Intelligent power plant terminal identity verification method and system based on identification algorithm

Abstract

The invention discloses a smart power plant terminal identity verification method and system based on an identification algorithm. The verification method comprises the steps that terminal equipment or a user submits physical feature information or identity information of the equipment to a registration agency RA for registration; after the RA verifies the information, generating a Device ID (Identifier) or a UID (User Identifier) for the device; based on an SM9 identification algorithm, a registration authority (RA) generates a public key and private key pair of equipment or a user, the private key is locally and securely stored in the equipment and is not transmitted through a network, and the public key of the equipment or the user, an equipment identifier Device ID and a user identity identifier UID are securely transmitted to an authentication server AS through an encryption channel and are stored in a database of the authentication server AS; the user or the terminal equipment initiates an identity verification request to the authentication server AS; and after the verification is passed, the authentication server AS generates a session key based on an SM9 algorithm. According to the invention, secure access of the terminal and the user can be ensured.

Description

Technical Field

[0001] The present invention relates to a method and system for identity verification of a smart power plant terminal based on an identification algorithm, and belongs to the technical field of security of smart power plants. Background Art

[0002] With the rapid development of intelligent technology, smart power plants have gradually become a development trend in the power industry. Smart power plants integrate various advanced information and communication technologies to automatically monitor and manage the operation of power systems, thereby improving the operating efficiency, reliability and safety of power plants. In smart power plants, terminal devices (such as sensors, controllers, smart meters, etc.) are responsible for collecting, processing and transmitting large amounts of real-time data, and interacting with the control center through the network. The security of these terminal devices is crucial to the safe operation of the entire power plant, especially when the power plant faces a complex network environment and evolving network security threats. The identity authentication and access control of terminal devices are particularly important.

[0003] Traditional terminal authentication methods usually rely on encryption algorithms based on public key infrastructure (PKI), such as RSA or ECC. These algorithms rely on the use of public and private key pairs and the management of digital certificates. Although these methods provide security to a certain extent, they face the following major challenges in the actual application of smart power plants:

[0004] 1: Complex key management: The traditional PKI system needs to maintain a complex digital certificate and key management system, including certificate issuance, update, revocation, etc. This is costly and error-prone for smart power plants with a large number of widely distributed devices.

[0005] 2: Computing resource consumption: Traditional encryption algorithms (such as RSA) usually require a longer key length to ensure security, which may lead to low computing efficiency for resource-constrained terminal devices (such as sensors and embedded devices), affecting the real-time performance and response speed of the device.

[0006] 3: Certificate dependency: In a PKI-based authentication system, the authentication of terminal devices depends on the credibility of the certificate authority (CA). Once the security of the CA is compromised, the security of the entire system will be at risk. In addition, the process of obtaining and managing certificates is complicated, which increases the difficulty of system deployment and maintenance.

[0007] Difficulty in binding identification and equipment: In traditional systems, the identity information of a device is usually bound to its public key or certificate, which may not directly reflect the physical properties or functional characteristics of the device. In this case, once the device information is tampered with or forged, it may pose a serious threat to the safety of the power plant. Summary of the invention

[0008] The present invention relates to a method and system for terminal identity authentication of a smart power plant based on an identification algorithm, which aims to solve the identity authentication problem of terminal devices in smart power plants, especially the security, efficiency and management complexity problems in complex network environments. By adopting the national commercial SM9 identification cryptographic algorithm, the present invention simplifies the complex operations of the traditional public key infrastructure (PKI) system, enhances the identity authentication security of terminal devices, and adapts to the diverse terminal devices and complex network architecture in smart power plants.

[0009] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0010] A method for identity authentication of a smart power plant terminal based on an identification algorithm comprises the following steps:

[0011] Step 1: Terminal device identity registration

[0012] 1.1 When a terminal device is first connected to the smart power plant network, it shall register by submitting the physical characteristics information (such as KKS code) and basic behavior characteristics (such as geographic location, usage time period, device status, etc.) of the device through the registration agency RA;

[0013] 1.2 After the registration authority RA verifies the physical feature information of the device, it combines the physical feature information of the device and the basic behavioral characteristics to generate a unique device identifier Device ID for the device;

[0014] 1.3 Based on the SM9 identification algorithm, the registration authority RA generates the public key and private key pair of the device. The private key is securely stored locally on the device and is not transmitted over the network. The public key and device identifier Device ID of the device and the basic behavior characteristics of the terminal device are securely transmitted to the authentication server AS through an encrypted channel and stored in the database of the authentication server AS. The authentication server AS analyzes the basic behavior characteristics of the device through the K-Means clustering machine learning algorithm and establishes a threshold range R1, which is defined as the boundary of the normal behavior mode of the terminal device.

[0015] Step 2: User identity registration

[0016] 2.1 The user submits identity information and basic behavior characteristic data (such as location, usage frequency, etc.) to the registration authority RA through the client to register;

[0017] 2.2 The registration authority RA verifies the legitimacy of the user's identity information and generates a unique user identity identifier UID;

[0018] 2.3 The registration authority RA uses the SM9 identification algorithm to generate the user's public key and private key pair based on the user identity identifier UID. The user's private key is only securely stored on the local device and is not transmitted over the network. The user's public key and user identity identifier UID and the user's basic behavior characteristics are transmitted to the authentication server AS through an encrypted channel and stored in the authentication server AS's database; the authentication server AS analyzes the user's basic behavior characteristics through the K-Means clustering machine learning algorithm and establishes a threshold range R2, which is defined as the boundary of the user's normal behavior pattern;

[0019] Step 3: Authentication and secure communication

[0020] 3.1 When a user or terminal device needs to access the network resources of the smart power plant, it initiates an identity authentication request to the authentication server AS. The request contains the user's UID, the device ID and behavior feature data of the device;

[0021] 3.2 After receiving the identity authentication request, the authentication server AS uses the stored identification information and the SM9 identification algorithm to verify the identity of the user or device, and at the same time verifies the public key of the user or device to confirm whether it matches the stored identity information; at the same time, the behavior feature data of the user or device is compared with the previously established behavior pattern threshold range R2 or R1;

[0022] If the user's behavior feature data exceeds the threshold range R2, a one-time verification code OTP is sent to the user's registered email or mobile phone, requiring the user to enter the verification code within a specified time to complete the verification. If the user enters the verification code correctly, the verification is successful;

[0023] If the device exceeds the threshold range R1, if the device supports display or input functions, the authentication server AS generates and sends a one-time verification code, requiring the user to enter the verification code on the device to complete the verification. If the verification code entered on the device is correct, the verification is successful. Otherwise, the device's operation log and status information (such as CPU load, storage status) are checked to ensure that the device is running normally and there is no sign of tampering or infection. If the device is running normally, the verification is successful.

[0024] 3.3 After verification, the authentication server AS generates a session key based on the SM9 algorithm, which is used to encrypt subsequent communication data between the user or device and the authentication server AS. The session key is encrypted using the public key of the user or terminal device and transmitted to the user or device to ensure the confidentiality and integrity of the data during the communication process;

[0025] 3.4 After the communication is completed, the authentication server AS destroys the session key to prevent data leakage and unauthorized access;

[0026] SM9 algorithm parameter configuration

[0027] Elliptic curve parameters: Select the elliptic curve parameters defined by the SM9 standard. The elliptic curve equation is:

[0028] E:y 2 =x 3 +ax+b mod p

[0029] Where: a and b are the parameters of the curve; p is a prime number that defines a finite field;

[0030] Generator: Select the generator P and order n on the elliptic curve. Generator P is a basic point on the elliptic curve, and order n is the size of the subgroup generated by P.

[0031] Terminal device key pair generation: randomly generate device private key d / , generate the device public key Q / :Q / =d / .P, where P is the generator on the elliptic curve;

[0032] User key pair generation: randomly generate a user private key d, generate a user public key Q: Q = dP, where P is the generator on the elliptic curve;

[0033] Identity information hashing: The identity information is converted into points on the elliptic curve through the hash function H, and the hashed points are used as the basis for key generation to calculate the corresponding public and private keys.

[0034] The above-mentioned smart power plant terminal identity authentication method based on identification algorithm also includes:

[0035] Step 4: Key Management

[0036] 4.1 The registration authority RA and the authentication server AS regularly check the key validity of users and terminal devices. If a key failure or security threat is detected, the registration authority RA will initiate a key update process;

[0037] The key update process is as follows: the registration authority RA uses the SM9 identification algorithm to regenerate the public key and private key of the device or user, and transmits the new public key to the authentication server AS through an encrypted channel to replace the old public key;

[0038] 4.2 If the terminal device is removed or invalid, or the user no longer needs to access system resources, the registration authority RA will revoke the key of the device or user, and the authentication service AS will then update the database record to prevent unauthorized devices from continuing to access system resources.

[0039] Assuming the session key is K, the calculation formula is: K = H (Q || Q / ), where Q and Q / are the public keys of the user and device respectively, || represents the concatenation operation, and H is the hash function.

[0040] A smart power plant terminal identity authentication system based on identification algorithm, comprising:

[0041] The registration authority RA is used to generate a unique device identifier Device ID and user identity identifier UID for the device and user respectively after verifying the physical feature information of the terminal device and the identity information of the user, and generate a public key and private key pair for the device and user based on the SM9 identification algorithm. The private key is securely stored locally on the device and is not transmitted over the network. The registration authority RA securely transmits the public key and device identifier Device ID of the device and the public key and user identity identifier UID of the user to the authentication server AS through an encrypted channel and stores them in the database of the authentication server AS;

[0042] The authentication server AS is used to receive and store the device's public key and device identifier Device ID and the user's public key and user identity identifier UID; the authentication server AS receives the verification request from the user or terminal device, uses the stored identification information and SM9 identification algorithm to verify the identity of the user or device, and verifies the public key of the user or device to confirm whether it matches the stored identity information. After the verification is passed, the authentication server AS generates a session key based on the SM9 algorithm to encrypt subsequent communication data between the user or device and the authentication server AS. The session key is transmitted to the user or device through a secure channel to ensure the confidentiality and integrity of the data during the communication process; after the communication is completed, the authentication server AS destroys the session key to prevent data leakage and unauthorized access.

[0043] The above-mentioned registration authority RA and authentication server AS are also used to check the validity of the keys of users and terminal devices. If it is detected that the key is invalid or there is a security threat, the registration authority RA will initiate the key update process; the key update process is: the registration authority RA uses the SM9 identification algorithm to regenerate the public key and private key of the device or user, and transmits the new public key to the authentication server AS through an encrypted channel to replace the old public key; if the terminal device is removed or invalid, or the user no longer needs to access system resources, the registration authority RA will revoke the key of the device or user, and the authentication server AS will immediately update the database record to prevent unauthorized devices from continuing to access system resources.

[0044] The present invention provides an effective alternative based on identity-based cryptography (IBC). There is no need to rely on traditional digital certificates, thus simplifying the key management process. In the national cryptographic standard issued by the State Cryptography Administration, the SM9 algorithm is a typical identity cryptographic algorithm that combines the characteristics of high security and high efficiency and is suitable for identity authentication and key management of smart power plant terminal equipment.

[0045] The technologies not mentioned in the present invention are all referred to the prior art.

[0046] The smart power plant terminal identity authentication method and system based on the identification algorithm of the present invention have the following beneficial effects:

[0047] Efficiency: The present invention simplifies the identity authentication process and improves the operating efficiency of the system by adopting the SM9 identification algorithm. It is particularly suitable for equipment that requires real-time response in smart power plants.

[0048] Security: The unique identifier and key pair generated by the SM9 algorithm ensure the uniqueness and non-tamperability of the device and user's identity, preventing identity forgery and information leakage.

[0049] Simplified management: The present invention simplifies the cumbersome certificate management and key distribution operations in the traditional PKI system through automated key management and identity authentication, thereby reducing the deployment and maintenance costs of the system.

[0050] In summary, the present invention provides a smart power plant terminal identity authentication method and system based on an identification algorithm, which can effectively cope with the increasingly complex network environment and security requirements of smart power plants, ensure the secure access, identity authentication and communication encryption of terminal devices, thereby improving the overall safety and operating efficiency of the power plant. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a schematic diagram of the identity authentication method of a smart power plant terminal based on an identification algorithm of the present invention; DETAILED DESCRIPTION

[0052] In order to better understand the present invention, the content of the present invention is further explained below in conjunction with the embodiments, but the content of the present invention is not limited to the following embodiments.

[0053] Example 1

[0054] A method for identity authentication of a smart power plant terminal, using an SM9 identification algorithm, comprises the following steps:

[0055] Step 1: Terminal device identity registration

[0056] 1.1 When the terminal device is first connected to the smart power plant network, it shall register by submitting the physical characteristic information KKS code and basic behavior characteristics (geographic location, usage time period and device status) of the device through the registration agency RA;

[0057] 1.2 After the registration authority RA verifies the physical feature information of the device, it combines the physical feature information of the device and the basic behavioral characteristics to generate a unique device identifier Device ID for the device;

[0058] 1.3 Based on the SM9 identification algorithm, the registration authority RA generates the public key and private key pair of the device. The private key is securely stored locally on the device and is not transmitted over the network. The public key and device identifier Device ID of the device and the basic behavior characteristics of the terminal device are securely transmitted to the authentication server AS through an encrypted channel and stored in the database of the authentication server AS. The authentication server AS analyzes the basic behavior characteristics of the device through the K-Means clustering machine learning algorithm and establishes a threshold range R1, which is defined as the boundary of the normal behavior mode of the terminal device.

[0059] Step 2: User identity registration

[0060] 2.1 The user submits identity information and basic behavior characteristic data (location and usage frequency) to the registration authority RA through the client to register;

[0061] 2.2 The registration authority RA verifies the legitimacy of the user's identity information and generates a unique user identity identifier UID;

[0062] 2.3 The registration authority RA uses the SM9 identification algorithm to generate the user's public key and private key pair based on the user identity identifier UID. The user's private key is only securely stored on the local device and is not transmitted over the network. The user's public key and user identity identifier UID and the user's basic behavior characteristics are transmitted to the authentication server AS through an encrypted channel and stored in the authentication server AS's database; the authentication server AS analyzes the user's basic behavior characteristics through the K-Means clustering machine learning algorithm and establishes a threshold range R2, which is defined as the boundary of the user's normal behavior pattern;

[0063] SM9 algorithm parameter configuration

[0064] (1) Elliptic curve parameters: Select the elliptic curve parameters defined by the SM9 standard. The elliptic curve equation is:

[0065] E:y 2 =x 3 +ax+b mod p

[0066] in:

[0067] a and b are the parameters of the curve.

[0068] p is a prime number, defining a finite field.

[0069] (2) Generator: Select a generator P and its order n on the elliptic curve. Generator P is a basic point on the elliptic curve, and order n is the size of the subgroup generated by P.

[0070] Key pair generation

[0071] (1) Generation of terminal device key pair:

[0072] Device identifier generation: Assume that the device identifier is DeviceID.

[0073] Generate device private key d / : Randomly generate a private key d / .

[0074] Generate device public key Q / :Q / =d / .P.

[0075] Where P is the generator on the elliptic curve.

[0076] (2) User key pair generation:

[0077] User identifier generation: Assume that the user's identifier is UID.

[0078] Generate user private key d: Randomly generate a private key d.

[0079] Generate user public key Q: Q = dp where P is the generator on the elliptic curve.

[0080] Identifier Mapping

[0081] Identity information hash: The identity information (such as ID or DeviceID) is converted into a point on the elliptic curve through the hash function H:

[0082] P ID =H(ID)

[0083] P DeviceID =H(DeviceID)

[0084] Generate a key pair: Use the hashed point as the basis for key generation and calculate the corresponding public and private keys.

[0085] Step 3: Authentication and secure communication

[0086] 3.1 When a user or terminal device needs to access the network resources of the smart power plant, it initiates an identity authentication request to the authentication server AS. The request contains the user's UID or the device ID, behavioral feature data, and other relevant authentication information;

[0087] 3.2 After receiving the identity authentication request, the authentication server AS uses the stored identification information and the SM9 identification algorithm to verify the identity of the user or device, and uses the following steps to confirm the legitimacy of the public key: Verify the public key of the user or device to confirm whether it matches the stored identity information. At the same time, compare the user or device's behavior feature data with the previously established behavior pattern threshold range R2 or R1;

[0088] If the user's behavior feature data exceeds the threshold range R2, a one-time verification code OTP is sent to the user's registered email or mobile phone, requiring the user to enter the verification code within a specified time to complete the verification. If the user enters the verification code correctly, the verification is successful;

[0089] If the device exceeds the threshold range R1, if the device supports display or input functions, the authentication server AS generates and sends a one-time verification code, requiring the user to enter the verification code on the device to complete the verification. If the verification code entered on the device is correct, the verification is successful. Otherwise, the device's operation log and status information (CPU load, storage status) are checked to ensure that the device is running normally and there is no sign of tampering or infection. If the device is running normally, the verification is successful.

[0090] 3.3 After verification, the authentication server AS generates a session key based on the SM9 algorithm, which is used to encrypt subsequent communication data between the user or device and the authentication server AS. The session key is encrypted using the public key of the user or terminal device and transmitted to the user or device to ensure the confidentiality and integrity of the data during the communication process;

[0091] Assuming the session key is K, the calculation formula is:

[0092] K=H(Q||Q / )

[0093] Among them, Q and Q / are the public keys of the user and device respectively, || represents the concatenation operation, and H is the hash function.

[0094] 3.4 After the communication is completed, the authentication server AS destroys the session key to prevent data leakage and unauthorized access;

[0095] Step 4: Key Management

[0096] 4.1 The registration authority RA and the authentication server AS regularly check the key validity of users and terminal devices. If a key failure or security threat is detected, the registration authority RA will initiate a key update process;

[0097] The key update process is as follows: the registration authority RA uses the SM9 identification algorithm to regenerate the public key and private key of the device or user, and transmits the new public key to the authentication server AS through an encrypted channel to replace the old public key;

[0098] 4.2 If the terminal device is removed or invalid, or the user no longer needs to access system resources, the registration authority RA will revoke the key of the device or user, and the authentication service AS will then update the database record to prevent unauthorized devices from continuing to access system resources.

[0099] Specific implementation steps of the SM9 algorithm

[0100] Generate a key pair:

[0101] Randomly select private key d or d /

[0102] Calculate the public key Q or Q′: Q = dp

[0103] Q / =d / .P

[0104] Generate a session key:

[0105] The session key K is calculated by the SM9 algorithm and the hash function: K = H(Q||Q / )

[0106] Verification process:

[0107] The received public key is verified using the SM9 algorithm to confirm that it matches the stored identity information.

[0108] Example 2

[0109] A smart power plant terminal identity authentication system based on identification algorithm, comprising:

[0110] The registration authority RA is used to generate a unique device identifier Device ID and user identity identifier UID for the device and user respectively after verifying the physical feature information of the terminal device and the identity information of the user, and generate a public key and private key pair for the device and user based on the SM9 identification algorithm. The private key is securely stored locally on the device and is not transmitted over the network. The registration authority RA securely transmits the public key and device identifier Device ID of the device and the public key and user identity identifier UID of the user to the authentication server AS through an encrypted channel and stores them in the database of the authentication server AS;

[0111] The authentication server AS is used to receive and store the device's public key and device identifier Device ID and the user's public key and user identity identifier UID; the authentication server AS receives the verification request from the user or terminal device, uses the stored identification information and SM9 identification algorithm to verify the identity of the user or device, and verifies the public key of the user or device to confirm whether it matches the stored identity information. After the verification is passed, the authentication server AS generates a session key based on the SM9 algorithm to encrypt subsequent communication data between the user or device and the authentication server AS. The session key is transmitted to the user or device through a secure channel to ensure the confidentiality and integrity of the data during the communication process; after the communication is completed, the authentication server AS destroys the session key to prevent data leakage and unauthorized access.

[0112] The registration authority RA and the authentication service AS are also used to check the validity of the keys of users and terminal devices. If the key is detected to be invalid or there is a security threat, the registration authority RA will initiate the key update process; the key update process is: the registration authority RA uses the SM9 identification algorithm to regenerate the public key and private key of the device or user, and transmits the new public key to the authentication service AS through an encrypted channel to replace the old public key; if the terminal device is removed or invalid, or the user no longer needs to access system resources, the registration authority RA will revoke the key of the device or user, and the authentication service AS will immediately update the database record to prevent unauthorized devices from continuing to access system resources. For the rest of the content not mentioned in this example, refer to Example 1.

[0113] The above-mentioned smart power plant terminal identity authentication methods and systems based on identification algorithms simplify the identity authentication process and improve the operating efficiency of the system by adopting the SM9 identification algorithm. They are particularly suitable for devices that require real-time response in smart power plants. The unique identifier and key pair generated by the SM9 algorithm ensure the uniqueness and immutability of the identity of the device and user, and prevent identity forgery and information leakage. Through automated key management and identity authentication, the cumbersome certificate management and key distribution operations in the traditional PKI system are simplified, and the deployment and maintenance costs of the system are reduced. It can effectively respond to the increasingly complex network environment and security requirements of smart power plants, ensure the secure access, identity authentication and communication encryption of terminal devices, and thus improve the overall safety and operating efficiency of power plants.

Claims

1. A method for identity authentication of a smart power plant terminal based on an identification algorithm, characterized in that it comprises the following steps: Step 1: Terminal device identity registration 1.1 When a terminal device is first connected to the smart power plant network, it shall register by submitting the physical characteristics information and basic behavior characteristics of the device through the registration authority RA; 1.2 After the registration authority RA verifies the physical feature information of the device, it combines the physical feature information of the device and the basic behavioral characteristics to generate a unique device identifier Device ID for the device; 1.3 Based on the SM9 identification algorithm, the registration authority RA generates the public key and private key pair of the device. The private key is securely stored locally on the device and is not transmitted over the network. The public key of the device and the device identifier DeviceID and the basic behavior characteristics of the terminal device are securely transmitted to the authentication server AS through an encrypted channel and stored in the database of the authentication server AS. The authentication server AS analyzes the basic behavior characteristics of the device through the K-Means clustering machine learning algorithm and establishes a threshold range R1, which is defined as the boundary of the normal behavior mode of the terminal device; Step 2: User identity registration 2.1 The user submits identity information and basic behavior characteristic data to the registration authority RA through the client to register; 2.2 The registration authority RA verifies the legitimacy of the user's identity information and generates a unique user identity identifier UID; 2.3 The registration authority RA uses the SM9 identification algorithm to generate the user's public key and private key pair based on the user identity identifier UID. The user's private key is only securely stored on the local device and is not transmitted over the network. The user's public key and user identity identifier UID and the user's basic behavior characteristics are transmitted to the authentication server AS through an encrypted channel and stored in the database of the authentication server AS; The authentication server AS analyzes the user's basic behavior characteristics through the K-Means clustering machine learning algorithm and establishes a threshold range R2, which is defined as the boundary of the user's normal behavior pattern; Step 3: Authentication and secure communication 3.1 When a user or terminal device needs to access the network resources of the smart power plant, it initiates an identity authentication request to the authentication server AS. The request contains the user's UID, the device ID and behavior feature data of the device; 3.2 After receiving the identity authentication request, the authentication server AS uses the stored identification information and the SM9 identification algorithm to verify the identity of the user or device, and at the same time verifies the public key of the user or device to confirm whether it matches the stored identity information; at the same time, the behavior feature data of the user or device is compared with the previously established behavior pattern threshold range R2 or R1; If the user's behavior feature data exceeds the threshold range R2, a one-time verification code OTP is sent to the user's registered email or mobile phone, requiring the user to enter the verification code within a specified time to complete the verification. If the user enters the verification code correctly, the verification is successful; If the device exceeds the threshold range R1, if the device supports display or input functions, the authentication server AS generates and sends a one-time verification code, requiring the user to enter the verification code on the device to complete the verification. If the verification code entered on the device is correct, the verification is successful. Otherwise, the device's operation log and status information are checked to ensure that the device is running normally and there is no sign of tampering or infection. If the device is running normally, the verification is successful. 3.3 After verification, the authentication server AS generates a session key based on the SM9 algorithm, which is used to encrypt subsequent communication data between the user or device and the authentication server AS. The session key is encrypted using the public key of the user or terminal device and transmitted to the user or device to ensure the confidentiality and integrity of the data during the communication process; 3.4 The user or terminal device uses its own private key to decrypt the information sent by the authentication server AS to obtain the session key, and then uses the session key to communicate; 3.5 After the communication is completed, the authentication server AS destroys the session key to prevent data leakage and unauthorized access; SM9 algorithm parameter configuration Elliptic curve parameters: Select the elliptic curve parameters defined by the SM9 standard. The elliptic curve equation is: E:y 2 =x 3 +ax+b mod p Where: a and b are the parameters of the curve; p is a prime number that defines a finite field; Generator: Select the generator P and order n on the elliptic curve. Generator P is a basic point on the elliptic curve, and order n is the size of the subgroup generated by P. Terminal device key pair generation: randomly generate device private key d / , generate the device public key Q / :Q / =d / .P, where P is a generator on the elliptic curve; User key pair generation: randomly generate a user private key d, generate a user public key Q: Q = dP, where P is the generator on the elliptic curve; Identity information hashing: The identity information is converted into points on the elliptic curve through the hash function H, and the hashed points are used as the basis for key generation to calculate the corresponding public and private keys.

2. The smart power plant terminal identity authentication method based on identification algorithm according to claim 1, characterized in that it also includes: Step 4: Key Management 4.1 The registration authority RA and the authentication server AS regularly check the key validity of users and terminal devices. If a key failure or security threat is detected, the registration authority RA will initiate a key update process; The key update process is as follows: the registration authority RA uses the SM9 identification algorithm to regenerate the public key and private key of the device or user, and transmits the new public key to the authentication server AS through an encrypted channel to replace the old public key; 4.2 If the terminal device is removed or invalid, or the user no longer needs to access system resources, the registration authority RA will revoke the key of the device or user, and the authentication service AS will then update the database record to prevent unauthorized devices from continuing to access system resources.

3. The identity authentication method for a smart power plant terminal based on an identification algorithm as claimed in claim 1 or 2, characterized in that: assuming that the session key is K, the calculation formula is: K = H (Q || Q / ), where Q and Q / are the public keys of the user and device respectively, || represents the concatenation operation, and H is the hash function.

4. A smart power plant terminal identity authentication system based on identification algorithm, characterized by: include: The registration authority RA is used to generate a unique device identifier DeviceID and user identity identifier UID for the device and user respectively after verifying the physical feature information of the terminal device and the identity information of the user, and generate a public key and private key pair for the device and user based on the SM9 identification algorithm. The private key is securely stored locally on the device and is not transmitted over the network. The registration authority RA securely transmits the public key and device identifier Device ID of the device and the public key and user identity identifier UID of the user to the authentication server AS through an encrypted channel and stores them in the database of the authentication server AS; The authentication server AS is used to receive and store the public key and device identifier Device ID of the device and the public key and user identity identifier UID of the user; The authentication server AS receives the authentication request from the user or terminal device, verifies the identity of the user or device using the stored identification information and the SM9 identification algorithm, and verifies the public key of the user or device to confirm whether it matches the stored identity information. After the verification is passed, the authentication server AS generates a session key based on the SM9 algorithm to encrypt subsequent communication data between the user or device and the authentication server AS. The session key is transmitted to the user or device through a secure channel to ensure the confidentiality and integrity of the data during the communication process; After the communication is completed, the authentication server AS destroys the session key to prevent data leakage and unauthorized access.

5. The smart power plant terminal identity authentication system based on identification algorithm as claimed in claim 4, characterized in that: The registration authority RA and the authentication server AS are also used to check the validity of the keys of users and terminal devices. If a key failure or security threat is detected, the registration authority RA will initiate a key update process. The key update process is as follows: the registration authority RA uses the SM9 identification algorithm to regenerate the public key and private key of the device or user, and transmits the new public key to the authentication server AS through an encrypted channel to replace the old public key. If the terminal device is removed or invalid, or the user no longer needs to access system resources, the registration authority RA will revoke the key of the device or user, and the authentication service AS will then update the database record to prevent unauthorized devices from continuing to access system resources.

Images