Method and system for verifying cross-regional authentication credential of power system network

Abstract

The invention discloses a power system network cross-region authentication certificate verification method and system, and the verification method comprises the steps: effectively guaranteeing the confidentiality, integrity and non-repudiation of an authentication certificate in a transmission process through a cross-region authentication protocol based on a unified multi-domain identifier; a production control region and a management information region are respectively provided with a sub-domain key management center, a root key management center is arranged between the two regions, corresponding authentication certificates are generated according to respective security policies and requirements, and the authentication certificates are distributed to corresponding users or systems through secure channels; in the process of data exchange and information sharing, both communication parties need to adopt a continuous authentication mechanism, a communication line is protected from attacks of various protocols through a nonlinear function, and the risk of security vulnerabilities and data leakage is reduced to the minimum. According to the invention, safe and rapid verification of authentication credentials between a production control region and a management information region is realized, and the safety, reliability and real-time performance of data exchange and information sharing are ensured.

Description

Technical Field

[0001] The invention relates to a method and system for verifying cross-regional authentication credentials of a power system network, and belongs to the technical field of power system network security. Background Art

[0002] In the power system, the network is clearly divided into the production control area and the management information area. The production control area is mainly responsible for the direct control and monitoring of the power production process, including the power plant DCS system, power data acquisition and monitoring system, energy management system, wide-area phasor measurement system, distribution network automation system, substation automation system, etc. These systems ensure the normal operation of power production by collecting, analyzing and processing various data in real time, and take timely measures in case of abnormal situations to prevent accidents or reduce the impact of accidents. The management information area is mainly responsible for the management and operation of power companies, including the dispatching production management system, administrative telephone network management system, financial ERP, daily trading system, etc. These systems provide support for the decision-making of power companies by integrating, analyzing and processing various data in the power production process, helping companies to achieve more efficient and refined management.

[0003] In actual applications, data exchange and information sharing between the production control area and the management information area face many challenges, especially the cross-area verification of authentication credentials. Due to the different security protection levels of the two areas and the strict physical and logical isolation, traditional authentication methods are difficult to meet the needs of cross-area verification, which easily leads to security vulnerabilities and data leakage risks.

[0004] Therefore, developing a cross-region authentication credential verification method and system for power system networks to achieve safe and efficient authentication of authentication credentials between production control areas and management information areas is of great significance for improving the overall safety performance and operation efficiency of power system networks. Summary of the invention

[0005] The present invention provides a method and system for verifying cross-regional authentication credentials of an electric power system network, which realizes safe and rapid verification of authentication credentials between a production control region and a management information region, and ensures the security, reliability and real-time performance of data exchange and information sharing.

[0006] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0007] A method for verifying cross-regional authentication credentials of a power system network comprises the following steps:

[0008] Step 1: Set up a root key management center RKMC between the production control area and the management information area; the root key management center RKMC creates a globally unique authentication credential for various entities in the production control area and the management information area;

[0009] Step 2: Set up subdomain key management centers in the production control area and management information area respectively; the subdomain key management center (DKMC) is responsible for generating unique public and private keys for entities in the area according to the UMI principle, and distributing the public key base including all entity public keys to all entities. This information is used for mutual authentication between subsequent entities; the private key generated by the DKMC is an important part of the authentication credentials between entities, ensuring the uniqueness of each subject's identity and the security of authentication;

[0010] Take the authentication process between entities A and B as an example. Entities A and B are located in the production control area and the management information area respectively. A and ID B Represents the authentication credentials of entity A and B respectively, pk A and sk A is the public and private key of entity A, pk B and sk B are the public and private keys of entity B;

[0011] Step 3: Entity A generates a random number r a , and use the hash function H to generate the ID A ||ID B ||r a The hash value of entity A is signed with its private key to obtain S A =Sig(sk A ,H(ID A ||ID B ||r a )), and S A 、r a 、ID A Send to entity B;

[0012] Step 4: Entity B receives the message from entity A, determines the public key base of the zone where entity A is located through entity A's authentication certificate, and extracts entity A's public key pk from it A , use pk A Verify the signature S A , and confirm the hash value H(ID A ∣∣ID B ∣∣r a ) to verify the identity of entity A;

[0013] Step 5: Entity B generates a random number r b , and use the hash function H and its own private key sk B Generate digital signature S B =Sig(sk B ,H(ID A ||IDB ||r b )), then S B 、r b 、ID B Sent to entity A, which verifies the identity of entity B using the same operation as step 4 above;

[0014] Step 6: If the authentication is successful, entities A and B generate channel state information C in the received data packets respectively. r and C i , entity A will C r and a random number r b Encrypt with B's public key to get M A =pk B (C r ,r b ), and sends it to entity B;

[0015] Step 7: Entity B receives message M A Then, use the private key sk B Decrypt and get C r and r b , if r b If it is correct, it proves that the message has not been tampered with during transmission, and the information status information C r Correct; then entity B uses A's public key pk A Calculate M B =pk A (C i ,r a ), and send it to A;

[0016] Step 8: Entity A receives message M B Then, use the private key sk A Decrypt and get C i and r a , if r a If it is correct, it proves that the message has not been tampered with during transmission, and the channel state information C i Correct, now set the counter of entity A to ACK A = 1, and each time a message is received, it is incremented by 1 to ensure that the messages are received in the correct order; then entity A generates a session key lastSkey is the previous session key. LastSkey is not needed for the initial authentication because if an attacker can obtain the current channel state information, it is difficult to accurately calculate the current session key without lastSkey. Therefore, adding lastSkey when generating the session key ensures the continuity and security of the session key. At the same time, entity A sets the session continuity time T and timestamp t mAnd randomly select a nonlinear function f (in this case f = a·e bt ), then T, t m , f and generate session key marker A S =1Use pk B After encryption, it is sent to entity B;

[0017] Step 9: Entity B receives the message sent by entity A containing A S = 1, generate the corresponding session key Skey and set the counter ACK B =1; at this time, the counter values ​​of both entity A and entity B are 1. After that, the two entities located in the production control area and the management information area will communicate securely through the session key Skey within the set time T. The messages communicated between the two parties contain their respective counters to ensure that the messages are received in order.

[0018] During the data exchange and information sharing process, both parties need to use a continuous authentication mechanism within T time to ensure the security of communication. The following are the specific steps of the continuous authentication stage:

[0019] Step 9.1: Entity A randomly generates an integer a and calculates Where n is a large prime number, then entity A uses the session key Skey to a ,n,ACK A Encrypt and send to entity B;

[0020] Step 9.2: After receiving the message sent by entity A, entity B uses the session key to decrypt it and obtain m a and n, and calculate a and r based on these values b , if r b If the timestamp is correct, it proves that the message has not been tampered with during transmission. At the same time, entity B will also record the current timestamp t. If the timestamp difference tt m If the message is longer than the session duration T, entity B will encrypt Rs=1 with the session key Skey and send it to entity A, where Rs represents the "reset flag", which is used to indicate that mutual authentication needs to be restarted to generate a new session key. When entity A receives the message containing Rs=1, it will restart mutual authentication to generate a new session key.

[0021] Step 9.3: If the timestamp difference is less than the session duration T, entity B will also randomly generate an integer b and calculate And through the nonlinear function f=a·e negotiated in the authentication phase bt Calculate f b , then use Skey to encrypt m b 、f b, ACK B , b and the recorded timestamp t, and send it to entity A;

[0022] Step 9.4: After receiving the message, entity A obtains integer b, timestamp t and r through decryption calculation a , if r a If it is correct, it proves that the message has not been tampered with during transmission; entity A uses a and b through f = a·e bt Calculate f a , and then compare it with the f in the message b Compare and if they match correctly, it proves that entity A is communicating securely with entity B;

[0023] Step 9.5: Entity A encrypts r using the session key Skey b , ACK A and f a It is sent to entity B, which decrypts it and verifies r b Correctness, ACK A Is the value correct and check f at the same time a Is it related to f b Similarly, if these parameters are verified, it proves that entity A and entity B can still communicate with each other, and entity B will use the session key Skey to encrypt the mark keep=1 and ACK B Sent to entity A to ensure that both parties in the two regions know that they can continue to communicate without regenerating a new session key.

[0024] During the continuous authentication process, entity A counter ACK A and entity B calculator ACK B It will also be incremented to ensure that messages are received in the correct order.

[0025] The above method sets up a subdomain key management center (DKMC) in the production control area and the management information area respectively, and sets up a root key management center (RKMC) between the two areas, generates corresponding authentication credentials according to their respective security policies and requirements, and distributes them to the corresponding users or systems through a secure channel. In the process of data exchange and information sharing, the communicating parties need to adopt a continuous authentication mechanism, protect the communication line through nonlinear functions to prevent attacks from various protocols, and ensure that the risk of security vulnerabilities and data leakage is minimized.

[0026] In the above step 1, each authentication credential includes the credential of the zone where the zone is located and the credential of the entity in the zone.

[0027] In the above step 8, the nonlinear function f = a·e bt, where a is an integer randomly generated by entity A during the continuous authentication phase; b is an integer randomly generated by entity B during the continuous authentication phase; t is the timestamp recorded by the entity when the session duration T agreed upon by both entities has not yet expired, and e is the base of the natural logarithm, which is approximately equal to 2.71828.

[0028] A system for implementing the above-mentioned power system network cross-region authentication credential verification method comprises: a root key management center RKMC, a subdomain key management center, an entity A and an entity B;

[0029] The root key management module is located between the production control area and the management information area, and is used to create globally unique authentication credentials for various entities in the production control area and the management information area. Each authentication credential includes the credentials of the area where it is located and the credentials of the entity in the area;

[0030] The production control area and the management information area are respectively equipped with a subdomain key management center (DKMC). The subdomain key management center (DKMC) is responsible for generating unique public and private keys for entities in its area according to the UMI principle, and distributing the public key base including all entity public keys to all entities. This information is used for mutual authentication between subsequent entities; the private key generated by the DKMC is an important component of the authentication credentials between entities, ensuring the uniqueness of each subject's identity and the security of authentication.

[0031] The technologies not mentioned in the present invention are all referred to the prior art.

[0032] The present invention has the following beneficial effects:

[0033] 1. Improved security: By adopting a cross-region authentication protocol based on the unified multi-domain identification (UMI) technology, the confidentiality, integrity and non-repudiation of authentication credentials during transmission are effectively guaranteed. This method can effectively prevent unauthorized access and data tampering, and significantly improve the overall security protection level of the system.

[0034] 2. Enhanced authentication efficiency: By establishing a root key management center (RKMC) between the production control area and the management information area, and setting up a subdomain key management center (DKMC) in each area to generate and distribute authentication credentials, this architecture effectively reduces the time delay in the authentication process and achieves efficient authentication credential management and verification.

[0035] 3. Ensure the real-time and reliability of data exchange: During the verification process, the protection of the communication line is enhanced through nonlinear functions, reducing the risk of data leakage and security vulnerabilities. At the same time, the real-time and reliability of data exchange and information sharing are ensured through the continuous authentication mechanism.

[0036] 4. Strong adaptability: The system and method of the present invention are applicable to a variety of different network environments and application scenarios in the power system. The authentication process and parameters can be flexibly adjusted according to specific security policies and requirements to provide customized security solutions.

[0037] 5. Improve operational efficiency: Through automated authentication and key management processes, the need for manual intervention is reduced, thereby improving the system's operational efficiency and response speed. In addition, reasonable design also helps power companies reduce maintenance and operating costs.

[0038] 6. Continuous communication guarantee: Through the set session key and continuous authentication mechanism, not only the secure communication of the communicating parties within the set time is guaranteed, but also mutual authentication can be restarted in time when potential security threats are detected, and new session keys can be generated, further enhancing the security and stability of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is the architecture diagram of the cross-region authentication system of the present invention;

[0040] Figure 2 This is a flow chart of cross-regional authentication of the power system network of the present invention;

[0041] Figure 3 This is a flow chart of continuous authentication during the communication process between two parties of the present invention. DETAILED DESCRIPTION

[0042] In order to better understand the present invention, the content of the present invention is further explained below in conjunction with the embodiments, but the content of the present invention is not limited to the following embodiments.

[0043] Example 1

[0044] A method and system for verifying cross-regional authentication credentials of a power system network, taking the authentication process between subjects A and B as an example, subjects A and B are respectively located in the production control area and the management information area. A and ID B Represents the authentication credentials of subject A and B respectively, pk A and sk A is the public and private key of subject A, pk B and sk B The public and private keys of subject B.

[0045] Step 1: Figure 1 As shown, a root key management center RKMC is set between the production control area and the management information area; the root key management center RKMC creates globally unique authentication credentials for various entities in the production control area and the management information area. Each authentication credential includes the credentials of the area where it is located and the credentials of the entity in the area.

[0046] Step 2: Set up subdomain key management centers in the production control area and the management information area respectively; the subdomain key management center (DKMC) is responsible for generating unique public and private keys for entities in the area according to the UMI principle, and distributes the public key base including all entity public keys to all entities. This information is used for mutual authentication between subsequent entities.

[0047] Step 3: If Figure 2 As shown, subject A generates a random number r a , and use the hash function H to generate the ID A ||ID B ||r a The hash value of . Use your own private key to sign the hash value to get S A =Sig(sk A ,H(ID A ||ID B ||r a )), and S A 、r a 、ID A Sent to subject B located in another region.

[0048] Step 4: Subject B receives the message from subject A, determines the public key base of the zone where A is located through A's authentication certificate, and extracts A's public key pk from it A . Use pk A Verify the signature S A , and confirm the hash value H(ID A ∣∣ID B ∣∣r a ) to verify the identity of subject A.

[0049] Step 5: Agent B generates a random number r b , and use the hash function H and its own private key sk B Generate digital signature S B =Sig(sk B ,H(ID A ||ID B ||r b )), then S B 、r b 、ID B Sent to subject A. Subject A uses the same operation as in step 4 above to verify the identity of subject B.

[0050] Step 6: If the authentication is successful, entities A and B generate the channel state information C in the received data packets respectively. r and C i . Entity A will C r and a random number rb Encrypt with B's public key to get M A =pk B (C r ,r b ) and sends it to subject B.

[0051] Step 7: Subject B receives message M A Then, use the private key sk B Decrypt and get C r and r b If r b If it is correct, it proves that the message has not been tampered with during transmission, and the information status information C r Correct. Then subject B uses A's public key pk A Calculate M B =pk A (C i ,r a ), and sends it to A.

[0052] Step 8: Subject A receives message M B Then, use the private key sk A Decrypt and get C i and r a If r a If it is correct, it proves that the message has not been tampered with during transmission, and the channel state information C i Correct. Now set the counter of subject A to ACK A = 1, and each time a message is received, it is incremented by 1 to ensure that the messages are received in the correct order. Then A generates the session key lastSkey is the previous session key. LastSkey is not needed for the initial authentication. If an attacker can obtain the current channel state information, it is difficult to accurately calculate the current session key without lastSkey. Therefore, adding lastSkey when generating the session key ensures the continuity and security of the session key. At the same time, subject A sets the session continuity time T and timestamp t m And randomly select a nonlinear function f (in this case f = a·e bt ), then T, t m , f and generate session key marker A S =1Use pk B It is encrypted and sent to subject B.

[0053] Step 9: Subject B receives the message sent by subject A containing A S = 1, generate the corresponding session key Skey and set the counter ACK B= 1. At this time, the counter values ​​of both subject A and subject B are 1. After that, the two entities in the two regions will communicate securely through the session key Skey within the set time T. The messages communicated between the two parties contain their respective counters to ensure that the messages are received in order.

[0054] During the data exchange and information sharing process, both parties need to use a continuous authentication mechanism within T time to ensure the security of communication. Figure 3 As shown, the following are the specific steps of the continuous certification stage:

[0055] Step 1: Subject A randomly generates an integer a and calculates Where n is a large prime number. Then subject A uses the session key Skey to a ,n,ACK A Encrypted and sent to subject B.

[0056] Step 2: After receiving the message sent by subject A, subject B uses the session key to decrypt it and obtain m a and n, and calculate a and r based on these values b , if r b If it is correct, it proves that the message has not been tampered with during transmission. At the same time, subject B will also record the current timestamp t. If the timestamp difference tt m If the value is greater than the session duration T, entity B will use the session key Skey to encrypt Rs=1 and send it to entity A, where Rs represents the "reset flag", which is used to indicate that mutual authentication needs to be restarted to generate a new session key. When entity A receives the message containing Rs=1, it will restart mutual authentication to generate a new session key.

[0057] Step 3: If the timestamp difference is less than the session duration T, then subject B will also randomly generate an integer b and calculate And through the nonlinear function f=a·e negotiated in the authentication phase bt Calculate f b . Then use Skey to encrypt m b 、f b , ACK B , b and the recorded timestamp t, and send it to subject A.

[0058] Step 4: After receiving the message, subject A obtains integer b, timestamp t and r through decryption calculation a , if r a If it is correct, it proves that the message has not been tampered with during transmission. Subject A uses a and b through f = a·e bt Calculate f a , and then compare it with the f in the message bIf they match correctly, it proves that subject A is communicating securely with subject B.

[0059] Step 5: Subject A encrypts r using the session key Skey b , ACK A and f a Send it to subject B. Subject B decrypts it after receiving it and verifies r b Correctness, ACK A Is the value correct and check f at the same time a Is it related to f b If all these parameters are verified, it proves that subject A and subject B can still communicate with each other. Subject B will use the session key Skey to encrypt the keep=1 and ACK B Sent to subject A to ensure that both parties in the two regions know that they can continue to communicate without regenerating a new session key.

[0060] During the continuous authentication process, the subject A counter ACK A and the subject B calculator ACK B It will also be incremented to ensure that messages are received in the correct order.

[0061] Example 2

[0062] A system for cross-regional authentication credential verification of a power system network, comprising: a root key management center RKMC, a subdomain key management center, an entity A and an entity B;

[0063] The root key management module is located between the production control area and the management information area, and is used to create globally unique authentication credentials for various entities in the production control area and the management information area. Each authentication credential includes the credentials of the area where it is located and the credentials of the entity in the area;

[0064] The production control area and the management information area are respectively equipped with a subdomain key management center (DKMC). The subdomain key management center (DKMC) is responsible for generating unique public and private keys for entities in its area according to the UMI principle, and distributing the public key base including all entity public keys to all entities. This information is used for mutual authentication between subsequent entities; the private key generated by the DKMC is an important component of the authentication credentials between entities, ensuring the uniqueness of each subject's identity and the security of authentication.

[0065] A verification method for cross-region authentication credentials of a power system network, refer to Example 1.

[0066] The above-mentioned cross-region authentication credential verification methods and systems for power system networks effectively ensure the confidentiality, integrity and non-repudiation of authentication credentials during transmission by adopting a cross-region authentication protocol based on unified multi-domain identification (UMI) technology. This method can effectively prevent unauthorized access and data tampering, and significantly improve the overall security protection level of the system. By establishing a root key management center (RKMC) between the production control area and the management information area, and setting up a subdomain key management center (DKMC) in each area to generate and distribute authentication credentials, such an architecture effectively reduces the time delay in the authentication process and realizes efficient authentication credential management and verification. During the verification process, the protection of the communication line is enhanced by nonlinear functions, reducing the risk of data leakage and security vulnerabilities. At the same time, the real-time and reliability of data exchange and information sharing are ensured through a continuous authentication mechanism. It can be applied to a variety of different network environments and application scenarios in the power system, and the authentication process and parameters can be flexibly adjusted according to specific security strategies and requirements to provide customized security solutions. Through automated authentication and key management processes, the need for manual intervention is reduced, thereby improving the operating efficiency and response speed of the system. In addition, reasonable design also helps power companies reduce maintenance costs and operating costs. Through the set session key and continuous authentication mechanism, not only is the secure communication between the two parties guaranteed within the set time, but also mutual authentication can be restarted in time when potential security threats are detected to generate new session keys, further enhancing the security and stability of communication.

Claims

1. A method for verifying cross-regional authentication credentials of a power system network, characterized in that: The steps include: Step 1: Set up a root key management center RKMC between the production control area and the management information area; the root key management center RKMC creates a globally unique authentication credential for various entities in the production control area and the management information area; Step 2: Set up subdomain key management centers in the production control area and the management information area respectively; the subdomain key management center is responsible for generating unique public and private keys for entities in the area according to the UMI principle, and distributes the public key base including all entity public keys to all entities. This information is used for mutual authentication between subsequent entities; Take the authentication process between entities A and B as an example. Entities A and B are located in the production control area and the management information area respectively. A and ID B Represents the authentication credentials of entity A and B respectively, pk A and sk A is the public and private key of entity A, pk B and sk B are the public and private keys of entity B; Step 3: Entity A generates a random number r a , and use the hash function H to generate the ID A ||ID B ||r a The hash value of entity A is signed with its private key to obtain S A =Sig(sk A ,H(ID A ||ID B ||r a )), and S A 、r a 、ID A Send to entity B; Step 4: Entity B receives the message from entity A, determines the public key base of the zone where entity A is located through entity A's authentication certificate, and extracts entity A's public key pk from it A , use pk A Verify the signature S A , and confirm the hash value H(ID A ∣∣ID B ∣∣r a ) to verify the identity of entity A; Step 5: Entity B generates a random number r b , and use the hash function H and its own private key sk B Generate a digital signature S B =Sig(sk B ,H(ID A ||ID B ||r b )), then S B 、r b 、ID B Sent to entity A, which verifies the identity of entity B using the same operation as step 4 above; Step 6: If the authentication is successful, entities A and B generate channel state information C in the received data packets respectively. r and C i , entity A will C r and a random number r b Encrypt with B's public key to get M A =pk B (C r ,r b ), and sends it to entity B; Step 7: Entity B receives message M A Then, use the private key sk B Decrypt and get C r and r b , if r b If it is correct, it proves that the message has not been tampered with during transmission, and the information status information C r Correct; then entity B uses A's public key pk A Calculate M B =pk A (C i ,r a ), and send it to A; Step 8: Entity A receives message M B Then, use the private key sk A Decrypt and get C i and r a , if r a If it is correct, it proves that the message has not been tampered with during transmission, and the channel state information C i Correct, now set the counter of entity A to ACK A = 1, and each time a message is received, it is incremented by 1 to ensure that the messages are received in the correct order; then entity A generates a session key lastSkey is the previous session key. LastSkey is not required for the initial authentication. At the same time, entity A sets the session duration T and timestamp t m And randomly select a nonlinear function f, and then T, t m , f and generate session key marker A S =1Use pk B After encryption, it is sent to entity B; Step 9: Entity B receives the message sent by entity A containing A S = 1, generate the corresponding session key Skey and set the counter ACK B =1; at this time, the counter values ​​of both entity A and entity B are 1. After that, the two entities located in the production control area and the management information area will communicate securely through the session key Skey within the set time T. The messages communicated between the two parties contain their respective counters to ensure that the messages are received in order.

2. The method for verifying cross-regional authentication credentials of a power system network according to claim 1, characterized in that: During the data exchange and information sharing process, both parties need to use a continuous authentication mechanism within T time to ensure the security of communication. The following are the specific steps of the continuous authentication stage: Step 9.1: Entity A randomly generates an integer a and calculates Where n is a large prime number, then entity A uses the session key Skey to a ,n,ACK A Encrypt and send to entity B; Step 9.2: After receiving the message sent by entity A, entity B uses the session key to decrypt it and obtain m a and n, and calculate a and r based on these values b , if r b If the timestamp is correct, it proves that the message has not been tampered with during transmission. At the same time, entity B will also record the current timestamp t. If the timestamp difference tt m If the message is longer than the session duration T, entity B will use the session key Skey to encrypt Rs=1 and send it to entity A, where Rs represents the "reset flag", which is used to indicate that mutual authentication needs to be restarted to generate a new session key. When entity A receives the message containing Rs=1, it will restart mutual authentication to generate a new session key. Step 9.3: If the timestamp difference is less than the session duration T, entity B will also randomly generate an integer b and calculate And through the nonlinear function f=a·e negotiated in the authentication phase bt Calculate f b , then use Skey to encrypt m b 、f b , ACK B , b and the recorded timestamp t, and send it to entity A; Step 9.4: After receiving the message, entity A obtains integer b, timestamp t and r through decryption calculation a , if r a If it is correct, it proves that the message has not been tampered with during transmission; entity A uses a and b through f = a·e bt Calculate f a , and then compare it with the f in the message b Compare and if they match correctly, it proves that entity A is communicating securely with entity B; Step 9.5: Entity A encrypts r using the session key Skey b , ACK A and f a It is sent to entity B, which decrypts it and verifies r b Correctness, ACK A Is the value correct and check f at the same time a Is it related to f b Similarly, if these parameters are verified, it proves that entity A and entity B can still communicate with each other, and entity B will use the session key Skey to encrypt the mark keep=1 and ACK B Sent to entity A to ensure that both parties in the two regions know that they can continue to communicate without regenerating a new session key.

3. The method for verifying cross-regional authentication credentials of a power system network according to claim 1 or 2, characterized in that: During the continuous authentication process, entity A counter ACK A and entity B calculator ACK B It will also be incremented to ensure that messages are received in the correct order.

4. The method for verifying cross-regional authentication credentials of a power system network according to claim 1 or 2, characterized in that: In step 1, each authentication credential includes the credentials of the zone where it is located and the credentials of the entity in the zone.

5. The method for verifying cross-regional authentication credentials of a power system network according to claim 1 or 2, characterized in that: In step 8, the nonlinear function f = a·e bt , where a is an integer randomly generated by entity A during the continuous authentication phase; b is an integer randomly generated by entity B during the continuous authentication phase; t is the timestamp recorded by the entity when the session duration T agreed upon by both entities has not yet expired, and e is the base of the natural logarithm, which is approximately equal to 2.71828.

6. A system for implementing the power system network cross-region authentication credential verification method according to any one of claims 1 to 5, comprising: Root key management center RKMC, subdomain key management center, entity A and entity B; The root key management module is located between the production control area and the management information area, and is used to create globally unique authentication credentials for various entities in the production control area and the management information area. Each authentication credential includes the credentials of the area where it is located and the credentials of the entity in the area; The production control area and the management information area are respectively equipped with subdomain key management centers. The subdomain key management centers are responsible for generating unique public and private keys for entities in their respective areas according to the UMI principle, and distributing the public key base including the public keys of all entities to all entities. This information is used for mutual authentication between subsequent entities.

Images