Trusted authentication method and system for distributed storage of photovoltaic data

Abstract

The invention discloses a credible authentication method and system for distributed storage of photovoltaic data, and the method comprises the steps: constructing an authentication management network through management end equipment, and carrying out the identity authentication of new equipment through a Ripple consensus mechanism; based on an authentication management network and an identity authentication mechanism constructed by a management end, controlled end equipment obtains an intranet access permission through preset identity information and a key chain generation and updating mechanism; the access authentication of the terminal equipment is realized through three stages of endorsement, sorting and verification by adopting a distributed account book technology based on the intranet access authority, the method is more suitable for the privacy and security requirements of incomplete disclosure of the photovoltaic system data, and the security and concealment of the photovoltaic system are protected.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a trusted authentication method and system for distributed storage of photovoltaic data. Background Art

[0002] As a renewable energy source, solar energy is one of the important means for mankind to solve the energy problem. In recent years, the photovoltaic power generation industry has been greatly developed, and the scale of photovoltaic power stations around the world is huge. The operation and maintenance level of photovoltaic power stations is related to both the cost of photovoltaic power generation and the safety of power grid operation. Therefore, it is an inevitable requirement for the development of the industry to adopt reasonable storage technology to ensure the security of photovoltaic data and improve the operation and maintenance level of photovoltaic power stations.

[0003] Most of the methods currently used are to upload photovoltaic data to a third-party storage server for management based on local storage, generally using a centralized storage method. However, there are many security risks in using a centralized storage method. For example, when sending and requesting a large amount of data to a central node, it will cause blocking and delays in the interface server during peak periods, and waste a large amount of server hardware resources during off-peak periods; once the backbone network fails, it will also cause large-scale service interruptions or delays. And with more and more terminal devices, which are usually resource-constrained embedded devices and are easily attacked, in order to continuously monitor the status of the device, measures need to be used to continuously authenticate the device, so that timely measures can be taken when the device is untrustworthy to reduce losses.

[0004] Distributed storage solutions effectively solve the various problems existing in the above-mentioned centralized storage. At present, there are many protocols used in distributed storage solutions. For example, distributed storage based on the IPFS protocol largely ensures that data is not tampered with, reduces data costs and avoids network failures. However, due to the lack of password verification when the IPFS node is running on the server, the distributed storage solution still has certain security risks. Blockchain technology cleverly combines several technologies, including distributed storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc., which is essentially a distributed ledger. The IPFS protocol can also be used in blockchain storage, and there have been many studies and applications. In response to many problems of trusted authentication, from early remote verification to the proposal and expansion of collective remote proof protocols, it has achieved a certain degree of reduction in the risk of device networks being attacked. At present, most of the research on photovoltaic power stations focuses on material design, data collection, performance analysis, etc., and lacks research on photovoltaic data storage and protection.

[0005] With the construction of the power Internet of Things, the number of smart terminal devices in the power system continues to grow. The deployment range of smart terminals is wide, and the computing and storage capabilities are limited. They can easily become the main targets of network attacks and malicious control. Since photovoltaic data has a huge total amount, the access of a large number of terminal nodes will bring a huge burden to storage for photovoltaic systems. For existing photovoltaic systems, there is a risk of data leakage if they want to achieve trusted authentication based on blockchain. Summary of the invention

[0006] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0007] In view of the above existing problems, the present invention is proposed.

[0008] Therefore, the present invention provides a trusted authentication method and system for distributed storage of photovoltaic data to solve the problem of data leakage risk in the trusted authentication based on blockchain of existing photovoltaic systems.

[0009] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0010] In a first aspect, the present invention provides a trusted authentication method for distributed storage of photovoltaic data, comprising:

[0011] Build an authentication management network through management-end devices and authenticate new devices through the Ripple consensus mechanism;

[0012] Based on the authentication management network and identity authentication mechanism built by the management end, the controlled end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism;

[0013] Based on the access rights to the intranet, distributed ledger technology is used to achieve access authentication of terminal devices through three stages: endorsement, sorting and verification.

[0014] As a preferred solution of the trusted authentication method for distributed storage of photovoltaic data described in the present invention, wherein:

[0015] The method of constructing an authentication management network through a management terminal device includes the following steps:

[0016] Select a group of devices as the initial management end;

[0017] When a new device attempts to join the network, the existing management device evaluates the new device;

[0018] The new device passes the Ripple consensus mechanism. If more than 50% of the existing management devices vote in favor, it agrees to join the network and determines whether the new device is a controlled device.

[0019] If the new device is a controlled device, the device will be added to the network; if the new device is a management device, it will be added to the authentication blockchain.

[0020] As a preferred solution of the trusted authentication method for distributed storage of photovoltaic data described in the present invention, wherein:

[0021] The authentication of the new device through the Ripple consensus mechanism includes the following steps:

[0022] Before attempting to join the network, the management device submits its identity information to the authentication network;

[0023] The nodes in the authentication network calculate the hash value of the identity information provided by the new device and compare it with the hash value calculated by the device itself;

[0024] If the hash value and public key information match, the identity information verification is considered successful.

[0025] As a preferred solution of the trusted authentication method for distributed storage of photovoltaic data described in the present invention, wherein:

[0026] The controlled terminal device obtains the permission to access the intranet by presetting identity information, key chain generation and update mechanism, including the following steps:

[0027] The controlled device submits the preset identity information to the authentication center;

[0028] The authentication center generates a key chain based on the preset information;

[0029] The controlled device integrates the generated key chain and hash chain into a request message and sends it to the authentication network;

[0030] The management device performs verification and grants the controlled device permission to access the intranet.

[0031] As a preferred solution of the trusted authentication method for distributed storage of photovoltaic data described in the present invention, wherein:

[0032] The endorsement phase includes the following steps:

[0033] The controlled device collects data and access verification messages;

[0034] Encapsulate the collected data and access verification message together as endorsement information;

[0035] Sending the endorsement information to the endorsement node in the authentication network composed of management end devices;

[0036] After receiving the endorsement information, the endorsing node verifies the key and digital signature contained therein;

[0037] If the verification is successful, the endorsing node replies endorsement support to the controlled device that initiated the request;

[0038] The controlled device collects endorsement support information from multiple endorsement nodes and generates an endorsement signature set;

[0039] Use the Lagrange interpolation formula to calculate the group key of the endorsement signature set;

[0040] According to the value of the group key, it is determined whether the controlled device has collected signatures from a sufficient number of endorsing nodes. If the endorsement policy requirements are met, the sorting phase is entered.

[0041] As a preferred solution of the trusted authentication method for distributed storage of photovoltaic data described in the present invention, wherein:

[0042] The sorting stage includes the following steps:

[0043] After all conditions in the endorsement phase are met, the controlled device C sends an authentication request to the Orderer node;

[0044] After receiving the authentication request, the Orderer node packages the authentication request and other requests into a block;

[0045] The Orderer node sorts the packaged blocks and broadcasts the sorted requests to all Peer nodes.

[0046] As a preferred solution of the trusted authentication method for distributed storage of photovoltaic data described in the present invention, wherein:

[0047] The verification stage includes the following steps:

[0048] The Committing Peer node verifies the integrity and correctness of the proposal information in the received block;

[0049] Check if proposal numbers are duplicated;

[0050] Determine whether the proposal is feasible;

[0051] If all verification items pass, the Committing Peer node marks the proposal as passed and writes it into the storage data of the blockchain;

[0052] The approved proposals are packaged into new blocks, added to the end of the blockchain, and data sharing continues.

[0053] In a second aspect, the present invention provides a trusted authentication system for distributed storage of photovoltaic data, comprising:

[0054] The management-side authentication module is used to build an authentication management network through management-side devices and authenticate new devices through the Ripple consensus mechanism;

[0055] The controlled-end authentication module is used for the authentication management network and identity authentication mechanism built on the management end. The controlled-end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism;

[0056] The distributed ledger authentication module is used to implement access authentication of terminal devices based on intranet access permissions using distributed ledger technology through three stages: endorsement, sorting, and verification.

[0057] In a third aspect, the present invention provides a computing device, comprising:

[0058] Memory, used to store programs;

[0059] A processor is used to execute the computer executable instructions, which, when executed by the processor, implement the steps of the trusted authentication method for distributed storage of photovoltaic data.

[0060] In a fourth aspect, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, the steps of implementing the trusted authentication method for distributed storage of photovoltaic data are implemented.

[0061] Beneficial effects of the present invention:

[0062] 1. The present invention combines the distributed ledger technology Hyperledger Fabric with the photovoltaic system to meet the incomplete decentralization requirements of the photovoltaic system, reduce the burden on the central node, and improve the system processing efficiency;

[0063] 2. The present invention designs a trusted access solution for photovoltaic system terminals based on blockchain technology. Identity authentication and authority management are more suitable for the privacy and security requirements of photovoltaic system data that are not fully disclosed, and the security and confidentiality of the photovoltaic system are protected;

[0064] 3. The present invention combines distributed storage with encryption algorithms to maintain the environmental safety of the photovoltaic system during operation. The open, transparent and equal network node accounting prevents malicious nodes from tampering with transaction information. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0066] Figure 1 A basic flow chart of a trusted authentication method for distributed storage of photovoltaic data provided by an embodiment of the present invention;

[0067] Figure 2 An overall blockchain architecture diagram of a trusted authentication method for distributed storage of photovoltaic data provided by one embodiment of the present invention;

[0068] Figure 3 A relationship diagram of a management end and a controlled end of a trusted authentication method for distributed storage of photovoltaic data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0070] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0071] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0072] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0073] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0074] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0075] Example 1

[0076] Reference Figure 1 , is an embodiment of the present invention, which provides a trusted authentication method for distributed storage of photovoltaic data, such as Figure 1 As shown, the following steps are included:

[0077] S1: Build an authentication management network through management-end devices and authenticate new devices through the Ripple consensus mechanism;

[0078] In the embodiment of the present application, the construction of the authentication management network formed by the management terminal device and the identity authentication include the following steps:

[0079] (1) Screen the initial management end and build the voting center of the system. The authentication center composed of nodes on the original chain votes for the new device to join the network. The nodes that agree to the Ripple consensus of more than 50% will join the network and determine whether it is a controlled device. If it is a controlled device, the device will be added to the network. If it is a management end, it will join the authentication blockchain.

[0080] (2) Before a new terminal device accesses the system for identity authentication, it must first send an access request to the authentication center. Only after receiving a response can it obtain access rights to the intranet and obtain the distributed key and certificate for access identity authentication. Suppose the code name of the new terminal device is M, and the RSA algorithm is mainly used to generate M i Key, the steps are as follows:

[0081] Step 1: Generate a random number n within 256 bits;

[0082] Step 2: Verify the random number n. If 1 <n<2 256, then the generated number is considered to be standardized, and the random number n is specified as M i The private key SKM i If it is not standard, return to step 1;

[0083] Step 3: By private key SKM i M is obtained through the RSA algorithm i Public key PKM i :

[0084] PKM i =SKM i *G

[0085] Among them, G is the constant point specified by the RSA algorithm.

[0086] (3) Management terminal equipment access to the network

[0087] Step 1: Pre-set identity information

[0088] Management terminal device M i The identity information M iID Sent to the authentication network composed of management devices.

[0089] M iID ={ID Mi ,PK Mi ,h(A),Sig(A) SKMi}

[0090] Where A is the preset protocol information that can identify the identity of the management terminal device; ID Mi For device M i The unique identification mark of the access terminal; PKM i The key generation system is a device M i The generated public key; h(A) is the hash function; Sig(A) SKMi For digital signature.

[0091] Step 2: Hash value comparison

[0092] Calculate the hash value h(A) and public key PKM of the current authentication network node j , and the hash value in step 1 and Sig(A) SKMj contrast.

[0093] Step 3: Compare the results and make judgments

[0094] If the two are consistent, the verification is passed. According to the Ripple consensus mechanism, in the authentication network, when M i When the equipment obtains more than 50% approval, M i Join the certification network and gain management rights over the blockchain.

[0095] S2: Based on the authentication management network and identity authentication mechanism built by the management end, the controlled end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism;

[0096] In the embodiment of the present application, it is assumed that the controlled device is coded as C. i The hardware condition of the controlled device C is relatively poor and can be easily hacked, so its key should be updated regularly. ij The key chain is managed by a management device with better performance. The steps to generate the key chain are as follows:

[0097] Step 1: Keychain Generation

[0098] In the authentication center, the controlled device C ij The key chain is managed by the management end device M that manages the controlled end device i Generate, let v i is the i-th item of the cryptographic chain, and the generation mechanism is:

[0099] v i =h i (PKM i )=h(h(h(...h(PKM i )...)))(i times) (2)

[0100] Among them, assume that the management terminal device M i The number of accesses that can be made is λ, and the maximum value range of i is λ. From formula (2), we can see that the key M of the management end device is i By the controlled device C ij Obtained through a certain number of hash operations.

[0101] Step 2: Keychain Update

[0102] Through the Merkle tree structure, the management device M i The keychain is saved as a Merkle root r i :

[0103] r i =h(v i )=v i -1 i∈{1 <i≤n,i mod 2≠0} (3)

[0104] It can be seen that when the demand for access increases, the number of keys generated will increase accordingly, so there will be no situation where the number of keys is exhausted.

[0105] In the embodiment of the present application, the controlled terminal device accesses the network, including the following steps:

[0106] Step 1: Keychain generation:

[0107] Controlled device C k Send Preset ID ck Go to the authentication center, which generates a key chain and saves it as r k ;

[0108] Step 2: Obtaining intranet license:

[0109] Controlled device C k The required parameters such as the generated hash chain, key chain r k Equally integrated into C kID , and sent to the authentication network. This will allow you to access the intranet, but you cannot join the intranet in this step.

[0110] Step 3: Generate access authentication verification message:

[0111] Controlled device C k Confirm the key chain from v0 to v n The certificate validity period t, access authentication verification message RM i for:

[0112] RM i = {v i ,t,r i ,C kID}.

[0113] S3: Based on the access rights to the intranet, distributed ledger technology is used to implement access authentication of terminal devices through three stages: endorsement, sorting, and verification.

[0114] In the embodiment of the present application, the terminal device access authentication includes the following steps:

[0115] The present invention is based on the distributed ledger technology (Hyperledger Fabric) as a whole. The nodes in the network are divided into three categories. First, the Orderer node is responsible for receiving proposals and transaction information and verifying the reliability, and broadcasting them to other peer nodes after sorting to maintain the consensus of the blockchain; the peer node is responsible for verifying the block data broadcast by the Orderer. A small number of peer nodes have the endorsement function and prepare for the next stage together with the Orderer node; the CA node is the authentication center, and when the terminal is connected, it distributes digital certificates to it.

[0116] Phase One: Endorsement Phase.

[0117] The access terminal first applies for an endorsement signature from the endorsement node in the peer node, and decides whether to access the intranet based on whether the endorsement policy is met. The endorsement policy of this solution is: an endorsement signature from a specific node is required, and access to the intranet is allowed only after a sufficient number of signatures are received.

[0118] In the embodiment of the present application, the steps of the endorsement phase are as follows:

[0119] Step 1: Information Packaging

[0120] Controlled terminal device C k The collected data p and the access verification message RM i Together they are packaged as endorsement information EM:

[0121] EM={p,RM i}

[0122] At the same time, the endorsement information EM will be sent to the authentication network established by the management end to seek support.

[0123] Step 2: Obtain endorsement support

[0124] The endorsement information EM is authenticated by the end-user end endorsing node M in the network. k Verification Key v i If the verification is successful, the endorsement support will be replied to node M j , by M j Proceed to the next step. Endorsement support is:

[0125] {T,PKM i}

[0126] Where T is the generated timestamp; PKM i The public key generated by the key generation system for the management device.

[0127] Step 3: Generate endorsement signature and determine the number of signatures

[0128] M j Generate endorsement signature:

[0129]

[0130] The number of endorsement signatures is determined by using the Lagrange interpolation formula. i}Record the point pair (x1,y1),...(x t ,y t ), calculation formula:

[0131]

[0132] Among them, S k is the group key, and t is the number of endorsement signatures. k The value of the controlled device C k Have enough signatures from endorsing nodes been collected? If so, proceed to the next stage.

[0133] Phase 2: Orderer node sorting

[0134] After all the conditions in the previous stage are met, the terminal sends an authentication request to the orderer node, which broadcasts the sorting request. The orderer node first packages the request and then broadcasts it to all peer nodes, thereby initiating distributed authentication. The purpose is to ensure the consistency of data between nodes so that each node receives the same sorting of the request sequence.

[0135] Phase 3: Verification

[0136] The final comparison of the sorting proposal is performed by the Committing peer node in the peer node. The main tasks of the comparison include: the integrity and correctness of the proposal information; whether the proposal number is repeated; and whether the proposal can be executed. When all items are met, the Committing peer node will mark it as passed and write it into the storage data of the blockchain. The entire information is packaged into a new block, added to the end of the blockchain, and data sharing continues.

[0137] It should be noted that the anti-attack ability of the photovoltaic system of the present invention is enhanced. When an attacker forges the identity information ID to carry out a man-in-the-middle attack on the system, since there is a digital signature distribution link in the preset identity information, the forged ID will fail to be verified because it cannot provide a valid digital signature. Therefore, this technology can effectively resist man-in-the-middle attacks and effectively prevent the terminal from forging feedback information. If there is a malicious node, the chain verification method and timestamp of the blockchain can be used to trace the tampered information. At the same time, the terminal's unique identity authentication ID has been initialized and given when it enters the network, and can be traced back through the ID to prevent the terminal from forging feedback information.

[0138] This embodiment also provides a trusted authentication system for distributed storage of photovoltaic data, including:

[0139] The management-side authentication module is used to build an authentication management network through management-side devices and authenticate new devices through the Ripple consensus mechanism;

[0140] The controlled-end authentication module is used for the authentication management network and identity authentication mechanism built on the management end. The controlled-end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism;

[0141] The distributed ledger authentication module is used to implement access authentication of terminal devices based on intranet access permissions using distributed ledger technology through three stages: endorsement, sorting, and verification.

[0142] Furthermore, it also includes:

[0143] Memory, used to store programs;

[0144] A processor is used to load the program to execute the trusted authentication method for distributed storage of photovoltaic data.

[0145] This embodiment also provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the trusted authentication method for distributed storage of photovoltaic data.

[0146] The storage medium proposed in this embodiment and the trusted authentication method for distributed storage of photovoltaic data proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0147] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (RandomAccess Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0148] Example 2

[0149] Reference Figure 2-3 , as an embodiment of the present invention, provides a trusted authentication system for distributed storage of photovoltaic data, including a management end authentication module, a controlled end authentication module and a distributed ledger authentication module;

[0150] For trusted authentication of distributed storage of photovoltaic data, such as Figure 2As shown in the figure, it mainly involves five layers: application layer, contract layer, consensus layer, network layer and data layer. Each layer has specific functions and roles, and together constitutes a complete trusted authentication system for distributed photovoltaic power generation systems. The application layer includes the actual application scenarios of photovoltaic data collected by the terminal and is responsible for the storage and scheduling of power data; the contract layer contains smart contracts, which encapsulates the algorithms, protocols and mechanisms required for the operation of distributed photovoltaic power generation systems, and implements the algorithms through chain code deployment; the consensus layer includes the use of consensus algorithms to maintain consensus between nodes, and realizes consensus between nodes through self-organizing network communication mechanisms; the network layer includes the authentication network that constitutes the P2P networking form and provides data structure support; the data layer includes the chain structure formed by the links between blocks, provides data structure support upward, and connects to the next block through the previous block to form a specific block structure design. This architecture aims to achieve trusted authentication of distributed photovoltaic power generation systems through blockchain technology to ensure data security and consistency. Each layer is closely connected, jointly ensuring the stable operation and efficient operation of the entire system.

[0151] The existing photovoltaic system terminals have limited computing, storage and communication capabilities due to volume and power constraints, so they cannot deploy complete cryptographic algorithms. The present invention divides the devices to be connected into management terminals and controlled terminals before they are connected to the network. The relationship between the management terminal and the controlled terminal is as follows: Figure 3 As shown in the figure, the management end mainly includes the main station and control center equipment that serve as managers in the system; the management end pre-sets its own identity information, which may include device ID, public key, etc.; the management end uses hash functions to generate a series of hash values ​​to form an unalterable hash chain to ensure the integrity of the data; the management end has the right to directly read, write and maintain data on the blockchain because it has the right to record and manage the blockchain in the photovoltaic system. The management end performs identity authentication through preset identity information and hash chains to ensure its own legitimacy and data integrity. The controlled end includes basic terminal devices, which have relatively low performance and importance, do not have accounting rights, and need to indirectly obtain the right to access block data through the management end. The controlled end also pre-sets identity information, but this information is usually simple and does not contain complex encryption algorithms; the controlled end will also generate a hash chain, but this is mainly to verify its own identity and data integrity. The controlled end does not have the right to directly access the blockchain, but indirectly obtains the right to block data through the management end. The controlled end performs identity authentication through preset identity information and hash chains, and also needs to be confirmed by the management end before it can obtain the right to access the blockchain data.

[0152] In the embodiment of the present application, the entire photovoltaic data system consists of three parts: a large number of controlled devices, a peer-to-peer authentication network consisting of multiple management-end devices, and an authentication center with a preset identity ID.

[0153] In the embodiment of the present application, the management end authentication module includes building an authentication management network through the management end device, and authenticating the new device through the Ripple consensus mechanism; the management end device first builds an authentication management network, and authenticates the new device through the Ripple consensus mechanism. Before joining the network, the new device must be voted by the existing management end device. Only after more than 50% of the nodes agree, the new device can officially join the network. If the new device is a controlled end device, it is allowed to join the network directly; if it is a management end device, it needs to further join the authentication blockchain to obtain the corresponding accounting rights and management rights.

[0154] In the embodiment of the present application, the controlled end authentication module includes an authentication management network and an identity authentication mechanism built on the management end, and the controlled end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism;

[0155] In the embodiment of the present application, once the authentication management network is established and running, the controlled terminal device can complete the network access authentication with the assistance of the management terminal device through the preset identity information and key chain generation and update mechanism. The controlled terminal device first submits the preset identity information to the authentication center, and the authentication center generates a key chain and saves it as a Merkle root. The controlled terminal device sends the necessary parameters to the authentication network to obtain intranet access permission. The management terminal device is responsible for verifying and managing these key chains to ensure the security and legitimacy of the controlled terminal device.

[0156] In the embodiment of the present application, the distributed ledger authentication module includes access authentication of the terminal device based on the intranet access authority, using distributed ledger technology through three stages of endorsement, sorting and verification.

[0157] In an embodiment of the present application, after the controlled end device obtains the intranet access right, the access authentication of the terminal device is further strengthened through the distributed ledger technology (such as Hyperledger Fabric). The entire authentication process is divided into three stages: endorsement, sorting, and verification. First, the terminal device encapsulates the data and access verification message into endorsement information and sends it to the endorsement node for verification and support. After collecting a sufficient number of endorsement signatures, the terminal device sends the authentication request to the Orderer node, which sorts and broadcasts it to all Peer nodes to ensure data consistency. Finally, the CommittingPeer node verifies the proposal information in the block to ensure its integrity and correctness, and writes it to the blockchain after passing it to complete the access authentication.

[0158] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A trusted authentication method for distributed storage of photovoltaic data, characterized in that: include: Build an authentication management network through management-end devices and authenticate new devices through the Ripple consensus mechanism; Based on the authentication management network and identity authentication mechanism built by the management end, the controlled end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism; Based on the access rights to the intranet, distributed ledger technology is used to achieve access authentication of terminal devices through three stages: endorsement, sorting and verification.

2. The trusted authentication method for distributed storage of photovoltaic data according to claim 1, characterized in that: The method of constructing an authentication management network through a management terminal device includes the following steps: Select a group of devices as the initial management end; When a new device attempts to join the network, the existing management device evaluates the new device; The new device passes the Ripple consensus mechanism. If more than 50% of the existing management devices vote in favor, it agrees to join the network and determines whether the new device is a controlled device. If the new device is a controlled device, the device will be added to the network; if the new device is a management device, it will be added to the authentication blockchain.

3. The trusted authentication method for distributed storage of photovoltaic data according to claim 1 or 2, characterized in that: The authentication of the new device through the Ripple consensus mechanism includes the following steps: Before attempting to join the network, the management device submits its identity information to the authentication network; The nodes in the authentication network calculate the hash value of the identity information provided by the new device and compare it with the hash value calculated by the device itself; If the hash value and public key information match, the identity information verification is considered successful.

4. The trusted authentication method for distributed storage of photovoltaic data according to claim 3, characterized in that: The controlled terminal device obtains the permission to access the intranet by presetting identity information, key chain generation and update mechanism, including the following steps: The controlled device submits the preset identity information to the authentication center; The authentication center generates a key chain based on the preset information; The controlled device integrates the generated key chain and hash chain into a request message and sends it to the authentication network; The management device performs verification and grants the controlled device permission to access the intranet.

5. The trusted authentication method for distributed storage of photovoltaic data according to claim 4, characterized in that: The endorsement phase includes the following steps: The controlled device collects data and access verification messages; Encapsulate the collected data and access verification message together as endorsement information; Sending the endorsement information to the endorsement node in the authentication network composed of management end devices; After receiving the endorsement information, the endorsing node verifies the key and digital signature contained therein; If the verification is successful, the endorsing node replies endorsement support to the controlled device that initiated the request; The controlled device collects endorsement support information from multiple endorsement nodes and generates an endorsement signature set; Use the Lagrange interpolation formula to calculate the group key of the endorsement signature set; According to the value of the group key, it is determined whether the controlled device has collected signatures from a sufficient number of endorsing nodes. If the endorsement policy requirements are met, the sorting phase is entered.

6. The trusted authentication method for distributed storage of photovoltaic data according to claim 5, characterized in that: The sorting stage includes the following steps: After all conditions in the endorsement phase are met, the controlled device C sends an authentication request to the Orderer node; After receiving the authentication request, the Orderer node packages the authentication request and other requests into a block; The Orderer node sorts the packaged blocks and broadcasts the sorted requests to all Peer nodes.

7. The trusted authentication method for distributed storage of photovoltaic data according to claim 6, characterized in that: The verification stage includes the following steps: The Committing Peer node verifies the integrity and correctness of the proposal information in the received block; Check if proposal numbers are duplicated; Determine whether the proposal is feasible; If all verification items pass, the Committing Peer node marks the proposal as passed and writes it into the storage data of the blockchain; The approved proposals are packaged into new blocks, added to the end of the blockchain, and data sharing continues.

8. A system based on the trusted authentication method for distributed storage of photovoltaic data according to claim 1, characterized in that: The management-side authentication module is used to build an authentication management network through management-side devices and authenticate new devices through the Ripple consensus mechanism; The controlled-end authentication module is used for the authentication management network and identity authentication mechanism built on the management end. The controlled-end device obtains the permission to access the intranet through the preset identity information, key chain generation and update mechanism; The distributed ledger authentication module is used to implement access authentication of terminal devices based on intranet access permissions using distributed ledger technology through three stages: endorsement, sorting, and verification.

9. An electronic device, characterized in that: include: Memory, used to store programs; A processor is used to load the program to execute the steps of the trusted authentication method for distributed storage of photovoltaic data as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the steps of the trusted authentication method for distributed storage of photovoltaic data as described in any one of claims 1 to 7 are implemented.

Images