentication fails. The corresponding second authentication channel node n generates the corresponding authentication result message F P ; If the authentication result message F generated by the second authentication channel node n P If it is a pass message, the authentication result message F P Send it to other second authentication channel nodes n in a certain order until the authentication result message F of all second authentication channel nodes n is received. P When all authentications are passed, an authentication permission message of the corresponding electrical device is sent to the first authentication channel node, and a communication connection is established between the electrical device and the first authentication channel node.

2. The electrical equipment collaborative authentication method according to claim 1, characterized in that: If the authentication result message F generated by the second authentication channel node n P If it is a pass message, the authentication result message F P Send it to the host computer. After the host computer obtains the authentication message of each authentication channel node n, it determines the authentication result message F of all authentication channel nodes n. P If all authentications are passed, an authentication permission message is generated by the host computer and sent to the first authentication channel node. The first authentication channel node establishes a communication connection with the corresponding electrical device according to the authentication permission message.

3. The electrical equipment collaborative authentication method according to claim 1, characterized in that: The first authentication channel node pre-acquires the URL address of each second authentication channel node n that requires collaborative authentication, and pre-configures the sequential sequence x of the URL address of each second authentication channel node n, encapsulates the sequential sequence x of the URL address of the second authentication channel node n into the authentication request message and sends it to the designated second authentication channel node n, and the designated second authentication channel node n sends authentication result messages to other authentication channel nodes in turn according to the sequential sequence x of the URL address. If one of the second authentication channel nodes fails in authentication, it will no longer send authentication result messages to other second authentication channel nodes, and directly send an authentication failure message to the corresponding first authentication channel node.

4. An electrical equipment collaborative authentication system, characterized in that: The system executes an electrical equipment collaborative authentication method as described in any one of claims 1-3.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement an electrical equipment collaborative authentication method as described in any one of claims 1 to 3.

Images