Substation WAPI network security management method based on quantum authentication

Abstract

The invention discloses a transformer substation WAPI network security management method based on quantum authentication, and the method comprises the steps: building a unified management quantum key system, providing a quantum key source for a WAPI authentication system, and forming a quantum certificate in combination with a WAPI system AS certificate generation mode. Through the quantum certificate, part of business terminals of the transformer station, such as mobile operation, monitoring ball and other Internet of Things businesses, are accessed to the power communication network through the WAPI network of the transformer station. The WAPI quantum certificate has the characteristic of'one-time pad ', namely each authentication certificate belongs to a key generated by a true random number, so that the communication security is greatly improved. And in the aspect of a certificate updating mechanism, the certificate can be updated again according to different conditions such as user configuration strategies, time, power-on again after network disconnection and the like, so that the authentication certificate can have a dynamic mechanism, and the security of the WAPI is further improved. Through a WAPI network security mechanism of quantum authentication, security construction of a digital substation and a novel power system can be actively promoted, and the method has a good application prospect.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a substation WAPI network security management method based on quantum authentication. Background Art

[0002] As a security protocol, WAPI (Wireless LAN Authentication and Privacy Infrastructure) has shown significant advantages in wireless connections in substations. WAPI has been regarded as the preferred solution for reliable WLAN (Wireless LAN) technology in the power industry. WAPI networking has currently formed a complete system of data encryption and user authentication between CPE (wireless terminal access equipment), AP (authentication server), AC (access controller) and AS (authentication server), but there are still defects in the key source generation mechanism, unified key management, key update mechanism, etc.

[0003] The existing WAPI network uses traditional passwords as a security mechanism for business terminal access. Traditional password devices mainly include VPN, password cards, server password machines and other password devices. The password algorithms used are based on asymmetric cryptographic technology. The security of its keys is guaranteed by the security of the inverse calculation algorithm of the one-way function. As the counting ability increases, all one-way functions will become vulnerable, and the security of the keys cannot be guaranteed. At the same time, the development of quantum computing has also brought threats to traditional encryption technology. Quantum computers can easily crack asymmetric algorithms that are considered unbreakable in traditional encryption systems.

[0004] Based on the characteristics of quantum keys such as true randomness, non-eavesdropping, unpredictability, and non-repetition, this solution establishes a unified quantum key system at the provincial level as the quantum key source for the WAPI authentication system, and combines the original WAPI system AS certificate generation mode to form a WAPI quantum certificate. The WAPI quantum certificate has the characteristic of "one-time one-key", that is, each authentication certificate is a key generated by a true random number, which greatly improves the security of communications. In terms of the certificate update mechanism, the certificate can be updated according to different situations such as time, network disconnection and power on, etc. according to user configuration policies, so that the authentication certificate can have a dynamic mechanism to further enhance the security of WAPI. Summary of the invention

[0005] In view of this, the purpose of the present invention is to propose a substation WAPI network security management method based on quantum authentication which is reliable and safe.

[0006] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0007] A substation WAPI network security management method based on quantum authentication, comprising:

[0008] Build a quantum key system and authentication program server at the first-level management level to provide key sources and quantum authentication programs respectively;

[0009] In the secondary management layer, an authentication server AS and an access server AC based on the WAPI network system are built, and the authentication server AS is connected to the authentication program server for communication;

[0010] Build a WAPI network system in the substation. At the same time, use the access switch connected to the WAPI network to establish an in-station wired network. At the same time, deploy multiple wireless access points (APs) connected to the access switch in the substation.

[0011] One or more service terminals STA in the substation establish communication interaction with the wireless access point AP through the customer premise terminal CPE as a communication bridge;

[0012] When the service terminal STA in the substation is associated and connected to the wireless access point AP, the wireless access point AP sends authentication activation information to the service terminal STA to start the preset authentication process.

[0013] As a preferred implementation method, preferably, the preset identification process described in this solution includes the following:

[0014] Access authentication request: The service terminal STA responds to the authentication activation information sent by the wireless access point AP, sends an access authentication request to the wireless access point AP, and sends the STA quantum certificate and the current system time of the service terminal STA to the wireless access point AP, where the system time is set to the access authentication request time;

[0015] Certificate authentication request: After receiving the access authentication request from the service terminal STA, the wireless access point AP sends a certificate authentication request to the authentication server AS of the secondary management layer through the access switch to which it is connected. The certificate authentication request includes a certificate authentication request message with an AP signature attached. The certificate authentication request message is a collection of the STA quantum certificate, the access authentication request time, and the AP quantum certificate and quantum key possessed by the wireless access point AP;

[0016] Certificate authentication response: After receiving the certificate authentication request from the wireless access point AP, the authentication server AS verifies the AP signature and AP quantum certificate in the certificate authentication request message. If they are incorrect, the authentication process fails. Otherwise, the legitimacy of the wireless access point AP and STA quantum certificates is further verified. After the verification is completed, the authentication server AS generates STA certificate authentication result information and AP quantum certificate authentication result information, and aggregates them into a certificate authentication response message with a signature and sends it back to the wireless access point AP;

[0017] Access authentication response: The wireless access point AP performs signature verification on the certificate authentication response returned by the authentication server AS, and then parses to obtain the authentication result of the STA quantum certificate; the wireless access point AP then sends the certificate authentication response message to the service terminal STA, which verifies the signature of the authentication server AS and then parses to obtain the authentication result of the AP quantum certificate; the service terminal STA then decides whether to access the wireless access point AP based on the authentication result of the AP quantum certificate.

[0018] As a preferred implementation mode, preferably, the substation in this solution is also equipped with a security proxy module that is in communication with a wireless access point AP or an access switch, and the security proxy module is used for message encryption; the secondary management layer is also equipped with a security access gateway for decrypting messages;

[0019] When the wireless access point AP sends a certificate authentication request message to the authentication server AS, it also encrypts the certificate authentication request message through the security proxy module, and then the security access gateway of the secondary management layer decrypts the message and sends it to the authentication server AS.

[0020] As a preferred implementation mode, preferably, the STA certificate authentication result information described in this solution includes the STA quantum certificate, the authentication result corresponding to the STA quantum certificate, and the signature of the authentication server AS on the STA quantum certificate and its corresponding authentication result;

[0021] The AP quantum certificate authentication result information includes the AP quantum certificate, the authentication result corresponding to the AP quantum certificate, the access authentication request time, and the signature of the authentication server AS on the AP quantum certificate and its corresponding authentication result.

[0022] As a preferred implementation method, preferably, after the authentication server AS of this scheme receives the certificate authentication request sent by the wireless access point AP, if the AP signature and AP quantum certificate in the certificate authentication request message are incorrectly verified, the authentication process fails, and the wireless access point AP disassociates the corresponding service terminal STA in the substation.

[0023] As a preferred implementation method, preferably, when the customer premise terminal CPE of this solution serves as a communication bridge to establish communication interaction with the wireless access point AP, it also undergoes authentication processing, which includes:

[0024] Authentication activation: When the customer premise terminal CPE communicates with the wireless access point AP and associates with the AP, the wireless access point AP sends an authentication activation message to the customer premise terminal CPE to start the entire authentication process;

[0025] Access authentication request: The customer premise terminal CPE responds to the authentication activation information sent by the wireless access point AP and sends an access authentication request to the wireless access point AP, that is, the CPE quantum certificate of the customer premise terminal CPE and its current system time are sent to the wireless access point AP, where the system time is called the access authentication request time;

[0026] Certificate authentication request: After receiving the access authentication request from the customer front-end terminal CPE, the wireless access point AP sends a certificate authentication request with the AP signature to the access server AC, that is, sends the CPE quantum certificate and access authentication request time to the access server AC;

[0027] The access server AC sends a certificate authentication request message with the AP signature to the authentication server AS. The certificate authentication request message includes: AP signature, CPE quantum certificate, access authentication request time;

[0028] Certificate authentication response: After the authentication server AS receives the certificate authentication request message from the access server AC, it first verifies the AP signature of the wireless access point AP. If it is incorrect, the authentication process fails. Otherwise, it further verifies the legitimacy of the wireless access point AP and CPE quantum certificates. After the verification is completed, the authentication server AS sends the CPE certificate authentication result information in the form of a certificate authentication response message with a signature back to the access server AC.

[0029] Access authentication response: The access server AC performs signature verification on the certificate authentication response returned by the authentication server AS to obtain the authentication result of the CPE quantum certificate. The access server AC sends the certificate authentication response message to the wireless access point AP, which transparently transmits it to the customer premise terminal CPE. After the customer premise terminal CPE verifies the signature of the authentication server AS, it obtains the authentication result of the authentication server AS quantum certificate. The customer premise terminal CPE decides whether to access the wireless access point AP corresponding to the access server AC based on the authentication result.

[0030] As a preferred implementation mode, preferably, the CPE certificate authentication result information of this solution includes the STA quantum certificate, the authentication result and the signature of the access server AC on them.

[0031] As a preferred implementation method, preferably, the first-level management level in this solution is a provincial power company, and the second-level management level is a municipal power company.

[0032] As a preferred implementation mode, preferably, the present solution further includes: the WAPI network system updates the WAPI authentication certificate at a preset time interval, which includes:

[0033] Certificate acquisition: When the quantum authentication program requests a certificate from the authentication server AS, the authentication server AS outputs the certificate file to the certificate service online and securely;

[0034] Certificate issuance: After the quantum authentication program obtains the certificate, it issues the certificate to the customer front-end terminal CEP or other WAPI terminals through a secure channel;

[0035] Loading certificate: After successfully downloading the certificate, the customer premise terminal CPE or other WAPI terminal reports the download status to the certificate service to verify the validity of the certificate;

[0036] After verifying that the certificate is valid, the update process is completed and waits for the next update to be triggered.

[0037] As a preferred implementation method, preferably, the quantum key system described in this scheme is composed of a quantum random number generator, a quantum key exchange cipher machine, a quantum cryptographic service engine device, and a quantum key recharging device.

[0038] By adopting the above-mentioned technical scheme, the present invention has the following beneficial effects compared with the prior art: this scheme provides a quantum key source for the WAPI authentication system by establishing a quantum key system under unified management, and forms a quantum certificate in combination with the AS certificate generation mode of the WAPI system. Through quantum certificates, some business terminals of substations, such as mobile operations, control balls, robot inspections, video surveillance and other IoT services, are connected to the power communication network through the substation WAPI network. The WAPI quantum certificate has the characteristic of "one-time one-key", that is, each authentication certificate belongs to a key generated by a true random number, which greatly improves the security of communication. In terms of the certificate update mechanism, the certificate can be updated according to different situations such as time, network disconnection and power on, etc. according to the user configuration strategy, so that the authentication certificate can have a dynamic mechanism to further improve the security of WAPI. Through the WAPI network security mechanism of quantum authentication, it can actively promote the security construction of digital substations and new power systems, and it has good application prospects in the field of power engineering or communication engineering design technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 This is the overall architecture diagram of the WAPI network after the deployment of this solution method;

[0041] Figure 2This is the quantum WAPI network deployment topology diagram of this solution;

[0042] Figure 3 This is the business terminal quantum authentication process in this solution method;

[0043] Figure 4 This is the flow chart of the WAPI authentication certificate update solution in this solution method. DETAILED DESCRIPTION

[0044] The present invention will be further described in detail below in conjunction with the accompanying drawings and examples. It is particularly noted that the following examples are only used to illustrate the present invention, but are not intended to limit the scope of the present invention. Similarly, the following examples are only partial embodiments of the present invention rather than all embodiments, and all other embodiments obtained by those of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0045] This embodiment provides a substation WAPI network security management method based on quantum authentication, which includes:

[0046] Build a quantum key system and authentication program server at the first-level management level to provide key sources and quantum authentication programs respectively;

[0047] In the secondary management layer, an authentication server AS and an access server AC based on the WAPI network system are built, and the authentication server AS is connected to the authentication program server for communication;

[0048] Build a WAPI network system in the substation. At the same time, use the access switch connected to the WAPI network to establish an in-station wired network. At the same time, deploy multiple wireless access points (APs) connected to the access switch in the substation.

[0049] One or more service terminals STA in the substation establish communication interaction with the wireless access point AP through the customer premise terminal CPE as a communication bridge;

[0050] When the service terminal STA in the substation is associated and connected to the wireless access point AP, the wireless access point AP sends authentication activation information to the service terminal STA to start the preset authentication process.

[0051] Combination Figure 1 As shown, the first-level management level in this plan is the provincial power company, and the second-level management level is the municipal power company.

[0052] This embodiment deploys a quantum key system and an authentication program server (authentication program server) in the provincial power company, establishes a quantum key source and an authentication program based on this, establishes the AS and AC of the WAPI network in the municipal company, and also establishes a WAPI network system in the substation AP. In the substation, an access switch is used to establish an in-station wired network. STA (various inspection, monitoring, sensing and other service terminals) receives and wirelessly sends to AP through CPE as a bridge. AP requests access to the switch network, and the switch accesses the power communication private network through the aggregation switch. STA access network uses quantum key established by the provincial company for quantum authentication to achieve secure access identification of the terminal.

[0053] Figure 2 The quantum WAPI network deployment topology diagram of this solution is shown.

[0054] The deployment instructions on the provincial company side are as follows:

[0055] Quantum authentication procedure:

[0056] (1) The quantum authentication program is one of the core components of the quantum WAPI network system. It is mainly responsible for implementing the identity authentication function in the quantum WAPI network. During the identity authentication process, nodes will use quantum keys to encrypt communications to verify each other's identities. Only nodes holding legitimate quantum keys can pass identity authentication and obtain access to the quantum WAPI network.

[0057] (2) The quantum authentication program can be deployed using a separate server or on an existing provincial communication application platform.

[0058] Quantum Key Systems:

[0059] (1) Providing secure keys: The quantum key system uses the characteristics of quantum mechanics to provide secure and random keys for both communicating parties in the network, ensuring that the keys cannot be eavesdropped or cracked during transmission.

[0060] (2) Enhanced network security: Through quantum key distribution, both communicating parties can ensure the confidentiality and integrity of information transmission, effectively prevent information leakage and illegal access, and thus enhance the security of the entire network.

[0061] (3) Support encrypted communication: The quantum key system can be combined with the encryption mechanism in the WAPI network system to achieve encrypted transmission of information, ensuring that only legitimate recipients can decrypt and obtain the original information.

[0062] (4) Quantum key system: It consists of four devices: quantum random number generator, quantum key exchange cipher machine, quantum cryptographic service engine device, and quantum key recharge device, and is uniformly deployed in the production management area.

[0063] The deployment instructions for municipal companies are as follows:

[0064] AS Server:

[0065] (1) In the quantum WAPI network system, AS (Authentication Server) plays a core role, responsible for verifying the identity of network devices and terminals, ensuring that only legitimate entities can access the network. By issuing, verifying and revoking WAPI certificates, AS implements a two-way authentication mechanism, effectively ensuring the security and reliability of the network. At the same time, AS also supports dynamic key negotiation to provide encryption protection for data transmission.

[0066] Combination Figure 3 As shown, it shows the implementation process of the service terminal STA in quantum authentication of this solution, which includes:

[0067] Authentication activation. When a STA (various service terminals) associates with an AP, the AP sends an authentication activation message to the STA to start the entire authentication process.

[0068] Access authentication request: The service terminal STA responds to the authentication activation information sent by the wireless access point AP, sends an access authentication request to the wireless access point AP, and sends the STA quantum certificate and the current system time of the service terminal STA to the wireless access point AP, where the system time is set to the access authentication request time;

[0069] Certificate authentication request: After receiving the access authentication request from the service terminal STA, the wireless access point AP sends a certificate authentication request to the authentication server AS of the secondary management layer through the access switch to which it is connected. The certificate authentication request includes a certificate authentication request message with an AP signature attached. The certificate authentication request message is a collection of the STA quantum certificate, the access authentication request time, and the AP quantum certificate and quantum key possessed by the wireless access point AP;

[0070] Certificate authentication response: After receiving the certificate authentication request from the wireless access point AP, the authentication server AS verifies the AP signature and AP quantum certificate in the certificate authentication request message. If they are incorrect, the authentication process fails. Otherwise, the legitimacy of the wireless access point AP and STA quantum certificates is further verified. After the verification is completed, the authentication server AS generates STA certificate authentication result information and AP quantum certificate authentication result information, and aggregates them into a certificate authentication response message with a signature and sends it back to the wireless access point AP;

[0071] Access authentication response: The wireless access point AP performs signature verification on the certificate authentication response returned by the authentication server AS, and then parses to obtain the authentication result of the STA quantum certificate; the wireless access point AP then sends the certificate authentication response message to the service terminal STA, which verifies the signature of the authentication server AS and then parses to obtain the authentication result of the AP quantum certificate; the service terminal STA then decides whether to access the wireless access point AP based on the authentication result of the AP quantum certificate.

[0072] At this point, the identity authentication process between STA and AP is completed. If the authentication is successful, AP allows STA to access, otherwise it will disassociate. That is, after the authentication server AS of this solution receives the certificate authentication request sent by the wireless access point AP, if the AP signature and AP quantum certificate in the certificate authentication request message are not correctly verified, the authentication process fails, and the wireless access point AP disassociates the corresponding service terminal STA in the substation.

[0073] Among them, as a preferred implementation method, preferably, the substation described in this scheme is also deployed with a security proxy module that is communicated with the wireless access point AP or the access switch, and the security proxy module is used for message encryption; the secondary management layer is also deployed with a secure access gateway for decrypting the message.

[0074] Correspondingly, when the wireless access point AP sends a certificate authentication request message to the authentication server AS, it also encrypts the certificate authentication request message through the security proxy module, and then the security access gateway of the secondary management layer decrypts it and sends it to the authentication server AS.

[0075] In addition, as a preferred implementation method, preferably, the STA certificate authentication result information described in this scheme includes the STA quantum certificate, the authentication result corresponding to the STA quantum certificate, and the signature of the authentication server AS on the STA quantum certificate and its corresponding authentication result; the AP quantum certificate authentication result information includes the AP quantum certificate, the authentication result corresponding to the AP quantum certificate, the access authentication request time, and the signature of the authentication server AS on the AP quantum certificate and its corresponding authentication result.

[0076] Combination Figure 4 As shown, with respect to the WAPI authentication certificate update, the scheme of this embodiment includes: the WAPI network system updates the WAPI authentication certificate at a preset time interval, which includes:

[0077] Certificate acquisition: When the quantum authentication program requests a certificate from the authentication server AS, the authentication server AS outputs the certificate file to the certificate service online and securely;

[0078] Certificate issuance: After the quantum authentication program obtains the certificate, it issues the certificate to the customer front-end terminal CEP or other WAPI terminals through a secure channel;

[0079] Loading certificate: After successfully downloading the certificate, the customer premise terminal CPE or other WAPI terminal reports the download status to the certificate service to verify the validity of the certificate;

[0080] After verifying that the certificate is valid, the update process is completed and waits for the next update to be triggered.

[0081] In addition to the above, when the customer premise terminal CPE of this solution acts as a communication bridge to establish communication interaction with the wireless access point AP, it also undergoes authentication processing, which includes:

[0082] Authentication activation: When the customer premise terminal CPE communicates with the wireless access point AP and associates with the AP, the wireless access point AP sends an authentication activation message to the customer premise terminal CPE to start the entire authentication process;

[0083] Access authentication request: The customer premise terminal CPE responds to the authentication activation information sent by the wireless access point AP and sends an access authentication request to the wireless access point AP, that is, the CPE quantum certificate of the customer premise terminal CPE and its current system time are sent to the wireless access point AP, where the system time is called the access authentication request time;

[0084] Certificate authentication request: After receiving the access authentication request from the customer front-end terminal CPE, the wireless access point AP sends a certificate authentication request with the AP signature to the access server AC, that is, sends the CPE quantum certificate and access authentication request time to the access server AC;

[0085] The access server AC sends a certificate authentication request message with the AP signature to the authentication server AS. The certificate authentication request message includes: AP signature, CPE quantum certificate, access authentication request time;

[0086] Certificate authentication response: After the authentication server AS receives the certificate authentication request message from the access server AC, it first verifies the AP signature of the wireless access point AP. If it is incorrect, the authentication process fails. Otherwise, it further verifies the legitimacy of the wireless access point AP and CPE quantum certificates. After the verification is completed, the authentication server AS sends the CPE certificate authentication result information in the form of a certificate authentication response message with a signature back to the access server AC.

[0087] Access authentication response: The access server AC performs signature verification on the certificate authentication response returned by the authentication server AS to obtain the authentication result of the CPE quantum certificate. The access server AC sends the certificate authentication response message to the wireless access point AP, which transparently transmits it to the customer premise terminal CPE. After the customer premise terminal CPE verifies the signature of the authentication server AS, it obtains the authentication result of the authentication server AS quantum certificate. The customer premise terminal CPE decides whether to access the wireless access point AP corresponding to the access server AC based on the authentication result.

[0088] As a preferred implementation mode, preferably, the CPE certificate authentication result information of this solution includes the STA quantum certificate, the authentication result and the signature of the access server AC on them.

[0089] The above descriptions are only some embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any equivalent device or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A substation WAPI network security management method based on quantum authentication, characterized in that: It includes: Build a quantum key system and authentication program server at the first-level management level to provide key sources and quantum authentication programs respectively; In the secondary management layer, an authentication server AS and an access server AC based on the WAPI network system are built, and the authentication server AS is connected to the authentication program server for communication; Build a WAPI network system in the substation. At the same time, use the access switch connected to the WAPI network to establish an in-station wired network. At the same time, deploy multiple wireless access points (APs) connected to the access switch in the substation. One or more service terminals STA in the substation establish communication interaction with the wireless access point AP through the customer premise terminal CPE as a communication bridge; When the service terminal STA in the substation is associated and connected to the wireless access point AP, the wireless access point AP sends authentication activation information to the service terminal STA to start the preset authentication process.

2. The substation WAPI network security management method based on quantum authentication as claimed in claim 1 is characterized in that: The preset identification process includes the following: Access authentication request: The service terminal STA responds to the authentication activation information sent by the wireless access point AP, sends an access authentication request to the wireless access point AP, and sends the STA quantum certificate and the current system time of the service terminal STA to the wireless access point AP, where the system time is set to the access authentication request time; Certificate authentication request: After receiving the access authentication request from the service terminal STA, the wireless access point AP sends a certificate authentication request to the authentication server AS of the secondary management layer through the access switch to which it is connected. The certificate authentication request includes a certificate authentication request message with an AP signature attached. The certificate authentication request message is a collection of the STA quantum certificate, the access authentication request time, and the AP quantum certificate and quantum key possessed by the wireless access point AP; Certificate authentication response: After receiving the certificate authentication request from the wireless access point AP, the authentication server AS verifies the AP signature and AP quantum certificate in the certificate authentication request message. If they are incorrect, the authentication process fails. Otherwise, the legitimacy of the wireless access point AP and STA quantum certificates is further verified. After the verification is completed, the authentication server AS generates STA certificate authentication result information and AP quantum certificate authentication result information, and aggregates them into a certificate authentication response message with a signature and sends it back to the wireless access point AP; Access authentication response: The wireless access point AP performs signature verification on the certificate authentication response returned by the authentication server AS, and then parses to obtain the authentication result of the STA quantum certificate; the wireless access point AP then sends the certificate authentication response message to the service terminal STA, which verifies the signature of the authentication server AS and then parses to obtain the authentication result of the AP quantum certificate; the service terminal STA then decides whether to access the wireless access point AP based on the authentication result of the AP quantum certificate.

3. The substation WAPI network security management method based on quantum authentication as claimed in claim 2 is characterized in that: The substation is also equipped with a security proxy module that is in communication with a wireless access point AP or an access switch, and the security proxy module is used for message encryption; the secondary management layer is also equipped with a security access gateway for decrypting messages; When the wireless access point AP sends a certificate authentication request message to the authentication server AS, it also encrypts the certificate authentication request message through the security proxy module, and then the security access gateway of the secondary management layer decrypts the message and sends it to the authentication server AS.

4. The substation WAPI network security management method based on quantum authentication as claimed in claim 2 is characterized in that: The STA certificate authentication result information includes the STA quantum certificate, the authentication result corresponding to the STA quantum certificate, and the signature of the authentication server AS on the STA quantum certificate and its corresponding authentication result; The AP quantum certificate authentication result information includes the AP quantum certificate, the authentication result corresponding to the AP quantum certificate, the access authentication request time, and the signature of the authentication server AS on the AP quantum certificate and its corresponding authentication result.

5. The substation WAPI network security management method based on quantum authentication as claimed in claim 2 is characterized in that: After the authentication server AS receives the certificate authentication request sent by the wireless access point AP, if the AP signature and AP quantum certificate in the certificate authentication request message are not verified correctly, the authentication process fails, and the wireless access point AP disassociates the corresponding service terminal STA in the substation.

6. The substation WAPI network security management method based on quantum authentication as claimed in claim 1 is characterized in that: When the customer premise terminal CPE acts as a communication bridge to establish communication interaction with the wireless access point AP, it also undergoes authentication processing, which includes: Authentication activation: When the customer premise terminal CPE communicates with the wireless access point AP and associates with the AP, the wireless access point AP sends an authentication activation message to the customer premise terminal CPE to start the entire authentication process; Access authentication request: The customer premise terminal CPE responds to the authentication activation information sent by the wireless access point AP and sends an access authentication request to the wireless access point AP, that is, the CPE quantum certificate of the customer premise terminal CPE and its current system time are sent to the wireless access point AP, where the system time is called the access authentication request time; Certificate authentication request: After receiving the access authentication request from the customer front-end terminal CPE, the wireless access point AP sends a certificate authentication request with the AP signature to the access server AC, that is, sends the CPE quantum certificate and access authentication request time to the access server AC; The access server AC sends a certificate authentication request message with the AP signature to the authentication server AS. The certificate authentication request message includes: AP signature, CPE quantum certificate, access authentication request time; Certificate authentication response: After the authentication server AS receives the certificate authentication request message from the access server AC, it first verifies the AP signature of the wireless access point AP. If it is incorrect, the authentication process fails. Otherwise, it further verifies the legitimacy of the wireless access point AP and CPE quantum certificates. After the verification is completed, the authentication server AS sends the CPE certificate authentication result information in the form of a certificate authentication response message with a signature back to the access server AC. Access authentication response: The access server AC performs signature verification on the certificate authentication response returned by the authentication server AS to obtain the authentication result of the CPE quantum certificate. The access server AC sends the certificate authentication response message to the wireless access point AP, which transparently transmits it to the customer premise terminal CPE. After the customer premise terminal CPE verifies the signature of the authentication server AS, it obtains the authentication result of the authentication server AS quantum certificate. The customer premise terminal CPE decides whether to access the wireless access point AP corresponding to the access server AC based on the authentication result.

7. The substation WAPI network security management method based on quantum authentication as claimed in claim 6 is characterized in that: The CPE certificate authentication result information includes the STA quantum certificate, the authentication result, and the signature of the access server AC on them.

8. The substation WAPI network security management method based on quantum authentication as claimed in claim 1 is characterized in that: The first-level management level is the provincial power company, and the second-level management level is the municipal power company.

9. The substation WAPI network security management method based on quantum authentication as claimed in claim 1 is characterized in that: It also includes: the WAPI network system updates the WAPI authentication certificate at a preset time interval, which includes: Certificate acquisition: When the quantum authentication program requests a certificate from the authentication server AS, the authentication server AS outputs the certificate file to the certificate service online and securely; Certificate issuance: After the quantum authentication program obtains the certificate, it issues the certificate to the customer front-end terminal CEP or other WAPI terminals through a secure channel; Loading certificate: After successfully downloading the certificate, the customer premise terminal CPE or other WAPI terminal reports the download status to the certificate service to verify the validity of the certificate; After verifying that the certificate is valid, the update process is completed and waits for the next update to be triggered.

10. The substation WAPI network security management method based on quantum authentication according to claim 1 is characterized in that: The quantum key system consists of a quantum random number generator, a quantum key exchange cipher machine, a quantum cryptographic service engine device, and a quantum key recharging device.

Images