Mutual authentication method, system and equipment for intra-domain power internet of things equipment based on lightweight cryptography and medium

Abstract

The invention provides an intra-domain electric power Internet of Things equipment mutual authentication method, system, equipment and medium based on lightweight cryptography, and the method comprises the following steps: 1, setting an intelligent power grid network model diagram which comprises a trusted registration mechanism, a plurality of service providers and a plurality of intelligent electric meters, setting a private key and an identity of a trusted registration mechanism; step 2, in an offline state, registering information corresponding to each service provider and each intelligent electric meter in a trusted registration mechanism; step 3, performing mutual authentication between each service provider and each intelligent electric meter which are registered offline and establishing a session key so as to complete mutual authentication between the intra-domain electric power Internet of Things equipment, and performing information transmission between each service provider and each intelligent electric meter through the established session key; the method has relatively high security, and provides guarantee for subsequent power data secure transmission.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things identity authentication, and relates to a method, system, device and medium for mutual authentication of intra-domain power Internet of Things devices based on lightweight cryptography. Background Art

[0002] The smart grid model can be abstracted into users, service providers (SP) and IoT devices smart meters (SMt Meter). Users are the end users of electricity and may also generate, store and manage energy. Service providers SP are responsible for the distribution and trading of electricity. Smart meters SM are responsible for the detection of electricity usage and consumer pricing. Smart grids are superior to traditional grids in terms of flexible control, efficient operation and convenient use. However, smart meters SM are deployed near consumers, so most people can easily access them, which provides many opportunities for malicious attackers. In addition, due to the large number of smart meters SM, it may be difficult for service providers SP to conduct effective security monitoring and physical protection. In other words, the security of smart grids depends on the security of the communication protocol used when communicating between each sub-module in the grid and the service provider SP, as well as whether identity authentication and information transmission can be performed securely.

[0003] In the smart grid, the Trusted Registration Authority (TA) initializes the system parameters, and then other participants in the system (smart meters SM and service providers SP) must communicate through a private secure channel to obtain some initialization parameters and complete the registration process. After that, the service provider SP and the smart meter SM communicate on a public channel to detect, transmit and control power data. However, when the above communication is carried out on a public channel, attackers have the opportunity to infiltrate the session, thereby compromising the data privacy of entities in the smart grid environment.

[0004] Accordingly, the communication and security vulnerabilities between entities need to be considered and resolved to ensure the communication security of the smart grid. In addition, smart meters SM are usually installed in users' homes, and attackers may crack the smart meters SM and use the credentials stored in their memory to forge their identities. Therefore, the mutual authentication and authentication key exchange between the smart meters SM and the service provider SP must be secure and efficient to ensure the security of users' private data. Summary of the invention

[0005] The purpose of the present invention is to provide a method, system, device and medium for mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography, which solves the defect that the existing method for mutual authentication of power Internet of Things devices within a domain has security risks.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is: The present invention provides a method for mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography, comprising the following steps: Step 1, setting a smart grid network model diagram, the smart grid network model diagram includes a trusted registration agency, multiple service providers and multiple smart meters, wherein a private key and identity of the trusted registration agency are set; Step 2: In an offline state, register the corresponding information of each service provider and each smart meter in a trusted registration agency; In step 3, each service provider and each smart meter that have performed offline registration will perform mutual authentication and establish a session key to complete mutual authentication between power IoT devices in the domain, and each service provider and each smart meter will transmit information using the established session key.

[0007] Preferably, in step 2, in an offline state, the information corresponding to each service provider is registered in a trusted registration agency, and the specific method is: Each service provider initiates a registration request to the trusted registration authority. The trusted registration authority selects a unique real identity from each service provider and obtains the current timestamp T0; Calculate the corresponding pseudo-identity and long-term secret of each service provider based on its real identity and current timestamp T0; Send the obtained pseudo-identity and long-term secret corresponding to each service provider to the corresponding service provider; The shared symmetric key between the trusted registration authority and the service provider and the temporary parameters used to calculate the session key are calculated based on the random number selected by each service provider and the current timestamp T1. and ; Each service provider sends a shared symmetric key between the trusted registration authority and the service provider to the trusted registration authority.

[0008] Preferably, in step 2, in an offline state, the information corresponding to each smart meter is registered in a trusted registration agency, and the specific method is: Each smart meter sends a registration request to the trusted registration agency, which selects a unique real identity for each smart meter and obtains the current timestamp. ; Based on the real identity and current timestamp of each smart meter Calculate its corresponding pseudo-identity and long-term secret; The obtained pseudo identity and long-term secret corresponding to each smart meter are sent to the corresponding smart meter; The shared symmetric key between the trusted registration authority and the smart meter and the temporary parameters used to calculate the session key are calculated based on the random number selected by each smart meter and the current timestamp T2. , , and ; Each smart meter will obtain the shared symmetric key between the trusted registration authority and the smart meter and the temporary parameters used to calculate the session key and Send to a trusted registry

[0009] Preferably, in step 3, mutual authentication is performed between each service provider that has performed offline registration and each corresponding smart meter, and a session key is established. The specific method is: The service provider calculates the temporary parameters used to calculate the session key based on the generated random number, the current timestamp T3, the shared symmetric key between the trusted registration authority and the service provider, the trusted registration authority identity, the service provider pseudo identity, the service provider long-term secret and the smart meter pseudo identity. and and temporary parameters used to verify the identity of the service provider and ; The service provider sends a request authentication message to the trusted registration authority, wherein the request authentication message includes the corresponding smart meter pseudo identity and the temporary parameters used to calculate the session key. and temporary parameters used to verify the identity of the service provider ; The trusted registration authority calculates and verifies the identity parameters of the service provider based on the received authentication request message; The trusted registration authority verifies the identity of the service provider based on the obtained identity parameters of the verification service provider and the temporary parameters used to verify the identity of the service provider in the authentication request message. Perform authentication, wherein if the authentication fails, the authentication process ends; otherwise, the identity of the service provider is verified; The trusted registration authority calculates the temporary parameters used to calculate the session key based on the generated random number R4, the current timestamp T4 obtained, and the shared symmetric key between the trusted registration authority and the service provider. and , core parameters for generating session keys and temporary parameters used to verify the identity of the trusted registration authority and ; The trusted registration authority sends a service provider authentication request message to the smart meter. The service provider authentication request message includes the service provider pseudo identity and the core parameters for generating the session key. , Temporary parameters used to calculate session keys and temporary parameters used to verify the identity of the trusted registration authority ; The smart meter uses the temporary parameters used to calculate the session key , calculate the calibration parameters ; Smart meter based on the calibration parameters Temporary parameters used to verify the identity of a trusted registration authority Perform authentication, where if the authentication fails, the authentication process ends; otherwise, verify the identity of the trusted registration authority; The smart meter uses the temporary parameters used to calculate the session key , and , calculate and obtain the session key used for calculating the communication of the smart meter; The smart meter generates a random number R6, obtains the current timestamp T6, the smart meter long-term secret, the trusted registration agency identity, the service provider pseudo identity, the smart meter pseudo identity, the shared symmetric key between the trusted registration agency and the smart meter, and the temporary parameters used to calculate the session key. , calculate the parameters used to verify the identity of the smart meter , and ; The smart meter sends an authentication message to the trusted registration authority, which includes parameters for verifying the identity of the smart meter. ; The trusted registration agency calculates the parameters for verifying the identity of the smart meter based on the pseudo-identity of the smart meter and the shared symmetric key between the trusted registration agency and the smart meter. ; Trusted registration agencies can verify the identity of smart meters based on the parameters and parameters used to verify the identity of the smart meter Perform authentication, wherein if the authentication fails, the authentication process ends; otherwise, the identity of the smart meter is verified; The trusted registrar uses the temporary parameters used to calculate the session key , a shared symmetric key between the trusted registrar and the smart meter, the identity of the trusted registrar, a shared symmetric key between the trusted registrar and the service provider, a pseudo identity of the service provider, and a long-term secret of the service provider, and the temporary parameters used to calculate the session key , Temporary parameters used to verify the identity of a trusted registration authority , and and core parameters for generating session keys ; The trusted registration authority sends an authentication message to the service provider, which includes the core parameters for generating session keys. , Temporary parameters used to verify the identity of a trusted registration authority and ; The service provider uses the temporary parameters used to calculate the session key , service provider long-term secret, service provider pseudo identity, shared symmetric key between the trusted registrar and the service provider, and the trusted registrar identity, calculate the parameters for verifying the trusted registrar identity ; The service provider verifies the identity of the trusted registration authority based on the parameters and temporary parameters used to verify the identity of the trusted registration authority Perform authentication, where if the authentication fails, the authentication process ends; otherwise, verify the identity of the trusted registration authority; The service provider decrypts and calculates the temporary parameter based on the shared symmetric key between the trusted registration authority and the service provider. ; The service provider calculates the session based on the temporary parameters and temporary parameters , calculate the session key for service provider communication.

[0010] Preferably, the trusted registration authority verifies the identity of the service provider based on the obtained identity parameter of the verification service provider and the temporary parameter used to verify the identity of the service provider in the authentication request message. To authenticate, the specific method is: The identity parameter of the verification service provider is split symmetrically on the left and right, the two variables obtained after the split are XORed, and the result is added to the temporary parameter used to verify the identity of the service provider in the authentication request message. Compare them, if the two are equal, the authentication succeeds, otherwise the authentication fails; Smart meter based on the calibration parameters Temporary parameters used to verify the identity of a trusted registration authority To authenticate, the specific method is: Will get the verification parameters Perform a symmetrical split on the left and right, perform an XOR operation on the two variables obtained after the split, and compare the result with the temporary parameter used to verify the identity of the trusted registration agency. Compare them, if the two are equal, the authentication succeeds, otherwise the authentication fails; Trusted registration agencies can verify the identity of smart meters based on the parameters and parameters used to verify the identity of the smart meter To authenticate, the specific method is: The obtained parameters for verifying the identity of the smart meter Perform left-right symmetrical segmentation, perform XOR operation on the two variables obtained after segmentation, and compare the result with the parameter used to verify the identity of the smart meter. Compare them, if the two are equal, the authentication succeeds, otherwise the authentication fails; The service provider verifies the identity of the trusted registration authority based on the parameters and temporary parameters used to verify the identity of the trusted registration authority To authenticate, the specific method is: The obtained parameters for verifying the identity of the trusted registration authority Perform a symmetrical split on the left and right, perform an XOR operation on the two variables obtained after the split, and compare the result with the temporary parameter used to verify the identity of the trusted registration agency. A comparison is performed, where if the two are equal, the authentication succeeds, otherwise the authentication fails.

[0011] A mutual authentication system for power Internet of Things devices within a domain based on lightweight cryptography, comprising: A parameter setting unit, used to set a smart grid network model diagram, the smart grid network model diagram includes a trusted registration authority, multiple service providers and multiple smart meters, wherein a private key and identity of the trusted registration authority are set; A registration unit, used for registering information corresponding to each service provider and each smart meter in a trusted registration agency in an offline state; The authentication unit is used to mutually authenticate each service provider and each smart meter that have performed offline registration and establish a session key to complete mutual authentication between power Internet of Things devices in the domain, and each service provider and each smart meter transmits information using the established session key.

[0012] A computer device comprising: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the optimization method is executed.

[0013] A computer-readable storage medium stores a computer program, and the computer program implements the optimization method when executed by a processor.

[0014] A computer program product comprises a computer program, wherein the computer program implements the optimization method when executed by a processor.

[0015] A chip, a memory having a computer program stored thereon; A processor is used to execute the computer program in the memory to implement the steps of the method.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a method for mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography. By using lightweight cryptography, with the assistance of a trusted registration authority TA, an efficient and secure mutual authentication scheme between smart meters SM and service providers SP within the domain is realized. The method proposed by the present invention fully considers the reality that the computing power of most power Internet of Things devices is limited, and only lightweight cryptographic primitives are used to propose a protocol for mutual authentication of power Internet of Things devices within the domain. The method proposed by the present invention can effectively save the computing overhead of power Internet of Things devices, tolerate the problem of limited computing resources of smart meter SM devices, and at the same time, only low communication and storage overhead is required for smart meters SM and service providers SP to achieve mutual authentication. The method has high security and can resist various network attacks such as eavesdropping attacks, forgery and impersonation attacks, man-in-the-middle attacks, replay attacks, offline guessing attacks, denial of service attacks, and insider privilege attacks, providing guarantee for the subsequent safe transmission of power data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a diagram of the smart grid network model of the present invention; Figure 2 This is a registration sequence diagram of the smart meter SM of the present invention; Figure 3 This is a registration sequence diagram of the service provider SP of the present invention; Figure 4 This is a mutual authentication sequence diagram between the smart meter SM and the service provider SP of the present invention. DETAILED DESCRIPTION

[0018] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0019] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0020] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0021] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0022] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0023] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0024] Example 1 See also Figures 1 to 4This embodiment discloses a method for mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography. By using lightweight cryptography, with the assistance of a trusted registration authority TA, an efficient and secure mutual authentication scheme between the smart meter SM of the Internet of Things device within the domain and the device of the service provider SP is implemented. The method proposed in this embodiment fully considers the reality that the computing power of most power Internet of Things devices is limited. Only lightweight cryptographic primitives are used to propose a protocol for mutual authentication of power Internet of Things devices within the domain, and the semantic security of the protocol is proved by formal and informal methods. The method proposed in this embodiment can effectively save the computing, communication and storage overhead of power Internet of Things devices, and has high security and can resist various network attacks.

[0025] The specific steps include: Step 1: Set up a smart grid network model diagram, which includes a trusted registration authority TA, multiple service providers SP {service provider SP i | i = 1, 2, ..., n} and a series of smart meters SM{smart meters SM j | j = 1, 2, ..., m}, see Figure 1 .

[0026] In this model, each smart meter SM is responsible for collecting sensor data installed in the home, such as real-time power load and power consumption, and providing these data to the corresponding service provider SP. A service provider SP can be connected to multiple smart meters SM, and the trusted registration authority TA is responsible for the registration of all smart meters SM and service providers SP. The registration process is carried out through a secure channel for data transmission. The communication between the smart meter SM and the service provider SP is a public channel, that is, it needs to rely on the established secure session key for data transmission.

[0027] Step 2: During the initialization phase, the trusted registration authority TA generates corresponding initialization parameters for itself and other power IoT devices, smart meters SM, and service providers SP. The steps are as follows: 1) The trusted registration authority TA selects a one-way collision-resistant hash function , the trusted registration authority TA selects a secure symmetric encryption algorithm; 2) The trusted registration authority TA generates the corresponding private key and identity , and then calculate the corresponding pseudo identity ; 3) Finally, the trusted registration authority TA publicly releases system parameters , hash function and symmetric encryption algorithms.

[0028] Step 3, the offline registration process of a single service provider SP, the service provider SP registers its identity information with the trusted registration authority TA, see Figure 2 .

[0029] First, the service provider SP initiates a registration request to the trusted registration authority TA, and the trusted registration authority TA selects a different real identity for the service provider SP , and get the current timestamp T0; Next, the trusted registration authority TA calculates the pseudo-identity for the service provider SP And a long-standing secret :

[0030]

[0031] in, Represents a connector. Represents a hash function.

[0032] The trusted registration authority TA will It is sent to all service providers SP through a secure channel, and the service provider SP receives it and saves it in memory.

[0033] Each service provider SP selects a 128-bit random number R1 and the current timestamp T1, and calculates the shared symmetric key between the trusted registration authority TA and the service provider SP. , and the temporary parameters used to calculate the session key:

[0034]

[0035]

[0036] in, Represents the exclusive OR operator; is the shared symmetric key between the trusted registration authority TA and the service provider SP, and Both are temporary parameters used to calculate the session key.

[0037] The service provider SP will Stored in memory and The shared symmetric key is sent to the trusted registration authority TA through a secure channel, and the trusted registration authority TA stores it in its own database after receiving it.

[0038] Step 4, the smart meter SM registration process, the smart meter SM registers its own information with the trusted registration agency TA in an offline state, see Figure 3 .

[0039] First, for the registration of each smart meter SM, the smart meter SM sends a registration request to the trusted registration authority TA, and the trusted registration authority TA selects a different real identity for each smart meter SM , and get the current timestamp , Next, the trusted registration authority TA calculates the pseudo-identity for each smart meter SM And a long-standing secret

[0040]

[0041]

[0042] Then, the trusted registration authority TA will It is sent to the smart meter SM through a secure channel, and the smart meter SM receives it and saves it in the memory.

[0043] Next, the smart meter SM selects a 128-bit random number R2 and the current timestamp T2 and calculates:

[0044]

[0045]

[0046]

[0047]

[0048] in, , , and Both are temporary parameters used to calculate the session key. It is a shared symmetric key between the trusted registration authority TA and the smart meter SM.

[0049] Next, the smart meter SM will Stored in memory and It is sent to the trusted registration authority TA through a secure channel, and the trusted registration authority TA stores it in its own database.

[0050] Step 5: Based on the offline registration of identity information between the service provider SP and the smart meter SM in steps 2 and 3, in this step, the smart meter SM and the service provider SP mutually authenticate and establish a session key for future secure communication processes, see Figure 4 .

[0051] First, the service provider SP generates a 128-bit random number R3 and obtains the current timestamp T3, and calculates:

[0052]

[0053]

[0054]

[0055] in, and express The result obtained by bilaterally symmetrical segmentation; and is the temporary parameter used to calculate the session key, and It is a temporary parameter used to verify the identity of the service provider SP.

[0056] Then, after the service provider SP has calculated the above variables, the service provider SP sends a message to the trusted registration authority TA , indicating a request for authentication.

[0057] Next, after the trusted registration authority TA receives the authentication request message Msg1 from the service provider SP, it first needs to calculate and verify the identity parameters of the service provider SP:

[0058] Next, After symmetrical left and right division, we get two variables and then perform XOR operation on them. Then we add the result to the value in Msg1. The variables are compared. If they are not equal, the authentication process ends; if they are equal, the identity of the service provider SP is successfully verified and the subsequent authentication process continues.

[0059] Next, the trusted registration authority TA generates a 128-bit random number R4 and obtains the current timestamp T4, and extracts it from the memory. , then calculate:

[0060]

[0061]

[0062]

[0063]

[0064] in, and express The result obtained by bilaterally symmetrical segmentation; and is the temporary parameter used to calculate the session key, To generate the core parameters of the session key, and It is a temporary parameter used to verify the identity of the trusted registration authority TA.

[0065] Then, after the trusted registration agency TA calculates the above results, the trusted registration agency TA sends a message to the smart meter SM , indicating that the service provider SP requests authentication.

[0066] Next, when the smart meter SM receives the authentication message Msg2, it needs to verify the identity of the trusted registration agency TA first. The smart meter SM extracts H1 from the memory and calculates the verification parameter .

[0067] Next, the smart meter SM will After symmetrical left and right division, we get two variables and then perform XOR operation on them. Then we add the result to the value in Msg2. The variables are compared. If they are not equal, the authentication process ends; if they are equal, the identity of the trusted registration authority TA is successfully verified and the subsequent authentication process continues.

[0068] Smart meter SM is extracted from memory , and , then calculate:

[0069]

[0070] in, is the temporary parameter used to calculate the session key, For the symmetric encryption process, It is the session key for smart meter SM communication.

[0071] That is:

[0072] Next, the smart meter SM generates a 128-bit random number R6 and obtains the current timestamp T6, and calculates:

[0073]

[0074]

[0075] in, and express The result obtained after left-right symmetrical segmentation; , and These are all parameters for verifying the identity of the smart meter SM.

[0076] Next, the smart meter SM sends an authentication message to the trusted registration authority TA .

[0077] After the trusted registration agency TA receives the authentication message Msg3 from the smart meter SM, the trusted registration agency TA needs to confirm the identity of the smart meter SM first. The trusted registration agency TA obtains the authentication message Msg3 from the memory. as well as , and then calculate the parameters for verifying the identity of the smart meter SM:

[0078] Then, the trusted registration authority TA will After symmetrical left and right division, we get two variables and then perform XOR operation on them. Then we add the result to the value in Msg3. The variables are compared. If they are not equal, the authentication process ends; if they are equal, the identity of the smart meter SM is successfully verified and the subsequent authentication process continues.

[0079] The trusted registration authority TA extracts variables such as B3 and A4 from the database and then calculates:

[0080]

[0081]

[0082]

[0083]

[0084] in, and express The result obtained after left-right symmetrical segmentation; is the temporary parameter used to calculate the session key, For the symmetric decryption process, To generate the core parameters of the session key, , and It is a temporary parameter used to verify the identity of the trusted registration authority TA.

[0085] After the trusted registration authority TA calculates the above variables, the trusted registration authority TA sends an authentication message to the service provider SP. , let the service provider SP generate a session key.

[0086] After the service provider SP receives the authentication message Msg4, it calculates the parameters for verifying the identity of the trusted registration authority TA:

[0087] The service provider SP will After symmetrical left and right division, the two variables are XORed and then the result is added to the value in Msg4. The variables are compared. If they are not equal, the authentication process ends; if they are equal, the identity of the trusted registration authority TA is successfully verified and the subsequent authentication process continues.

[0088] The service provider SP uses a shared key Decryption calculates temporary parameters:

[0089] Next, the service provider SP extracts A1 from the memory and calculates the session key:

[0090] Right now:

[0091] When the service provider SP also calculates the session key, the smart meter SM and the service provider SP subsequently transmit information through the session key.

[0092] Example 2 This embodiment provides a mutual authentication system for power Internet of Things devices within a domain based on lightweight cryptography, which is characterized by including: A parameter setting unit, used to set a smart grid network model diagram, the smart grid network model diagram includes a trusted registration authority, multiple service providers and multiple smart meters, wherein a private key and identity of the trusted registration authority are set; A registration unit, used for registering information corresponding to each service provider and each smart meter in a trusted registration agency in an offline state; The authentication unit is used to mutually authenticate each service provider and each smart meter that have performed offline registration and establish a session key to complete mutual authentication between power Internet of Things devices in the domain, and each service provider and each smart meter transmits information using the established session key.

[0093] Example 3 This embodiment 3 provides a computer device, including: a memory for storing a computer program; and a processor for implementing the steps of a computer method when executing the computer program.

[0094] When the processor executes the computer program, the steps of the above-mentioned computer method are implemented, or when the processor executes the computer program, the functions of each module in the above-mentioned system are implemented. Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing preset functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0095] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above are examples of computer devices and do not constitute a limitation on computer devices. The computer device may include more components than the above, or a combination of certain components, or different components. For example, the computer device may also include input and output devices, network access devices, buses, etc.

[0096] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

[0097] The memory may be used to store the computer programs and / or modules, and the processor implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory.

[0098] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0099] Example 4 This embodiment 4 also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the optimization method are implemented.

[0100] If the module / unit integrated in the computer system is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0101] Based on such understanding, the present invention implements all or part of the processes in the above optimization method, and can also be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above computer method can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or preset intermediate form, etc.

[0102] The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0103] It should be noted that the content contained in the computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable storage media do not include electrical carrier signals and telecommunication signals.

[0104] Example 5 This embodiment 5 provides a computer product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; the processor of the computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device can execute the method in embodiment 1, which will not be repeated here.

[0105] It should be noted that a person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods.

[0106] Example 6 This embodiment provides a chip.

[0107] The terminal device is a chip, and the chip of this embodiment includes a processor, which may be one or more, and a memory for storing a computer program executable by the processor. The computer program stored in the memory may include one or more modules, each corresponding to a set of instructions. In addition, the processor may be configured to execute the computer program to perform the method described in embodiment 1.

[0108] In addition, the chip may also include a power supply component and a communication component, wherein the power supply component may be configured to perform power management of the chip, and the communication component may be configured to implement communication of the chip, for example, wired or wireless communication. In addition, the chip may also include an input / output (I / O) interface. The chip may operate based on an operating system stored in the memory.

[0109] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography, characterized in that: The following steps are involved: Step 1, setting a smart grid network model diagram, the smart grid network model diagram includes a trusted registration agency, multiple service providers and multiple smart meters, wherein a private key and identity of the trusted registration agency are set; Step 2: In an offline state, register the corresponding information of each service provider and each smart meter in a trusted registration agency; In step 3, each service provider and each smart meter that have performed offline registration will perform mutual authentication and establish a session key to complete mutual authentication between power IoT devices in the domain, and each service provider and each smart meter will transmit information using the established session key.

2. According to the method of mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography according to claim 1, it is characterized in that: In step 2, in an offline state, the information corresponding to each service provider is registered in a trusted registration agency. The specific method is: Each service provider initiates a registration request to the trusted registration authority. The trusted registration authority selects a unique real identity from each service provider and obtains the current timestamp T0; Calculate the corresponding pseudo-identity and long-term secret of each service provider based on its real identity and current timestamp T0; Send the obtained pseudo-identity and long-term secret corresponding to each service provider to the corresponding service provider; The shared symmetric key between the trusted registration authority and the service provider and the temporary parameters used to calculate the session key are calculated based on the random number selected by each service provider and the current timestamp T1. and ; Each service provider sends a shared symmetric key between the trusted registration authority and the service provider to the trusted registration authority.

3. According to the method of mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography according to claim 1, it is characterized in that: In step 2, in an offline state, the information corresponding to each smart meter is registered in a trusted registration agency. The specific method is: Each smart meter sends a registration request to the trusted registration agency, which selects a unique real identity for each smart meter and obtains the current timestamp. ; Based on the real identity and current timestamp of each smart meter Calculate its corresponding pseudo-identity and long-term secret; The obtained pseudo identity and long-term secret corresponding to each smart meter are sent to the corresponding smart meter; The shared symmetric key between the trusted registration authority and the smart meter and the temporary parameters used to calculate the session key are calculated based on the random number selected by each smart meter and the current timestamp T2. , , and ; Each smart meter will obtain the shared symmetric key between the trusted registration authority and the smart meter and the temporary parameters used to calculate the session key and Sent to a trusted registration authority.

4. According to the method of mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography according to claim 1, it is characterized in that: In step 3, each offline registered service provider and each corresponding smart meter are mutually authenticated and a session key is established. The specific method is: The service provider calculates the temporary parameters used to calculate the session key based on the generated random number, the current timestamp T3, the shared symmetric key between the trusted registration authority and the service provider, the trusted registration authority identity, the service provider pseudo identity, the service provider long-term secret and the smart meter pseudo identity. and and temporary parameters used to verify the identity of the service provider and ; The service provider sends a request authentication message to the trusted registration authority, wherein the request authentication message includes the corresponding smart meter pseudo identity and the temporary parameters used to calculate the session key. and temporary parameters used to verify the identity of the service provider ; The trusted registration authority calculates and verifies the identity parameters of the service provider based on the received authentication request message; The trusted registration authority verifies the identity of the service provider based on the obtained identity parameters of the verification service provider and the temporary parameters used to verify the identity of the service provider in the authentication request message. Perform authentication, wherein if the authentication fails, the authentication process ends; otherwise, the identity of the service provider is verified; The trusted registration authority calculates the temporary parameters used to calculate the session key based on the generated random number R4, the current timestamp T4 obtained, and the shared symmetric key between the trusted registration authority and the service provider. and , core parameters for generating session keys and temporary parameters used to verify the identity of the trusted registration authority and ; The trusted registration authority sends a service provider authentication request message to the smart meter. The service provider authentication request message includes the service provider pseudo identity and the core parameters for generating the session key. , Temporary parameters used to calculate session keys and temporary parameters used to verify the identity of the trusted registration authority ; The smart meter uses the temporary parameters used to calculate the session key , calculate the calibration parameters ; Smart meter based on the calibration parameters Temporary parameters used to verify the identity of a trusted registration authority Perform authentication, where if the authentication fails, the authentication process ends; otherwise, verify the identity of the trusted registration authority; The smart meter uses the temporary parameters used to calculate the session key , and , calculate and obtain the session key used for calculating the communication of the smart meter; The smart meter generates a random number R6, obtains the current timestamp T6, the smart meter long-term secret, the trusted registration agency identity, the service provider pseudo identity, the smart meter pseudo identity, the shared symmetric key between the trusted registration agency and the smart meter, and the temporary parameters used to calculate the session key. , calculate the parameters used to verify the identity of the smart meter , and ; The smart meter sends an authentication message to the trusted registration authority, which includes parameters for verifying the identity of the smart meter. ; The trusted registration agency calculates the parameters for verifying the identity of the smart meter based on the pseudo-identity of the smart meter and the shared symmetric key between the trusted registration agency and the smart meter. ; Trusted registration agencies can verify the identity of smart meters based on the parameters and parameters used to verify the identity of the smart meter Perform authentication, wherein if the authentication fails, the authentication process ends; otherwise, the identity of the smart meter is verified; The trusted registrar uses the temporary parameters used to calculate the session key , a shared symmetric key between the trusted registrar and the smart meter, the identity of the trusted registrar, a shared symmetric key between the trusted registrar and the service provider, a pseudo identity of the service provider, and a long-term secret of the service provider, and the temporary parameters used to calculate the session key , Temporary parameters used to verify the identity of a trusted registration authority , and and core parameters for generating session keys ; The trusted registration authority sends an authentication message to the service provider, which includes the core parameters for generating session keys. , Temporary parameters used to verify the identity of a trusted registration authority and ; The service provider uses the temporary parameters used to calculate the session key , service provider long-term secret, service provider pseudo identity, shared symmetric key between the trusted registrar and the service provider, and the trusted registrar identity, calculate the parameters for verifying the trusted registrar identity ; The service provider verifies the identity of the trusted registration authority based on the parameters and temporary parameters used to verify the identity of the trusted registration authority Perform authentication, where if the authentication fails, the authentication process ends; otherwise, verify the identity of the trusted registration authority; The service provider decrypts and calculates the temporary parameter based on the shared symmetric key between the trusted registration authority and the service provider. ; The service provider calculates the session based on the temporary parameters and temporary parameters , calculate the session key for service provider communication.

5. According to claim 4, a method for mutual authentication of power Internet of Things devices within a domain based on lightweight cryptography is characterized in that: The trusted registration authority verifies the identity of the service provider based on the obtained identity parameters of the verification service provider and the temporary parameters used to verify the identity of the service provider in the authentication request message. To authenticate, the specific method is: The identity parameter of the verification service provider is split symmetrically on the left and right, the two variables obtained after the split are XORed, and the result is added to the temporary parameter used to verify the identity of the service provider in the authentication request message. Compare them, if the two are equal, the authentication succeeds, otherwise the authentication fails; Smart meter based on the calibration parameters Temporary parameters used to verify the identity of a trusted registration authority To authenticate, the specific method is: Will get the verification parameters Perform a symmetrical split on the left and right, perform an XOR operation on the two variables obtained after the split, and compare the result with the temporary parameter used to verify the identity of the trusted registration agency. Compare them, if the two are equal, the authentication succeeds, otherwise the authentication fails; Trusted registration agencies can verify the identity of smart meters based on the parameters and parameters used to verify the identity of the smart meter To authenticate, the specific method is: The obtained parameters for verifying the identity of the smart meter Perform left-right symmetrical segmentation, perform XOR operation on the two variables obtained after segmentation, and compare the result with the parameter used to verify the identity of the smart meter. Compare them, if the two are equal, the authentication succeeds, otherwise the authentication fails; The service provider verifies the identity of the trusted registration authority based on the parameters and temporary parameters used to verify the identity of the trusted registration authority To authenticate, the specific method is: The obtained parameters for verifying the identity of the trusted registration authority Perform a symmetrical split on the left and right, perform an XOR operation on the two variables obtained after the split, and compare the result with the temporary parameter used to verify the identity of the trusted registration agency. A comparison is performed, where if the two are equal, the authentication succeeds, otherwise the authentication fails.

6. A mutual authentication system for power Internet of Things devices within a domain based on lightweight cryptography, characterized in that: include: A parameter setting unit, used to set a smart grid network model diagram, the smart grid network model diagram includes a trusted registration authority, multiple service providers and multiple smart meters, wherein a private key and identity of the trusted registration authority are set; A registration unit, used for registering information corresponding to each service provider and each smart meter in a trusted registration agency in an offline state; The authentication unit is used to mutually authenticate each service provider and each smart meter that have performed offline registration and establish a session key to complete mutual authentication between power Internet of Things devices in the domain, and each service provider and each smart meter transmits information using the established session key.

7. A computer device, characterized in that: include: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the optimization method according to any one of claims 1 to 5 is executed.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the optimization method according to any one of claims 1 to 5 is implemented.

9. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the optimization method according to any one of claims 1 to 5 is implemented.

10. A chip, characterized in that: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 5.

Images