User authentication method based on nuclear power Internet of Things, electronic equipment and storage medium

Abstract

The invention relates to the technical field of nuclear power plant industrial internet of things, in particular to a nuclear power internet of things-based user authentication method, electronic equipment and a storage medium. The method comprises the following steps: firstly, acquiring a user login request, including a user identifier and a password, at a nuclear power Internet of Things terminal, recording a login timestamp, performing hash encryption on the information, generating a hash value, and creating a first key according to the hash value; and encrypting the user identifier and the timestamp by using the key to form authentication encryption data, and then sending the authentication encryption data to a nuclear power Internet of Things server. After receiving the data, the nuclear power internet-of-things server obtains a registered user identifier and a password by querying a registered information base, and performs hash processing to generate a second secret key; and decrypting and authenticating the encrypted data by using the second key to obtain the user identifier and the timestamp, and checking the user identifier and the timestamp. And if the verification is passed, executing an authentication response. Therefore, the security is enhanced, the use of computing resources is optimized, and the dual requirements of the industrial Internet of Things on efficiency and security are met.

Description

Technical Field

[0001] The present application relates to the technical field of industrial Internet of Things for nuclear power plants, and in particular to a user authentication method, electronic device, and storage medium based on the nuclear power Internet of Things. Background Art

[0002] The Industrial Internet of Things for nuclear power plants involves a large amount of critical infrastructure and sensitive data, so it has high requirements for network security. It not only needs to solve traditional information security problems, but also cope with new security challenges brought by the particularity of wireless systems. At present, the main technical problem faced by the Industrial Internet of Things for nuclear power plants is the lack of network security, especially in terms of user authentication.

[0003] In the related technologies, traditional user authentication methods mainly rely on hash algorithms, such as Message-Digest Algorithm 5 (MD5); some user authentication methods rely on encryption technology, such as Advanced Encryption Standard (AES) and Rivest-Shamir-Adleman (RSA). However, these methods have some areas that need to be improved. For example, there are some unresolved security vulnerabilities or high resource consumption. Therefore, how to solve the limitations of high computational cost and insufficient anti-attack ability while ensuring the security of the industrial Internet of Things network of nuclear power plants has become a problem that needs to be solved urgently in the industry. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a user authentication method, electronic device, and storage medium based on the nuclear power Internet of Things, which can not only improve security but also reduce the consumption of computing resources to meet the dual requirements of high efficiency and high security in the industrial Internet of Things environment.

[0005] According to the user authentication method based on the nuclear power Internet of Things according to the first aspect of the present application, the method is applied to a nuclear power Internet of Things terminal, and the method includes:

[0006] Obtaining a user login request, and extracting a user login identifier and a target authentication password from the user login request; wherein the user login request is configured with a corresponding login timestamp;

[0007] Performing hash encryption processing on the user login identification to obtain a first identification hash value;

[0008] Performing hash encryption processing on the user login password to obtain a first password hash value;

[0009] Generate a first key according to the first identification hash value and the first password hash value;

[0010] Encrypting the user login identifier and the login timestamp based on the first key to obtain authentication encrypted data;

[0011] The user login identifier and the authentication encrypted data are sent to the nuclear power Internet of Things server so that the nuclear power Internet of Things server performs an authentication response operation.

[0012] According to some embodiments of the present application, performing hash encryption processing on the user login identifier to obtain a first identifier hash value includes:

[0013] The user login identifier is hashed by a secure hash algorithm to obtain a first transition identifier hash value;

[0014] Signing the first transition identifier hash value using an information digest encryption algorithm to generate the first identifier hash value;

[0015] The performing hash encryption processing on the user login password to obtain a first password hash value includes:

[0016] The user login password is hashed by the secure hash algorithm to obtain a first transitional password hash value;

[0017] The first transitional cryptographic hash value is signed using the information digest encryption algorithm to generate the first cryptographic hash value.

[0018] According to some embodiments of the present application, the number of bytes of the first identification hash value is a first number, the number of bytes of the first password hash value is a second number, and generating a first key according to the first identification hash value and the first password hash value includes:

[0019] Integrate the first identification hash value and the first password hash value to obtain a first key reference value whose number of bytes is a third number; wherein the third number is the sum of the first number and the second number;

[0020] The first key reference value is subjected to high-order encryption processing by using a high-order encryption algorithm to generate the first key.

[0021] According to some embodiments of the present application, before sending the user login identifier and the authentication encryption data to the nuclear power Internet of Things server so that the nuclear power Internet of Things server performs an authentication response operation, it also includes:

[0022] In response to the target authentication password being binary data, performing a character transcoding operation on the authentication encrypted data;

[0023] The step of sending the user login identifier and the authentication encrypted data to the nuclear power IoT server includes:

[0024] The user login identification and the authentication encrypted data after character transcoding operation are sent to the nuclear power Internet of Things server.

[0025] According to the user authentication method based on the nuclear power Internet of Things according to the second aspect of the present application, applied to a nuclear power Internet of Things server, the method includes:

[0026] Obtaining a user login identifier and authentication encryption data sent by a nuclear power Internet of Things terminal; wherein the user login identifier and the authentication encryption data are obtained by the user authentication method based on the nuclear power Internet of Things described in any one of the embodiments of the first aspect of the present application;

[0027] Using the user login identifier as an index, a query is performed in a preset registration information database to obtain a user registration identifier and a user registration password;

[0028] Performing hash encryption processing on the user registration identifier to obtain a second identifier hash value;

[0029] Performing hash encryption processing on the user registration password to obtain a second password hash value;

[0030] Generate a second key according to the second identification hash value and the second password hash value;

[0031] Decrypting the authentication encrypted data using the second key to obtain a decrypted user identifier and a decrypted timestamp;

[0032] Verifying the decryption user identifier and the decryption timestamp to obtain a verification result;

[0033] Based on the verification result, an authentication response operation is performed.

[0034] According to some embodiments of the present application, performing hash encryption processing on the user registration identifier to obtain a second identifier hash value includes:

[0035] The user registration identifier is hashed by a secure hash algorithm to obtain a second transition identifier hash value;

[0036] The second transition identifier hash value is signed by using an information digest encryption algorithm to generate the second identifier hash value.

[0037] The performing hash encryption processing on the user registration password to obtain a second password hash value includes:

[0038] The user registration password is hashed by the secure hash algorithm to obtain a second transitional password hash value;

[0039] The second transitional cryptographic hash value is signed using the information digest encryption algorithm to generate the second cryptographic hash value.

[0040] According to some embodiments of the present application, the number of bytes of the second identification hash value is a second number, the number of bytes of the second password hash value is a second number, and the generating of the second key according to the second identification hash value and the second password hash value includes:

[0041] Integrate the second identification hash value and the second password hash value to obtain a second key reference value whose number of bytes is a third number; wherein the third number is the sum of the second number and the second number;

[0042] The second key reference value is subjected to high-order encryption processing by a high-order encryption algorithm to generate the second key.

[0043] According to some embodiments of the present application, the verifying the decrypted user identifier and the decrypted timestamp to obtain a verification result includes:

[0044] Perform consistency comparison on the decrypted user ID based on the user login ID to obtain an ID comparison result;

[0045] Performing a time difference comparison on the decrypted timestamp based on the current timestamp to obtain a time difference comparison result;

[0046] In response to the identification comparison result and the time difference comparison result satisfying a preset verification condition, the verification result indicating that the verification has passed is obtained.

[0047] According to some embodiments of the present application, the method further includes:

[0048] In response to the identification comparison result reflecting that the user login identification is inconsistent with the decryption user identification, but the time difference comparison result is less than or equal to the preset time difference, obtaining the verification result of the first type of verification failure;

[0049] The performing an authentication response operation based on the verification result includes:

[0050] In response to the verification result being a failure of the first type of verification, the authentication of the user login identifier and the authentication encryption data is rejected, and an identity authentication operation is performed on the nuclear power Internet of Things terminal.

[0051] According to some embodiments of the present application, the method further includes:

[0052] In response to the identification comparison result reflecting that the user login identification is consistent with the decryption user identification, but the time difference comparison result is greater than the preset time difference, obtaining the verification result of the second type of verification failure;

[0053] The performing an authentication response operation based on the verification result includes:

[0054] In response to the verification result being a failure of the second type of verification, the authentication of the user login identifier and the authentication encryption data is rejected, and an authentication timeout prompt is fed back to the nuclear power Internet of Things terminal.

[0055] According to some embodiments of the present application, the method further includes:

[0056] In response to the identification comparison result reflecting that the user login identification is inconsistent with the decryption user identification, and the time difference comparison result is greater than the preset time difference, obtaining the verification result of the third type of verification failure;

[0057] The performing an authentication response operation based on the verification result includes:

[0058] In response to the verification result being a failure of the third type of verification, refusing authentication of the user login identifier and the authentication encryption data, and marking the nuclear power Internet of Things terminal as a key observation terminal;

[0059] In response to the number of times that the nuclear power Internet of Things terminal is marked as the key observation terminal meeting a preset abnormality determination condition, the nuclear power Internet of Things terminal is marked as an abnormal terminal, and access to the nuclear power Internet of Things terminal is restricted.

[0060] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements a user authentication method based on the nuclear power Internet of Things as described in any one of the embodiments of the first aspect of the present application.

[0061] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a program, and the program is executed by a processor to implement a user authentication method based on the nuclear power Internet of Things as described in any one of the embodiments of the first aspect of the present application.

[0062] According to the embodiment of the present application, a user authentication method, electronic device, and storage medium based on nuclear power Internet of Things have at least the following beneficial effects:

[0063] According to the user authentication method based on the nuclear power Internet of Things of the present application, at the nuclear power Internet of Things terminal, it is necessary to first obtain a user login request, and extract a user login identifier and a target authentication password from the user login request; wherein the user login request is configured with a corresponding login timestamp; hash encryption processing is performed on the user login identifier to obtain a first identifier hash value; hash encryption processing is performed on the user login password to obtain a first password hash value; a first key is generated based on the first identifier hash value and the first password hash value; the user login identifier and the login timestamp are encrypting based on the first key to obtain authentication encrypted data; the user login identifier and the authentication encrypted data are sent to the nuclear power Internet of Things server, so that the nuclear power Internet of Things server performs an authentication response operation.

[0064] In the nuclear power Internet of Things server, it is necessary to obtain the user login identification and authentication encryption data sent by the nuclear power Internet of Things terminal; wherein, the user login identification and authentication encryption data are obtained through the user authentication method based on the nuclear power Internet of Things of any one of the first aspect embodiments of the present application; query in the preset registration information library with the user login identification as the index to obtain the user registration identification and the user registration password; perform hash encryption processing on the user registration identification to obtain the second identification hash value; perform hash encryption processing on the user registration password to obtain the second password hash value; generate a second key according to the second identification hash value and the second password hash value; decrypt the authentication encryption data through the second key to obtain the decrypted user identification and decryption timestamp; verify the decrypted user identification and decryption timestamp to obtain the verification result; based on the verification result, perform the authentication response operation. In this way, it can not only improve security, but also reduce the consumption of computing resources to meet the dual requirements of high efficiency and high security in the industrial Internet of Things environment.

[0065] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0067] Figure 1 A schematic diagram of a flow chart of a user authentication method based on nuclear power Internet of Things provided in an embodiment of the present application;

[0068] Figure 2 Another schematic diagram of a process flow of a user authentication method based on the nuclear power Internet of Things provided in an embodiment of the present application;

[0069] Figure 3 Another schematic diagram of a process flow of a user authentication method based on the nuclear power Internet of Things provided in an embodiment of the present application;

[0070] Figure 4 Another schematic diagram of a process flow of a user authentication method based on the nuclear power Internet of Things provided in an embodiment of the present application;

[0071] Figure 5 Another schematic diagram of a process flow of a user authentication method based on the nuclear power Internet of Things provided in an embodiment of the present application;

[0072] Figure 6 Another schematic diagram of a process flow of a user authentication method based on the nuclear power Internet of Things provided in an embodiment of the present application;

[0073] Figure 7 Another schematic diagram of a process flow of a user authentication method based on the nuclear power Internet of Things provided in an embodiment of the present application;

[0074] Figure 8 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0075] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0076] In the description of this application, "several" means one or more, "more" means more than two, "greater than", "less than", "exceed", etc. are understood to exclude the number itself, and "above", "below", "within", etc. are understood to include the number itself. If there is a description of "first" or "second", it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0077] In the description of the present application, it should be understood that descriptions involving orientation, such as up, down, left, right, front, back, etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0078] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0079] In the description of this application, it should be noted that, unless otherwise clearly defined, the terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application in combination with the specific content of the technical solution. In addition, the identification of specific steps below does not represent a limitation on the order of steps and execution logic. The execution order and execution logic between each step should be understood and inferred with reference to the contents described in the embodiment.

[0080] The industrial Internet of Things for nuclear power plants involves a large amount of critical infrastructure and sensitive data, so it has high requirements for network security. It not only needs to solve traditional information security problems, but also cope with new security challenges brought by the particularity of wireless systems. At present, the main technical problem facing the field of industrial Internet of Things for nuclear power plants is the lack of network security, especially in user authentication. In related technologies, traditional user authentication methods mainly rely on hash algorithms (such as MD5) and encryption technologies (such as AES and RSA) to ensure the security of network communications. However, these methods have some areas that need to be improved.

[0081] First, the commonly used user authentication method in the private domain is implemented through hashing and AES encryption, but this method has a key problem: it cannot effectively prevent copying attacks. Attackers can intercept authentication information in the network and copy this information without authorization to access the system. This security vulnerability may lead to the leakage of sensitive data and unauthorized network access.

[0082] Secondly, although the RSA encryption user authentication method used in the public domain provides high security, its computational complexity and resource consumption are relatively large. This not only increases the operating cost of the system, but also limits the number of authentication requests that can be processed at the same time, affecting the scalability and response speed of the system. Therefore, how to solve the limitations of high computational cost and insufficient anti-attack capability while ensuring the security of the industrial Internet of Things network in nuclear power plants has become a problem that needs to be solved urgently in the industry.

[0083] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a user authentication method, electronic device, and storage medium based on the nuclear power Internet of Things, which can not only improve security but also reduce the consumption of computing resources to meet the dual requirements of high efficiency and high security in the industrial Internet of Things environment.

[0084] Further explanation is given below based on the accompanying drawings.

[0085] Reference Figure 1 , the user authentication method based on the nuclear power Internet of Things in the embodiment of the present application, in the nuclear power Internet of Things terminal, the user authentication method of the embodiment of the present application may include:

[0086] Step S101, obtaining a user login request, and extracting a user login identifier and a target authentication password from the user login request; wherein the user login request is configured with a corresponding login timestamp;

[0087] Step S102, performing hash encryption processing on the user login identification to obtain a first identification hash value;

[0088] Step S103, performing hash encryption processing on the user login password to obtain a first password hash value;

[0089] Step S104, generating a first key according to the first identification hash value and the first password hash value;

[0090] Step S105, encrypt the user login identification and login timestamp based on the first key to obtain authentication encryption data, and send the user login identification and authentication encryption data to the nuclear power Internet of Things server.

[0091] On the other hand, in the nuclear power IoT server, the user authentication method of the embodiment of the present application may include:

[0092] Step S106, obtaining the user login identification and authentication encryption data sent by the nuclear power Internet of Things terminal;

[0093] Step S107, using the user login ID as an index to search in a preset registration information database to obtain the user registration ID and the user registration password;

[0094] Step S108, performing hash encryption processing on the user registration identification to obtain a second identification hash value;

[0095] Step S109, performing hash encryption processing on the user registration password to obtain a second password hash value;

[0096] Step S110, generating a second key according to the second identification hash value and the second password hash value;

[0097] Step S111, decrypting the authentication encrypted data using the second key to obtain a decrypted user identifier and a decryption timestamp;

[0098] Step S112, verifying the decrypted user ID and the decrypted timestamp to obtain a verification result;

[0099] Step S113: Execute an authentication response operation based on the verification result.

[0100] In the field of industrial Internet of Things in nuclear power plants, it is crucial to ensure network security, especially the security of user authentication. The user authentication method of the embodiment of the present application aims to solve the problems of insufficient network security, high computational cost and insufficient anti-attack ability in related technologies.

[0101] First, when a user attempts to log in, the embodiment of the present application obtains the user's login request, which includes a user ID and an authentication password, as well as a login timestamp. This login timestamp is critical because it increases the dynamics of the authentication process, making each authentication unique, thereby improving the ability to resist replay attacks. It should be noted that anti-replay attacks refer to a protection measure designed to prevent attackers from performing unauthorized operations or causing system state changes by intercepting and resending previously valid data packets. This type of attack is particularly common in user authentication and network communications, because attackers may try to capture data packets containing sensitive information (such as authentication tokens, passwords, etc.) and resend these data packets at some point in the future to deceive the system into re-authenticating or performing other operations.

[0102] Next, the embodiment of the present application performs hash encryption processing on the user ID and password. The hash algorithm used here can ensure that even if it is intercepted during the data transmission process, the attacker cannot easily reverse the original user ID and password. In this way, the user's sensitive information is protected, and it also provides a basis for generating keys. It should be pointed out that the first key is based on the hash value of the user ID and password, and this key will be used to encrypt the user ID and login timestamp. This encryption method not only protects the privacy of the user ID, but also ensures the security of the login timestamp, prevents the time information from being tampered with, and thus enhances the security of the authentication process.

[0103] On the nuclear power IoT server, the user authentication process continues. The nuclear power IoT server first obtains the user login ID and authentication encryption data sent from the nuclear power IoT terminal. Then, the nuclear power IoT server uses the user login ID as an index to query the preset registration information library, obtains the user registration ID and user registration password, and performs the same hashing process on these information to generate the second key.

[0104] Using the second key, the nuclear power IoT server can decrypt the encrypted data sent by the nuclear power IoT terminal and obtain the decrypted user ID and decryption timestamp. The nuclear power IoT server then verifies the decrypted user ID and decryption timestamp, including verifying the accuracy of the decrypted user ID and decryption timestamp. If the verification passes, indicating the compliance of the user identity and the real-time nature of the request, the nuclear power IoT server will perform the corresponding authentication response operation to allow the user to access the resources of the nuclear power IoT server.

[0105] The embodiment of the present application not only improves the security of user authentication through this method, but also reduces the computational cost by reducing unnecessary calculations and optimizing the key generation process. At the same time, by introducing timestamps and dynamic key generation mechanisms, the resistance to attacks in the user authentication process is enhanced. This comprehensive method provides a more secure and efficient user authentication solution for the industrial Internet of Things in nuclear power plants.

[0106] In step S101 of some embodiments, a user login request is obtained, and a user login identifier and a target authentication password are extracted from the user login request; wherein the user login request is configured with a corresponding login timestamp.

[0107] It should be noted that the user login request is issued by the user to start the authentication process so that the user can access protected resources or services. To enhance security, the login request also includes a login timestamp. The login timestamp is the time point when the user attempts to log in, which provides a specific history for each login request. The login timestamp is very important and introduces a dynamic element into the authentication process, making each request unique.

[0108] It should be noted that a replay attack is a security threat in which an attacker attempts to re-execute certain operations or access certain data by capturing previous network requests and then sending the same request again. By including a login timestamp in the login request, an embodiment of the present application can verify the timeliness of the user's login request. If the timestamp shows that the request was issued within a reasonable time window, then the embodiment of the present application will continue to process the request. If the timestamp shows that the request was issued a long time ago, or is too different from the current time of the nuclear power Internet of Things server, then the nuclear power Internet of Things server of the embodiment of the present application may reject the request because it may be a replay attack.

[0109] In steps S102 to S103 of some embodiments, hash encryption processing is performed on the user login identification to obtain a first identification hash value; and hash encryption processing is performed on the user login password to obtain a first password hash value.

[0110] It should be noted that the user login ID and password will be hashed and encrypted at the nuclear power IoT terminal before being sent to the nuclear power IoT server. This step is a key link in the user authentication process, and its purpose is to ensure the security of user sensitive information.

[0111] First, the user login identifier, that is, the username, is processed through a hash function. A hash function is an algorithm that accepts input data of any length and produces an output of a fixed length. This process is one-way, which means that it is almost impossible to reverse the original input data from the hash value. Through hashing, the username is converted into a first identification hash value, which is a digital summary of the original username and is used in the subsequent authentication process.

[0112] Next, the user's login password will be hashed and encrypted in the same way. As another key factor in user authentication, the password is of vital importance for its security. Through the hash algorithm, the user's login password is converted into a first password hash value, which also represents the digital summary of the original password. Hash processing not only protects the user's privacy, but also enhances the security of the authentication process, because even if the data is intercepted during transmission, the attacker cannot directly obtain the user's original password.

[0113] Reference Figure 2 According to some embodiments of the present application, step S102 performs hash encryption processing on the user login identifier to obtain a first identifier hash value, which may include:

[0114] Step S201, hashing the user login identifier using a secure hash algorithm to obtain a first transition identifier hash value;

[0115] Step S202, using the information digest encryption algorithm to sign the first transition identification hash value to generate a first identification hash value;

[0116] In step S103, performing hash encryption processing on the user login password to obtain a first password hash value may include:

[0117] Step S203, hashing the user login password using a secure hash algorithm to obtain a first transitional password hash value;

[0118] Step S204: Sign the first transitional cryptographic hash value using a message digest encryption algorithm to generate a first cryptographic hash value.

[0119] In some embodiments of the present application, the hash encryption of the user login identification and the user login password is an important step to ensure network security and user data protection. This process not only involves hashing the data entered by the user, but also includes signing these hash values ​​to enhance the security of the data.

[0120] In step S201 of some embodiments, the user login identifier is hashed using a secure hash algorithm (such as a SHA series algorithm). This step generates a first transition identifier hash value, which is the initial hash value of the user login identifier and provides basic data integrity and irreversibility.

[0121] In step S202 of some embodiments, the first transition identifier hash value is signed using an information digest encryption algorithm (such as MD5) to generate a final first identifier hash value. This signing process adds an extra layer of security to the hash value, ensuring the integrity and authenticity of the hash value. Even if an attacker is able to obtain the hash value, they cannot forge or tamper with these values ​​without the corresponding signature information.

[0122] In step S203 of some embodiments, the user login password is hashed by a secure hash algorithm to obtain a first transitional password hash value. This step ensures the security of the password data, and even in the case of data leakage, an attacker cannot directly obtain the user's original password.

[0123] In step S204 of some embodiments, the first transitional cryptographic hash value is signed using an information digest encryption algorithm to generate a first cryptographic hash value. This signing process provides the same security protection for the cryptographic hash value as the user identification hash value, ensuring the integrity and authentication of the cryptographic data.

[0124] Through the processing steps involved in step S201 to step S204, the embodiment of the present application ensures the security of the user login identification and user login password during network transmission and storage. These measures help prevent unauthorized access and data leakage, while providing security for the nuclear power industrial Internet of Things. This comprehensive hash and signature mechanism not only improves the security of user authentication, but also provides a solid foundation for data protection of the entire system.

[0125] In some more specific embodiments, the secure hash algorithm may be a SHA-1 algorithm or a message digest encryption algorithm MD5 algorithm.

[0126] In step S104 of some embodiments, a first key is generated according to the first identification hash value and the first password hash value.

[0127] In some embodiments, after obtaining the first identification hash value and the first password hash value, the next step is to use the two hash values ​​to generate a key, which is called the first key and plays a vital role in the user authentication process.

[0128] The process of generating the first key requires combining the hash value of the username and the hash value of the password. This combination can be done in a variety of ways, for example, through concatenation, exclusive OR (XOR) operation, or using a specific key derivation function (KDF). Regardless of the method used, the goal is to ensure that the generated key is unique and difficult to derive directly from the original username and password.

[0129] Using a hash of the username and password to generate a key has several key advantages. First, this approach increases security because even if someone is able to intercept the key, they cannot easily reverse the original username and password. Second, this approach provides flexibility because the key can be changed at any time as needed, just by changing the hash of the username or password. Finally, this approach also helps simplify key management because key generation and updates no longer need to rely on complex key distribution mechanisms.

[0130] Reference Figure 3 According to some embodiments of the present application, the number of bytes of the first identification hash value is a first number, and the number of bytes of the first password hash value is a second number. Step S104 generates a first key according to the first identification hash value and the first password hash value, which may include:

[0131] Step S301, integrating the first identification hash value and the first password hash value to obtain a first key reference value whose number of bytes is a third number; wherein the third number is the sum of the first number and the second number;

[0132] Step S302: Perform high-order encryption processing on the first key reference value using a high-order encryption algorithm to generate a first key.

[0133] In step S301 of some embodiments, in order to generate a first key, the embodiments of the present application integrate the two hash values, the first identification hash value and the first password hash value. This step includes splicing the first identification hash value and the first password hash value together to form a longer byte sequence, called the first key reference value. The total number of bytes of this first key reference value, i.e., the third number, is the sum of the first number and the second number. The process of integrating the first identification hash value and the first password hash value is intended to create a single data structure that contains all the hash information of the user login identification and the user login password, providing a basis for generating a strong key.

[0134] In step S302 of some embodiments, the first key reference value is subjected to high-order encryption processing by a high-order encryption algorithm. A high-order encryption algorithm refers to an encryption technology that can provide a good balance between data security and performance. Such an algorithm may include multiple encryption rounds, each of which uses a different key or encryption parameter to enhance the complexity and difficulty of cracking the encryption result. Through such high-order encryption processing, the first key reference value is converted into a final first key.

[0135] In some embodiments, the high-order encryption algorithm may include a combination or variation of the following algorithms:

[0136] Advanced Encryption Standard (AES): AES is a widely used symmetric key encryption algorithm that supports 128, 192, or 256-bit key lengths. It enhances data security through a series of complex transformations, including byte substitution, row shift, column obfuscation, and round key addition. AES is often used to encrypt sensitive data due to its strong security and high processing efficiency.

[0137] RSA encryption algorithm: RSA is an asymmetric encryption algorithm, commonly used to encrypt small amounts of data or symmetric keys. It provides high security based on the difficulty of factoring large integers. The RSA algorithm includes steps such as key generation, encryption, and decryption, which can effectively protect data from unauthorized access.

[0138] Elliptic Curve Cryptography (ECC): ECC is a public key cryptography technology based on elliptic curve mathematics. It can provide a shorter key length than RSA at a given level of security, thus having advantages in processing speed and bandwidth efficiency. The ECC algorithm generates keys by performing point addition and point multiplication operations on elliptic curves, providing security comparable to RSA, but with shorter keys.

[0139] Password-Based Encryption (PBE): The PBE algorithm uses a password (such as a password entered by a user) as the basis for encryption, by combining the password with other data (such as a salt value) and performing multiple hashing operations to generate a key. The purpose of the PBE algorithm is to make the key derivation process more secure and reliable.

[0140] Chaos encryption algorithm: This is an encryption method based on chaos theory, which uses the inherent unpredictability of dynamic systems to encrypt data. Chaos encryption algorithm has high security in theory, but its practical application is still in the research and development stage.

[0141] In step S302, the selection of the high-order encryption algorithm depends on specific security requirements, performance requirements and environmental conditions. The embodiment of the present application can select or design a suitable encryption algorithm according to actual conditions to ensure the security and effectiveness of the encryption process. Regardless of which algorithm the high-order encryption algorithm specifically uses, the core goal of the high-order encryption algorithm in the embodiment of the present application is to provide security protection to prevent the first key from being unauthorized access or tampering during transmission and storage. Through this encryption process, the security of the first key can be ensured, thereby providing a solid security foundation for the entire authentication process.

[0142] Reference Figure 4 According to some embodiments of the present application, before sending the user login identification and the authentication encryption data to the nuclear power IoT server in step S105 so that the nuclear power IoT server performs the authentication response operation, the following may also be included:

[0143] Step S401, in response to the target authentication password being binary data, performing a character transcoding operation on the authentication encrypted data;

[0144] In step S105, sending the user login identification and authentication encryption data to the nuclear power IoT server may include:

[0145] Step S402, sending the user login identification and the authentication encrypted data after the character transcoding operation to the nuclear power Internet of Things server.

[0146] In some embodiments of the present application, the user login identification and authentication encryption data may need to undergo additional processing steps before being sent to the nuclear power Internet of Things server to ensure the compatibility and security of the data.

[0147] In step S401 of some embodiments, when the target authentication password is binary data, it is necessary to perform a character transcoding operation on the authentication encrypted data.

[0148] It should be noted that the purpose of character transcoding is to convert binary data into a format suitable for network transmission. Since binary data can contain characters that cannot be directly transmitted in certain network protocols or systems, such as NULL characters or specific control characters, it is necessary to convert these data into a more universal format, such as Base64 encoding. It should be pointed out that Base64 encoding can convert binary data into a text string consisting of 64 printable characters, thereby ensuring that data transmission in various systems and network environments will not encounter problems.

[0149] In step S402 of some embodiments, in the process of sending the user login identification and authentication encrypted data to the nuclear power IoT server, if the authentication password is binary data, the character transcoding operation described in step S401 needs to be performed before sending. In this way, the data sent to the nuclear power IoT server includes not only the user login identification, but also the authentication encrypted data after the character transcoding operation, ensuring that the nuclear power IoT server can receive the user login information with the correct format and complete content, so that the subsequent authentication response operation can be smoothly performed, which improves the efficiency and reliability of the entire authentication process.

[0150] In step S105 of some embodiments, the user login identification and login timestamp are encrypted based on the first key to obtain authentication encrypted data, and the user login identification and authentication encrypted data are sent to the nuclear power Internet of Things server.

[0151] In some embodiments, once the first key is generated, the next step is to use the first key to strengthen the protection of the user login identification and login timestamp. It should be noted that the login timestamp is the time point when the user attempts to log in, which provides a specific historical record for each user login request, increases the uniqueness of the user login request, and thus improves the ability to resist replay attacks.

[0152] In the embodiment provided in the present application, the process of encrypting using the first key can adopt a symmetric encryption algorithm, such as AES (Advanced Encryption Standard). This encryption algorithm requires a key to encrypt data, and uses the same key or a derived key to decrypt data. In this case, the first key can be used as the key for encrypting and decrypting these data in the future. The encryption process ensures the security of the user login identification and login timestamp during transmission to the nuclear power Internet of Things server via the network. Even if the data is intercepted during transmission, without the corresponding key, the attacker cannot decipher the encrypted data.

[0153] After encryption is completed, the authentication encrypted data is obtained, which contains an encrypted version of the original login information (that is, the user login ID and login timestamp). The nuclear power IoT terminal then sends the user login ID and authentication encrypted data to the nuclear power IoT server.

[0154] In step S106 of some embodiments, the nuclear power Internet of Things server obtains the user login identification and authentication encryption data sent by the nuclear power Internet of Things terminal.

[0155] In some embodiments, the nuclear power IoT server plays a core role in the user authentication process. The nuclear power IoT server receives two key information from the nuclear power IoT terminal: user login identification and authentication encryption data. The user login identification is the user's unique identification information, and the authentication encryption data is the encrypted information containing the user login timestamp. The two pieces of information, user login identification and authentication encryption data, together constitute the core content of the user login request.

[0156] After the nuclear power IoT terminal initiates a user login request, this information is securely sent to the nuclear power IoT server. The nuclear power IoT server then receives and processes this data. Among them, the user login identifier enables the nuclear power IoT server to identify which user the request comes from, and the authentication encrypted data contains the login timestamp, which is crucial for subsequent authentication checks.

[0157] In step S107 of some embodiments, a user login identifier is used as an index to query a preset registration information database to obtain a user registration identifier and a user registration password.

[0158] In some embodiments, after receiving the user login identification and authentication encryption data, the next step of the nuclear power IoT server is to perform identity authentication. To this end, the nuclear power IoT server needs to access a preset registration information library, which is a database that stores all user registration information. In the registration information library, each registered user has a unique user identification and a user password associated with it.

[0159] It should be noted that the nuclear power IoT server of the embodiment of the present application uses the received user login identifier as an index to query in the registration information library. This query process is fast and efficient because the user login identifier can be compared with each user identifier stored in the registration information library. Through this query, the nuclear power IoT server can retrieve the user registration identifier and user registration password corresponding to the user login identifier. The user registration identifier is the user identifier that matches the user login identifier in the registration information library, and the user registration password is the password set by the user corresponding to the user registration identifier when registering. The nuclear power IoT server can store these passwords in encrypted form.

[0160] In steps S108 to S109 of some embodiments, hash encryption processing is performed on the user registration identification to obtain a second identification hash value; and hash encryption processing is performed on the user registration password to obtain a second password hash value.

[0161] It should be noted that after obtaining the user registration ID and the user registration password, the nuclear power IoT server will perform subsequent verification steps, including hashing the user registration ID to generate a second ID hash value, and hashing the user registration password to generate a second password hash value.

[0162] Reference Figure 5 According to some embodiments of the present application, step S108 performs hash encryption processing on the user registration identifier to obtain a second identifier hash value, which may include:

[0163] Step S501, hashing the user registration identifier using a secure hash algorithm to obtain a second transition identifier hash value;

[0164] Step S502: Sign the second transition identification hash value using a message digest encryption algorithm to generate a second identification hash value.

[0165] In step S109, performing hash encryption processing on the user registration password to obtain a second password hash value may include:

[0166] Step S503, hashing the user registration password using a secure hash algorithm to obtain a second transitional password hash value;

[0167] Step S504: Sign the second transitional cryptographic hash value using a message digest encryption algorithm to generate a second cryptographic hash value.

[0168] In some embodiments of the present application, in order to ensure the security of the user authentication process and the integrity of the data, the user registration ID and password need to undergo a series of hash encryption processes on the nuclear power IoT server. This process not only includes basic hashing processing, but also involves signing the hash value to enhance its security.

[0169] First, for the processing of the user registration identification, step S108 performs hashing processing on the user registration identification through a secure hash algorithm (such as the SHA series algorithm). This step generates a second transition identification hash value, which is a digital summary of the user identification and can provide basic data integrity and irreversibility.

[0170] Then, step S502 uses a message digest encryption algorithm (such as MD5) to sign the second transition identifier hash value to generate a final second identifier hash value. This signing process adds an extra security layer to the hash value, ensuring the integrity and authentication of the hash value.

[0171] For the processing of the user registration password, step S109 also adopts the same steps.

[0172] First, the user's registered password is hashed using a secure hash algorithm to obtain a second transitional password hash value. This step ensures the security of the password data, and even in the event of a data leak, an attacker cannot directly obtain the user's original password.

[0173] Then, in step S504 of the embodiment, the second transitional cryptographic hash value is signed using the information digest encryption algorithm to generate a second cryptographic hash value. This signing process provides the same security protection for the cryptographic hash value as the user identification hash value, ensuring the integrity and authentication of the cryptographic data.

[0174] Through this series of processing steps, the embodiments of the present application ensure the security of user identification and passwords during network transmission and storage. These measures help prevent unauthorized access and data leakage, while providing strong security protection for the nuclear power industrial Internet of Things. This comprehensive hash and signature mechanism not only improves the security of user authentication, but also provides a solid foundation for data protection of the entire system.

[0175] In step S110 of some embodiments, a second key is generated according to the second identification hash value and the second password hash value.

[0176] It should be noted that the two hash values, the second identification hash value and the second password hash value, will be used to generate the second key, which will be compared with the first key generated by the nuclear power IoT terminal to verify the user's compliance.

[0177] It should be pointed out that the user registration identification and password retrieved from the registration information library are processed by the hash algorithm to generate the second identification hash value and the second password hash value. This process is consistent with the process of generating the first identification hash value and the first password hash value by the nuclear power Internet of Things terminal, and both use the unidirectional and irreversible nature of the same hash processing method to ensure data security and integrity.

[0178] Subsequently, the nuclear power IoT server combines the second identification hash value and the second password hash value to generate a second key through a key derivation function (KDF) or other encryption method. The method of generating the second key needs to be consistent with the method of generating the first key. Its purpose is to generate a strong key from one or more initial inputs (here is the hash value), which will be used for subsequent encryption or decryption operations. If the second key is the same as the first key, it means that the second key can decrypt the authentication encrypted data sent by the nuclear power IoT terminal, thereby obtaining an accurate user login ID and login timestamp.

[0179] Reference Figure 6 According to some embodiments of the present application, the number of bytes of the second identification hash value is a second number, and the number of bytes of the second password hash value is a second number. Step S110 generates a second key according to the second identification hash value and the second password hash value, which may include:

[0180] Step S601, integrating the second identification hash value and the second password hash value to obtain a second key reference value whose number of bytes is a third number; wherein the third number is the sum of the second number and the second number;

[0181] Step S602: Perform high-order encryption processing on the second key reference value using a high-order encryption algorithm to generate a second key.

[0182] In some embodiments of the present application, the process of generating the second key is a key step in the user authentication mechanism, which involves integrating and encrypting the hash values ​​of the user registration identifier and the user registration password to generate a strong key for subsequent decryption operations. This process begins by performing hash encryption processing on the user registration identifier and the password to obtain a second identifier hash value and a second password hash value, respectively, which have the same number of bytes, namely the second number.

[0183] In step S601 of some embodiments, the second identification hash value and the second password hash value are integrated. This step forms a longer byte sequence called a second key reference value by splicing the second identification hash value and the second password hash value together. The total number of bytes of this second key reference value, i.e., the third number, is twice the second number because it contains all the hash information of the user registration identification and the user registration password.

[0184] In step S602 of some embodiments, the second key reference value is subjected to high-order encryption processing by a high-order encryption algorithm. The high-order encryption algorithm may include a variety of different encryption technologies, such as AES, RSA, ECC, etc. These algorithms enhance the security of data through a series of complex encryption steps. In this process, the second key reference value is converted into a final second key, which will be used to decrypt the encrypted data sent by the nuclear power Internet of Things terminal.

[0185] The generated second key is a critical step in the authentication process because it will be used to decrypt the authentication encrypted data containing the user's login information. If the second key is strong enough, even if the authentication encrypted data is intercepted during transmission, the attacker will not be able to decipher the authentication encrypted data without the corresponding key. In addition, the second key generation process also helps ensure that only compliant users can pass the authentication, because only the correct user registration ID and user registration password combination can generate the correct second key.

[0186] In step S111 of some embodiments, the authentication encrypted data is decrypted using a second key to obtain a decrypted user identifier and a decryption timestamp.

[0187] It should be noted that the authentication encrypted data is decrypted by the second key. This decryption process requires that the encryption method used to generate the first key and the encryption method used to generate the second key completely match each other to ensure that the authentication encrypted data can be correctly decrypted. After decryption, the nuclear power IoT server will obtain two key information: the decrypted user ID and the decryption timestamp.

[0188] The decrypted user ID is a hash value of the decrypted user name, and the decrypted timestamp is a decrypted time point when the user attempts to log in.

[0189] In steps S112 to S113 of some embodiments, the decrypted user identifier and the decrypted timestamp are verified to obtain a verification result; based on the verification result, an authentication response operation is performed.

[0190] In some embodiments, once the nuclear power IoT server successfully decrypts the encrypted data sent by the nuclear power IoT terminal and obtains the decrypted user ID and decryption timestamp, the next step is to verify the decrypted user ID and decryption timestamp. This verification process is a crucial part of the authentication process, and its purpose is to ensure the compliance and security of the user login request.

[0191] First, the Nuclear Power IoT server verifies the decrypted user ID obtained by decryption. This includes comparing the decrypted user ID with the user registration ID stored in the Nuclear Power IoT server database. If the two are consistent, this indicates that the login information provided by the user matches the information recorded by the Nuclear Power IoT server, thereby verifying the user's identity. In addition, the Nuclear Power IoT server can also verify the decryption timestamp to ensure that the request was issued within a reasonable time frame. This helps prevent replay attacks, where an attacker uses previously intercepted login request information to attempt to illegally log into the system.

[0192] In some embodiments, verifying the decryption timestamp may include checking whether the difference between the current nuclear power IoT server time and the request timestamp is within an acceptable range. This time range can be set according to the system security policy, such as within a few seconds or minutes. If the timestamp verification fails, such as the login timestamp is too far away from the current time of the nuclear power IoT server, the nuclear power IoT server may consider this to be an expired or replayed request and reject the authentication request.

[0193] After verifying that both the user ID and timestamp are passed, the Nuclear Power IoT server will perform an authentication response operation based on the verification result. If the verification is successful, the Nuclear Power IoT server will allow the user to log in, and the authentication response operation performed may be to send an authentication token or session ID to the user device for subsequent session management and access control. If the verification fails, the authentication response operation performed by the Nuclear Power IoT server may be to reject the user's login request, and the failed attempt may be recorded for subsequent security auditing and monitoring.

[0194] Based on this, verifying the decrypted user ID and decrypted timestamp, and performing authentication response operations based on the verification results, is an important part of ensuring the security of the nuclear power industrial Internet of Things system. This process not only verifies the identity of the user, but also ensures the real-time and validity of the request, thereby effectively preventing unauthorized access and security threats. Through this comprehensive verification and response mechanism, the nuclear power Internet of Things server can provide users with a safe and reliable authentication environment.

[0195] Reference Figure 7 According to some more specific embodiments of the present application, step S112 verifies the decrypted user identifier and the decrypted timestamp to obtain a verification result, which may include:

[0196] Step S701, performing consistency comparison on the decrypted user ID based on the user login ID to obtain an ID comparison result;

[0197] Step S702, performing a time difference comparison on the decrypted timestamp based on the current timestamp to obtain a time difference comparison result;

[0198] Step S703, in response to the identification comparison result and the time difference comparison result satisfying the preset verification condition, a verification result of passing the verification is obtained.

[0199] In some embodiments of the present application, once the nuclear power IoT server successfully decrypts the encrypted data sent by the nuclear power IoT terminal and obtains the decrypted user ID and decryption timestamp, the next step is to verify this information. This verification process is a key step in ensuring the integrity and validity of the data and preventing replay attacks.

[0200] In step S701 of some embodiments, it is necessary to perform a consistency comparison on the decrypted user ID. In this process, the nuclear power IoT server will compare the decrypted user ID with the ID provided by the user when logging in. This comparison is to verify whether the decrypted user ID is consistent with the user ID in the original login request. If the two match, it means that the user ID has not been tampered with during the transmission and decryption process, thereby confirming the identity of the user.

[0201] In step S702 of some embodiments, the nuclear power IoT server compares the decrypted timestamp obtained by decryption with the current timestamp. This comparison is to detect whether the decrypted timestamp is within an acceptable time range, which is usually set according to the system security policy. For example, if the set time difference threshold is 1 second, the timestamp is considered valid only when the decrypted timestamp differs from the current timestamp by no more than 1 second. This step helps prevent attackers from using old or replayed data for authentication.

[0202] In step S703 of some embodiments, it is determined whether the preset verification condition is met based on the identification comparison result and the time difference comparison result. If both comparison results meet the requirements, that is, the decrypted user identification is consistent and the timestamp is within an acceptable range, then the nuclear power IoT server will obtain a verification result of passing the verification. This verification result indicates that the user's login request is compliant and was issued within the valid time.

[0203] Through this comprehensive verification mechanism, the embodiment of the present application ensures that only compliant and timely user login requests can be authenticated. This not only improves the security of the system and prevents unauthorized access, but also helps maintain the integrity and reliability of the nuclear power industrial Internet of Things. In this way, the nuclear power Internet of Things server can accurately identify and verify users and provide the required resources and services to compliant users.

[0204] According to some embodiments of the present application, the user authentication method performed by the nuclear power IoT server also includes:

[0205] In response to the identification comparison result reflecting that the user login identification is inconsistent with the decrypted user identification, but the time difference comparison result is less than or equal to the preset time difference, a verification result of a first type of verification failure is obtained;

[0206] Based on the verification result, perform authentication response operations, including:

[0207] In response to the verification result being a first type of verification failure, the authentication of the user login identification and the authentication encryption data is rejected, and an identity authentication operation is performed on the nuclear power Internet of Things terminal.

[0208] In some embodiments of the present application, when the identification comparison result shows that the user login identification is inconsistent with the decrypted user identification, but the time difference comparison result shows that the timestamp verification is within the preset time range, the nuclear power IoT server determines this situation as a first type of verification failure. This situation means that the user's identity information has been tampered with during the transmission process, but the requested timestamp is valid, indicating that the request was issued within a reasonable time. This may be due to a network attack, system error, or other reasons that cause the user identification information to be incorrectly modified. In order to maintain the security of the system, the nuclear power IoT server needs to take appropriate measures to handle this verification failure.

[0209] For the verification results of the first type of verification failure, the nuclear power IoT server will perform the corresponding authentication response operation. Specifically, the nuclear power IoT server will refuse authentication through the user login identification and authentication encryption data, which means that even if the timestamp verification passes, the nuclear power IoT server still considers the authentication request to be illegal due to inconsistent user identification, and therefore does not allow the user to log in. In addition, the nuclear power IoT server can also perform identity authentication operations on the nuclear power IoT terminal. This can include resending the authentication request, requiring the user to provide additional identity information, or taking other security measures to verify the user's identity. The purpose of this step is to ensure that the security of the system is not compromised and to prevent unauthorized access.

[0210] In general, when faced with a first-class verification failure, the nuclear power IoT server will adopt a conservative security strategy, reject the authentication request and require further identity verification. This practice helps prevent potential security threats and ensures that only legitimate and verified users can access system resources. In this way, the embodiments of the present application can improve the security of the nuclear power industrial IoT and protect critical infrastructure and sensitive data from unauthorized access.

[0211] According to some embodiments of the present application, the user authentication method performed by the nuclear power IoT server also includes:

[0212] In response to the identification comparison result reflecting that the user login identification is consistent with the decrypted user identification, but the time difference comparison result is greater than the preset time difference, a verification result of a second type of verification failure is obtained;

[0213] Based on the verification result, perform authentication response operations, including:

[0214] In response to the verification result being a second type of verification failure, the authentication of the user login identification and authentication encryption data is rejected, and an authentication timeout prompt is fed back to the nuclear power Internet of Things terminal.

[0215] In some embodiments of the present application, when the identification comparison result shows that the user login identification is consistent with the decrypted user identification, this means that the user's identity information has not been tampered with during the transmission and decryption process, and the user identification is correct. However, if the time difference comparison result shows that the difference between the requested timestamp and the current time of the nuclear power IoT server is greater than the preset time difference, this may mean that the authentication request was issued in too long a time, and there is a risk of replay attack. In this case, the nuclear power IoT server determines this situation as a second type of verification failure. A replay attack is a security threat in which an attacker attempts to re-execute certain operations or access certain data by capturing previous network requests and then sending the same request again. In order to protect the system from such attacks, the nuclear power IoT server needs to be able to identify and reject authentication requests that are beyond a reasonable time range.

[0216] For the verification results of the second type of verification failure, the nuclear power IoT server will perform the corresponding authentication response operation. Specifically, the nuclear power IoT server will reject the authentication through the user login identification and authentication encryption data. Even if the user identification is correct, the nuclear power IoT server still considers the authentication request to be unsafe because the timestamp exceeds the preset time difference, and therefore does not allow the user to log in.

[0217] In addition, the Nuclear Power IoT server can also provide the Nuclear Power IoT terminal with an authentication timeout prompt. This prompt will inform the user or system administrator that the authentication request failed because the timestamp of the request is too far away from the current time of the Nuclear Power IoT server. This is not only a friendly reminder to the user, but also a protective measure for system security, because it can remind the user or administrator to pay attention to possible security issues.

[0218] In general, when facing the second type of verification failure, the nuclear power IoT server will take necessary security measures, reject the authentication request and provide feedback of authentication timeout. This practice helps to prevent potential replay attacks, ensure the security of the system, and maintain the integrity of user data. In this way, the embodiments of the present application can improve the security of the nuclear power industrial IoT and protect critical infrastructure and sensitive data from unauthorized access.

[0219] According to some embodiments of the present application, the user authentication method performed by the nuclear power IoT server also includes:

[0220] In response to the identification comparison result reflecting that the user login identification is inconsistent with the decrypted user identification, and the time difference comparison result is greater than the preset time difference, a verification result of a third type of verification failure is obtained;

[0221] Based on the verification result, perform authentication response operations, including:

[0222] In response to the verification result being a third-category verification failure, refusing authentication of the user login identification and authentication encryption data, and marking the nuclear power Internet of Things terminal as a key observation terminal;

[0223] In response to the number of times that the nuclear power Internet of Things terminal is marked as a key observation terminal meeting a preset abnormality determination condition, the nuclear power Internet of Things terminal is marked as an abnormal terminal, and access to the nuclear power Internet of Things terminal is restricted.

[0224] In some embodiments of the present application, when the identification comparison result shows that the user login identification is inconsistent with the decrypted user identification, and the time difference comparison result also shows that the difference between the requested timestamp and the current time of the nuclear power IoT server is greater than the preset time difference, the nuclear power IoT server determines this situation as a third-category verification failure. This situation indicates that there are more serious security issues, such as the user identification has been tampered with, and the request may be a replay attack. In order to deal with such high-risk security threats, the nuclear power IoT server will take a series of strict authentication response operations.

[0225] First, the nuclear power IoT server will refuse authentication through user login identification and authentication encryption data, ensuring that the security of the system will not be compromised by potential attacks.

[0226] In addition, the nuclear power IoT server will also mark the IoT terminal as a key observation terminal. This means that the nuclear power IoT server will monitor and analyze the subsequent behavior of the terminal more closely to detect abnormal behavior or potential security threats in a timely manner. This marking can trigger a series of security measures, such as increasing the audit frequency of the terminal, restricting its access to certain sensitive resources or functions, or requiring the terminal to provide additional authentication information.

[0227] If the number of times a nuclear power IoT terminal is marked as a key observation terminal reaches the preset abnormality judgment condition, the nuclear power IoT server will further mark the terminal as an abnormal terminal. This judgment is based on the terminal triggering security warnings or failed authentication attempts multiple times within a period of time. Once a nuclear power IoT terminal is marked as abnormal, the nuclear power IoT server will take more stringent measures, such as restricting or completely prohibiting the terminal's access rights, until the problem is resolved and the terminal's security is re-verified.

[0228] Through this multi-level, gradually enhanced security response strategy, the embodiments of the present application can effectively identify and respond to various security threats, protect the critical infrastructure and sensitive data of the nuclear power industrial Internet of Things from unauthorized access and attacks. At the same time, this also helps to timely discover and resolve potential security issues and improve the security and reliability of the entire system.

[0229] Reference Figure 8 , Figure 8The hardware structure of an electronic device of another embodiment is illustrated. The electronic device may include:

[0230] The processor 801 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0231] The memory 802 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 802 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 802, and the processor 801 calls and executes the user authentication method based on the nuclear power Internet of Things in the embodiment of this application;

[0232] Input / output interface 803, used to implement information input and output;

[0233] The communication interface 804 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0234] A bus 805 that transmits information between the various components of the device (e.g., the processor 801, the memory 802, the input / output interface 803, and the communication interface 804);

[0235] The processor 801 , the memory 802 , the input / output interface 803 and the communication interface 804 are connected to each other in communication within the device via a bus 805 .

[0236] The embodiment of the present application also provides a computer program product, which includes a computer program. The processor of the computer device reads and executes the computer program, so that the computer device executes the user authentication method based on the nuclear power Internet of Things.

[0237] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "comprises" and "comprising" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0238] It should be understood that in the present disclosure, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0239] It should be understood that in the description of the embodiments of the present application, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood to not include the number, and above, below, within, etc. are understood to include the number.

[0240] In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0241] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0242] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0243] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a nuclear power Internet of Things server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium may include: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0244] It should also be understood that the various implementations provided in the embodiments of the present application can be combined arbitrarily to achieve different technical effects.

[0245] The above is a specific description of the implementation methods of the present disclosure, but the present disclosure is not limited to the above implementation methods. Technical personnel familiar with the art can also make various equivalent modifications or substitutions without violating the spirit of the present disclosure. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present disclosure.

Claims

1. A user authentication method based on nuclear power Internet of Things, characterized in that: Applied to a nuclear power Internet of Things terminal, the method includes: Obtaining a user login request, and extracting a user login identifier and a target authentication password from the user login request; wherein the user login request is configured with a corresponding login timestamp; Performing hash encryption processing on the user login identification to obtain a first identification hash value; Performing hash encryption processing on the user login password to obtain a first password hash value; Generate a first key according to the first identification hash value and the first password hash value; Encrypting the user login identifier and the login timestamp based on the first key to obtain authentication encrypted data; The user login identifier and the authentication encrypted data are sent to the nuclear power Internet of Things server so that the nuclear power Internet of Things server performs an authentication response operation.

2. The method according to claim 1, characterized in that: The performing hash encryption processing on the user login identifier to obtain a first identifier hash value includes: The user login identifier is hashed by a secure hash algorithm to obtain a first transition identifier hash value; Signing the first transition identifier hash value using an information digest encryption algorithm to generate the first identifier hash value; The performing hash encryption processing on the user login password to obtain a first password hash value includes: The user login password is hashed by the secure hash algorithm to obtain a first transitional password hash value; The first transitional cryptographic hash value is signed using the information digest encryption algorithm to generate the first cryptographic hash value.

3. The method according to claim 2, characterized in that The number of bytes of the first identification hash value is a first number, the number of bytes of the first password hash value is a second number, and the generating of a first key according to the first identification hash value and the first password hash value includes: Integrate the first identification hash value and the first password hash value to obtain a first key reference value whose number of bytes is a third number; wherein the third number is the sum of the first number and the second number; The first key reference value is subjected to high-order encryption processing by a high-order encryption algorithm to generate the first key.

4. The method according to claim 1, characterized in that Before sending the user login identifier and the authentication encryption data to the nuclear power IoT server, the method further includes: In response to the target authentication password being binary data, performing a character transcoding operation on the authentication encrypted data; The step of sending the user login identifier and the authentication encrypted data to the nuclear power IoT server includes: The user login identification and the authentication encrypted data after character transcoding operation are sent to the nuclear power Internet of Things server.

5. A user authentication method based on nuclear power Internet of Things, characterized in that: Applied to nuclear power IoT servers, including: Obtaining a user login identifier and authentication encryption data sent by a nuclear power Internet of Things terminal; wherein the user login identifier and the authentication encryption data are obtained by the user authentication method based on the nuclear power Internet of Things according to any one of claims 1 to 5; Using the user login identifier as an index, a query is performed in a preset registration information database to obtain a user registration identifier and a user registration password; Performing hash encryption processing on the user registration identifier to obtain a second identifier hash value; Performing hash encryption processing on the user registration password to obtain a second password hash value; Generate a second key according to the second identification hash value and the second password hash value; Decrypting the authentication encrypted data using the second key to obtain a decrypted user identifier and a decrypted timestamp; Verifying the decryption user identifier and the decryption timestamp to obtain a verification result; Based on the verification result, an authentication response operation is performed.

6. The method according to claim 5, characterized in that The performing hash encryption processing on the user registration identifier to obtain a second identifier hash value includes: The user registration identifier is hashed by a secure hash algorithm to obtain a second transition identifier hash value; The second transition identifier hash value is signed by using an information digest encryption algorithm to generate the second identifier hash value. The performing hash encryption processing on the user registration password to obtain a second password hash value includes: The user registration password is hashed by the secure hash algorithm to obtain a second transitional password hash value; The second transitional cryptographic hash value is signed using the information digest encryption algorithm to generate the second cryptographic hash value.

7. The method according to claim 6, characterized in that The number of bytes of the second identification hash value is a second number, the number of bytes of the second password hash value is a second number, and the generating of the second key according to the second identification hash value and the second password hash value includes: Integrate the second identification hash value and the second password hash value to obtain a second key reference value whose number of bytes is a third number; wherein the third number is the sum of the second number and the second number; The second key reference value is subjected to high-order encryption processing by a high-order encryption algorithm to generate the second key.

8. The method according to claim 5, characterized in that The verifying the decrypted user identifier and the decrypted timestamp to obtain a verification result includes: Perform consistency comparison on the decrypted user ID based on the user login ID to obtain an ID comparison result; Performing a time difference comparison on the decrypted timestamp based on the current timestamp to obtain a time difference comparison result; In response to the identification comparison result and the time difference comparison result satisfying a preset verification condition, the verification result indicating that the verification has passed is obtained.

9. The method according to claim 8, characterized in that The method further comprises: In response to the identification comparison result reflecting that the user login identification is inconsistent with the decryption user identification, but the time difference comparison result is less than or equal to the preset time difference, obtaining the verification result of the first type of verification failure; The performing an authentication response operation based on the verification result includes: In response to the verification result being a failure of the first type of verification, the authentication of the user login identifier and the authentication encryption data is rejected, and an identity authentication operation is performed on the nuclear power Internet of Things terminal.

10. The method according to claim 8, characterized in that The method further comprises: In response to the identification comparison result reflecting that the user login identification is consistent with the decryption user identification, but the time difference comparison result is greater than the preset time difference, obtaining the verification result of the second type of verification failure; The performing an authentication response operation based on the verification result includes: In response to the verification result being a failure of the second type of verification, the authentication of the user login identifier and the authentication encryption data is rejected, and an authentication timeout prompt is fed back to the nuclear power Internet of Things terminal.

11. The method according to claim 8, characterized in that The method further comprises: In response to the identification comparison result reflecting that the user login identification is inconsistent with the decryption user identification, and the time difference comparison result is greater than the preset time difference, obtaining the verification result of the third type of verification failure; The performing an authentication response operation based on the verification result includes: In response to the verification result being a failure of the third type of verification, refusing authentication of the user login identifier and the authentication encryption data, and marking the nuclear power Internet of Things terminal as a key observation terminal; In response to the number of times that the nuclear power Internet of Things terminal is marked as the key observation terminal meeting a preset abnormality determination condition, the nuclear power Internet of Things terminal is marked as an abnormal terminal, and access to the nuclear power Internet of Things terminal is restricted.

12. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the user authentication method based on the nuclear power Internet of Things as described in any one of claims 1 to 11 is implemented.

13. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement the user authentication method based on the nuclear power Internet of Things as described in any one of claims 1 to 11.

Images