Power grid unified identity authentication method and system based on data intercommunication linkage

Abstract

The invention provides a power grid unified identity authentication method and system based on data intercommunication linkage, and the method comprises the following steps: enabling a plurality of registered users to log in a client, and collecting the login and registration information of the plurality of registered users in real time, the login and registration information, collected in real time, of a plurality of registered users is encrypted and uploaded to a cloud end, and after a visitor logs in a client end, the encrypted information of the cloud end is decrypted in sequence through a visitor public key and a visitor private key; judging whether the registration information obtained by the visitor through the visitor public key and the visitor private key is the user registration information which is stored in the cloud and is not encrypted or not, and then controlling whether the visitor is allowed to log in or not; the face biological information of the visitor is further recognized, and whether the visitor is allowed to log in or not is controlled according to whether face recognition succeeds or not. According to the method, the operation safety and data integrity of the power system are ensured by using digital signature and biological recognition technologies.

Description

Technical Field

[0001] The present invention belongs to the technical field of power grid client login authentication, and in particular relates to a power grid unified identity authentication method and system based on data intercommunication and linkage. Background Art

[0002] In modern power systems, identity authentication and authorization management between devices and users are crucial. Traditional identity authentication methods often have security vulnerabilities and efficiency issues, and are difficult to meet the growing needs of power systems. Therefore, a new identity authentication method is needed to improve the safety, reliability and efficiency of power systems.

[0003] At present, the smart grid dispatching and control system has fully covered all the level 4 security systems within the power grid company, ensuring the safe, stable, economical and environmentally friendly operation of the power grid, providing an indispensable and important technical means for the dispatching of super-large power grids, and has become an important part of the strong smart grid. With the rapid development of new clean energy, the demand for integrated operation and comprehensive monitoring and control of large power grids has become increasingly prominent. In this context, on the basis of fully reusing the achievements of the current power system, the new power system uses advanced and mature technologies such as cloud computing, big data, and artificial intelligence, adopts a new architecture of "physical distribution and logical unification", and provides the functions of various applications to the whole network in the form of services, realizing the new functions of "ubiquitous perception and coordinated control", and fully supporting the safe and reliable operation of the new power system. The human-machine cloud terminal (hereinafter referred to as the "cloud terminal") is the human-machine interaction terminal of the new power system under the new architecture. It accesses the system through the human-machine interaction network, uses the human-machine cloud desktop to download the client of various applications (hereinafter referred to as the "APP client"), and then uses the APP client to call the service, realizing the location-independent and same-view display function, and supporting the dispatching duty personnel to conduct local and remote monitoring and control without distinction. Under the new architecture, the use of cloud terminals for human-machine access faces the following new security challenges.

[0004] 1) Cloud terminals have wide-area access, but lack effective means to verify their authenticity. Under the new architecture, cloud terminals are connected over a wide area based on a human-computer interaction network. Any cloud terminal that can access the human-computer interaction network can access the new power system to access services and data on the entire network. The existing technology lacks methods and systems for authenticating cloud terminal devices during client login, verifying the authenticity of cloud terminals, and blocking the network connection between the cloud terminal and the new power system when the cloud terminal authentication fails, thus preventing illegal cloud terminals from accessing the new power system.

[0005] 2) User identity authentication is not strong enough. Currently, human-machine user login mainly adopts the user password method, which has low security and does not meet the requirements for identity authentication in the fourth level security requirements of Information Protection 2.0. The client login process in the existing technology lacks the relevant methods and systems for combining password technology, biometric recognition technology, etc. to realize multi-factor identity authentication, and then realize high-strength user authentication.

[0006] 3) The service bus lacks a verification mechanism and cannot prevent illegal access to services. Services in the new power system uniformly use the service bus for service access. During the service call process, the service bus does not authenticate the identity of the caller. The service will respond immediately as soon as it receives the request, which poses a risk of illegal calls. The existing technology lacks a method and system for adding a service verification method during the client login process to ensure the security of service access.

[0007] 4) The service bus is transmitted in plain text, which poses a risk of data leakage. When accessing services in the new power system, the communication data is not encrypted. In the client login process in the prior art, there is a lack of methods and systems for encrypting the service bus communication using encryption algorithms to improve the security of service interaction data. Summary of the invention

[0008] In view of the above-mentioned defects, the present invention provides a unified identity authentication method and system for power grid based on data intercommunication and linkage.

[0009] The present invention provides the following technical solution: a unified identity authentication method for a power grid based on data intercommunication and linkage, wherein the method performs dual identification of login information based on a digital signature and facial biometric information, and comprises the following steps:

[0010] S1: Multiple registered users log in to the client, and the login registration information of multiple registered users is collected in real time, and facial biometric information is collected during the first login registration;

[0011] S2: The client encrypts the login registration information of multiple registered users collected in real time in step S1 and uploads it to the cloud. After the visitor logs in to the client, the encrypted information on the cloud is decrypted in sequence using the visitor public key and the visitor private key to determine whether the registration information obtained by the visitor using his own visitor public key and the visitor private key is the user registration information before encryption stored in the cloud. If so, proceed to step S3; otherwise, a login information filling error report is sent to the client, and the visitor is not allowed to log in.

[0012] S3: further identify the visitor's facial biometric information and compare it with the user's facial biometric information that is consistent with the corresponding user registration information after decryption in step S2 stored in the cloud. If the facial information comparison is successful, the visitor's identity authentication is successful and the visitor is allowed to log in to the client. Otherwise, a facial recognition error report continues to be sent to the client and the visitor is not allowed to log in.

[0013] Furthermore, the step S2 includes the following steps:

[0014] S21: Real-time collection of the login registration information m of the i-th registered user i , i = 1, 2, ..., N; construct multiple registered user login registration information hash sequence h (m i ): M→F q , where M is a set of multiple registered user login registration information, M = {m1, m2, ..., m N}, where N is the total number of logged-in registered users; F q is the hash sequence information matrix of multiplication order q related to the login information of the i-th registered user; q≠1;

[0015] S22: The client uses the cloud public key to encrypt the login information of the i-th user to generate ciphertext information α i , in, is the hash sequence information matrix F q The conjugate matrix of is the matrix obtained by taking the conjugate of each element in the hash sequence information matrix;

[0016] S23: Select an arbitrary or non-repeated random value k that is used only once, and construct a hash sequence information matrix F of multiplication order p related to the login information of the i-th registered user p The calculation formula of the public key r(k) of any ciphertext information β and the hash sequence information matrix F of multiplication order q related to the login information of the i-th registered user q The encrypted conjugate matrix of any ciphertext information α i The private key s(k, m i )Calculation formula:

[0017]

[0018]

[0019] β q =1,β∈F p ;

[0020] in, is the q-order upward integer function of the independent variable, The calculation result is in the range of [1, q-1], 0<q<1; For β k The calculation result of is rounded up to pth order, 0<p<1, p≠q, p and q are both prime numbers; for the i-th registered user login registration information m i Encryption is performed to form a key pair (r(k), s(k, m i ))Transfer to the cloud;

[0021] S24: The digital signature (r(k), s(k, m) uploaded by the cloud to the client i )) and the ciphertext information α obtained by encrypting the i-th user login information i To store;

[0022] S25: When the jth visitor logs in through the client, the visitor's public key is used to hash the hash sequence information matrix F q Decrypt each element in the conjugate matrix of to obtain the decrypted information set T = {t1, t2, ..., t j ,...t N}, where t j is the ciphertext information corresponding to the login information of the i-th registered user α i The jth decrypted information, j = 1, 2, ... N; i does not necessarily have to be equal to j, s -1 (k,m i ) is the private key s(k, m i ) is the inverse function of

[0023] S26: Use the visitor's private key to decrypt the jth information t j Decrypt and get the registration information u of the jth visitor j :

[0024] u j =[t j (r(k)β -q ) p-1 ] k-1 ;

[0025] S27: Construct a decryption error limiting threshold calculation matrix Thr related to N decryption information and q and l:

[0026] Wherein, l is the maximum number of digits of the random value k;

[0027] S28: Calculate the determinant of the decryption error limit threshold calculation matrix Thr to obtain the threshold q / (2 l+1), determine the registration information u of the jth visitor j With the i-th user login information m i Is the error between the N decrypted information within the threshold q / (2 l+1 ), that is, |u j -m i |≤q / (2 l +1 ), if yes, then the jth visitor's registration information u is identified j With the login information m of the i-th user i The same, that is, the j-th visitor is the ith registered user; otherwise, repeat S21-S27.

[0028] Furthermore, the calculation formula for the maximum number of digits 1 of the random value k is as follows:

[0029]

[0030] Furthermore, the S3 step includes the following steps:

[0031] S31: The client collects real-time facial photos of multiple registered users through a camera, and forms facial biometric information data f(x) in the physical coordinate system of the image for the real-time facial photo of the i-th registered user in the user facial biometric information that is consistent with the corresponding user registration information after decryption in step S2 stored in the cloud. i ,y i ); x i is the horizontal coordinate of the facial biometric information of the i-th registered user in the physical coordinate system of the image, x i =0,1,2,...,X-1;X≠1;y i is the vertical coordinate of the facial biometric information of the i-th registered user in the physical coordinate system of the image, y i =0,1,2,...,Y-1;;Y≠1;i=1,2,...,N;

[0032] S32: The real-time face photo of the i-th registered user collected in step S31 is converted into the image physical coordinate system (x i ,y i ) is converted into facial biometric information data J(∈ i , v i ):

[0033]

[0034] Among them, ∈ i is the horizontal coordinate of the facial biometric information of the i-th registered user in the pixel coordinate system, ∈ i=0,1,...,U-1;U≠1;v i =0,1,...,V-1;V≠1;a(∈ i ) is the pixel coordinate system horizontal coordinate conversion coefficient equation, b(v i ) is the pixel coordinate system ordinate conversion coefficient equation;

[0035] S33: Calculate the Gaussian image texture kernel feature coefficient of the real-time face photo of the i-th registered user converted in step S32 in the pixel coordinate system:

[0036]

[0037] in, is the pixel coordinate kernel feature vector of the i-th registered user, for The Euclidean norm of σ is the variance of the distance between the real-time face photos of N registered users and the origin of the pixel coordinate system in the pixel coordinate system, η is a complex number,

[0038] S34: The Gaussian image texture kernel feature coefficients of the real-time face photos of N registered users in the pixel coordinate system are collected to form a data set and uploaded to the cloud. When the jth visitor logs in to the client, j = 1, 2, .... N, the steps S31-S33 are repeated to obtain the Gaussian image texture kernel feature coefficient Q (∈ j , v j ):

[0039] S35: Construct the facial feature recognition threshold P calculation equation:

[0040]

[0041] S36: Determine whether the facial feature recognition threshold P is less than 0.16. If so, determine that the jth visitor is the ith registered user, that is, the facial information of the jth visitor is successfully matched, the visitor identity authentication is successful, and the visitor is allowed to log in to the client; otherwise, continue to send a facial recognition error report to the client, and do not allow the jth visitor to log in to the client.

[0042] Furthermore, the pixel coordinate system abscissa conversion coefficient equation a(u i )as follows:

[0043]

[0044] The pixel coordinate system ordinate conversion coefficient equation b(vi )as follows:

[0045]

[0046] Furthermore, the pixel coordinate kernel feature vector of the i-th registered user The calculation formula is as follows:

[0047]

[0048] in, is the horizontal axis component of the pixel coordinate kernel feature vector of the i-th registered user in the pixel coordinate system; is the vertical axis component of the pixel coordinate kernel feature vector of the i-th registered user in the pixel coordinate system; μ is the average distance between the real-time face photos of N registered users and the origin of the pixel coordinate system in the pixel coordinate system, θ i0 is the horizontal and vertical coordinate angle of the pixel coordinates of the i-th registered user.

[0049] Furthermore, the horizontal and vertical coordinate angle θ of the pixel coordinates of the i-th registered user is i0 The calculation formula is as follows:

[0050]

[0051] in, is the horizontal axis vector of the real-time face photo of the i-th registered user in the pixel coordinate system, ∈0 is the horizontal coordinate of the origin of the pixel coordinate system; is the vertical axis vector of the real-time face photo of the i registered user in the pixel coordinate system, v0 is the ordinate of the origin of the pixel coordinate system; for and The inner product of for The Euclidean norm of for The Euclidean norm of

[0052] The present invention also provides a unified identity authentication system for a power grid based on data intercommunication and linkage using the above method, the system comprising a cloud for storing user registration data and a client installed in a storage medium of a mobile device, the system also comprising a login information and face information collection module, a digital signature and recognition module and a face recognition module;

[0053] The login information and face information collection module is used for multiple registered users to log in to the client, collect the login registration information of multiple registered users in real time, and collect face biological information when logging in for the first time;

[0054] The digital signature and identification module is used for the client to encrypt the login registration information of multiple registered users collected in real time in step S1 and upload it to the cloud. After the visitor logs in to the client, the encrypted information on the cloud is decrypted in sequence by the visitor public key and the visitor private key, and it is determined whether the registration information obtained by the visitor through the visitor public key and the visitor private key is the user registration information before encryption stored in the cloud. If so, step S3 is performed, otherwise a login information filling error report is sent to the client;

[0055] The face recognition module is used to further identify the visitor's facial biometric information and compare it with the user's facial biometric information that is consistent with the corresponding user registration information after decryption by the digital key recognition module stored in the cloud. If the facial information comparison is successful, the visitor's identity authentication is successful and he is allowed to log in to the client. Otherwise, a face recognition error report will continue to be sent to the client and the visitor will not be allowed to log in.

[0056] The beneficial effects of the present invention are:

[0057] 1. The present invention provides a unified identity authentication method and system for power grids based on data intercommunication and linkage, which is used to achieve safe and efficient identity authentication and authorization management between devices, users and operators in the power system diagram. By using blockchain technology, digital signatures and biometrics, the operational safety and data integrity of the power system are ensured.

[0058] 2. The present invention uses a digital signature and identification module to gradually decrypt the visitor login digital signature of S21-S28 to see if it is consistent with the user registration information stored in the cloud, and then verify the visitor login identity. The user login registration information is gradually encrypted through steps S21-S28 and the digital signature of the visitor public key and the visitor private key can be used to verify the visitor's identity. When the visitor logs in through the client, the visitor signs the information with the private key, and the server verifies it with the corresponding public key. If the signature verification is successful, it means that the information is indeed sent by the claimed user (that is, the registered user of the user login registration information that has been stored in the cloud).

[0059] In addition, digital signatures ensure that the data has not been tampered with during transmission. If the data is modified during transmission, the signature will no longer be valid, and the server can detect this and reject the login request. Digitally signing user login information with a key can prevent man-in-the-middle attacks and other types of network attacks. Because only users (guests) with private keys can generate valid signatures, it increases the difficulty for attackers to forge login requests, thereby improving the security of the power system while simplifying the identity authentication process.

[0060] 3. After the digital signature authentication, the present invention further verifies whether the visitor is the corresponding registered user (i.e., whether he logs in with his own registered account) through facial biometric information. By recording the facial recognition information at each login, a post-audit can be performed, which helps to track and identify any abnormal or suspicious login behavior. Facial recognition, as part of the multi-factor authentication of power grid identity in conjunction with other digital signature verifications, can provide more comprehensive security protection for the data privacy protection of power grid clients, and can effectively prevent anonymous theft of user privacy information or arbitrary tampering with electricity consumption or electricity charges. Enhanced audit capabilities.

[0061] 4. The present invention ensures the operational safety and data integrity of the power system by using digital signature and biometric technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The present invention will be described in more detail below based on embodiments and with reference to the accompanying drawings, wherein:

[0063] Figure 1 A schematic diagram of a flow chart of a unified identity authentication method for a power grid based on data intercommunication and linkage provided by the present invention;

[0064] Figure 2 A schematic diagram of the structure of a unified identity authentication system for a power grid based on data intercommunication and linkage provided by the present invention. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] like Figure 1As shown, it is a flow chart of the unified identity authentication method for power grid based on data intercommunication and linkage provided by the present invention. The unified identity authentication method for power grid based on data intercommunication and linkage provided by the present invention is to perform double recognition of login information when the customer logs in to the client based on digital signature and facial biometric information, such as Figure 1 As shown, the method provided by the present invention comprises the following steps:

[0067] S1: Multiple registered users log in to the client, and the login registration information of multiple registered users is collected in real time, and facial biometric information is collected during the first login registration;

[0068] S2: The client encrypts the login registration information of multiple registered users collected in real time in step S1 and uploads it to the cloud. After the visitor logs in to the client, the encrypted information on the cloud is decrypted in sequence using the visitor public key and the visitor private key to determine whether the registration information (the decrypted visitor information plain text) obtained by the visitor using his own visitor public key and the visitor private key is the user registration information before encryption stored in the cloud (the user information plain text when the user registered). If so, proceed to step S3. Otherwise, a login information filling error report is sent to the client, and the visitor is not allowed to log in.

[0069] S3: Further identify the visitor's facial biometric information and compare it with the user's facial biometric information that is consistent with the corresponding user registration information after decryption in step S2 stored in the cloud. If the facial information comparison is successful, the visitor's identity authentication is successful and he is allowed to log in to the client. Otherwise, a facial recognition error report will continue to be sent to the client and the visitor will not be allowed to log in.

[0070] Identity authentication is the basic credential for users to access the Internet platform. In the Web2.0 era, user identity information needs to be hosted on different Internet platforms in the form of accounts. While traditional Internet platforms bring many conveniences to users, users also face the problem of lack of digital identity autonomy and user data autonomy. On the one hand, the security and privacy of user data hosted on the Internet platform depends on the management level of the platform, and there is a risk of intentional or unintentional leakage of user identity information. On the other hand, the lack of data autonomy will result in the user's control over identity information being passive once the user registers a digital identity on the platform. Therefore, it is necessary to construct an independent key pair encryption and decryption algorithm on the client used in the process of handling online business in the power grid, so as to improve the user's ability to effectively identify the correct identity when logging in again after the first registration, improve the privacy and security of the client, and ensure that the privacy of multiple user registration information stored in the cloud is not leaked.

[0071] Therefore, as a preferred embodiment of the present invention, step S2 includes the following steps:

[0072] S21: Real-time collection of the login registration information m of the i-th registered user i , i = 1, 2, ..., N; construct multiple registered user login registration information hash sequence h (m i ): M→F q , where M is a set of multiple registered user login registration information, M = {m1, m2, ..., m N}, where N is the total number of logged-in registered users; F q is the hash sequence information matrix of multiplication order q related to the login information of the i-th registered user; q≠1;

[0073] S22: The client uses the cloud public key to encrypt the login information of the i-th user to generate ciphertext information α i , in, is the hash sequence information matrix F q The conjugate matrix of is the matrix obtained by taking the conjugate of each element in the hash sequence information matrix;

[0074] S23: Select an arbitrary or non-repeated random value k that is used only once, and construct a hash sequence information matrix F of multiplication order p related to the login information of the i-th registered user p The calculation formula of the public key r(k) of any ciphertext information β and the hash sequence information matrix F of multiplication order q related to the login information of the i-th registered user q The encrypted conjugate matrix of any ciphertext information α i The private key s(k, m i )Calculation formula:

[0075]

[0076]

[0077] β q =1,β∈F p ;

[0078] in, is the q-order upward integer function of the independent variable, The calculation result is in the range of [1, q-1], that is, is the q-order upward integer function of the independent variable x, 0<q<1; For β k The calculation result of is rounded up to pth order, 0<p<1, p≠q, p and q are both prime numbers; for the i-th registered user login registration information m i Encryption is performed to form a key pair (r(k), s(k, m i))Transfer to the cloud;

[0079] S24: The digital signature (r(k), s(k, m) uploaded by the cloud to the client i )) and the ciphertext information α obtained by encrypting the i-th user login information i To store;

[0080] S25: When the jth visitor logs in through the client, the visitor's public key is used to hash the information matrix F q Decrypt each element in the conjugate matrix of to obtain the decrypted information set T = {t1, t2, ..., t j ,...t N}, where t j is the ciphertext information corresponding to the login information of the i-th registered user α i The jth decrypted information, j = 1, 2, ... N; i does not necessarily have to be equal to j, s -1 (k,m i ) is the private key s(k, m i ) is the inverse function of

[0081] S26: Use the visitor's private key to decrypt the jth information t j Decrypt and get the registration information u of the jth visitor j :

[0082] u j =[t j (r(k)β -q ) p-1 ] k-1 ;

[0083] S27: Construct a decryption error limiting threshold calculation matrix Thr associated with N decryption information and q and 1:

[0084] Where l is the maximum number of digits of the random value k;

[0085] S28: Calculate the determinant of the decryption error limit threshold calculation matrix Thr, and obtain the threshold q / (2 l+1 ), determine the registration information u of the jth visitor j With the i-th user login information m i Is the error between the N decrypted information within the threshold q / (2 l+1 ), that is, |u j -m i |≤q / (2 l+1 ), if yes, then the jth visitor's registration information u is identifiedj With the login information m of the i-th user i The same, that is, the j-th visitor is the ith registered user; otherwise, repeat S21-S27.

[0086] The calculation formula for the maximum number of digits l of the random value k is as follows:

[0087]

[0088] The present invention performs registration information filling when the user logs in for the first time, and performs registration information filling for each registered user. i Perform hash operation, h(m i ): M→F q , forming a plurality of registered user login registration information sets M = {m1, m2, ..., m N}, and then further encrypted by the cloud public key, and constructed the public key r(k) for any ciphertext information β and any ciphertext information α through step S23 i The private key s(k, m i ), where the ciphertext information β and the ciphertext information α i is a conjugate relationship, thus forming a key pair (r(k), s(k, m i )) is transmitted to the cloud. The information filled in by any visitor when logging into the client can be gradually decrypted using the visitor's public key and private key, and then compared with the user registration information stored in the cloud. When the jth visitor's registration information u j With the i-th user login information m i The error between the N decrypted messages is the threshold value q / (2 l+1 ), that is, |u j -m i |≤q / (2 l+1 ), the digital signature and recognition module of the unified identity authentication system for power grid based on data intercommunication and linkage provided by the present invention determines that the j-th visitor is the ith registered user, and controls the system to enter the next step of the login verification process of facial biometric information recognition, further improving the privacy protection of user registration information by the system provided by the present invention and preventing visitors from stealing information.

[0089] In the power grid client system, it is very important to prevent unauthorized access. Even after the digital signature is verified, there is a certain possibility that the digital signature is lost or the Trojan virus obtains the key pair required for encryption and decryption. Therefore, after verifying whether the visitor's login information is correct through the digital signature, it is necessary to verify the biological information again, and face recognition can effectively prevent unauthorized personnel from accessing sensitive data and control systems. In addition, face recognition technology can adapt to different environments and conditions, and can maintain a high recognition accuracy even in dim light or changes in user facial expressions. Therefore, as another preferred embodiment of the present invention, the S3 step of the method provided by the present invention includes the following steps:

[0090] S31: The client collects real-time facial photos of multiple registered users through a camera, and forms facial biometric information data f(x) in the physical coordinate system of the image based on the real-time facial photo of the i-th registered user in the user facial biometric information that is consistent with the corresponding user registration information after decryption in step S2 stored in the cloud. i ,y i ); x i is the horizontal coordinate of the facial biometric information of the i-th registered user in the physical coordinate system of the image, x i =0, 1, 2, ..., X-1; X≠1; X is the total number of horizontal coordinates of the facial biometric information of the i-th registered user in the image physical coordinate system; y i is the vertical coordinate of the facial biometric information of the i-th registered user in the physical coordinate system of the image, y i =0, 1, 2, ..., Y-1;; Y≠1; Y is the total number of vertical coordinates of the facial biometric information of the i-th registered user in the image physical coordinate system; i=1, 2, ..., N;

[0091] S32: The real-time face photo of the i-th registered user collected in step S31 is converted into the image physical coordinate system (x i ,y i ) is converted into facial biometric information data J(∈ i , v i ):

[0092]

[0093] Among them, ∈ i is the horizontal coordinate of the facial biometric information of the i-th registered user in the pixel coordinate system, ∈ i =0,1,...,U-1; U≠1; U is the total number of horizontal coordinates of the facial biometric information of the i-th registered user in the pixel coordinate system; v i =0,1,...,V-1; V≠1; V is the total number of vertical coordinates of the facial biometric information of the i-th registered user in the pixel coordinate system; a(∈i ) is the pixel coordinate system horizontal coordinate conversion coefficient equation, b(v i ) is the pixel coordinate system ordinate conversion coefficient equation;

[0094] Pixel coordinate system horizontal coordinate conversion coefficient equation a(u i )as follows:

[0095]

[0096] The pixel coordinate system ordinate conversion coefficient equation b(v i )as follows:

[0097]

[0098] S33: Calculate the Gaussian image texture kernel feature coefficient of the real-time face photo of the i-th registered user converted in step S32 in the pixel coordinate system:

[0099]

[0100] in, is the pixel coordinate kernel feature vector of the i-th registered user, for The Euclidean norm of σ is the variance of the distance between the real-time face photos of N registered users and the origin of the pixel coordinate system in the pixel coordinate system, η is a complex number,

[0101] The pixel coordinate kernel feature vector of the i-th registered user The calculation formula is as follows:

[0102]

[0103] in, is the horizontal axis component of the pixel coordinate kernel feature vector of the i-th registered user in the pixel coordinate system; is the vertical axis component of the pixel coordinate kernel feature vector of the i-th registered user in the pixel coordinate system; μ is the average distance between the real-time face photos of N registered users and the origin of the pixel coordinate system in the pixel coordinate system, θ i0 is the horizontal and vertical coordinate angle of the pixel coordinates of the i-th registered user;

[0104] The horizontal and vertical angle θ of the pixel coordinates of the i-th registered user i0 The calculation formula is as follows:

[0105]

[0106] in, is the horizontal axis vector of the real-time face photo of the i-th registered user in the pixel coordinate system, ∈0 is the horizontal coordinate of the origin of the pixel coordinate system; is the vertical axis vector of the real-time face photo of the i registered user in the pixel coordinate system, v0 is the ordinate of the origin of the pixel coordinate system; for and The inner product of for The Euclidean norm of for The Euclidean norm of

[0107] S34: The Gaussian image texture kernel feature coefficients of the real-time face photos of N registered users in the pixel coordinate system are collected to form a data set and uploaded to the cloud. When the jth visitor logs in to the client, j = 1, 2, .... N, and steps S31-S33 are repeated to obtain the Gaussian image texture kernel feature coefficient Q (∈ j , v j ):

[0108] S35: Construct the facial feature recognition threshold P calculation equation:

[0109]

[0110] S36: Determine whether the facial feature recognition threshold P is less than 0.16. If so, determine that the jth visitor is the ith registered user, that is, the jth visitor's facial information is successfully matched, the visitor's identity authentication is successful, and he is allowed to log in to the client; otherwise, continue to send a facial recognition error report to the client, and do not allow the jth visitor to log in to the client.

[0111] The present invention first obtains the real-time face photo of the camera and the face pixel feature f(x i ,y i ), and the face biometric information data J(∈ i , v i ), several levels of feature extraction and transformation, the low-frequency components obtained after decomposition are further processed using a linear mapping algorithm. The Gaussian image texture kernel feature coefficient Q(∈ i , v i) is extracted, and it is continuously optimized and iterated to build a facial feature recognition threshold P. It is determined whether the iteration is complete, and the optimal decomposition scale is found to maximize the image recognition accuracy, thereby improving the accuracy of face recognition. By recording the face recognition information at each login, a post-audit can be performed to help track and identify any abnormal or suspicious login behavior. Face recognition, as part of the multi-factor authentication of power grid identity with auxiliary digital signatures, is used in combination with other digital signature verifications to provide more comprehensive security protection for the data privacy protection of power grid clients, and can effectively prevent anonymous theft of user privacy information or arbitrary tampering with electricity consumption or electricity charges.

[0112] like Figure 2 As shown, the present invention also provides a unified identity authentication system for a power grid based on data intercommunication and linkage using the above method, the system includes a cloud for storing user registration data and a client installed in a storage medium of a mobile device, characterized in that the system also includes a login information and face information collection module, a digital signature and recognition module, and a face recognition module;

[0113] The login information and face information collection module is used for multiple registered users to log in to the client, collect the login registration information of multiple registered users in real time, and collect facial biometric information when logging in for the first time;

[0114] The digital signature and identification module is used by the client to encrypt the login registration information of multiple registered users collected in real time in step S1 and upload it to the cloud. After the visitor logs in to the client, the encrypted information on the cloud is decrypted in sequence using the visitor public key and the visitor private key to determine whether the registration information (the decrypted visitor information plain text) obtained by the visitor using his own visitor public key and the visitor private key is the user registration information before encryption (the user information plain text when the user registered) stored in the cloud. If so, proceed to step S3, otherwise send a login information filling error report to the client;

[0115] The face recognition module is used to further identify the visitor's facial biometric information and compare it with the user's facial biometric information that is consistent with the corresponding user registration information after decryption by the digital key recognition module stored in the cloud. If the facial information comparison is successful, the visitor's identity authentication is successful and he is allowed to log in to the client. Otherwise, a face recognition error report will continue to be sent to the client and the visitor will not be allowed to log in.

[0116] The present embodiment also provides a computer storage medium, which stores a computer program, and the method described above can be implemented when the processor executes the computer program. Computer-readable media can be considered to be tangible and non-temporary. Non-limiting examples of non-temporary tangible computer-readable media include non-volatile memory circuits (such as flash memory circuits, erasable programmable read-only memory circuits or mask read-only memory circuits), volatile memory circuits (such as static random access memory circuits or dynamic random access memory circuits), magnetic storage media (such as analog or digital tapes or hard drives) and optical storage media (such as CDs, DVDs or Blu-ray discs), etc. The computer program includes processor executable instructions stored on at least one non-temporary tangible computer-readable medium. The computer program may also include or rely on stored data. The computer program may include a basic input / output system (BIOS) that interacts with the hardware of a special-purpose computer, a device driver that interacts with a specific device of a special-purpose computer, one or more operating systems, user applications, background services, background applications, etc.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0118] Although the present invention has been described with reference to preferred embodiments, various modifications may be made thereto and some of the technical processes / components therein may be replaced with equivalents without departing from the scope of the present invention. In particular, the various technical features mentioned in the various embodiments may be combined in any manner as long as there is no structural / methodological conflict. The present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A unified identity authentication method for power grid based on data intercommunication and linkage, the method performs dual identification of login information based on digital signature and facial biometric information, characterized in that: The following steps are involved: S1: Multiple registered users log in to the client, and the login registration information of multiple registered users is collected in real time, and facial biometric information is collected during the first login registration; S2: The client encrypts the login registration information of multiple registered users collected in real time in step S1 and uploads it to the cloud. After the visitor logs in to the client, the encrypted information on the cloud is decrypted in sequence using the visitor public key and the visitor private key to determine whether the registration information obtained by the visitor using his own visitor public key and the visitor private key is the user registration information before encryption stored in the cloud. If so, proceed to step S3; otherwise, a login information filling error report is sent to the client, and the visitor is not allowed to log in. S3: further identify the visitor's facial biometric information and compare it with the user's facial biometric information that is consistent with the corresponding user registration information after decryption in step S2 stored in the cloud. If the facial information comparison is successful, the visitor's identity authentication is successful and the visitor is allowed to log in to the client. Otherwise, a facial recognition error report continues to be sent to the client and the visitor is not allowed to log in.

2. The method for unified identity authentication of power grid based on data intercommunication and linkage according to claim 1 is characterized in that: The S2 step includes the following steps: S21: Real-time collection of the login registration information m of the i-th registered user i , i = 1, 2, ..., N; construct multiple registered user login registration information hash sequence h (m i ): M→F q , where M is a set of multiple registered user login registration information, M = {m1, m2, ..., m N }, where N is the total number of logged-in registered users; F q is the hash sequence information matrix of multiplication order q related to the login information of the i-th registered user; q≠1; S22: The client uses the cloud public key to encrypt the login information of the i-th user to generate ciphertext information α i , in, is the hash sequence information matrix F q The conjugate matrix of is the matrix obtained by taking the conjugate of each element in the hash sequence information matrix; S23: Select an arbitrary or non-repeated random value k that is used only once, and construct a hash sequence information matrix F of multiplication order p related to the login information of the i-th registered user p The calculation formula of the public key r(k) of any ciphertext information β and the hash sequence information matrix F of multiplication order q related to the login information of the i-th registered user q The encrypted conjugate matrix of any ciphertext information α i The private key s(k, m i )Calculation formula: βq=1,β∈ F p; in, is the q-order upward integer function of the independent variable, The calculation result is in the range of [1, q-1], 0 <q<1; For β k The calculation result of is rounded up to pth order, 0<p<1, p≠q, p and q are both prime numbers; for the i-th registered user login registration information m i Encryption is performed to form a key pair (r(k), s(k, m i ))Transfer to the cloud; S24: The digital signature (r(k), s(k, m) uploaded by the cloud to the client i )) and the ciphertext information α obtained by encrypting the i-th user login information i To store; S25: When the jth visitor logs in through the client, the visitor's public key is used to hash the hash sequence information matrix F q Decrypt each element in the conjugate matrix of to obtain the decrypted information set T = {t1, t2, ..., t j ,...t N }, where t j is the ciphertext information corresponding to the login information of the i-th registered user α i The jth decrypted information, j = 1, 2, ... N; i does not necessarily have to be equal to j, s -1 (k,m i ) is the private key s(k, m i ) is the inverse function of S26: Use the visitor's private key to decrypt the jth information t j Decrypt and get the registration information u of the jth visitor j : u j =[t j (r(k)β -q ) p-1 ] k-1 ; S27: Construct a decryption error limiting threshold calculation matrix Thr related to N decryption information and q and l: Wherein, l is the maximum number of digits of the random value k; S28: Calculate the determinant of the decryption error limit threshold calculation matrix Thr to obtain the threshold q / (2 l+1 ), determine the registration information u of the jth visitor j With the i-th user login information m i Is the error between the N decrypted information within the threshold q / (2 l+1 ), that is, |u j -m i |≤q / (2 l+1 ), if yes, then the jth visitor's registration information u is identified j With the login information m of the i-th user i The same, that is, the j-th visitor is the ith registered user; otherwise, repeat S21-S27.

3. The method for unified identity authentication of power grid based on data intercommunication and linkage according to claim 2 is characterized in that: The calculation formula for the maximum number of digits l of the random value k is as follows:

4. The method for unified identity authentication of power grid based on data intercommunication and linkage according to claim 1 is characterized in that: The S3 step includes the following steps: S31: The client collects real-time facial photos of multiple registered users through a camera, and forms facial biometric information data f(x) in the physical coordinate system of the image for the real-time facial photo of the i-th registered user in the user facial biometric information that is consistent with the corresponding user registration information after decryption in step S2 stored in the cloud. i ,y i ); x i is the horizontal coordinate of the facial biometric information of the i-th registered user in the physical coordinate system of the image, x i =0,1,2,...,X-1;X≠1;y i is the vertical coordinate of the facial biometric information of the i-th registered user in the physical coordinate system of the image, y i =0,1,2,...,Y-1;;Y≠1;i=1,2,...,N; S32: The real-time face photo of the i-th registered user collected in step S31 is converted into the image physical coordinate system (x i ,y i ) is converted into facial biometric information data J(∈ i , v i ): Among them, ∈ i is the horizontal coordinate of the facial biometric information of the i-th registered user in the pixel coordinate system, ∈ i =0,1,...,U-1;U≠1;v i =0,1,...,V-1;V≠1;a(∈ i ) is the pixel coordinate system horizontal coordinate conversion coefficient equation, b(v i ) is the pixel coordinate system ordinate conversion coefficient equation; S33: Calculate the Gaussian image texture kernel feature coefficient of the real-time face photo of the i-th registered user converted in step S32 in the pixel coordinate system: in, is the pixel coordinate kernel feature vector of the i-th registered user, for The Euclidean norm of σ is the variance of the distance between the real-time face photos of N registered users and the origin of the pixel coordinate system in the pixel coordinate system, η is a complex number, S34: The Gaussian image texture kernel feature coefficients of the real-time face photos of N registered users in the pixel coordinate system are collected to form a data set and uploaded to the cloud. When the jth visitor logs in to the client, j = 1, 2, .... N, the steps S31-S33 are repeated to obtain the Gaussian image texture kernel feature coefficient Q (∈ j , v j ): S35: Construct the facial feature recognition threshold P calculation equation: S36: Determine whether the facial feature recognition threshold P is less than 0.

16. If so, determine that the jth visitor is the ith registered user, that is, the facial information of the jth visitor is successfully matched, the visitor identity authentication is successful, and the visitor is allowed to log in to the client; otherwise, continue to send a facial recognition error report to the client, and do not allow the jth visitor to log in to the client.

5. The method for unified identity authentication of power grid based on data intercommunication and linkage according to claim 4 is characterized in that: The pixel coordinate system abscissa conversion coefficient equation a(u i )as follows: The pixel coordinate system ordinate conversion coefficient equation b(v i )as follows:

6. The method for unified identity authentication of power grid based on data intercommunication and linkage according to claim 4 is characterized in that: The pixel coordinate kernel feature vector of the i-th registered user The calculation formula is as follows: in, is the horizontal axis component of the pixel coordinate kernel feature vector of the i-th registered user in the pixel coordinate system; is the vertical axis component of the pixel coordinate kernel feature vector of the i-th registered user in the pixel coordinate system; μ is the average distance between the real-time face photos of N registered users and the origin of the pixel coordinate system in the pixel coordinate system, θ i0 is the horizontal and vertical coordinate angle of the pixel coordinates of the i-th registered user.

7. The method for unified identity authentication of power grid based on data intercommunication and linkage according to claim 6 is characterized in that: The horizontal and vertical coordinate angle θ of the pixel coordinates of the i-th registered user i0 The calculation formula is as follows: in, is the horizontal axis vector of the real-time face photo of the i-th registered user in the pixel coordinate system, ∈0 is the horizontal coordinate of the origin of the pixel coordinate system; is the vertical axis vector of the real-time face photo of the i registered user in the pixel coordinate system, v0 is the ordinate of the origin of the pixel coordinate system; for and The inner product of for The Euclidean norm of for The Euclidean norm of 8. A unified identity authentication system for a power grid based on data intercommunication and linkage using the method according to any one of claims 1 to 7, the system comprising a cloud for storing user registration data and a client installed in a storage medium of a mobile device, characterized in that: The system also includes a login information and face information collection module, a digital signature and recognition module, and a face recognition module; The login information and face information collection module is used for multiple registered users to log in to the client, collect the login registration information of multiple registered users in real time, and collect face biological information when logging in for the first time; The digital signature and identification module is used for the client to encrypt the login registration information of multiple registered users collected in real time in step S1 and upload it to the cloud. After the visitor logs in to the client, the encrypted information on the cloud is decrypted in sequence by the visitor public key and the visitor private key, and it is determined whether the registration information obtained by the visitor through the visitor public key and the visitor private key is the user registration information before encryption stored in the cloud. If so, step S3 is performed, otherwise a login information filling error report is sent to the client; The face recognition module is used to further identify the visitor's facial biometric information and compare it with the user's facial biometric information that is consistent with the corresponding user registration information after decryption by the digital key recognition module stored in the cloud. If the facial information comparison is successful, the visitor's identity authentication is successful and he is allowed to log in to the client. Otherwise, a face recognition error report will continue to be sent to the client and the visitor will not be allowed to log in.

Images