Distributed power supply service terminal authentication method, system, device, medium and product

Abstract

The invention discloses a distributed power supply service terminal authentication method, system and device, a medium and a product. The method is applied to a distributed power supply service terminal authentication system, the distributed power supply service terminal authentication system comprises at least one terminal, a 5G gateway and an authentication server, and the method comprises the following steps: starting terminal authentication by using a user name and a password, establishing a TLS channel based on a key generation center, and performing challenge response authentication by the terminal and the authentication server. According to the scheme, the terminal identity is authenticated by combining the protected extensible identity authentication protocol with the key generation center, and the scheme does not need to additionally add peripheral equipment, so that the authentication efficiency and security are effectively improved under the condition of not increasing the cost.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of communication security technology, and in particular, to a distributed power supply service terminal authentication method, system, device, medium and product. Background Art

[0002] With the large-scale access of distributed generation (DG) such as photovoltaic and wind power to the power grid, the security and stability of the power grid are facing challenges. These distributed generation are characterized by large numbers and wide distribution. Through the cross-domain integration of 5G and WiFi, the advantages of both can be fully utilized to meet the needs of distributed generation business cluster control for communication networks.

[0003] Currently, non-3GPP networks can be connected to the 5G core network through the Non-3GPP InterWorking Function (N3IWF). The user terminal first connects to an untrusted non-3GPP network, such as Wi-Fi, and then accesses the 5G core network through the N3IWF secure 5G gateway. N3IWF connects to the control plane and user plane functions of the 5G core network through the N2 interface and the N3 interface respectively, enabling the terminal to access the 5G core network from an untrusted non-3GPP network. Faced with the situation where a large number of distributed power service terminals are connected to the 5G+WiFi converged network, how to achieve unified network authentication for these terminals has become a problem that needs to be solved.

[0004] In the cross-domain integration of 5G and non-3GPP networks, two access authentication methods, EAP-AKA and 5G-AKA, are currently supported. However, these two authentication methods rely on SIM cards for identity authentication, involving complex communications and key derivation processes with the authentication center and the home location register. The authentication process is relatively complex and inefficient. At the same time, these two authentication methods also have high requirements for equipment, resulting in low authentication efficiency, poor security and high costs. Summary of the invention

[0005] The present invention provides a distributed power supply service terminal authentication method, system, device, medium and product to solve the problems of low authentication efficiency, poor security and high cost in the existing terminal authentication method.

[0006] According to one aspect of the present invention, a distributed power supply service terminal authentication method is provided, which is applied to a distributed power supply service terminal authentication system, wherein the distributed power supply service terminal authentication system includes at least one terminal, a 5G gateway and an authentication server, and the method includes:

[0007] After receiving the protected extensible authentication protocol PEAP start authentication message sent by the 5G gateway, the terminal sends a PEAP terminal Hello response message to the authentication server through the 5G gateway, wherein the PEAP terminal Hello response message includes at least a random number, an encryption algorithm list, and a compression algorithm;

[0008] The authentication server generates a first message, and signs the first message using a server private key and a terminal public key to obtain a first signed message, and sends the first signed message and a server Hello message to the terminal through the 5G gateway, wherein the server Hello message includes at least a target encryption algorithm and the compression algorithm, the target encryption algorithm is determined based on the encryption algorithm list, the server private key is determined based on the system parameters of the key generation center and the first initial private key, and the terminal public key is determined based on the system parameters;

[0009] The terminal determines that the authentication server is legitimate based on the terminal private key, the server public key and the first secret signed message, generates a second message, signs the second message using the terminal private key and the server public key to obtain a second secret signed message, and sends the second secret signed message to the authentication server, wherein the terminal private key is determined based on the system parameters and the second initial private key, and the server public key is determined based on the system parameters;

[0010] When the authentication server confirms that the terminal is legitimate based on the second secret signed message, the terminal encrypts the pre-master key by using the server public key to obtain an encrypted pre-master key, sends the encrypted pre-master key to the authentication server through the 5G gateway, and calculates the pre-master key and the random number by using the target encryption algorithm to obtain a first session key;

[0011] The authentication server decrypts the encrypted pre-master key using the server private key to obtain the pre-master key, determines the second session key based on the pre-master key and the random number using the target encryption algorithm, and sends a TSL confirmation message to the terminal through the 5G gateway, wherein the TSL confirmation message includes the second session key and a TLS finished message;

[0012] After receiving the TSL confirmation message, the terminal sends a TLSOK message to the authentication server through the 5G gateway to confirm that the TSL channel is successfully established;

[0013] After receiving the TLSOK message, the authentication server generates a first challenge message, encrypts the first challenge message using the second session key, sends the obtained first encrypted challenge message to the terminal, and after receiving the challenge success message sent by the terminal, sends an EAP success message to the terminal to complete the terminal authentication.

[0014] According to another aspect of the present invention, a distributed power supply service terminal authentication system is provided, characterized in that it includes at least one terminal, a 5G gateway and an authentication server, wherein:

[0015] The terminal is configured to send a PEAP terminal Hello response message to the authentication server through the 5G gateway after receiving a Protected Extensible Authentication Protocol (PEAP) start authentication message sent by the 5G gateway, wherein the PEAP terminal Hello response message includes at least a random number, an encryption algorithm list, and a compression algorithm;

[0016] The authentication server is configured to generate a first message, and sign the first message using a server private key and a terminal public key to obtain a first signed message, and send the first signed message and a server Hello message to the terminal through the 5G gateway, wherein the server Hello message includes at least a target encryption algorithm and the compression algorithm, the target encryption algorithm is determined based on the encryption algorithm list, the server private key is determined based on a system parameter of a key generation center and a first initial private key, and the terminal public key is determined based on the system parameter;

[0017] The terminal is used to generate a second message based on the terminal private key, the server public key and the first secret signed message, if it is determined that the authentication server is legitimate, and to sign the second message using the terminal private key and the server public key to obtain a second secret signed message, and to send the second secret signed message to the authentication server, wherein the terminal private key is determined based on the system parameters and the second initial private key, and the server public key is determined based on the system parameters;

[0018] The terminal is configured to, when the authentication server confirms that the terminal is legitimate based on the second secret signed message, encrypt the pre-master key using the server public key to obtain an encrypted pre-master key, send the encrypted pre-master key to the authentication server through the 5G gateway, and calculate the pre-master key and the random number using the target encryption algorithm to obtain a first session key;

[0019] The authentication server is configured to decrypt the encrypted pre-master key using the server private key to obtain the pre-master key, determine the second session key based on the pre-master key and the random number using the target encryption algorithm, and send a TSL confirmation message to the terminal through the 5G gateway, wherein the TSL confirmation message includes the second session key and a TLS finished message;

[0020] The terminal is used to send a TLSOK message to the authentication server through the 5G gateway after receiving the TSL confirmation message to determine that the TSL channel is successfully established;

[0021] The authentication server is used to generate a first challenge message after receiving the TLSOK message, encrypt the first challenge message by using the second session key, send the obtained first encrypted challenge message to the terminal, and after receiving the challenge success message sent by the terminal, send an EAP success message to the terminal to complete the terminal authentication.

[0022] According to another aspect of the present invention, an electronic device is provided, the electronic device being configured as a terminal or an authentication server in a distributed power supply service terminal authentication system, the electronic device comprising:

[0023] at least one processor; and

[0024] a memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the corresponding steps in the distributed power supply service terminal authentication method described in any embodiment of the present invention.

[0026] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the distributed power supply service terminal authentication method described in any embodiment of the present invention when executed.

[0027] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the distributed power supply service terminal authentication method described in any embodiment of the present invention is implemented.

[0028] The technical solution provided by the embodiment of the present invention uses a user name and password to start terminal authentication, establishes a TLS channel based on a key generation center, and authenticates the terminal and the authentication server through challenge response. The terminal identity is authenticated through a protected extensible identity authentication protocol combined with a key generation center. The solution does not require additional peripherals and effectively improves authentication efficiency and security without increasing costs.

[0029] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 This is a flow chart of a distributed power supply service terminal authentication method provided in Embodiment 1 of the present invention;

[0032] Figure 2 It is a schematic diagram of generating a key based on a certificateless signcryption system provided by an embodiment of the present invention;

[0033] Figure 3 It is a schematic diagram of a distributed power supply service terminal authentication process provided by an embodiment of the present invention;

[0034] Figure 4 It is a structural diagram of a distributed power supply service terminal authentication system provided by Embodiment 2 of the present invention;

[0035] Figure 5 It is a structural schematic diagram of an electronic device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] Embodiment 1

[0039] Figure 1 This is a flowchart of a distributed power service terminal authentication method provided in the first embodiment of the present invention. This embodiment is applicable to the case of authenticating a distributed power service terminal. The method can be executed by a distributed power service terminal authentication system. The distributed power service terminal authentication system can be implemented in the form of hardware and / or software. The distributed power service terminal authentication system can be configured in an electronic device. The distributed power service terminal authentication system includes at least one terminal, a 5G gateway, and an authentication server. Figure 1 As shown, the method includes:

[0040] S110. After receiving the protected extensible authentication protocol (PEAP) start authentication message sent by the 5G gateway, the terminal sends a PEAP terminal Hello response message to the authentication server through the 5G gateway, wherein the PEAP terminal Hello response message includes at least a random number, an encryption algorithm list, and a compression algorithm.

[0041] In this embodiment, the Protected Extensible Authentication Protocol (PEAP) is used to securely transmit authentication credentials by creating an encrypted tunnel in a wireless network. The start authentication message is used to start the PEAP authentication process, for example, it can be an EAP-Request / PEAP / Start message. The PEAP Terminal Hello response message is used to indicate to the authentication server that the terminal is ready for identity authentication, for example, it can be an EAP-Response / Client Hello message. Among them, the PEAP Terminal Hello response message includes at least a random number, an encryption algorithm list and a compression algorithm, and can also include a TLS protocol version, a session ID, etc.

[0042] Specifically, after receiving the PEAP authentication start message sent by the 5G gateway, the terminal will generate a PEAP terminal Hello response message, which is used to encapsulate random numbers, a list of encryption algorithms supported by the terminal, TLS protocol version, session ID, and compression algorithm, and send the PEAP terminal Hello response message to the 5G gateway; the 5G gateway will send the received PEAP terminal Hello response message to the authentication server.

[0043] S120. The authentication server generates a first message, and signs the first message using a server private key and a terminal public key to obtain a first signed message, and sends the first signed message and a server Hello message to the terminal through the 5G gateway, wherein the server Hello message includes at least a target encryption algorithm and the compression algorithm, the target encryption algorithm is determined based on the encryption algorithm list, the server private key is determined based on the system parameters of the key generation center and the first initial private key, and the terminal public key is determined based on the system parameters.

[0044] In this embodiment, the first message is used to verify the legitimacy of the authentication server identity. The key generation center is a device responsible for generating and managing keys. In the present invention, the key generation center is deployed on the authentication server. The server Hello message is the first response message sent by the authentication server to the client during the TLS handshake process, which is used to confirm the encryption algorithm and compression algorithm, etc. For example, the server Hello message is a ServerHello message. The server Hello message includes at least a target encryption algorithm and a compression algorithm, wherein the target encryption algorithm is an encryption algorithm selected from the encryption algorithm list.

[0045] Specifically, after the PEAP authentication starts, it is necessary to establish a Transport Layer Security (TLS) channel, and during the establishment process, it is necessary to determine the legitimacy of the authentication server and the terminal. First, the legitimacy of the authentication server is determined. After receiving the PEAP terminal Hello response message, the authentication server will use the system parameters in the key generation center and the first initial private key generated by the key generation center to determine the server private key of the authentication server, and receive the terminal public key sent by the key center. The terminal public key is determined by the terminal based on the system parameters. After obtaining the server private key and the terminal public key, the authentication server will generate a first message, and use the server private key and the terminal public key to sign the first message based on the elliptic curve finite field to obtain a first signed message, and then send the first signed message and the server Hello message to the terminal through the 5G gateway.

[0046] S130. The terminal determines that the authentication server is legitimate based on the terminal private key, the server public key and the first signed message, generates a second message, signs the second message using the terminal private key and the server public key to obtain a second signed message, and sends the second signed message to the authentication server, wherein the terminal private key is determined based on the system parameters and the second initial private key, and the server public key is determined based on the system parameters.

[0047] In this embodiment, the terminal private key is determined by the terminal based on system parameters and the second initial private key, which is generated by the key generation center and sent to the terminal. The server public key is determined by the authentication server based on system parameters and sent to the terminal through the key generation center.

[0048] Specifically, after receiving the first signed message, the terminal uses the terminal private key and the server public key to decrypt the first signed message to obtain a decryption result, and then judges the legitimacy of the authentication server based on the decryption result. If the authentication server is determined to be legitimate, a second message is generated to enable the authentication server to confirm the legitimacy of the terminal. Then, the second message is signed using the terminal private key and the server public key to obtain a second signed message, and the second signed message is sent to the authentication server.

[0049] S140. When the authentication server confirms that the terminal is legitimate based on the second secret signed message, the terminal uses the server public key to encrypt the pre-master key to obtain an encrypted pre-master key, and sends the encrypted pre-master key to the authentication server through the 5G gateway, and uses the target encryption algorithm to calculate the pre-master key and the random number to obtain a first session key.

[0050] In this embodiment, the pre-master key is a temporary key generated during the TLS channel handshake phase, which is used to derive subsequent session keys to ensure communication security. For example, the pre-master key may be PreMasterSceret.

[0051] Specifically, after receiving the second secret signature message, the authentication server will decrypt and sign the second secret signature message, and use the decryption result to determine the legitimacy of the terminal. If the terminal is determined to be legitimate, the authentication server will send a relevant message to the terminal to notify the terminal that the authentication is successful.

[0052] After receiving the relevant message, the terminal will use the server public key to encrypt the pre-master key to obtain the encrypted pre-master key, and send the encrypted pre-master key to the authentication server through the 5G gateway. At the same time, the terminal will calculate the pre-master key and the random number through the target encryption algorithm to obtain the first session key, which will be used for encryption work in subsequent sessions between the terminal and the authentication server.

[0053] S150. The authentication server uses the server private key to decrypt the encrypted pre-master key to obtain the pre-master key, determines the second session key based on the pre-master key and the random number using the target encryption algorithm, and sends a TSL confirmation message to the terminal through the 5G gateway, wherein the TSL confirmation message includes the second session key and the TLS finished message.

[0054] In this embodiment, the TLS finished message is used to confirm that the TLS handshake is completed.

[0055] Specifically, after receiving the encrypted pre-master key, the authentication server uses the server private key to decrypt the encrypted pre-master key to obtain the pre-master key, and then uses the target encryption algorithm to calculate the pre-master key and the random number to obtain the second session key. The second session key and the TLS finished message are encapsulated as a TSL confirmation message, and the TSL confirmation message is encapsulated in the access-challenge of the EAP over RADIUS message and sent to the 5G gateway, which is then sent to the terminal as an EAP-Request message.

[0056] S160. After receiving the TSL confirmation message, the terminal sends a TLSOK message to the authentication server through the 5G gateway to confirm that the TSL channel is successfully established.

[0057] In this embodiment, the TLSOK message is used to indicate that the TLS secure channel has been successfully established. For example, the TLSOK message may be an EAP-Response / TLSOK message.

[0058] Specifically, after receiving the TSL confirmation message, the terminal will send a TLSOK message to the authentication server through the 5G gateway, thereby completing the establishment of the TSL channel.

[0059] S170. After receiving the TLSOK message, the authentication server generates a first challenge message, encrypts the first challenge message using the second session key, sends the obtained first encrypted challenge message to the terminal, and after receiving the challenge success message sent by the terminal, sends an EAP success message to the terminal to complete the terminal authentication.

[0060] In this embodiment, the EAP success message is used to indicate that the terminal authentication is successful. For example, the EAP success message may be an EAP-Success message.

[0061] Specifically, when the TSL channel is successfully established, the two-way authentication between the authentication server and the terminal is performed to ensure the security of the session. After receiving the TLSOK message, the authentication server generates a first challenge message, such as an EAP-Request / EAP-MS-CHAP-V2 challenge message, and encrypts the first challenge message using the second session key, and sends the obtained first encrypted challenge message to the terminal, which then responds to the challenge. After receiving the challenge success message sent by the terminal, the authentication server sends an EAP success message to the terminal to complete the terminal authentication.

[0062] The technical solution provided in the first embodiment of the present invention uses a user name and password to start terminal authentication, establishes a TLS channel based on a key generation center, and authenticates the terminal and the authentication server through challenge response. The terminal identity is authenticated through a protected extensible identity authentication protocol combined with a key generation center. The solution does not require additional peripherals and effectively improves authentication efficiency and security without increasing costs.

[0063] In some embodiments, the terminal determines a first private value based on the system parameters and the identity ID of the terminal, determines a terminal public key based on the system parameters and the first private value, and determines a terminal private key based on the system parameters, the first initial private key and the first private value; the authentication server determines a second private value based on the system parameters and the IP address of the authentication server, determines a server public key based on the system parameters and the second private value, and determines a server private key based on the system parameters, the second initial private key and the second private value.

[0064] Specifically, in the process of establishing the TSL channel, a certificateless signcryption mechanism is introduced, that is, in the present invention, the key generation center is only responsible for generating part of the private key, and the complete private key and the complete public key are generated by the terminal and the authentication server. The generation process is as follows:

[0065] The Key Generation Center (KGC) selects the master key and security parameters as input and outputs system parameters. The KGC independently retains the master key L (not disclosed) and discloses the system parameters.

[0066] Generation of terminal key and terminal public key for the terminal: KGC generates the first initial private key (i.e., partial private key) of the terminal according to the identity ID, master key, and system parameters of the terminal and sends it to the terminal; the terminal uses the identity ID and system parameters to generate a first private value as a long-term private key, which is completely confidential to KGC; the terminal uses the identity ID, the first initial private key, and the first private value to obtain the terminal private key through calculation, and the terminal private key is a complete private key and is not disclosed; the terminal uses the identity ID, system parameters, and the first private value to obtain the terminal public key, which is a complete public key, and notifies the terminal public key to the authentication server through KGC;

[0067] Generation of server key and server public key of the authentication server: KGC generates the second initial private key (i.e., partial private key) of the authentication server according to the IP address, master key, and system parameters of the authentication server; the authentication server generates a second private value using the IP address and system parameters as a long-term private key, which is completely confidential to KGC; the authentication server obtains the authentication server private key by calculation using the IP address, the second initial private key, and the second private value, which is a complete private key and is not disclosed; the authentication server obtains the server public key using the IP address, system parameters, and the second private value, which is a complete public key, and notifies the server public key to the terminal through KGC.

[0068] Through the above technical solution, a certificateless signcryption system is introduced. Compared with the traditional public key cryptography system, it avoids certificate management and key escrow, as well as complex cryptographic operations, reduces the complexity of calculations and the consumption of storage space, improves operational efficiency, and effectively ensures the security and low-latency transmission of distributed power business data.

[0069] For example, the sending end is a terminal and the receiving end is an authentication server. Figure 2 FIG. 1 is a schematic diagram of a key generation method based on a certificateless signcryption system provided by an embodiment of the present invention. Figure 2 As shown in the figure, KGC generates partial keys for the sender and receiver respectively, and the sender and receiver generate their own secret values ​​respectively, and then generate their own private keys based on their own secret values ​​and partial keys. At the same time, both parties generate their own public keys. During the message transmission process, the sender uses its own private key and the other party's public key to sign the message, and then transmits it to the receiver through the channel. The receiver uses its own private key and the other party's public key to decrypt the message.

[0070] In some embodiments, before the terminal receives the PEAP start authentication message sent by the 5G gateway, it also includes: the terminal receives a user name and password entered by the user, generates an authentication request based on the user name and the password, and sends the authentication request to the 5G gateway; after the 5G gateway receives the authentication request, it sends user identity request information to the terminal, and the user identity request information includes request information of the terminal identity ID; the terminal responds to the user identity request information and sends user identity response information to the authentication server through the 5G gateway, and the user identity response information includes the terminal identity ID; after the authentication server receives the user identity response information, it determines whether the terminal identity ID exists in the preset device list. If so, it sends a PEAP start authentication message to the terminal through the 5G gateway.

[0071] In this embodiment, the user identity request information is used to request the user identity information, and the information includes the request information of the terminal identity ID. For example, the user identity request information can be an EAP-Request / Identity data frame. The user identity response information is used to reply to the user identity request information, and the data frame includes the terminal identity ID. For example, the user identity response information can be an EAP-Response / Identity data frame. The preset device list is pre-set and used to store the irreversible HASH value generated by the user name, password and terminal identity ID using the MD5 algorithm. The PEAP start authentication message is used to start PEAP authentication. For example, the PEAP start authentication message can be an EAP-Request / Start data frame.

[0072] Specifically, when the terminal accesses the 5G+WiFi converged network, the user name and password are used to enable PECLAP authentication and authentication initialization: the terminal receives the user name and password entered by the user, generates an authentication request based on the user name and password, and sends the authentication request to the 5G gateway. After receiving the authentication request, the 5G gateway sends a user identity request message to the terminal to request the user identity information; the terminal replies to the 5G gateway with a user identity response message, which includes the user name, password, and terminal identity ID. Then, the 5G gateway sends the user identity response message to the authentication server in the message format of EAP over RADIUS, and brings the relevant RADIUS attributes; after receiving the user identity response message, the authentication server calculates a HASH value through the MD5 algorithm for the user name, password, and terminal identity ID in the user identity response message, and then searches for it in the preset list. If found, a PEAP authentication message is sent to the terminal through the 5G gateway. The terminal authentication is enabled and initialized, laying the foundation for further authentication.

[0073] In some embodiments, after the authentication server sends the obtained first encrypted challenge message to the terminal, it also includes: the terminal decrypts the first encrypted challenge information using the first session key, and based on the user name, the password, the identity ID of the terminal and the random number, uses a secure hash algorithm to generate a first response message of the first challenge message, and uses the first session key to encrypt the first response message and the second challenge message, and sends the obtained first encrypted response message and the second encrypted challenge message to the authentication server; the authentication server decrypts the first encrypted response message and the second encrypted challenge message using the second session key to obtain the first response message and the second response message, and sends a verification pass message to the terminal through the 5G gateway when confirming that the first response message is correct, wherein the verification pass message includes the second challenge message, and the verification pass message is a message encrypted by the second session key; the terminal decrypts the verification pass message using the first session key, and after determining that the second challenge message in the decrypted verification pass message is consistent with the second challenge message of the terminal locally, sends a challenge success message to the authentication server.

[0074] In this embodiment, the secure hash algorithm is a series of cryptographic hash functions that can convert data of any length into a hash value of fixed length, and is generally used to ensure the integrity of data and generate digital signatures. For example, the secure hash algorithm may be the SHA-1 hash algorithm.

[0075] Specifically, after receiving the first encrypted challenge information, the terminal uses the first session key to decrypt the first encrypted challenge information to obtain the first challenge information, and then uses the SHA-1 hash algorithm based on the user name, password, terminal identity ID, random number and other information to respond to the challenge, generate a first response message and a second challenge message to the first challenge message, and use the first session key to encrypt the first response message and the second challenge message to obtain the first encrypted response message and the second encrypted challenge message, and send the two encrypted messages to the authentication server; the authentication server uses the second session key to decrypt the first encrypted response message and the second encrypted challenge message to obtain the first response message and the second response message, and determines whether the first response message is correct. If the first response message is confirmed to be correct, a verification pass message is sent to the terminal through the 5G gateway, and the information includes the second challenge message to inform the terminal that the response is correct, wherein the verification pass message can be a Radius Access-Challenge / EAP-Request / PEAP / EAP-ExtensionsSuccessResultTLV, the verification message is a message encrypted by the second session key; the terminal uses the first session key to decrypt the verification message, and detects whether the second challenge information is consistent with its own. If it is consistent, it sends the challenge success message to the authentication server; then, the authentication server sends an EAP success message, such as an EAP-Success message, to complete the terminal authentication. Through the above technical solution, the security issues caused by directly sending the username and password are effectively avoided, and the security and efficiency of the two-way authentication between the terminal and the authentication server are guaranteed.

[0076] In some embodiments, the identity ID of the terminal is determined based on a physical unclonable function.

[0077] In this embodiment, Physically Unclonable Functions (PUF) is a security technology that uses the inherent physical randomness of semiconductor devices to generate non-replicable and unique identifiers. In this embodiment, it is used to generate a unique identity ID for the terminal. A highly secure identity authentication mechanism is provided to ensure the non-replicability and unpredictability of the terminal identity ID, thereby enhancing the security and anti-attack capabilities of the terminal device.

[0078] In a certain embodiment, the first message is generated based on the random number, the terminal identity ID and the first timestamp, and the terminal identity ID is sent by the terminal to the authentication server; the terminal determines that the authentication server is legitimate based on the terminal private key, the server public key and the first signed message, and generates a second message, including: the terminal uses the terminal private key and the server public key to decrypt the first signed message to obtain a decryption result, and when the terminal identity ID in the decryption result is consistent with the identity ID of the terminal, it is determined that the authentication server is legitimate, and the second message is generated based on the decryption result, the identity ID of the terminal and the second timestamp.

[0079] In this embodiment, the first message is a challenge code generated by the authentication server using a random number, a terminal identity ID and a first timestamp, and the terminal identity ID is sent by the terminal to the authentication server.

[0080] Specifically, the authentication server generates a first message using a random number, a terminal identity ID and a first timestamp, and then signs the first message using an elliptic curve finite field based on the server private key and the terminal public key to obtain a first signed message. Then, the authentication server selects a group of encryption algorithms from the encryption algorithm list as the target encryption algorithm, and combines the compression algorithm and other contents to form a server Hello message, for example, ServerHello, and sends the first signed message and the server Hello message to the terminal through the 5G gateway; the terminal uses the terminal private key and the server public key to decrypt the first signed message to obtain a decryption result, and then determines whether the terminal identity ID in the decryption result is consistent with the terminal's local identity ID. If they are consistent, the decryption result, the terminal's local identity ID and the second timestamp generate a second message, and the terminal private key and the authentication server public key are used to sign and send it to the authentication server, so that the authentication server confirms the legitimacy of the terminal identity. Through the above technical solution, the security of authentication is effectively improved.

[0081] For example, Figure 3 is a schematic diagram of a distributed power supply service terminal authentication process provided by an embodiment of the present invention, such as Figure 3 As shown:

[0082] In the authentication initialization phase, the terminal sends an EAPol Start message to the 5G gateway to start PEAP authentication, where the EAPol Start message includes the user name and password entered by the user (not shown in the figure). After receiving the EAPolStart message, the 5G gateway sends an EAP-Request / Identity message to the terminal to request user identity information; after receiving the EAP-Request / Identity message, the terminal sends an EAP-Response / Identity message to the 5G gateway, which includes user information such as user name, password and terminal identity ID; then, the 5G gateway sends the EAP-Response / Identity message to the authentication server (Radius 5G) in the EAP over RADIUS message format. After receiving the EAP-Response / Identity message, the authentication server uses the MD5 algorithm to calculate a HASH value for the user name, password and terminal identity ID in the EAP-Response / Identity message, and then searches for the content in the preset list. If it exists (not shown in the figure), a challenge is generated, and EAP-Request / peap / start is sent to the terminal device through the gateway;

[0083] During the TLS channel establishment phase, after receiving the EAP-Request / PEAP / Start message, the terminal generates a random number, a list of encryption algorithms supported by the terminal, the TLS protocol version, the session ID, and the compression method, etc., and encapsulates them in the EAP-Response / Client Hello message and sends them to the 5G gateway; the 5G gateway sends the EAP-Response / identity to the authentication server in the EAP over RADIUS message format;

[0084] Then, a certificateless system is introduced to confirm the terminal private key, terminal public key, server private key and server public key (not shown in the figure). After obtaining the public key and private key, the authentication server generates the first message using a random number, terminal identity ID and timestamp, and uses its own private key and the public key of the distributed power service terminal to sign based on the elliptic curve finite field. The authentication server selects a set of encryption algorithms, plus the authentication server's Session ID and compression algorithm to form ServerHello, and encapsulates the first message after ServerHello plus the sign and encryption in an Access-Challenge message and sends it to the 5G gateway. The 5G gateway further encapsulates it in an EAP-Request and sends it to the distributed power service terminal.

[0085] The distributed power business terminal uses the terminal private key and the server public key to decrypt the sign-encryption. The terminal determines whether the terminal identity ID obtained after decryption is consistent with the local identity ID. If they are consistent, the terminal adds the decrypted result to the terminal identity ID and timestamp to generate a second message, which is signed using the terminal private key and the server public key and sent to the authentication server so that the authentication server can confirm the legitimacy of the terminal identity. After the terminal determines that the authentication server has determined that it is legitimate, it generates PreMasterSceret, encrypts it with the server public key, and encapsulates the encrypted information in EAP-Response / TLSOK and sends it to the 5G gateway; the 5G gateway sends EAP-Response / TLS OK to the authentication server in the message format of EAP over RADIUS; the authentication server verifies the correctness of the message, and the authentication server uses its own private key to decrypt it to obtain PerMasterSceret; the communicating parties obtain the session key based on PerMasterSceret and the random number, respectively, using the target encryption algorithm; the authentication server encapsulates the second session key and the TLS finished message in the EAP over RADIUS message access-challenge and sends it to the 5G gateway, which further encapsulates it in EAP-Request and sends it to the distributed power service terminal; the terminal replies EAP-Response / TLSOK (not shown in the figure);

[0086] During the authentication phase, after repeated challenge responses between the authentication server and the terminal, the authentication server sends an EAP-Success message to the 5G gateway, which is then forwarded to the terminal by the 5 gateways. The authentication is successful, and the terminal successfully connects to the 5G gateway via WiFi.

[0087] Embodiment 2

[0088] Figure 4 FIG. 1 is a schematic diagram of a distributed power supply service terminal authentication system provided by Embodiment 2 of the present invention. Figure 4 As shown, the distributed power supply service terminal authentication system includes at least one terminal 200, a 5G gateway 210 and an authentication server 220, and only one terminal is shown in the figure for illustration, wherein:

[0089] The terminal 200 is configured to send a PEAP terminal Hello response message to the authentication server 220 through the 5G gateway 210 after receiving a protected extensible authentication protocol PEAP start authentication message sent by the 5G gateway 210, wherein the PEAP terminal Hello response message includes at least a random number, an encryption algorithm list, and a compression algorithm;

[0090] The authentication server 220 is used to generate a first message, and use the server private key and the terminal public key to sign the first message to obtain a first signed message, and send the first signed message and the server Hello message to the terminal 200 through the 5G gateway 210, wherein the server Hello message at least includes a target encryption algorithm and the compression algorithm, the target encryption algorithm is determined based on the encryption algorithm list, the server private key is determined based on the system parameters of the key generation center and the first initial private key, and the terminal public key is determined based on the system parameters;

[0091] The terminal 200 is used to generate a second message based on the terminal private key, the server public key and the first secret signed message, and to sign the second message using the terminal private key and the server public key to obtain a second secret signed message, and to send the second secret signed message to the authentication server 220, wherein the terminal private key is determined based on the system parameters and the second initial private key, and the server public key is determined based on the system parameters;

[0092] The terminal 200 is configured to, when the authentication server 220 confirms that the terminal 200 is legitimate based on the second secret signed message, encrypt the pre-master key using the server public key to obtain an encrypted pre-master key, send the encrypted pre-master key to the authentication server 220 through the 5G gateway 210, and calculate the pre-master key and the random number using the target encryption algorithm to obtain a first session key;

[0093] The authentication server 220 is configured to decrypt the encrypted pre-master key using the server private key to obtain the pre-master key, determine the second session key based on the pre-master key and the random number using the target encryption algorithm, and send a TSL confirmation message to the terminal 200 through the 5G gateway 210, wherein the TSL confirmation message includes the second session key and a TLS finished message;

[0094] The terminal 200 is used to send a TLSOK message to the authentication server 220 through the 5G gateway 210 after receiving the TSL confirmation message, to determine that the TSL channel is successfully established;

[0095] The authentication server 220 is used to generate a first challenge message after receiving the TLSOK message, encrypt the first challenge message by using the second session key, send the obtained first encrypted challenge message to the terminal 200, and after receiving the challenge success message sent by the terminal 200, send an EAP success message to the terminal 200 to complete the authentication of the terminal 200.

[0096] The technical solution provided in the second embodiment of the present invention does not require additional peripherals and effectively improves the authentication efficiency and security without increasing the cost.

[0097] Optionally, the distributed power business terminal authentication system also includes:

[0098] The terminal 200 is configured to determine a first secret value based on the system parameter and the identity ID of the terminal 200, determine a terminal public key based on the system parameter and the first secret value, and determine a terminal private key based on the system parameter, the first initial private key and the first secret value;

[0099] The authentication server 220 is used to determine a second private value based on the system parameters and the IP address of the authentication server 220, determine a server public key based on the system parameters and the second private value, and determine a server private key based on the system parameters, the second initial private key and the second private value.

[0100] Optionally, the distributed power business terminal authentication system also includes:

[0101] The terminal 200 is used to receive a user name and a password input by a user, generate an authentication request based on the user name and the password, and send the authentication request to the 5G gateway 210;

[0102] The 5G gateway 210 is configured to send user identity request information to the terminal 200 after receiving the authentication request, wherein the user identity request information includes request information of the terminal identity ID;

[0103] The terminal 200 is used to send user identity response information to the authentication server 220 through the 5G gateway 210 in response to the user identity request information, and the user identity response information includes a terminal identity ID;

[0104] The authentication server 220 is used to determine whether the terminal identity ID is in the preset device list after receiving the user identity response information. If so, send a PEAP start authentication message to the terminal 200 through the 5G gateway 210.

[0105] Optionally, the distributed power business terminal authentication system also includes:

[0106] The terminal 200 is used to decrypt the first encrypted challenge message using the first session key, and generate a first response message of the first challenge message using a secure hash algorithm based on the user name, the password, the identity ID of the terminal 200 and the random number, and encrypt the first response message and the second challenge message using the first session key, and send the obtained first encrypted response message and the second encrypted challenge message to the authentication server 220;

[0107] The authentication server 220 is configured to decrypt the first encrypted response message and the second encrypted challenge message by using the second session key to obtain a first response message and a second response message, and when confirming that the first response message is correct, send a verification pass message to the terminal 200 through the 5G gateway 210, wherein the verification pass message includes the second challenge message, and the verification pass message is a message encrypted by the second session key;

[0108] The terminal 200 is used to decrypt the verification pass message using the first session key, and after determining that the second challenge message in the decrypted verification pass message is consistent with the second challenge message local to the terminal 200, send a challenge success message to the authentication server 220.

[0109] Optionally, the identity ID of the terminal 200 is determined based on a physical unclonable function.

[0110] Optionally, the first message is generated based on the random number, the terminal identity ID and the first timestamp, and the terminal identity ID is sent by the terminal 200 to the authentication server 220;

[0111] Optionally, the terminal 200 is used to decrypt the first signed message using the private key of the terminal 200 and the public key of the server to obtain a decryption result. When the terminal identity ID and the identity ID of the terminal 200 in the decryption result are consistent, it is determined that the authentication server 220 is legitimate, and a second message is generated based on the decryption result, the identity ID of the terminal 200 and the second timestamp.

[0112] The distributed power supply service terminal authentication system provided in the embodiment of the present invention can execute the distributed power supply service terminal authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0113] Embodiment 3

[0114] Figure 5It is a structural schematic diagram of an electronic device provided in Embodiment 3 of the present invention. The electronic device is configured as a terminal or authentication server in a distributed power business terminal authentication system, and is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0115] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0116] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the corresponding steps in the distributed power supply service terminal authentication method.

[0118] In some embodiments, the corresponding steps in the distributed power business terminal authentication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps in the distributed power business terminal authentication method described above may be executed. Alternatively, in other embodiments, the processor 11 may be configured to execute the corresponding steps in the distributed power business terminal authentication method in any other appropriate manner (e.g., by means of firmware).

[0119] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0121] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0123] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0124] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0125] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0126] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

[0127] An embodiment of the present invention further provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements a distributed power supply service terminal authentication method as provided in any embodiment of the present application.

[0128] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0129] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A distributed power supply service terminal authentication method, characterized in that: Applied to a distributed power supply service terminal authentication system, the distributed power supply service terminal authentication system includes at least one terminal, a 5G gateway and an authentication server, and the method includes: After receiving the protected extensible authentication protocol PEAP start authentication message sent by the 5G gateway, the terminal sends a PEAP terminal Hello response message to the authentication server through the 5G gateway, wherein the PEAP terminal Hello response message includes at least a random number, an encryption algorithm list, and a compression algorithm; The authentication server generates a first message, and signs the first message using a server private key and a terminal public key to obtain a first signed message, and sends the first signed message and a server Hello message to the terminal through the 5G gateway, wherein the server Hello message includes at least a target encryption algorithm and the compression algorithm, the target encryption algorithm is determined based on the encryption algorithm list, the server private key is determined based on the system parameters of the key generation center and the first initial private key, and the terminal public key is determined based on the system parameters; The terminal determines that the authentication server is legitimate based on the terminal private key, the server public key and the first secret signed message, generates a second message, signs the second message using the terminal private key and the server public key to obtain a second secret signed message, and sends the second secret signed message to the authentication server, wherein the terminal private key is determined based on the system parameters and the second initial private key, and the server public key is determined based on the system parameters; When the authentication server confirms that the terminal is legitimate based on the second secret signed message, the terminal encrypts the pre-master key by using the server public key to obtain an encrypted pre-master key, sends the encrypted pre-master key to the authentication server through the 5G gateway, and calculates the pre-master key and the random number by using the target encryption algorithm to obtain a first session key; The authentication server decrypts the encrypted pre-master key using the server private key to obtain the pre-master key, determines the second session key based on the pre-master key and the random number using the target encryption algorithm, and sends a TSL confirmation message to the terminal through the 5G gateway, wherein the TSL confirmation message includes the second session key and a TLS finished message; After receiving the TSL confirmation message, the terminal sends a TLSOK message to the authentication server through the 5G gateway to confirm that the TSL channel is successfully established; After receiving the TLSOK message, the authentication server generates a first challenge message, encrypts the first challenge message using the second session key, sends the obtained first encrypted challenge message to the terminal, and after receiving the challenge success message sent by the terminal, sends an EAP success message to the terminal to complete the terminal authentication.

2. The method according to claim 1, characterized in that Also includes: The terminal determines a first secret value based on the system parameter and the identity ID of the terminal, determines a terminal public key based on the system parameter and the first secret value, and determines a terminal private key based on the system parameter, the first initial private key and the first secret value; The authentication server determines a second secret value based on the system parameters and the IP address of the authentication server, determines a server public key based on the system parameters and the second secret value, and determines a server private key based on the system parameters, the second initial private key and the second secret value.

3. The method according to claim 1, characterized in that: Before receiving the PEAP authentication message sent by the 5G gateway, the terminal further includes: The terminal receives a user name and a password input by a user, generates an authentication request based on the user name and the password, and sends the authentication request to the 5G gateway; After receiving the authentication request, the 5G gateway sends user identity request information to the terminal, where the user identity request information includes request information of the terminal identity ID; The terminal sends user identity response information to the authentication server through the 5G gateway in response to the user identity request information, where the user identity response information includes a terminal identity ID; After receiving the user identity response information, the authentication server determines whether the terminal identity ID exists in the preset device list. If so, a PEAP start authentication message is sent to the terminal through the 5G gateway.

4. The method according to claim 3, characterized in that After the authentication server sends the obtained first encrypted challenge message to the terminal, the method further includes: The terminal decrypts the first encrypted challenge message using the first session key, and generates a first response message of the first challenge message using a secure hash algorithm based on the user name, the password, the identity ID of the terminal and the random number, and encrypts the first response message and the second challenge message using the first session key, and sends the obtained first encrypted response message and the second encrypted challenge message to the authentication server; The authentication server decrypts the first encrypted response message and the second encrypted challenge message by using the second session key to obtain a first response message and a second response message, and when confirming that the first response message is correct, sends a verification pass message to the terminal through the 5G gateway, wherein the verification pass message includes the second challenge message, and the verification pass message is a message encrypted by the second session key; The terminal decrypts the verification success message using the first session key, and after determining that the second challenge message in the decrypted verification success message is consistent with the second challenge message locally in the terminal, sends a challenge success message to the authentication server.

5. The method according to claim 1, characterized in that The identity ID of the terminal is determined based on a physical unclonable function.

6. The method according to claim 1, characterized in that The first message is generated based on the random number, the terminal identity ID and the first timestamp, and the terminal identity ID is sent by the terminal to the authentication server; The terminal determines, based on the terminal private key, the server public key and the first secret signed message, that the authentication server is legitimate, and generates a second message, including: The terminal uses the terminal private key and the server public key to decrypt the first signed message to obtain a decryption result. When the terminal identity ID in the decryption result is consistent with the identity ID of the terminal, it is determined that the authentication server is legitimate, and a second message is generated based on the decryption result, the identity ID of the terminal and the second timestamp.

7. A distributed power supply service terminal authentication system, characterized in that: It includes at least one terminal, a 5G gateway and an authentication server, wherein: The terminal is configured to send a PEAP terminal Hello response message to the authentication server through the 5G gateway after receiving a Protected Extensible Authentication Protocol (PEAP) start authentication message sent by the 5G gateway, wherein the PEAP terminal Hello response message includes at least a random number, an encryption algorithm list, and a compression algorithm; The authentication server is configured to generate a first message, and sign the first message using a server private key and a terminal public key to obtain a first signed message, and send the first signed message and a server Hello message to the terminal through the 5G gateway, wherein the server Hello message includes at least a target encryption algorithm and the compression algorithm, the target encryption algorithm is determined based on the encryption algorithm list, the server private key is determined based on a system parameter of a key generation center and a first initial private key, and the terminal public key is determined based on the system parameter; The terminal is used to generate a second message based on the terminal private key, the server public key and the first secret signed message, if it is determined that the authentication server is legitimate, and to sign the second message using the terminal private key and the server public key to obtain a second secret signed message, and to send the second secret signed message to the authentication server, wherein the terminal private key is determined based on the system parameters and the second initial private key, and the server public key is determined based on the system parameters; The terminal is configured to, when the authentication server confirms that the terminal is legitimate based on the second secret signed message, encrypt the pre-master key using the server public key to obtain an encrypted pre-master key, send the encrypted pre-master key to the authentication server through the 5G gateway, and calculate the pre-master key and the random number using the target encryption algorithm to obtain a first session key; The authentication server is configured to decrypt the encrypted pre-master key using the server private key to obtain the pre-master key, determine the second session key based on the pre-master key and the random number using the target encryption algorithm, and send a TSL confirmation message to the terminal through the 5G gateway, wherein the TSL confirmation message includes the second session key and a TLS finished message; The terminal is used to send a TLSOK message to the authentication server through the 5G gateway after receiving the TSL confirmation message to determine that the TSL channel is successfully established; The authentication server is used to generate a first challenge message after receiving the TLSOK message, encrypt the first challenge message by using the second session key, send the obtained first encrypted challenge message to the terminal, and after receiving the challenge success message sent by the terminal, send an EAP success message to the terminal to complete the terminal authentication.

8. An electronic device, characterized in that: The electronic device is configured as a terminal or an authentication server in a distributed power supply service terminal authentication system, and the electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the corresponding steps in the distributed power supply service terminal authentication method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the distributed power supply service terminal authentication method as described in any one of claims 1-6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the distributed power supply service terminal authentication method according to any one of claims 1-6.

Images