Multi-factor identity authentication method for power distribution network data asset access control

Abstract

The invention discloses a power distribution network data asset access control-oriented multi-factor identity authentication method, which comprises the following steps of: firstly, initiating a login request to a server by a power distribution network user, distributing user authority by a system, collecting user keystroke characteristics, and generating a user keystroke model; and meanwhile, generating a dynamic password, synchronizing the server and the client through an identity authentication out-of-step readjustment mechanism, finally performing identity authentication on the user, updating corresponding parameters after the authentication is finished, and notifying the user of an authentication result. The system is prevented from being attacked by illegal users, and the access control security of the power distribution network is improved; the characteristics of a power distribution network server and a client are combined, a user keystroke characteristic factor and a dynamic password factor are combined, and a multi-factor identity authentication scheme is provided; and the challenge-response protocol and the MD5 algorithm are combined to verify the dynamic password of the user, so that the accuracy and safety of identifying the legal user are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of power distribution networks, and in particular to a multi-factor identity authentication method for access control of data assets in power distribution networks. Background Art

[0002] With the development of mobile communication data and the gradual popularization of the Internet of Things, the data structure of the power system is constantly updated, and illegal attacks are also coming. Since illegal attacks are widely present in communication channels, it is crucial to ensure reliable two-way authentication between distribution network users and servers.

[0003] Identity authentication is the first step for attackers to attack the distribution network data asset access control system. Currently, the distribution network data asset access control identity authentication system lacks security; single-factor identity authentication can no longer guarantee the security of user information and distribution network data assets, and it is necessary to improve the security and scalability of identity authentication to resist illegal intrusion; due to the large size of distribution network data assets, the server load is high, so how to improve the efficiency of the identity authentication system is also one of the problems to be solved.

[0004] Multi-factor authentication technology is a method of verifying user identity by combining two or more independent authentication factors. It requires users to provide multiple pieces of evidence to obtain access to the system in order to improve system security. Multi-factor authentication can improve the security protection capabilities of the system, reduce the risk of unauthorized user access, and prevent all types of data from being stolen. At present, multi-factor authentication can comply with quasi-security standards and flexibly adapt to different fields. In view of the characteristics of distribution network data assets, how to combine multi-factor authentication to ensure the security of access control is a problem to be solved. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and propose a multi-factor identity authentication method for distribution network data asset access control, which combines keystroke behavior and dynamic passwords to perform identity authentication in the distribution network data asset access control process.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A multi-factor identity authentication method for access control of distribution network data assets. First, the distribution network user initiates a login request to the server. The system assigns user permissions, collects user keystroke characteristics, and generates a user keystroke model. At the same time, a dynamic password is generated, and the server and client are synchronized through the identity authentication desynchronization readjustment mechanism. Finally, the user is authenticated. After the authentication is completed, the corresponding parameters are updated and the user is notified of the authentication result.

[0008] Among them, the authentication based on the keystroke behavior of the distribution network user includes the following specific steps:

[0009] S1A: Registration stage: The user's viewing and use rights of the system are mainly granted by the administrator. In addition, the username and password will be initialized. The user logs in to the system with the initialized username and password. During the login process, the user's device information and location information will be stored in a specific whitelist. The system collects the keystroke information of each user login to improve the user's keystroke model;

[0010] S2A: Distribution network user identity authentication: When a user logs in, the client first verifies whether the username and password are correct. After the verification is passed, the trained user keystroke model is called for verification. If the verification is passed, the user's IP address and region information are checked to see if they are in the whitelist. If one of the above conditions is not met, the system sends a text message to inform the user that the verification has failed. Otherwise, the user is deemed to be legitimate, and the legitimate user's keystroke information will be retained for model updates;

[0011] S3A: Parameter update stage: Since the user's keystroke behavior is one of the biometric characteristics, the user's keystroke behavior habits will not change much in a short period of time, but as time goes by, the user's behavior will inevitably change slightly, so the user and the model need to be updated and maintained regularly;

[0012] In addition, the identity authentication of distribution network users through dynamic password factors includes the following specific steps:

[0013] S1B: Client registration phase: The purpose of this phase is to establish an initial trust relationship between the client and the server. During the registration process, the client and the server exchange a public key and a user name ID, and each party stores the public key generated by the other party.

[0014] S2B: Login stage;

[0015] S3B: Identity authentication out-of-sync readjustment: To synchronize the server and client of the distribution network data asset access control system;

[0016] S4B: Distribution network user identity authentication: distribution network user ID verification, distribution network user password verification, and response number verification.

[0017] As a further technical solution of the present invention, the keystroke factor and the dynamic password factor are independently parallel.

[0018] As a further technical solution of the present invention, in the S2B, the specific steps are as follows:

[0019] S2Ba: The client sends the encrypted ciphertext C1 to the server

[0020]

[0021] After being encrypted twice, C1 is sent directly to the server;

[0022] The client starts a timer for the random number R sent by the backup client. If the server does not send a response data packet to the client within the specified time T, the client discards the random number. If the client receives the response data sent by the server within the time limit T, it verifies it and discards the random number after verification.

[0023] S2Bb: Server decrypts ciphertext:

[0024] The server uses its own private key K pris Decrypt the ciphertext C1 to obtain the data packet M1 and the client IDC id And the random number R sent by the client, the decryption process is as follows:

[0025]

[0026] According to the decrypted data packet C id , find the corresponding public key K in the database pubc ;

[0027] S2Bc: Encrypt data packet M2

[0028]

[0029] S2Bd: The server sends a data packet to the client

[0030]

[0031] The server sends a packet C2 to the client, which is the R transmitted from the client to the server through the server private key and the server IDS id Encrypt, and then add the encrypted result and S id Pack and encrypt again using the client public key;

[0032] S2Be: Client Decryption Packet

[0033]

[0034] After receiving the feedback from the server, the client uses the client private key K pric Decrypt the encrypted data packet and record it as M4;

[0035] S2Bf: Decrypt to obtain the server ID and the random number R sent by the client

[0036]

[0037] The S obtained by formula (5) id Get the corresponding public key Kpubs , and through K pubs Decrypt M3 and get new S id and R.

[0038] As a further technical solution of the present invention, in the S2Ba, in formula (1): C id is the client ID, R is the random number issued by the client, The encryption process for the server through the public key, The encryption process of the client through the private key, P j The dynamic password received by the client.

[0039] As a further technical solution of the present invention, in the S2Bb, in formula (2): In order to utilize the decryption process of the server private key, M1 and M2 are data packets.

[0040] As a further technical solution of the present invention, in the S2Bc, in formula (4): The decryption process of the client public key decrypts the data packet M2 to obtain the client IDC id And the current dynamic password P j .

[0041] As a further technical solution of the present invention, in the S2Bd, in formula (5): For the encryption process using the client's public key, For the encryption process using the server’s private key, S id is the server ID, and R is the random number issued by the client.

[0042] As a further technical solution of the present invention, in the S2Be, in formula (6): M3 and M4 are data packets, This is the decryption process using the client's private key.

[0043] As a further technical solution of the present invention, in S3B, the specific steps are as follows:

[0044] Assume that the relationship between the dynamic password d and time t can be expressed as:

[0045] d=rand(tx) (9)

[0046] In the formula: x represents the key, rand() is a one-way hash function;

[0047] Assume that the time when the server sends the data packet is t1, then:

[0048] d1=rand(t1x) (10)

[0049] The time sent by the client is t2, then:

[0050] d2=rand(t2x) (11)

[0051] When t1≠t2, d1≠d2, there is a desynchronization situation, which can be solved by adjusting the time difference Δt on the server side;

[0052] The server time is fixed at t0, and Δt=t2-t1 is implanted on the server side. At this time, when the password received by the client is d=rand(t2x), the dynamic password can be expressed as d=rand((t1+Δt)x), which solves the problem of authentication desynchronization.

[0053] As a further technical solution of the present invention, in S4B, the specific steps are as follows:

[0054] S4Ba: Distribution network user ID verification: The user ID verification link adopts the MD5 hash algorithm. After the user enters the ID, the server performs an XOR operation on the ID and the 24-byte input factor Salt to form a data string D. The data string D is hashed through the MD5 algorithm to obtain the ID hash value. The 16-bit random array pre-stored in the program is recorded as HK. The user ID legitimacy verification can be completed by comparing the calculated hash value with the pre-stored hash value;

[0055] S4Bb: Distribution network user password verification: Assume that the user input password is PWD. After the user enters the password PWD, 128 groups of numbers are intercepted from the data string D to form a key, and the pre-stored HK ciphertext is decrypted through the decryption algorithm to obtain the plaintext P HK , use MD5 function and HK to perform hash operation on the message, get the corresponding hash value, compare the value with the pre-stored value in the system, if the two are consistent, the user is judged to be a legitimate user, otherwise it is an illegal user;

[0056] S4Bc: Response number verification: Response number verification occurs in the response module of the server. During the verification process, relevant encryption algorithms can be used for encryption to ensure that the keys obtained are different under different challenge numbers, thereby improving key security.

[0057] The beneficial effects of the present invention are:

[0058] 1. After the distribution network user submits a login request, the system determines that the user is a legitimate user after passing both keystroke feature verification and dynamic password verification, thereby allowing the user to access distribution network-related data assets, preventing illegal users from attacking the system and improving the security of distribution network access control.

[0059] 2. Combining the characteristics of the distribution network server and client, the user's keystroke feature factor and the dynamic password factor are combined to propose a multi-factor identity authentication scheme.

[0060] 3. Combine the challenge-response protocol and MD5 algorithm to verify the user's dynamic password, improving the accuracy and security of identifying legitimate users. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is the overall framework diagram of the multi-factor identity authentication method for distribution network data asset access control proposed by the present invention;

[0062] Figure 2 This is an identity authentication framework diagram based on keystroke feature factors of the multi-factor identity authentication method for distribution network data asset access control proposed by the present invention;

[0063] Figure 3 This is a communication flow chart of the login phase of the multi-factor identity authentication method for distribution network data asset access control proposed by the present invention. DETAILED DESCRIPTION

[0064] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0065] Please see attached Figure 1 , a multi-factor identity authentication method for access control of distribution network data assets, firstly, the distribution network user initiates a login request to the server, the system assigns user permissions, collects user keystroke characteristics, and generates a user keystroke model; at the same time, a dynamic password is generated, and the server and the client are synchronized through the identity authentication desynchronization readjustment mechanism, and finally the user is authenticated. After the authentication is completed, the corresponding parameters are updated and the user is notified of the authentication result. The keystroke factor and the dynamic password factor are independent and parallel;

[0066] Among them, the authentication based on the keystroke behavior of the distribution network user includes the following specific steps:

[0067] S1A: Registration stage: The user's viewing and use rights of the system are mainly granted by the administrator. In addition, the username and password will be initialized. The user logs in to the system with the initialized username and password. During the login process, the user's device information and location information will be stored in a specific whitelist. The system collects the keystroke information of each user login to improve the user's keystroke model;

[0068] S2A: Distribution network user identity authentication: When a user logs in, the client first verifies whether the username and password are correct. After the verification is passed, the trained user keystroke model is called for verification. If the verification is passed, the user's IP address and region information are checked to see if they are in the whitelist. If one of the above conditions is not met, the system sends a text message to inform the user that the verification has failed. Otherwise, the user is deemed to be legitimate. The keystroke information of legitimate users will be retained for model updates. The overall process is shown in the attached figure. Figure 2 As shown;

[0069] S3A: Parameter update stage: Since the user's keystroke behavior is one of the biometric characteristics, the user's keystroke behavior habits will not change much in a short period of time, but as time goes by, the user's behavior will inevitably change slightly, so the user and the model need to be updated and maintained regularly;

[0070] In addition, the identity authentication of distribution network users through dynamic password factors includes the following specific steps:

[0071] S1B: Client registration phase: The purpose of this phase is to establish an initial trust relationship between the client and the server. During the registration process, the client and the server exchange a public key and a user name ID, and each party stores the public key generated by the other party.

[0072] S2B: Login phase:

[0073] The communication process during the login phase is as follows: Figure 3 As shown;

[0074] S2Ba: The client sends the encrypted ciphertext C1 to the server

[0075]

[0076] Where: C id is the client ID, R is the random number issued by the client, The encryption process for the server through the public key, The encryption process of the client through the private key, P j It is the dynamic password received by the client. After being encrypted twice, C1 is sent directly to the server.

[0077] The client starts a timer for the random number R sent by the backup client. If the server does not send a response data packet to the client within the specified time T, the client discards the random number. If the client receives the response data sent by the server within the time limit T, it verifies it and discards the random number after verification.

[0078] S2Bb: Server decrypts ciphertext:

[0079] The server uses its own private key K pris Decrypt the ciphertext C1 to obtain the data packet M1 and the client IDC id And the random number R sent by the client, the decryption process is as follows:

[0080]

[0081] Where: In order to use the server private key decryption process, M1 and M2 are data packets; according to the decrypted data packet C id , find the corresponding public key K in the database pubc ;

[0082] S2Bc: Encrypt data packet M2

[0083]

[0084] Where: The decryption process of the client public key decrypts the data packet M2 to obtain the client IDC id And the current dynamic password P j ;

[0085] S2Bd: The server sends a data packet to the client

[0086]

[0087] Where: For the encryption process using the client's public key, For the encryption process using the server’s private key, S id is the server ID, R is the random number sent by the client; the server sends a data packet C2 to the client, which is R and the server ID transmitted to the client through the server private key. id Encrypt, and then add the encrypted result and S id Pack and encrypt again using the client public key;

[0088] S2Be: Client Decryption Packet

[0089]

[0090] Where: M3, M4 are data packets, After receiving the feedback from the server, the client uses the client private key K pric Decrypt the encrypted data packet and record it as M4;

[0091] S2Bf: Decrypt to obtain the server ID and the random number R sent by the client

[0092]

[0093] The S obtained by formula (5) id Get the corresponding public key K pubs , and through K pubs Decrypt M3 and get new S id and R;

[0094] S3B: Identity authentication out of sync and readjustment:

[0095] The purpose of identity authentication desynchronization readjustment is to synchronize the server and client of the distribution network data asset access control system;

[0096] Assume that the relationship between the dynamic password d and time t can be expressed as:

[0097] d=rand(tx) (9)

[0098] In the formula: x represents the key, rand() is a one-way hash function;

[0099] Assume that the time when the server sends the data packet is t1, then:

[0100] d1=rand(t1x) (10)

[0101] The time sent by the client is t2, then:

[0102] d2=rand(t2x) (11)

[0103] When t1≠t2, d1≠d2, there is a desynchronization situation, which can be solved by adjusting the time difference Δt on the server side;

[0104] Fix the server time at t0, and implant Δt=t2-t1 on the server side. When the password received by the client is d=rand(t2x), the dynamic password can be expressed as d=rand((t1+Δt)x), which solves the authentication desynchronization problem.

[0105] S4B: Distribution network user identity authentication:

[0106] S4Ba: Distribution network user ID verification: The user ID verification link adopts the MD5 hash algorithm. After the user enters the ID, the server performs an XOR operation on the ID and the 24-byte input factor Salt to form a data string D. The data string D is hashed through the MD5 algorithm to obtain the ID hash value. The 16-bit random array pre-stored in the program is recorded as HK. The user ID legitimacy verification can be completed by comparing the calculated hash value with the pre-stored hash value;

[0107] S4Bb: Distribution network user password verification: Assume that the user input password is PWD. After the user enters the password PWD, 128 groups of numbers are intercepted from the data string D to form a key, and the pre-stored HK ciphertext is decrypted through the decryption algorithm to obtain the plaintext P HK , use MD5 function and HK to perform hash operation on the message, get the corresponding hash value, compare the value with the pre-stored value in the system, if the two are consistent, the user is judged to be a legitimate user, otherwise it is an illegal user;

[0108] S4Bc: Response number verification: Response number verification occurs in the response module of the server. During the verification process, relevant encryption algorithms can be used for encryption to ensure that the keys obtained are different under different challenge numbers, thereby improving key security.

[0109] From the above description, it can be seen that the above-mentioned embodiments of the present invention achieve the following technical effects: after the distribution network user submits a login request, after passing both the keystroke feature verification and the dynamic password verification, the system determines that the user is a legitimate user, thereby allowing the user to access distribution network-related data assets, avoiding illegal users from attacking the system, and improving the security of distribution network access control.

[0110] Combining the characteristics of the distribution network server and client, the user's keystroke feature factor and the dynamic password factor are combined to propose a multi-factor identity authentication scheme.

[0111] The challenge-response protocol and MD5 algorithm are combined to verify the user's dynamic password, improving the accuracy and security of identifying legitimate users.

[0112] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention (including the claims) is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0113] The present invention is intended to cover all such substitutions, modifications and variations that fall within the broad scope of the claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-factor identity authentication method for access control of distribution network data assets, characterized in that: First, the distribution network user initiates a login request to the server. The system assigns user permissions, collects user keystroke features, and generates a user keystroke model. At the same time, a dynamic password is generated, and the server and client are synchronized through the identity authentication desynchronization readjustment mechanism. Finally, the user is authenticated. After the authentication is completed, the corresponding parameters are updated and the user is notified of the authentication result. Among them, the authentication based on the keystroke behavior of the distribution network user includes the following specific steps: S1A: Registration stage: The user's viewing and use rights of the system are mainly granted by the administrator. In addition, the username and password will be initialized. The user logs in to the system with the initialized username and password. During the login process, the user's device information and location information will be stored in a specific whitelist. The system collects the keystroke information of each user login to improve the user's keystroke model; S2A: Distribution network user identity authentication: When a user logs in, the client first verifies whether the username and password are correct. After the verification is passed, the trained user keystroke model is called for verification. If the verification is passed, the user's IP address and region information are checked to see if they are in the whitelist. If one of the above conditions is not met, the system sends a text message to inform the user that the verification has failed. Otherwise, the user is deemed to be legitimate, and the legitimate user's keystroke information will be retained for model updates; S3A: Parameter update stage: Since the user's keystroke behavior is one of the biometric characteristics, the user's keystroke behavior habits will not change much in a short period of time, but as time goes by, the user's behavior will inevitably change slightly, so the user and the model need to be updated and maintained regularly; In addition, the identity authentication of distribution network users through dynamic password factors includes the following specific steps: S1B: Client registration phase: The purpose of this phase is to establish an initial trust relationship between the client and the server. During the registration process, the client and the server exchange a public key and a user name ID, and each party stores the public key generated by the other party. S2B: Login stage; S3B: Identity authentication out-of-sync readjustment: To synchronize the server and client of the distribution network data asset access control system; S4B: Distribution network user identity authentication: distribution network user ID verification, distribution network user password verification, and response number verification.

2. The multi-factor identity authentication method for distribution network data asset access control according to claim 1 is characterized in that: The keystroke factor and the dynamic password factor are independent and parallel.

3. The multi-factor identity authentication method for distribution network data asset access control according to claim 1 is characterized in that: In the S2B, the specific steps are as follows: S2Ba: The client sends the encrypted ciphertext C1 to the server After being encrypted twice, C1 is sent directly to the server; The backup client sends a random number R, and the client starts a timer. If the server does not send a response packet to the client within the specified time T, the client discards the random number; If the response data sent by the server is received within the time limit T, it is verified and the random number is discarded after verification; S2Bb: Server decrypts ciphertext: The server uses its own private key K pris Decrypt the ciphertext C1 to obtain the data packet M1 and the client IDC id And the random number R sent by the client, the decryption process is as follows: According to the decrypted data packet C id , find the corresponding public key K in the database pubc ; S2Bc: Encrypt data packet M2 S2Bd: The server sends a data packet to the client The server sends a packet C2 to the client, which is the R transmitted from the client to the server through the server private key and the server IDS id Encrypt, and then add the encrypted result and S id Pack and encrypt again using the client public key; S2Be: Client Decryption Packet After receiving the feedback from the server, the client uses the client private key K pric Decrypt the encrypted data packet and record it as M4; S2Bf: Decrypt to obtain the server ID and the random number R sent by the client The S obtained by formula (5) id Get the corresponding public key K pubs , and through K pubs Decrypt M3 and get new S id and R.

4. The multi-factor identity authentication method for distribution network data asset access control according to claim 3 is characterized in that: In the S2Ba, in formula (1): C id is the client ID, R is the random number issued by the client, E Kpubs () is the encryption process of the server using the public key, E Kpric The encryption process of the client through the private key, P j The dynamic password received by the client.

5. The multi-factor identity authentication method for distribution network data asset access control according to claim 3 is characterized in that: In the S2Bb, in formula (2): D Kpris () is the decryption process using the server private key, M1 and M2 are data packets.

6. The multi-factor identity authentication method for distribution network data asset access control according to claim 3 is characterized in that: In the S2Bc, in formula (4): D Kpubc () is the decryption process using the client public key, which decrypts the data packet M2 to obtain the client IDC id And the current dynamic password P j .

7. The multi-factor identity authentication method for distribution network data asset access control according to claim 3 is characterized in that: In the S2Bd, in formula (5): E Kpubc () is the encryption process using the client public key, E Kpris () is the encryption process using the server private key, S id is the server ID, and R is the random number issued by the client.

8. The multi-factor identity authentication method for distribution network data asset access control according to claim 3 is characterized in that: In the S2Be, in formula (6): M3, M4 are data packets, D Kpric () is the decryption process using the client private key.

9. The multi-factor identity authentication method for distribution network data asset access control according to claim 1 is characterized in that: In the S3B, the specific steps are as follows: Assume that the relationship between the dynamic password d and time t can be expressed as: d = rand(tx)(9) In the formula: x represents the key, rand() is a one-way hash function; Assume that the time when the server sends the data packet is t1, then: d1=rand(t1x)(10) The time sent by the client is t2, then: d2=rand(t2x)(11) When t1≠t2, d1≠d2, there is a desynchronization situation, which can be solved by adjusting the time difference Δt on the server side; The server time is fixed at t0, and Δt=t2-t1 is implanted on the server side. At this time, when the password received by the client is d=rand(t2x), the dynamic password can be expressed as d=rand((t1+Δt)x), which solves the problem of authentication desynchronization.

10. The multi-factor identity authentication method for distribution network data asset access control according to claim 1, characterized in that: In the S4B, the specific steps are as follows: S4Ba: Distribution network user ID verification: The user ID verification link adopts the MD5 hash algorithm. After the user enters the ID, the server performs an XOR operation on the ID and the 24-byte input factor Salt to form a data string D. The data string D is hashed through the MD5 algorithm to obtain the ID hash value. The 16-bit random array pre-stored in the program is recorded as HK. The user ID legitimacy verification can be completed by comparing the calculated hash value with the pre-stored hash value; S4Bb: Distribution network user password verification: Assume that the user input password is PWD. After the user enters the password PWD, 128 groups of numbers are intercepted from the data string D to form a key, and the pre-stored HK ciphertext is decrypted through the decryption algorithm to obtain the plaintext P HK , use MD5 function and HK to perform hash operation on the message, get the corresponding hash value, compare the value with the pre-stored value in the system, if the two are consistent, the user is judged to be a legitimate user, otherwise it is an illegal user; S4Bc: Response number verification: Response number verification occurs in the server's response module to verify The relevant encryption algorithm can be used to encrypt the process to ensure that under different challenge numbers, The obtained keys are also different, which improves key security.

Images