Power system space entity cross-system authentication method and device based on alliance chain

Abstract

The invention discloses a cross-system authentication method and device for spatial entities of a power system based on an alliance chain. The method comprises the following steps: extracting entity features of each spatial entity in a power system, wherein the entity features comprise static feature vectors and dynamic behavior sequences; establishing a Merkel forest corresponding to each space entity according to the entity characteristics of each space entity; obtaining a joint signature of a cross-system authorization mechanism as an authorization certificate; storing Merkel forest information and joint signature information through an alliance chain; and performing cross-system identity authentication based on a zero-knowledge proof algorithm according to Merkel forest information, the information of the joint signature and the authorization certificate. According to the method, the Merkel forest is constructed by using the static features and the dynamic features of the space entities, the joint signature, the alliance chain and the zero-knowledge proof algorithm are combined, reliable cross-system identity authentication is realized on the premise of ensuring safety, and the method can be applied to various power systems and has expandability.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of power system security technology, and in particular, to a method and device for cross-system authentication of power system spatial entities based on an alliance chain. Background Art

[0002] The power network space is becoming more intelligent, diversified, and complex. There are usually multiple independent power systems that provide services and resources for the internal network space entities. When the network space entities have cross-system resource access behaviors, the support of cross-system identity authentication technology is required. Considering the intelligent development trend of the power system, the internal entities, resources, and service types of the system are complex and diverse. General and scalable authentication technology has become the key to meet multi-dimensional permission verification and access control.

[0003] Compared with traditional identity authentication, cross-system authentication has greater challenges. First, different power network systems are heterogeneous, and power equipment from various suppliers use different communication protocols and security standards, which leads to the need for identity authentication technology to support diverse system characteristics; second, as a critical infrastructure, the power system needs to take into account both high security requirements and high response efficiency, which requires the authentication process to meet real-time operation and response speed requirements, while having a high degree of anti-counterfeiting and anti-attack capabilities; in addition, the traditional identity authentication framework usually introduces a central management agency (such as a system administrator) to be responsible for identity management and access control, which is difficult to use in cross-system authentication: on the one hand, there is often a greater throughput overhead in the application scenario of cross-system authentication, which brings a burden of computing resources to the central management agency, and the central agency in turn becomes the computing bottleneck of the entire power system; on the other hand, the central management agency is usually considered to be trustworthy and has access data of all cyberspace entities in identity authentication and access control. This security assumption also brings potential security risks in cross-system authentication.

[0004] A traditional cross-system identity authentication scheme is to achieve secure identity management and authentication based on public key cryptography. In the Public Key Infrastructure (PKI) system, a Certificate Authority (CA) is usually included, which is responsible for verifying the power system entities and issuing digital certificates to trusted entities. This strategy provides a direct and effective authentication scheme, but the centralized authentication strategy may lead to serious computing bottlenecks and potential security risks; another scheme is based on distributed ledger technology (such as Byzantine system, blockchain, alliance chain, etc.), the entity's identity is stored in the data chain as transaction data and maintained by the distributed network. The power system implements trusted entity identity authentication and access management based on the chain data. However, the introduction of distributed ledgers brings greater data storage and computing overhead, and classic distributed ledgers such as blockchain have the characteristics of openness and transparency. The chain data is credible and cannot be tampered with. At the same time, it is transparent and accessible to any user (including its historical version), which brings unprecedented privacy and security challenges. That is, in the cross-system authentication technology based on distributed ledger technology, the entity's private data cannot be directly transmitted publicly on the chain, and private data (such as signature private key) cannot be used to participate in chain operations.

[0005] In summary, how to improve the reliability of cross-system identity authentication has become an urgent problem to be solved. Summary of the invention

[0006] The present application provides a method and device for cross-system authentication of space entities in a power system based on an alliance chain to improve the reliability of cross-system identity authentication.

[0007] In a first aspect, an embodiment of the present application provides a method for cross-system authentication of space entities in a power system based on a consortium chain, including:

[0008] Extracting entity features of each spatial entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences;

[0009] According to the entity characteristics of each of the spatial entities, a Merkle forest corresponding to each of the spatial entities is established;

[0010] Obtain a joint signature from a cross-system authorization agency as authorization credentials for cross-system access;

[0011] The information of the Merkle forest and the information of the joint signature are stored through the alliance chain;

[0012] According to the information of the Merkle forest, the information of the joint signature and the authorization certificate, cross-system identity authentication is performed based on a zero-knowledge proof algorithm.

[0013] In a second aspect, the embodiment of the present application further provides a power system space entity cross-system authentication device based on a consortium chain, including:

[0014] A feature extraction module, used to extract entity features of each spatial entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences;

[0015] An establishing module, used for establishing a Merkle forest corresponding to each of the spatial entities according to the entity characteristics of each of the spatial entities;

[0016] The signature acquisition module is used to obtain the joint signature of the cross-system authorization agency as the authorization credential for cross-system access;

[0017] A storage module, used to store the information of the Merkle forest and the information of the joint signature through a consortium chain;

[0018] The authentication module is used to perform cross-system identity authentication based on the Merkle forest information, the joint signature information and the authorization certificate based on a zero-knowledge proof algorithm.

[0019] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0020] one or more processors;

[0021] A storage device for storing one or more programs;

[0022] When the one or more programs are executed by the one or more processors, the one or more processors implement the cross-system authentication method of power system spatial entities based on alliance chain as described in the first aspect.

[0023] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cross-system authentication method for spatial entities of a power system based on an alliance chain as described in the first aspect.

[0024] In a fifth aspect, an embodiment of the present application further provides a computer program product, comprising a computer program and / or instructions, which, when executed by a processor, implements a cross-system authentication method for spatial entities of a power system based on an alliance chain as described in any of the above embodiments.

[0025] The embodiment of the present application provides a method and device for cross-system authentication of space entities in a power system based on a consortium chain. The method for cross-system authentication of space entities in a power system based on a consortium chain includes: extracting entity features of each space entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences; establishing a Merkle forest corresponding to each space entity according to the entity features of each space entity; obtaining a joint signature of a cross-system authorization agency as an authorization credential for cross-system access; storing the information of the Merkle forest and the information of the joint signature through a consortium chain; performing cross-system identity authentication based on the information of the Merkle forest, the information of the joint signature and the authorization credential based on a zero-knowledge proof algorithm. The above technical solution utilizes the static and dynamic features of the space entity to construct a Merkle forest, and on this basis, combines the joint signature, the consortium chain and the zero-knowledge proof algorithm to achieve reliable cross-system identity authentication while ensuring security, and is applicable to various power systems and has scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0027] Figure 1 A flowchart of a cross-system authentication method for space entities in a power system based on a consortium chain provided in an embodiment of the present application;

[0028] Figure 2 A schematic diagram of a graphical structure of a Merkle forest provided in an embodiment of the present application;

[0029] Figure 3 A schematic diagram of building a consortium chain network based on a smart power system provided in an embodiment of the present application;

[0030] Figure 4 A schematic diagram of a space entity using universal zero-knowledge proof for identity authentication and authority verification provided in an embodiment of the present application;

[0031] Figure 5 A schematic diagram of a cross-system identity authentication process for a space entity based on a consortium chain provided in an embodiment of the present application;

[0032] Figure 6 A schematic diagram of the structure of a cross-system authentication device for space entities in a power system based on a consortium chain provided in an embodiment of the present application;

[0033] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only the parts related to the present application, rather than all structures, are shown in the accompanying drawings.

[0035] It should be mentioned before discussing the exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the steps as sequential processes, many of the steps therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the steps can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0036] It should be noted that the concepts of "first", "second", etc. mentioned in the embodiments of the present application are only used to distinguish different devices, modules, units or other objects, and are not used to limit the order or interdependence of the functions performed by these devices, modules, units or other objects.

[0037] In addition, the embodiments in the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0038] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0039] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the relevant content of the solution.

[0040] Figure 1 A flowchart of a method for cross-system authentication of a space entity in a power system based on a consortium chain is provided for an embodiment of the present application. This embodiment can be applicable to the situation where cross-system identity authentication is performed on different power systems. Specifically, the method for cross-system authentication of a space entity in a power system based on a consortium chain can be performed by a cross-system authentication device for a space entity in a power system based on a consortium chain. The cross-system authentication device for a space entity in a power system based on a consortium chain can be implemented in software and / or hardware and integrated in an electronic device. Electronic devices include, but are not limited to, devices with data processing functions such as computers, smart phones, or servers. They can be space entities in a power system, or they can be control devices in a power system, etc.

[0041] like Figure 1 As shown, the method specifically comprises the following steps:

[0042] S110, extracting entity features of each spatial entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences.

[0043] In this embodiment, the spatial entity (which may be referred to as entity for short) may refer to any individual with resource and service requirements, such as user equipment, such as active users, communication nodes, and power equipment in the power system. Entity features include static features and dynamic behavior features. Static features may be features that do not change over time and may be expressed in the form of vectors. Dynamic behavior features may be features that change over time and may be expressed as sequences.

[0044] S120, establishing a Merkle forest corresponding to each of the spatial entities according to the entity characteristics of each of the spatial entities;

[0045] In this embodiment, for each spatial entity, a corresponding Merkle tree (also called a hash tree) can be constructed according to the corresponding entity characteristics, and the Merkle trees of each spatial entity constitute a Merkle forest. The Merkle tree is a hierarchical data structure that represents a set of data as an encrypted hash tree. Each node in the Merkle tree is marked with an encrypted hash value of a data block, that is, a unique identity can be generated for each spatial entity using the Merkle tree. By using the Merkle tree, the hash value of the data can be effectively calculated and compared, thereby efficiently verifying and storing a large amount of data.

[0046] S130. Obtain a joint signature from a cross-system authorization agency as an authorization credential for cross-system access.

[0047] In this embodiment, multi-party threshold signature technology is used to implement concurrent collaborative authorization for cross-system access. Specifically, a joint signature service can be provided to users, and the cryptographic module software on the mobile terminal can be used to complete digital signature operations, achieve key security, algorithm security and identity authentication, and ensure the security and integrity of users and data. In this process, private data (such as signature private keys) and public keys can be used to implement joint signatures. Among them, there can be one or more authorization agencies (also known as authority management agencies), which may be in a different power system from the spatial entity that currently has cross-system access requirements. Each authorization agency can generate corresponding sub-signatures, which are combined together to obtain a joint signature (also known as an aggregate signature), and the joint signatures of all authorization agencies are used as authorization credentials for cross-system access.

[0048] S140. The information of the Merkle forest and the information of the joint signature are stored through the alliance chain.

[0049] Specifically, the consortium chain is a type of blockchain between the public chain and the private chain, and the consortium chain allows data and transactions to be disclosed and privatized to a certain extent. The consortium chain can be regarded as a distributed ledger technology between the public chain and the private chain, which is jointly managed by multiple trusted institutions. Unlike the full openness of the public chain and the full closure of the private chain, the consortium chain only allows pre-set participants to perform block verification and consensus, allowing data and transactions to be disclosed and privatized to a certain extent, and can be applied to cross-system identity authentication application scenarios. In this embodiment, the information of the Merkle forest (such as entity information, resource information, and access policies, etc.) and the information of the joint signature (such as public key certificates) are stored on the consortium chain. On this basis, the entity can publicly transmit private data on the chain, and can also use private data (such as signature private keys) to participate in chain operations.

[0050] S150. Perform cross-system identity authentication based on the Merkle forest information, the joint signature information and the authorization certificate based on a zero-knowledge proof algorithm.

[0051] Specifically, by using the information of the Merkle forest and the information of the joint signature stored in the alliance chain, on the basis of the authorization certificate, cross-system identity verification and permission authentication can be achieved based on the zero-knowledge proof algorithm. Zero-knowledge proof (Zero-Knowledge Proof) is a cryptographic tool that allows two communicating parties who do not trust each other to prove the validity of a proposition without leaking any additional information. Its application in identity authentication can enable spatial entities to prove their identity and obtain access rights without revealing their identity information to the accessing party. By using the information of the Merkle forest, the information of the joint signature and the authorization certificate, based on the zero-knowledge proof algorithm, reliable cross-system identity authentication can be achieved while ensuring security.

[0052] The embodiment of the present application provides a method for cross-system authentication of power system space entities based on alliance chain, which solves the problem of cross-system identity verification and resource access control in the power network space. By extracting the static feature vector and dynamic behavior sequence of the network space entity, using the Merkle tree to generate a unique identity for the entity, organizing the power system entity state based on the Merkle forest, using the alliance chain to achieve cross-system reliable transmission of entity identity trust, and completing cross-system identity verification and authority authentication based on general zero-knowledge proof technology, it provides a more feasible and reliable solution for cross-system identity management and access control in the smart power system, and uses alliance chain and zero-knowledge proof technology to achieve safe and efficient cross-system identity authentication, providing reliable support for the safe development and operation of the power system. In addition, the method has good versatility and scalability, and can be applied to any power system or a newly added power system.

[0053] In one embodiment, extracting entity features of each spatial entity in the power system includes:

[0054] For each spatial entity, according to the entity type of the spatial entity, the static features of the spatial entity are extracted and a static feature vector is established, and the chain of dynamic behaviors of the spatial entity within a set time window is used as a dynamic behavior sequence; wherein the entity type includes at least one of the following: active user, power equipment; the static features include at least one of the following: entity identification, entity type, entity identity information, entity biometrics, entity hardware features, entity authority digital certificate; the dynamic behavior includes at least one of the following: login information, operation behavior, operation frequency.

[0055] Exemplarily, extracting entity features may include the following steps:

[0056] Step 1.1: For the power system cyberspace entities, they are defined as any individuals with resource and service needs, such as active users, communication nodes, and power equipment. For entity features, they are divided into static features and dynamic features, which are extracted separately to comprehensively characterize the cyberspace entity features.

[0057] Step 1.2: For the static features of cyberspace entities, we mainly focus on entity identification (ID), entity type, entity identity information, biometrics, hardware features, and / or entity authority digital credentials. We can select the corresponding feature extraction strategy according to the entity type. For example, for active users, we can collect their identity information, biometrics, and physical identity credentials; for power equipment, we can collect their manufacturer information, model information, and hardware feature information. We collect entity static attributes through information collection, network testing, and other methods to establish static feature vectors.

[0058] Step 1.3: For the dynamic features of cyberspace entities, we mainly focus on entity login information (such as time, space, network and / or equipment), operation behavior (such as resource access, permission application and / or cross-system authorization) and / or operation frequency. We can select the corresponding feature extraction strategy according to the entity type. For example, for active users, we need to detect their login habits, resource access habits, etc., which can be analyzed in combination with the user portrait established by the power service system; for power equipment, we need to detect its working rules and working status. By extracting the dynamic behavior chain of the entity within a time window, it is stored as a dynamic behavior sequence.

[0059] On this basis, by comprehensively and accurately extracting the physical features of spatial entities, a reliable foundation is provided for identity authentication such as signature and authorization.

[0060] In one embodiment, a Merkle forest corresponding to each spatial entity is established according to the entity characteristics of each spatial entity, including:

[0061] For each spatial entity, a Merkle tree corresponding to the spatial entity is established based on the static feature vector and dynamic behavior sequence of the spatial entity, and the root node of the Merkle tree is used as the unique identifier of the spatial entity; wherein the static features and dynamic behaviors of the spatial entity are both leaf nodes of the Merkle tree;

[0062] A Merkle forest is established according to the Merkle trees corresponding to each spatial entity, and the root node of the Merkle forest is used as the credential of the internal state of the power system; wherein, the Merkle trees corresponding to each spatial entity are all leaf nodes of the Merkle forest.

[0063] Exemplarily, establishing a Merkle forest may include the following steps:

[0064] Step 2.1: For cyberspace entities, organize their static feature vectors and dynamic behavior sequences into lists to build a Merkle tree. At this time, the static features and dynamic behaviors of the cyberspace entities are used as leaf nodes of the Merkle tree. Any slight change in the attributes of the entity will have an uncontrollable impact on the Merkle tree.

[0065] Step 2.2: Use the generated Merkle tree root node as the unique identifier of the cyberspace entity, and use its traceability and immutability to uniquely identify the entity identity.

[0066] Step 2.3. For entities inside the power system, organize all Merkle trees into a list and establish a Merkle forest. Specifically, the Merkle tree is a binary tree structure based on a hash summary algorithm. Among them: leaf nodes store the hash value of the data block; non-leaf nodes store the mixed hash of the values ​​of their two child nodes. Based on this merging rule, recurse upward and eventually get a root node. Due to the characteristics of the hash function and the Merkle tree structure, any slight change in any data block will cause the root of the Merkle tree to change. The Merkle forest is structurally isomorphic to the Merkle tree. In this embodiment, the Merkle tree established by each spatial entity inside the power system serves as a leaf node of the Merkle forest, such as Figure 2 The Merkle tree can be used to grasp the state of each spatial entity in a fine-grained manner, and the Merkle forest can be used to grasp the overall state of all spatial entities in a coarse-grained manner, effectively establishing the binding relationship between the entity and the power system.

[0067] Step 2.4: Use the generated Merkle forest root node as the credential of the current internal state of the power system.

[0068] On this basis, sufficient basis is provided for cross-system identity authentication, improving the security and reliability of cross-system identity authentication.

[0069] In one embodiment, the cross-system authorization agency includes at least two sub-agencies; obtaining a joint signature of the cross-system authorization agency as an authorization credential for cross-system access includes:

[0070] The private key corresponding to the global public key is divided into multiple signature private key shards, the corresponding signature private key shards are distributed to each organization respectively, and the global public key is stored; for spatial entities with cross-system access requirements, access requirements and authorization applications are sent to each sub-organization, so that each sub-organization uses the corresponding signature private key shard to execute the signature algorithm to generate a signature after verifying the entity identity and access requirements of the spatial entity; if the number of acquired signatures reaches a set threshold, a joint signature is generated based on the Lagrange interpolation method according to the acquired signatures of each sub-organization; if the number of acquired signatures reaches a set threshold, the joint signature passes the verification of the global public key, and the joint signature is used as an authorization credential for cross-system identity authentication.

[0071] Exemplarily, obtaining a joint signature may include the following steps:

[0072] Step 3.1: For cross-system authorization agencies deployed in the power system, distribute threshold signature key shards to each sub-agency for generating joint signatures. Store the global public key (pk) for verifying joint signatures. In multi-party threshold signatures, the signature private key is held by multiple participants, and each participant can generate a signature individually. When the number of signatures reaches the threshold, a valid joint signature can be synthesized.

[0073] For example, for (t,n)-TSS, there are n participants in total, and at least t participants are required to generate a valid joint signature. Let the global public key be (pk) and its corresponding private key be sk, which needs to be divided into n private key shards. To this end, first select the t-1 degree polynomial f(x) = sk + a1x + ... + a t-1 x t-1 , where the lowest coefficient is the global private key. For the i-th participant, calculate sk i =f(x i ) as its private key shard.

[0074] For example, multi-party threshold signature can be used for Elliptic Curve Digital Signature Algorithm (ECDSA). In the joint signature, each participant only needs to use the private key shard held to execute the signature algorithm. Assume that the signature generated by the i-th participant is ρ i , at this time, the Lagrange interpolation method is performed on the signature, that is, the calculation is: σ=∑λ i σ i , where λ i are the Lagrange interpolation coefficients: When the number of people participating in the joint signature reaches t, the signature σ can be authenticated by the global public key pk.

[0075] Step 3.2: For cyberspace entities that have cross-system resource access requirements, submit access requirements and authorization applications to different authorized sub-institutions. The authorized sub-institutions verify the spatial entity feature information and issue authorization for valid applications. Specifically, each sub-institution can use private key shards to sign the spatial entity identity and access requirements, and then send them to the spatial entity.

[0076] Step 3.3: When the number of collected signatures reaches the threshold, the signatures can be aggregated to obtain a valid joint signature as an authorization credential for cross-system identity authentication.

[0077] On this basis, by obtaining the joint signature of cross-system authorized agencies, valid credentials are provided for cross-system identity authentication, thereby improving the security and reliability of cross-system identity authentication.

[0078] In one embodiment, the information of the Merkle forest includes the root node of the Merkle forest, and the information of the joint signature includes the global public key (pk).

[0079] Figure 3 It shows a schematic diagram of building a consortium chain based on the power system. Figure 3 As shown, the information of the Merkle forest (such as entity information, resource information, access policy, etc.) and the information of the joint signature (such as public key certificate) are stored on the alliance chain. The advantage of using the alliance chain is that space entities can publicly transmit private data on the chain, and can also use private data (such as signature private keys) to participate in chain operations.

[0080] In one embodiment, cross-system identity authentication is performed based on the Merkle forest information, the joint signature information, and the authorization certificate based on the zero-knowledge proof algorithm, including:

[0081] For spatial entities with cross-system access requirements, a valid proof required for the spatial entity to access the target system is generated based on the zero-knowledge proof document in the alliance chain, where the zero-knowledge proof document includes the Merkle forest information and the joint signature information;

[0082] An access application is sent to the target system to request the target system to authenticate the spatial entity. The access application includes valid proof; wherein, the valid proof includes: the spatial entity holds an authorization credential for cross-system access; the static and dynamic features of the spatial entity are respectively bound to the authorization credential; the static and dynamic features of the spatial entity both meet the cross-system access requirements.

[0083] Exemplarily, the cross-system identity authentication process may include the following steps:

[0084] Step 5.1: Figure 4As shown in the figure, firstly, the proof proposition and the proof target, such as identity authentication, authority verification and access control, are clearly defined. On this basis, the power system performs initial settings for the zero-knowledge proof algorithm, which will be determined by the specific algorithm content. The initialization of the zero-knowledge proof algorithm includes trusted settings, such as setting the common reference string (CRS), including arithmetic representation and key generation. The power system publishes the zero-knowledge proof document (including supported algorithms and auxiliary proof data (such as global public key)) on the alliance chain.

[0085] Taking the active users of the power system as an example, according to their user information, equipment information, network information and other attributes, their static feature vectors are extracted, such as entity identification (ID), entity type (ROLE), entity identity information (IP or MAC address), entity hardware characteristics (host name, system version, processor version and model), etc.; according to their resource access, service access, permission application and other behaviors, their dynamic behavior sequences are extracted, such as multiple timestamps, as well as the geographical location (location), operation behavior (login), details (IP address, device type, resource type), etc. corresponding to each timestamp.

[0086] Then, a corresponding Merkle tree is established based on the static feature vector and the dynamic behavior sequence. For example, the SHA256 hash summary algorithm can be used to establish the Merkle tree, in which the Merkle tree root node serves as the unique identifier of the entity identity; the Merkle trees of each spatial entity constitute a Merkle forest, in which the root node is used to characterize the current state of the power system.

[0087] Three authorized (sub) organizations can be set up in the power system, each of which holds a multi-party threshold signature private key shard and stores the global public key. For example, the Elliptic Curve Digital Signature Algorithm (ECDSA) is a signature algorithm based on elliptic curves. The standard curve of the elliptic curve algorithm (such as secp256k1) is used. For cross-system access applications submitted by power network space entities, each organization generates a sub-signature, and finally obtains an aggregate signature based on a sufficient number of sub-signatures, and performs global public key verification on the aggregate signature.

[0088] On this basis, for cross-system resource access in the power system, the access control rules are defined as follows: using the static feature vector of the terminal device, dynamic behavior sequence, entity identity identification, power system status identification, cross-system access authorization, and zero-knowledge proof based on the Groth16 algorithm to achieve cross-system identity authentication.

[0089] Step 5.2: For cyberspace entities that have cross-system resource access requirements, use the on-chain auxiliary data and the algorithm supported by the target system to generate valid proofs. The cyberspace entity generates a valid proof and sends it to the target system as an access request for authentication. Specifically, the proof content mainly includes:

[0090] The space entity holds a valid identity certificate of the original power system, which can be proved by the entity identity certificate and the Merkle Forest of the original power system;

[0091] The space entity holds static and dynamic features bound to the authorization credentials, which can be proved by the Merkle tree;

[0092] The static and dynamic characteristics of spatial entities meet the cross-system resource access requirements, which can be determined by specific access restriction policies;

[0093] The spatial entity holds the corresponding access authorization credentials for cross-system resources, which can be proved by joint signature authorization and the global public key.

[0094] Step 5.3: For network entities that have cross-system resource access requirements, the power system authenticates their access applications. Specifically, by verifying whether the zero-knowledge proof is valid, reliable identity authentication, authorization verification, and access control are achieved without leaking private data.

[0095] Zero-knowledge proof technology allows the prover to prove the correctness of a statement to the verifier without revealing any other information. For example, for the target constraint set C and the public input x (also known as auxiliary input), the zero-knowledge proof technology states that the prover holds a private input w that satisfies:

[0096] (x,w)∈L={(x,w):C(x,w)=1}

[0097] In a general zero-knowledge proof system, the prover can transform the target problem into a specific form of arithmetic circuit and safely prove its correctness. A general zero-knowledge proof system is a zero-knowledge concise non-interactive knowledge argument, and the verification algorithm can be Groth16 or Plonk algorithm, etc. This type of algorithm embodies the characteristics of simplicity and non-interactiveness. The verifier can verify the correctness of the target problem in a constant number of operations without considering the scale and complexity of the target problem. For cross-system authentication of power network space entities based on alliance chains, this feature can well control the transmission and verification overhead generated by identity authentication, which meets the availability and reliability requirements of power system identity authentication.

[0098] On this basis, in the cross-system authentication of entities in the power network space, universal zero-knowledge proof technology can realize any form of identity verification, authority verification, and access control. At the same time, its zero-knowledge nature ensures that entity information will not be leaked in this process, providing a universal, secure and reliable solution.

[0099] Figure 5 A schematic diagram of a cross-system identity authentication process for a space entity based on a consortium chain is provided in an embodiment of the present application. Figure 5 As shown, for each entity in the entity set, the entity features are extracted and a Merkle tree is established to obtain a unique identity, and then a Merkle forest is established for the entity set as a system status credential; based on this system status credential, combined with the global public key of each authority management agency (cross-system authorization agency) and zero-knowledge proof auxiliary data, the alliance chain is used to process the entity's cross-system access request to achieve identity authentication of the entity.

[0100] Figure 6 A schematic diagram of the structure of a cross-system authentication device for a power system space entity based on a consortium chain provided in an embodiment of the present application. The cross-system authentication device for a power system space entity based on a consortium chain provided in this embodiment includes:

[0101] A feature extraction module 210 is used to extract entity features of each spatial entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences;

[0102] An establishing module 220, configured to establish a Merkle forest corresponding to each of the spatial entities according to the entity characteristics of each of the spatial entities;

[0103] The signature acquisition module 230 is used to obtain the joint signature of the cross-system authorization agency as the authorization certificate for cross-system access;

[0104] The evidence storage module 240 is used to store the information of the Merkle forest and the information of the joint signature through the alliance chain;

[0105] The authentication module 250 is used to perform cross-system identity authentication based on the Merkle forest information, the joint signature information and the authorization certificate based on a zero-knowledge proof algorithm.

[0106] The device uses a neural network model to predetermine the coding parameters corresponding to different complexity levels, and selects appropriate target coding parameters according to the complexity level during the coding process, thereby improving the quality and efficiency of cross-system authentication of spatial entities in power systems based on alliance chains.

[0107] In one embodiment, the feature extraction module 210 is specifically used for:

[0108] For each of the spatial entities, according to the entity type of the spatial entity, the static features of the spatial entity are extracted and a static feature vector is established, and the chain of dynamic behaviors of the spatial entity within a set time window is used as a dynamic behavior sequence;

[0109] Wherein, the entity type includes at least one of the following: an active user, an electric power device;

[0110] The static features include at least one of the following: entity identification, entity type, entity identity information, entity biometric features, entity hardware features, entity authority digital certificate;

[0111] The dynamic behavior includes at least one of the following: login information, operation behavior, and operation frequency.

[0112] In one embodiment, the establishment module 220 is specifically configured to:

[0113] For each of the spatial entities, a Merkle tree corresponding to the spatial entity is established according to the static feature vector and the dynamic behavior sequence of the spatial entity, and the root node of the Merkle tree is used as the unique identifier of the spatial entity; wherein the static features and dynamic behaviors of the spatial entity are both leaf nodes of the Merkle tree;

[0114] A Merkle forest is established according to the Merkle trees corresponding to each of the spatial entities, and the root node of the Merkle forest is used as the credential of the internal state of the power system; wherein the Merkle trees corresponding to each of the spatial entities are leaf nodes of the Merkle forest.

[0115] In one embodiment, the cross-system authorization organization includes at least two sub-organizations;

[0116] The signature acquisition module 230 is specifically used for:

[0117] Divide the private key corresponding to the global public key into multiple signature private key shards, distribute the corresponding signature private key shards to each of the institutions, and store the global public key;

[0118] For space entities with cross-system access requirements, send access requirements and authorization applications to each of the sub-institutions, so that each of the sub-institutions can use the corresponding signature private key shards to execute the signature algorithm to generate a signature after verifying the entity identity and access requirements of the space entity;

[0119] If the number of acquired signatures reaches the set threshold, a joint signature is generated based on the Lagrange interpolation method according to the acquired signatures of each sub-institution;

[0120] If the number of acquired signatures reaches a set threshold, the joint signature is verified by the global public key and used as an authorization credential for cross-system identity authentication.

[0121] In one embodiment, the information of the Merkle forest includes the root node of the Merkle forest, and the information of the joint signature includes the global public key.

[0122] In one embodiment, the authentication module 250 is specifically configured to:

[0123] For a spatial entity that has cross-system access requirements, a valid proof required for the spatial entity to access the target system is generated according to the zero-knowledge proof document in the alliance chain, wherein the zero-knowledge proof document includes the information of the Merkle forest and the information of the joint signature;

[0124] Sending an access request to the target system to request the target system to authenticate the spatial entity, the access request including the valid certificate;

[0125] The valid proof includes:

[0126] The spatial entity holds authorization credentials for cross-system access;

[0127] The static features and dynamic features of the spatial entity are respectively bound to the authorization credential;

[0128] Both the static and dynamic characteristics of the spatial entity meet cross-system access requirements.

[0129] The cross-system authentication device for space entities of a power system based on alliance chain provided in the embodiment of the present application can be used to execute the cross-system authentication method for space entities of a power system based on alliance chain provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0130] Figure 7 A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present application is shown. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 10 can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, user equipment, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0131] like Figure 7As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0132] Multiple components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, wireless networks.

[0133] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above.

[0134] In some embodiments, the method of the above embodiment may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform any of the above embodiment methods in any other appropriate manner (e.g., by means of firmware).

[0135] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0136] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow charts and / or block diagrams are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0137] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0138] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device 10 having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device 10. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0139] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0140] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0141] An embodiment of the present application also provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the cross-system authentication method for spatial entities of a power system based on an alliance chain as described in any of the above embodiments.

[0142] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0143] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A cross-system authentication method for space entities in a power system based on alliance chain, characterized in that: include: Extracting entity features of each spatial entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences; According to the entity characteristics of each of the spatial entities, a Merkle forest corresponding to each of the spatial entities is established; Obtain a joint signature from a cross-system authorization agency as authorization credentials for cross-system access; The information of the Merkle forest and the information of the joint signature are stored through the alliance chain; According to the information of the Merkle forest, the information of the joint signature and the authorization certificate, cross-system identity authentication is performed based on a zero-knowledge proof algorithm.

2. The method according to claim 1, characterized in that The extracting entity characteristics of each spatial entity in the power system further includes: For each of the spatial entities, according to the entity type of the spatial entity, the static features of the spatial entity are extracted and a static feature vector is established, and the chain of dynamic behaviors of the spatial entity within a set time window is used as a dynamic behavior sequence; Wherein, the entity type includes at least one of the following: an active user, an electric power device; The static features include at least one of the following: entity identification, entity type, entity identity information, entity biometric features, entity hardware features, entity authority digital certificate; The dynamic behavior includes at least one of the following: login information, operation behavior, and operation frequency.

3. The method according to claim 1, characterized in that According to the entity characteristics of each of the spatial entities, a Merkle forest corresponding to each of the spatial entities is established, including: For each of the spatial entities, a Merkle tree corresponding to the spatial entity is established according to the static feature vector and the dynamic behavior sequence of the spatial entity, and the root node of the Merkle tree is used as the unique identifier of the spatial entity; wherein the static features and dynamic behaviors of the spatial entity are both leaf nodes of the Merkle tree; A Merkle forest is established according to the Merkle trees corresponding to each of the spatial entities, and the root node of the Merkle forest is used as the credential of the internal state of the power system; wherein the Merkle trees corresponding to each of the spatial entities are leaf nodes of the Merkle forest.

4. The method according to claim 1, characterized in that: The cross-system authorization agency includes at least two sub-agencies; Obtain a joint signature from a cross-system authorization agency as authorization credentials for cross-system access, including: Divide the private key corresponding to the global public key into multiple signature private key fragments, distribute the corresponding signature private key fragments to each of the institutions, and store the global public key; For space entities with cross-system access requirements, send access requirements and authorization applications to each of the sub-institutions, so that each of the sub-institutions can use the corresponding signature private key shards to execute the signature algorithm to generate a signature after verifying the entity identity and access requirements of the space entity; Generating a joint signature based on the Lagrange interpolation method according to the acquired signatures of each of the sub-institutions; If the number of acquired signatures reaches a set threshold, the joint signature is verified by the global public key, and the joint signature is used as an authorization credential for cross-system identity authentication.

5. The method according to claim 4, characterized in that The information of the Merkle forest includes the root node of the Merkle forest, and the information of the joint signature includes the global public key.

6. The method according to claim 1, characterized in that According to the information of the Merkle forest, the information of the joint signature and the authorization certificate, cross-system identity authentication is performed based on the zero-knowledge proof algorithm, including: For a spatial entity that has cross-system access requirements, a valid proof required for the spatial entity to access the target system is generated according to the zero-knowledge proof document in the alliance chain, wherein the zero-knowledge proof document includes the information of the Merkle forest and the information of the joint signature; Sending an access request to the target system to request the target system to authenticate the spatial entity, wherein the access request includes the valid certificate; The valid proof includes: The spatial entity holds authorization credentials for cross-system access; The static features and dynamic features of the spatial entity are respectively bound to the authorization credential; Both the static and dynamic characteristics of the spatial entity meet cross-system access requirements.

7. A power system space entity cross-system authentication device based on alliance chain, characterized in that: include: A feature extraction module, used to extract entity features of each spatial entity in the power system, wherein the entity features include static feature vectors and dynamic behavior sequences; An establishing module, used for establishing a Merkle forest corresponding to each of the spatial entities according to the entity characteristics of each of the spatial entities; The signature acquisition module is used to obtain the joint signature of the cross-system authorization agency as the authorization credential for cross-system access; A storage module, used to store the information of the Merkle forest and the information of the joint signature through a consortium chain; The authentication module is used to perform cross-system identity authentication based on the Merkle forest information, the joint signature information and the authorization certificate based on a zero-knowledge proof algorithm.

8. An electronic device, characterized in that: include: at least one processor; a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the cross-system authentication method of power system spatial entities based on the alliance chain as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the cross-system authentication method for spatial entities of a power system based on an alliance chain as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or instructions are executed by the processor, the cross-system authentication method for spatial entities of a power system based on an alliance chain is implemented.

Images