Power WLAN Security Enhancement Method, System and Device Based on Trusted Computing

Abstract

The present invention discloses a method, system and device for securing power WLAN based on trusted computing, which relates to the technical field of power wireless local area network security. The method includes pre-setting trusted platform control modules on power wireless terminals, power wireless access points and power authentication servers respectively TPCM and corresponding components to form a three-element three-layer architecture; performing certificate application and distribution for devices according to the three-element three-layer architecture, and uniformly managing by the power authentication server. The devices include power wireless terminals and power wireless access points; performing trusted access authentication on the devices that have obtained certificates, including two-way identity authentication based on the three-element three-layer architecture, platform identity and integrity evaluation based on attributes, and key negotiation based on national cryptography algorithms, so as to realize the access of trusted power wireless terminals to trusted power wireless access points. The present invention can prevent collusion attacks, and will not disclose platform configuration information, and can effectively prevent sensitive information from being intercepted by attackers or untrusted intermediate devices.

Description

Technical Field

[0001] The present invention relates to the technical field of power wireless local area network security, and particularly relates to a security reinforcement method, system and device for power WLAN (Wireless Local Area Network) based on trusted computing. Background Art

[0002] Existing wireless local area network technologies mainly include the international wireless network technology WI-FI standard and the wireless local area network authentication and privacy infrastructure (WAPI) independently designed in China. The WI-FI standard is widely used in scenarios such as daily life and basic industries, bringing convenience while also increasing security risks. The WI-FI standard assumes that the network is trusted and only the terminal is untrusted. Therefore, usually, AP the (Access Point) authenticates the terminal unidirectionally, and the terminal has no right to authenticate AP , there is a risk of access impersonation AP . In addition, all terminals share a password. Once it is leaked or cracked, it will greatly threaten the security of user privacy data.

[0003] WAPI is a wireless network security protocol designed for the security defects of the international WI-FI standard. WAPI uses digital certificates as the identity certificates of devices, introduces a third party AS (Authentication Server), and realizes the two-way identity authentication between the terminal and AP , and can identify impersonated terminals and impersonations AP . In addition, WAPI realizes the encryption of transmitted data through the key negotiation between the terminal and AP , can prevent information from being tampered with, and protect the confidentiality of communication. Based on the fact that WAPI effectively solves some security risks existing in WI-FI, during the construction of a new power system, WAPI has been gradually applied to transform and upgrade the local area networks of various power business scenarios, forming multiple demonstration areas and test sites.

[0004] However, WAPI assumes that the authentication server AS is completely trusted, but there is no effective measure to guarantee it. And the AS controlled by the attacker and malicious terminals can easily forge the authentication result, thus bypassing the legitimate AP , forming a collusion attack. At the same time, the WAPI identity authentication process does not evaluate the terminal, AP Regarding the platform credibility, there is a risk that the identity is legal but the access to the platform is untrusted. The identity certificate information and intermediate keys are directly stored on the platform. When an attacker invades the platform, relevant privacy information can be stolen, and then an identity authentication attack can be launched. Moreover, during the WAPI identity authentication and key negotiation process, there are usually plaintext identity certificates, temporary public keys, and authentication results, which are easily intercepted by attackers in an insecure network channel. Summary of the Invention

[0005] The purpose of the present invention is to address the above problems in the prior art and provide a power WLAN security reinforcement method, system, and device based on trusted computing, which can ensure the security and trustworthiness of the device body, prevent collusion attacks; enable a trusted STA (Station, wireless device or terminal device) to access a trusted AP , and will not disclose platform configuration information; and prevent the stealing and misappropriation of privacy information such as certificate information and intermediate keys by attackers; by designing a symmetric encryption and decryption method, sensitive information in the entire access authentication process is encrypted, which can effectively prevent sensitive information from being intercepted by attackers or untrusted intermediate devices.

[0006] To achieve the above object, the present invention has the following technical solutions:

[0007] In a first aspect, a power WLAN security reinforcement method based on trusted computing is provided, including:

[0008] Pre-set a trusted platform control module STA and corresponding components on the power wireless terminal AP , power wireless access point AS and power authentication server TPCM respectively to form a three-element three-layer architecture;

[0009] Perform certificate application and distribution for the devices according to the three-element three-layer architecture, and be uniformly managed by the power authentication server AS . The devices include the power wireless terminal STA and the power wireless access point AP ;

[0010] Perform trusted access authentication on the devices that have obtained certificates, including two-way identity authentication based on the three-element three-layer architecture, platform identity and integrity evaluation based on attributes, and key negotiation based on national cryptographic algorithms, to achieve the access of a trusted power wireless terminal STA to a trusted power wireless access point AP .

[0011] As a preferred solution, when pre-setting a trusted platform control module STA and corresponding components on the power wireless terminal TPCM , the power wireless terminal STA As an access requester, being geographically dispersed, it includes the following components:

[0012] A wireless communication component, as a network access requester, located at the network access control layer, responsible for executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0013] A network access control and management component and a terminal trusted control component, as a trusted network connection client, located at the trusted platform evaluation layer, responsible for executing network connection control and assisting in completing platform identity and integrity evaluation;

[0014] Power wireless terminal trusted platform control module And a terminal trusted control component, as an integrity measurement collector, located at the integrity measurement layer, responsible for measuring component integrity, encryption, and signature, and sending the processed integrity measurement values to the integrity measurement verifier.

[0015] As a preferred solution, when a trusted platform control module AP And corresponding components are pre-installed on a power wireless access point TPCM The power wireless access point AP As an access controller, is deployed at a specified geographical location and includes the following components:

[0016] A wireless communication component, as a network access controller, located at the network access control layer, responsible for starting and executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0017] A network access control and management component and a terminal trusted control component, as a trusted network connection access point, located at the trusted platform evaluation layer, responsible for executing network connection control and assisting in completing platform identity and integrity evaluation;

[0018] Power wireless access point trusted platform control module And a terminal trusted control component, as an integrity measurement collector, located at the integrity measurement layer, responsible for measuring component integrity, encryption, and signature, and sending the processed integrity measurement values to the integrity measurement verifier.

[0019] As a preferred solution, when a trusted platform control module AS And corresponding components are pre-installed on a power authentication server TPCM The power authentication server AS As a policy manager, is deployed in the headquarters and provincial and municipal computer rooms and includes the following components:

[0020] The authentication policy component and the certificate verification component, as the authentication policy server, are located in the network access control layer and are responsible for receiving authentication data, verifying the legality of identity certificates, and sending authentication results as a trusted third party.

[0021] The evaluation policy component and the trusted management center component, as the evaluation policy server, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying the identity authentication key AIK certificate and the legality of the attribute certificate and sending the platform evaluation result.

[0022] Trusted platform control module of the power authentication server and the trusted management center component, as the integrity measurement verifier, are located in the integrity measurement layer and are responsible for receiving, verifying, and evaluating the integrity measurement values of the power wireless terminal STA and the power wireless access point AP

[0023] As a preferred solution, the certificate application and distribution of devices are carried out according to the three - element three - layer architecture, which is uniformly controlled by the power authentication server AS The devices include power wireless terminals STA and power wireless access points AP and include the following steps:

[0024] Let \(G, G\) T be p a bilinear cyclic group of order, g , h be the generators of \(G\), and the bilinear mapping \(e: G\times G\rightarrow G\) T such that , as public parameters, where represents the first bilinear pair, represents the bilinear mapping, and the symbol is defined as; Derive the public key SM2 of the identity certificate and the private key SM2 of the identity certificate , and the subscript device collectively represents the devices of the power wireless terminal STA and the power wireless access point AP ; The power authentication server AS According to the security parameter 1 λ , derive the public key SM2 of the root certificate and the private key SM2 of the root certificate to generate the temporary key random number ;

[0025] The device packages the place of origin, user name, device name, device type, Internet Protocol​ IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package the identity authentication key AIK Public key, endorsement key EK Certificate, platform certificate and conformance certificate as platform information; generate component configuration information , where i = 1, …, k , k is the number of components, cs is the set of configuration information, and calculate the component configuration metric value according to the following formula H = SM3 ( cs 1|| cs 2||…|| cs k ), as the platform attribute, where SM3 () represents performing SM3 algorithm processing; submit the above information to the power authentication server AS ;

[0026] Power authentication server AS Sign the received device identity information and platform information, and generate a device identity certificate , device platform certificate ; evaluate cs i The security attributes satisfied, , ps is the set of security attributes, making , where, represents the attribute certificate verification parameter, and the superscript in the parameter represents performing a power operation; generate a device attribute certificate , where, respectively represent the first parameter , second parameter and third parameter of the device attribute certificate, and the superscript in the parameter represents performing a power operation;

[0027] Power authentication server AS Calculate the temporary key seed , and send ( u , ps , , , , , ) to the device through a secure channel and store it in the non-volatile memory of NVM inside, where, is the MAC address of the power authentication server, For the MAC addresses of each device, is a temporary key random number, u is an attribute certificate verification parameter, ps is a set of security attributes, For the SM2 public key of the root certificate, is a temporary key seed, is a device identity certificate, is a device platform certificate, is a device attribute certificate, For each device, a trusted platform control module is preset;

[0028] The device uses the SM2 public key of the root certificate to verify the device identity certificate and the device platform certificate for correctness, and verify whether the following equation holds. If it holds, the device attribute certificate is correct; otherwise, reapply for the certificate:

[0029]

[0030]

[0031] In the formula, is an attribute certificate verification parameter, indicates whether it holds, is a power operation with the first bilinear pair T as the base and the set of security attributes ps as the exponent, g , is a generator of G, represents the bilinear mapping e as the base and the set of security attributes ps as the exponent of the power operation, represents a power operation with the bilinear mapping e as the base and the set of configuration information cs as the exponent.

[0032] As a preferred solution, the bidirectional identity authentication based on the three - element three - layer architecture includes the following steps:

[0033] The power wireless access point AP sends a first power wireless access point random number STA to the power wireless terminal through an uncontrolled port as an authentication activation message;

[0034] The power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express STA与AS间的上行SM4 Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device Identity Certificate Via device identity certificate Get, get the ciphertext ; and use STA Device Identity Certificate SM2 Private Key sign, STA Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following:

[0035]

[0036] Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the first power wireless terminal random number To confirm that it is a reply to the message sent by itself; if the check passes, then calculate , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to get ciphertext ,in AP Device Identity Certificate Via device identity certificate obtain; and use AP Device Identity Certificate SM2 Private Key sign, AP Device Identity Certificate SM2 Private Key Through the identity certificate of the derived device SM2 Private key Obtain and get the signature information after signing ; Send a certificate authentication request message to the power authentication server AS The certificate authentication request message includes the following formula:

[0037]

[0038] Power authentication server AS After receiving the certificate authentication request message, check the first power wireless access point random number And the first power wireless terminal random number , To prevent replay attacks; If the check passes, then calculate And , Decrypt to get STA Device identity certificate And AP Device identity certificate , Verify And The signature in, so as to verify the power wireless terminal STA And the power wireless access point AP The legitimacy of the identity; Then use STA Device identity certificate SM2 Public key And AP Device identity certificate SM2 Public key Respectively verify the signature And , To verify the power wireless terminal STA And the power wireless access point AP Holds its own identity certificate private key, STA Device identity certificate SM2 Public key And AP Device identity certificate SM2 Public key and Both are obtained through the identity certificate of the derived device SM2 Public key Obtain, and generate corresponding certificate authentication results respectively according to the above certificate authentication process And ; Then generate the first power authentication server random number , Calculate And , Wherein, Represents STA And AS The downlink between SM4 Temporary symmetric key, Represents STA Temporary key seed indicating AP the AS downlink SM4 temporary symmetric key indicating AP the ciphertext obtained by encrypting the temporary key seed and , indicating STA certificate authentication result indicating AP the certificate authentication result; sending a certificate authentication response message to the power wireless access point AP The certificate authentication response message includes the following formula:

[0039]

[0040] Power wireless access point AP After receiving the certificate authentication response message, check the first power authentication server random number to prevent replay attacks; if the check passes, send an authentication response message to the power wireless terminal STA The authentication response message includes the following formula:

[0041]

[0042] Then the power wireless access point AP calculates , decrypts , and obtains ; if the identity certificate authentication of the power wireless terminal STA passes, continue with the platform evaluation, otherwise reject the power wireless terminal STA from accessing;

[0043] Power wireless terminal STA After receiving the authentication response message, check the first power authentication server random number to prevent replay attacks; if the check passes, calculate , decrypts , and obtains ; if the identity certificate authentication of the power wireless access point AP passes, continue with the platform evaluation, otherwise reject access to the power wireless access point AP .

[0044] As a preferred solution, the attribute-based platform identity and integrity evaluation includes the following steps:

[0045] Power wireless terminal STA generates a second power wireless terminal random number , perform attribute proof calculation to generate STA Component attribute signature ; Calculate , encrypt the first power authentication server random number , STA Device platform certificate and STA Component attribute signature , STA Device platform certificate The device platform certificate is obtained to get the ciphertext ; Send a platform evaluation request message to the power wireless access point AP . The platform evaluation request message includes the following formula:

[0046]

[0047] Power wireless access point AP After receiving the platform evaluation request message, check the second power wireless terminal random number to prevent replay attacks; if the check passes, the power wireless access point AP generates a second power wireless access point random number , perform attribute proof calculation to generate AP Component attribute signature ; Calculate , encrypt the first power authentication server random number , AP Device platform certificate and AP Component attribute signature , AP Device platform certificate The device platform certificate is obtained to get the ciphertext ; Send a platform authentication request message to the power authentication server AS . The platform authentication request message includes the following formula:

[0048]

[0049] Power authentication server AS After receiving the platform authentication request message, check the second power wireless terminal random number and the second power wireless access point random number to prevent replay attacks; if the check passes, calculate and , and decrypt them respectively to obtain STA Device platform certificate , AP Device platform certificate , STA Component attribute signature , AP Component attribute signature ; Then verify and the digital signatures in, so as to evaluate the legitimacy of the platform identities of the power wireless terminal STA and the power wireless access point AP respectively; Then perform an attribute verification algorithm on , to evaluate the integrity of the platforms of the power wireless terminal STA and the power wireless access point AP respectively; Generate the STA platform evaluation result and AP platform evaluation result ; Generate the second power authentication server random number , and calculate and , encrypt to obtain ciphertexts and ; Send a platform authentication response message to the power wireless access point AP . The platform authentication response message includes the following formula:

[0050]

[0051] Power wireless access point AP After receiving the platform authentication response message, check the second power authentication server random number to prevent replay attacks; If the check passes, generate the third power wireless access point random number , SM2 temporary public key and SM2 temporary private key , and send a platform evaluation response message to the power wireless terminal STA . The platform evaluation response message includes the following formula:

[0052]

[0053] Then calculate , decrypt , and obtain ; If both the platform identity and integrity evaluations of the power wireless terminal STA pass, continue with the key negotiation, otherwise reject the access of the power wireless terminal STA;

[0054] Power wireless terminal STA After receiving the platform evaluation response message, check the second power authentication server random number And the third power wireless access point random number , to prevent replay attacks; if the check passes, then calculate , decrypt ,get ; If the power wireless access point AP If the platform identity and integrity assessments are both passed, key negotiation will continue, otherwise access to the power wireless access point will be denied. AP .

[0055] As a preferred solution, the attribute proof calculation includes the following steps:

[0056] Device generates random numbers N And the random numbers r1 and r2 used for blind calculation; random numbers N Random number taken from the second power wireless terminal With the second power wireless access point random number ;

[0057] use Calculating Commitment Value , where the superscript of the parameter indicates the exponentiation operation, the random number is calculated as follows N Calculating Commitment Value The signature value ;

[0058] The device performs blind calculations, and the blind value , where Indicates that Z Defined as the following value, Represent the first blinding parameters , the second blinding parameter and the third blinding parameter , the superscript in the parameter indicates that a power operation is performed;

[0059] The first evidence value is calculated as follows: Second Evidence Value , the superscript in the parameter indicates that a power operation is performed;

[0060] Generate component attribute signature .

[0061] As a preferred solution, the attribute verification algorithm includes the following steps:

[0062] Verify the signature value , to verify authenticity;

[0063] Calculate whether the following equation holds:

[0064]

[0065]

[0066] In the formula, represents a bilinear map, Indicates whether it is established. The first bilinear pairing T For the bottom, - ps is the exponential power operation, ps is a set of security attributes, The first bilinear pairing T For the bottom, is the exponential power operation, cs For configuration information collection, H Configure metrics for components, g , is the generator of G, Respectively represent the first evidence value and the second evidence value;

[0067] If the above equation does not hold, the attribute verification fails. Otherwise, the platform configuration attribute is used to verify the attribute. For the index, query the revocation list. If it is not in the list, the verification passes. If it is in the list, the verification fails.

[0068] As a preferred solution, the key negotiation based on the national secret algorithm includes the following steps:

[0069] Power wireless terminal STA Generate a random number for the third power wireless terminal , SM2 Temporary public key and SM2 Temporary private key ; Then calculate the power wireless terminal base key seed as follows: , calculate the base key of the power wireless terminal as follows: , calculate the power wireless terminal base key confirmation serial number as follows: , where Indicates the base key of the power wireless terminal, Indicates power wireless terminal STA of MAC address, Indicates power wireless access point AP of MAC address; then send power to the wireless access point AP Send a key negotiation request message, which includes the following formula:

[0070]

[0071] Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal , to prevent replay attacks, and check the random number of the third power wireless access point , to confirm that it is the key negotiation response initiated by itself; if the check passes, calculate the base key seed of the power wireless access point according to the following formula , calculate the base key of the power wireless access point according to the following formula , calculate the base key identifier of the power wireless access point according to the following formula , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point with the base key identifier of the power wireless terminal , if they are the same, the key negotiation is successful; then calculate , and take the first 128 bits of the result as the unicast key USK , and take the last 128 bits of the result as the encryption key of the multicast key MSK ; then generate the random number of the fourth power wireless access point MEK and the random number calculated by the multicast key , obtain the current system time and calculate the multicast identifier , where represents the current system time, represents performing string conversion function processing, , encrypt using MEK to obtain the ciphertext ; then send a key negotiation response message to the power wireless terminal STA , and the key negotiation response message includes the following formula:

[0072]

[0073] Power wireless terminal STA After receiving the key negotiation response message, check the random number of the fourth power wireless access point , to prevent replay attacks, and check the random number of the third power wireless terminal to confirm that it is the key negotiation request sent by itself; if the check passes, then calculate according to the following formula , and take the first 128 bits of the result as the unicast key USK , and take the last 128 bits of the result as the encryption key of the multicast key MSK ; then use MEK to decrypt the ciphertext MEK , to obtain M_ID and MSK ; then send a key negotiation confirmation message to the power wireless access point AP , and the key negotiation confirmation message includes the following formula: ​​

[0074]

[0075] Power wireless access point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point to confirm that it is the key negotiation response sent by itself; check M_ID to confirm the key negotiation result; then, the two parties start communication using the controlled port.

[0076] On the second aspect, a power WLAN security reinforcement system based on trusted computing is provided, including:

[0077] A trusted adaptation module for pre-setting a trusted platform control module STA and corresponding components on the power wireless terminal AP , the power wireless access point AS and the power authentication server TPCM to form a three-element three-layer architecture;

[0078] A certificate distribution module for performing device certificate application and distribution according to the three-element three-layer architecture, and being uniformly controlled by the power authentication server AS , and the devices include the power wireless terminal STA and the power wireless access point AP ;

[0079] A trusted access authentication module for performing trusted access authentication on the devices that have obtained certificates, including two-way identity authentication based on the three-element three-layer architecture, platform identity and integrity evaluation based on attributes, and key negotiation based on national cryptography algorithms, to realize the access of trusted power wireless terminals STA to the trusted power wireless access point AP .

[0080] As a preferred solution, when the trusted adaptation module pre-sets the trusted platform control module STA and corresponding components on the power wireless terminal TPCM , the power wireless terminal STA is deployed dispersedly geographically as an access requester, and includes the following components:

[0081] A wireless communication component, as a network access requester, located in the network access control layer, responsible for executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0082] A network access control and management component and a terminal trusted control and management component, as a trusted network connection client, located in the trusted platform evaluation layer, responsible for executing network connection control and assisting in completing platform identity and integrity evaluation;

[0083] Power wireless terminal trusted platform control module and the terminal trusted control component, as an integrity measurement collector, is located in the integrity measurement layer, responsible for measuring component integrity, encryption and signature, and sending the processed integrity measurement value to the integrity measurement verifier.

[0084] As a preferred solution, the trusted adaptation module pre-sets a trusted platform control module AP on the power wireless access point TPCM When the corresponding components are set, the power wireless access point AP As an access controller, is deployed at a specified geographical location and includes the following components:

[0085] The wireless communication component, as a network access controller, is located in the network access control layer, responsible for starting and executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0086] The network access control component and the terminal trusted control component, as a trusted network connection access point, are located in the trusted platform evaluation layer, responsible for performing network connection control and assisting in completing platform identity and integrity evaluation;

[0087] The power wireless access point trusted platform control module and the terminal trusted control component, as an integrity measurement collector, are located in the integrity measurement layer, responsible for measuring component integrity, encryption and signature, and sending the processed integrity measurement value to the integrity measurement verifier.

[0088] As a preferred solution, the trusted adaptation module pre-sets a trusted platform control module AS on the power authentication server TPCM When the corresponding components are set, the power authentication server AS As a policy manager, is deployed in the headquarters and provincial and municipal computer rooms and includes the following components:

[0089] The authentication policy component and the certificate verification component, as authentication policy servers, are located in the network access control layer, responsible for, as a trusted third party, receiving identity authentication data, verifying the legality of identity certificates, and sending authentication results;

[0090] The evaluation policy component and the trusted management center component, as evaluation policy servers, are located in the trusted platform evaluation layer, responsible for receiving evaluation data, verifying the AIK identity proof key certificate and the legality of attribute certificates and sending platform evaluation results;

[0091] The power authentication server trusted platform control module and the trusted management center component, as an integrity measurement verifier, are located in the integrity measurement layer, responsible for receiving, verifying, and evaluating power wireless terminals STA and power wireless access points AP integrity measurement value.

[0092] As a preferred solution, when the certificate distribution module applies for and distributes certificates for devices according to the three - tier three - layer architecture, let G, G T be p bilinear cyclic groups of order g , h be the generators of G, and the bilinear mapping e: G×G→G T , such that , as public parameters, where represents the first bilinear pair, represents the bilinear mapping, and the symbol is defined as; the identity certificate of the derived device SM2 public key and the identity certificate SM2 private key , with the subscript device collectively representing the devices of the power wireless terminal STA and the power wireless access point AP ; the power authentication server AS derives the λ public key SM2 and the private key SM2 of the root certificate according to the security parameter 1 , and generates a temporary key random number ;

[0093] The device packages the place of origin, user name, device name, device type, Internet Protocol IP address, Media Access Control MAC address, and the public key of the identity certificate as identity information; packages the public key of the identity authentication key AIK , endorsement key EK certificate, platform certificate, and consistency certificate as platform information; generates component configuration information , where i = 1, …, k , k is the number of components, cs is the set of configuration information, and calculates the component configuration measurement value according to the following formula H = SM3 ( cs 1|| cs 2||…|| cs k ), as the platform attribute, where SM3 ()represents performing SM3 algorithm processing; submits the above information to the power authentication server AS ;

[0094] Power authentication server AS Sign the received device identity information and platform information to generate a device identity certificate and a device platform certificate ; Evaluate cs i Satisfied security attributes , ps is a set of security attributes, so that , where represents the attribute certificate verification parameter, and the superscript in the parameter represents exponentiation; Generate a device attribute certificate , where respectively represent the first parameter , the second parameter and the third parameter of the device attribute certificate, and the superscript in the parameter represents exponentiation;

[0095] Power authentication server AS Calculate the temporary key seed , and send ( u , ps , , , , , ) to the device through a secure channel and store it in the non-volatile memory NVM inside, where is the MAC address of the power authentication server, is the MAC address of each device, is the temporary key random number, u is the attribute certificate verification parameter, ps is the set of security attributes, is the SM2 public key of the root certificate, is the temporary key seed, is the device identity certificate, is the device platform certificate, is the device attribute certificate, is the pre-configured trusted platform control module for each device;

[0096] The device uses the SM2 public key of the root certificate to verify the correctness of the device identity certificate and the device platform certificate , and verify whether the following equation holds. If it holds, the device attribute certificate Correct, otherwise reapply for the certificate:

[0097]

[0098]

[0099] In the formula, is the attribute certificate verification parameter, indicates whether it holds, is the power operation with the first bilinear pair T as the base and the set of security attributes ps as the exponent, g 、 is the generator of G, represents the bilinear mapping e as the base and the set of security attributes ps as the exponent of the power operation, represents the power operation with the bilinear mapping e as the base and the set of configuration information cs as the exponent.

[0100] As a preferred solution, when the trusted access authentication module performs two-way identity authentication based on the three-tier three-layer architecture, the power wireless access point AP sends the first power wireless access point random number STA to the power wireless terminal through the uncontrolled port as the authentication activation message;

[0101] After receiving the authentication activation message, the power wireless terminal STA checks the first power wireless access point random number to prevent replay attacks; if the check passes, it generates the first power wireless terminal random number , calculates , in the formula, represents STA与AS间的上行SM4 the temporary symmetric key, is STA the temporary key seed, represents the connection, SM3 () represents performing SM3 algorithm processing, encrypting and , STA the device identity certificate is obtained through the device identity certificate to obtain the ciphertext ; and uses STA the device identity certificate SM2 private key to sign, STA the device identity certificate SM2 private key Through the identity certificate of the derived device SM2 Private key Obtain, and after signing, obtain the signature information ; Send an authentication request message to the power wireless access point AP The authentication request message includes the following formula:

[0102]

[0103] Power wireless access point AP After receiving the authentication request message, check the first power wireless terminal random number To prevent replay attacks, check the first power wireless terminal random number To confirm that it is a reply to the message sent by itself; if the check passes, then calculate , Indicates AP And AS The uplink SM4 Temporary symmetric key, Is AP Temporary key seed, encrypt to obtain the ciphertext , where AP Device identity certificate Obtained through the device identity certificate ; And use AP Device identity certificate SM2 Private key Sign, AP Device identity certificate SM2 Private key Obtained through the identity certificate of the derived device SM2 Private key Obtain, and after signing, obtain the signature information ; Send a certificate authentication request message to the power authentication server AS The certificate authentication request message includes the following formula:

[0104]

[0105] Power authentication server AS After receiving the certificate authentication request message, check the first power wireless access point random number And the first power wireless terminal random number , to prevent replay attacks; if the check passes, then calculate And , decrypt to obtain STA Device identity certificate And AP Device identity certificate , verify And the signature in to verify the power wireless terminal STA and the power wireless access point AP the legitimacy of the identity; then use STA the device identity certificate SM2 public key and AP the device identity certificate SM2 public key to verify the signature and respectively, to verify that the power wireless terminal STA and the power wireless access point AP holds its own identity certificate private key, STA the device identity certificate SM2 public key and AP the device identity certificate SM2 public key and both are obtained through the public key of the derived device's identity certificate SM2 public key and respectively generate the corresponding certificate authentication results and ; then generate the first power authentication server random number and calculate and wherein, represents STA and AS the downlink SM4 temporary symmetric key between them, represents STA temporary key seed, represents AP and AS the downlink SM4 temporary symmetric key between them, represents AP temporary key seed, encrypt to obtain ciphertext and ; represents STA certificate authentication result, represents AP certificate authentication result; send a certificate authentication response message to the power wireless access point AP The certificate authentication response message includes the following formula:

[0106]

[0107] Power wireless access point AP After receiving the certificate authentication response message, check the first power authentication server random number to prevent replay attacks; if the check passes, send to the power wireless terminal STA Send an authentication response message, and the authentication response message includes the following formula:

[0108]

[0109] Then the power wireless access point AP Calculate , decrypt , and obtain ; If the identity certificate of the power wireless terminal STA passes the authentication, continue with the platform evaluation, otherwise reject the power wireless terminal STA from accessing;

[0110] After the power wireless terminal STA receives the authentication response message, check the first power authentication server random number to prevent replay attacks; if the check passes, calculate , decrypt , and obtain ; If the identity certificate of the power wireless access point AP passes the authentication, continue with the platform evaluation, otherwise reject the access to the power wireless access point AP .

[0111] As a preferred solution, when the trusted access authentication module performs the platform identity and integrity evaluation based on attributes, the power wireless terminal STA generates a second power wireless terminal random number , performs attribute proof calculation, and generates STA a component attribute signature ; Calculate , encrypt the first power authentication server random number , STA the device platform certificate and STA the component attribute signature , STA the device platform certificate is obtained from the device platform certificate to obtain the ciphertext ; Send a platform evaluation request message to the power wireless access point AP , and the platform evaluation request message includes the following formula:

[0112]

[0113] After the power wireless access point AP receives the platform evaluation request message, check the second power wireless terminal random number to prevent replay attacks; if the check passes, the power wireless access point AP Generate the second power wireless access point random number , perform attribute proof calculation, and generate AP Component attribute signature ; Calculate , encrypt the first power authentication server random number , AP Device platform certificate and AP Component attribute signature , AP Device platform certificate The device platform certificate is obtained, and the ciphertext is obtained; Send a platform authentication request message to the power authentication server AS . The platform authentication request message includes the following formula:

[0114]

[0115] Power authentication server AS After receiving the platform authentication request message, check the second power wireless terminal random number and the second power wireless access point random number to prevent replay attacks; If the check passes, calculate and , and decrypt them respectively to obtain STA Device platform certificate , AP Device platform certificate , STA Component attribute signature , AP Component attribute signature ; Then verify the digital signatures in and to evaluate the legitimacy of the respective platform identities of the power wireless terminal STA and the power wireless access point AP ; Then perform an attribute verification algorithm on , to evaluate the integrity of the respective platforms of the power wireless terminal STA and the power wireless access point AP ; Generate the platform evaluation result STA and and AP Platform evaluation result ; Generate the second power authentication server random number , and calculate and , and encrypt to obtain the ciphertext and ; Send to the power wireless access point AP Send the platform authentication response message, and the platform authentication response message includes the following formula:

[0116]

[0117] Power wireless access point AP After receiving the platform authentication response message, check the second power authentication server random number to prevent replay attacks; if the check passes, generate the third power wireless access point random number , SM2 Temporary public key and SM2 Temporary private key , and send the platform evaluation response message to the power wireless terminal STA The platform evaluation response message includes the following formula:

[0118]

[0119] Then calculate , decrypt , and obtain ; if the platform identity and integrity evaluation of the power wireless terminal STA both pass, continue with key negotiation, otherwise reject the access of the power wireless terminal STA;

[0120] Power wireless terminal STA After receiving the platform evaluation response message, check the second power authentication server random number and the third power wireless access point random number to prevent replay attacks; if the check passes, then calculate , decrypt , and obtain ; if the platform identity and integrity evaluation of the power wireless access point AP both pass, continue with key negotiation, otherwise reject the access to the power wireless access point AP .

[0121] As a preferred solution, when the trusted access authentication module performs key negotiation based on the national cryptography algorithm, it generates the third power wireless terminal random number STA through the power wireless terminal , SM2 Temporary public key and SM2 Temporary private key ; then calculate the power wireless terminal base key seed according to the following formula, calculate the power wireless terminal base key according to the following formula, calculate the power wireless terminal base key confirmation serial number , where, Represents the base key of the power wireless terminal, represents the power wireless terminal STA 's MAC address, represents the power wireless access point AP 's MAC address; then send a key negotiation request message to the power wireless access point AP The key negotiation request message includes the following formula:

[0122]

[0123] After the power wireless access point AP receives the key negotiation request message, it checks the third power wireless terminal random number to prevent replay attacks, and checks the third power wireless access point random number to confirm that it is the key negotiation response initiated by itself; if the check passes, calculate the power wireless access point base key seed according to the following formula, calculate the power wireless access point base key according to the following formula, calculate the power wireless access point base key identifier In the formula, is the power wireless access point base key; compare the power wireless access point base key identifier with the power wireless terminal base key identifier , if they are the same, the key negotiation is successful; then calculate , and take the first 128 bits of the result as the unicast key USK , and take the last 128 bits of the result as the encryption key MSK of the multicast key MEK ; then generate the fourth power wireless access point random number and the multicast key calculation random number , take the current system time and calculate the multicast identifier In the formula, represents the current system time, represents performing a string conversion function process, , encrypt using MEK to obtain the ciphertext ; then send a key negotiation response message to the power wireless terminal STA The key negotiation response message includes the following formula:

[0124]

[0125] After the power wireless terminal STA receives the key negotiation response message, it checks the fourth power wireless access point random number to prevent replay attacks, and checks the third power wireless terminal random number to confirm that the key negotiation request is sent by itself; if the check passes, calculate according to the following formula , and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK for the encryption key MEK ; then use MEK to decrypt the ciphertext to obtain M_ID and MSK ; then send a key negotiation confirmation message to the power wireless access point AP , and the key negotiation confirmation message includes the following formula:

[0126]

[0127] Power wireless access point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point to confirm that the key negotiation response is sent by itself; check M_ID to confirm the key negotiation result; after that, the two parties start to communicate using the controlled port.

[0128] Thirdly, an electronic device is provided, including a processor and a memory, and the processor is used to execute a computer program stored in the memory to implement the power WLAN security reinforcement method based on trusted computing.

[0129] Fourthly, a computer-readable storage medium is provided, and the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the power WLAN security reinforcement method based on trusted computing is implemented.

[0130] Compared with the prior art, the first aspect of the present invention has at least the following beneficial effects:

[0131] Aiming at the problems of untrusted devices, unevaluated platforms, insecure storage of privacy information, and clear text transmission of sensitive information in the existing wireless local area network authentication process, the power WLAN security reinforcement method based on trusted computing of the present invention respectively pre-sets a trusted platform control module on the power wireless terminal STA , power wireless access point AP and power authentication server AS TPCM ​and corresponding components to ensure the security and trustworthiness of the device body, effectively preventing collusion attacks. The method of the present invention can ensure the trustworthiness of the access platform based on the legal identity through two-way authentication based on a three-tier three-layer architecture. The method of the present invention designs an attribute-based platform identity and integrity assessment to effectively prevent the leakage of platform configuration information. The method of the present invention designs key negotiation based on national cryptographic algorithms, encrypts and stores certificates, keys, etc. in the trusted platform control module TPCM internally, physically isolated from the device body, improving the security of privacy information, and preventing the attacker from stealing or misusing privacy information such as certificate information and intermediate keys, thereby preventing identity authentication attacks. The method of the present invention encrypts and transmits sensitive information such as certificates and public keys, encrypts and protects the sensitive information in the entire access authentication process, can effectively prevent the attacker or untrusted intermediate device from intercepting the sensitive information, improves the confidentiality of communication, has forward security, can prevent replay attacks and man-in-the-middle attacks, and ensures the trusted power wireless terminal STA accesses the trusted power wireless access point AP , and can improve the access authentication efficiency by simplifying the key negotiation process.

[0132] It can be understood that the beneficial effects of the second to fourth aspects above can be referred to the relevant descriptions in the first aspect above, and will not be elaborated here. Description of the Drawings

[0133] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0134] 图1 is the overall flowchart of the power WLAN security reinforcement method based on trusted computing in the embodiment of the present invention;

[0135] 图2 is the schematic diagram of the three-tier three-layer architecture network connection formed in the embodiment of the present invention;

[0136] 图3 is the flowchart of certificate application and distribution in the embodiment of the present invention;

[0137] 图4 is the flowchart of the trusted access authentication for the device that has obtained the certificate in the embodiment of the present invention. Detailed Embodiments

[0138] In the following description, specific details such as specific system architectures and technologies are presented for the purpose of illustration rather than limitation, so as to thoroughly understand the embodiments of the present application. However, those skilled in the art should understand that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from hindering the description of the present application.

[0139] In the related prior art, for example, the patent application with the publication number CN111935717A discloses an "authentication method, device, and computer device for a WAPI system". This authentication method only determines the legitimacy of a wireless terminal and a wireless access point by verifying the identity certificate, without considering the situation where the device platforms of the wireless terminal and the wireless access point are invaded by attackers, resulting in an untrusted platform. This may lead to the situation where an untrusted wireless terminal accesses the wireless access point, or the wireless terminal accesses an untrusted wireless access point, presenting a security risk. Secondly, during the verification process, sensitive information such as identity certificates, basic media access control, and verification bytes is transmitted in plain text, posing risks of being stolen or tampered with. STA and the wireless access point AP of the legitimacy, without considering the wireless terminal STA and the wireless access point AP of the device platform being invaded by an attacker, resulting in an untrusted platform, which may lead to an untrusted wireless terminal STA accessing the wireless access point AP , or the wireless terminal STA accessing an untrusted wireless access point AP , presenting a security risk. Secondly, during the verification process, sensitive information such as identity certificates, basic media access control MAC , verification bytes, etc. are transmitted in plain text, posing risks of being stolen or tampered with.

[0140] For another example, the patent application with the publication number CN108601024A discloses a "lightweight identity authentication and platform authentication and evaluation method". This method realizes the platform authentication and evaluation between an access requester and an access controller by verifying the platform configuration PCR (Platform Configuration Register) value and the platform integrity measurement log, but has the disadvantages of low proof efficiency and easy leakage of platform configuration. Secondly, in the lightweight platform trusted authentication and evaluation method, only the access controller evaluates the platform integrity of the access requester, while the access requester does not evaluate the platform integrity of the access controller, presenting a risk that the access requester accesses an untrusted access controller. AR and the access controller AC between the platform authentication and evaluation, there are disadvantages of low proof efficiency and easy leakage of platform configuration. Secondly, in the lightweight platform trusted authentication and evaluation method, only the access controller AC evaluates the platform integrity of the access requester AR , while the access requester AR does not evaluate the platform integrity of the access controller AC , presenting a risk that the access requester AR accesses an untrusted access controller AC .

[0141] Please refer to Figure 1 , an embodiment of the present invention provides a power WLAN security reinforcement method based on trusted computing, including:

[0142] S1. Respectively on the power wireless terminal STA , a power wireless access point AP and a power authentication server AS are pre - installed with a trusted platform control module TPCM and corresponding components to form a three - element three - layer architecture;

[0143] S2. Perform certificate application and distribution for devices according to the three - element three - layer architecture, and be uniformly managed by the power authentication server AS . The devices include power wireless terminals STA and power wireless access points AP ;

[0144] S3. Perform trusted access authentication on the devices that have obtained certificates, including two - way identity authentication based on the three - element three - layer architecture, platform identity and integrity evaluation based on attributes, and key negotiation based on national cryptographic algorithms, to realize the access of trusted power wireless terminals STA to trusted power wireless access points AP .

[0145] Please refer to Figure 2 , Figure 2 , which shows the three - element three - layer architecture formed in step 1 of the embodiment of the present invention. In a possible implementation manner, when pre - installing a trusted platform control module STA and corresponding components on the power wireless terminal, the power wireless terminal TPCM , as an access requester, is deployed dispersedly geographically and includes the following components: STA A wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0146] A network access control and management component and a terminal trusted control component, as a trusted network connection client, are located in the trusted platform evaluation layer and are responsible for executing network connection control and assisting in completing platform identity and integrity evaluation;

[0147] A power wireless terminal trusted platform control module

[0148] and a terminal trusted control component, as an integrity measurement collector, are located in the integrity measurement layer and are responsible for measuring component integrity, encryption, and signature, and sending the processed integrity measurement values to the integrity measurement verifier.

[0149] AP When pre - installing a trusted platform control module TPCM and corresponding components on the power wireless access point, the power wireless access point AP , as an access controller, is deployed at a specified geographical location and includes the following components:

[0150] ​​The wireless communication component, as a network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0151] The network access control and management component and the terminal trusted control component, as the access points of the trusted network connection, are located in the trusted platform evaluation layer and are responsible for performing network connection control and assisting in platform identity and integrity evaluation;

[0152] The trusted platform control module of the power wireless access point and the terminal trusted control component, as the integrity measurement collector, are located in the integrity measurement layer and are responsible for measuring component integrity, encryption and signature, and sending the processed integrity measurement values to the integrity measurement verifier.

[0153] When pre - installing the trusted platform control module AS and the corresponding components on the power authentication server TPCM the power authentication server AS as the policy manager, is deployed in the headquarters and the computer rooms of provinces and cities and includes the following components:

[0154] The authentication policy component and the certificate verification component, as the authentication policy service providers, are located in the network access control layer and are responsible for, as a trusted third party, receiving identity authentication data, verifying the legality of identity certificates, and sending authentication results;

[0155] The evaluation policy component and the trusted management center component, as the evaluation policy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data, verifying the identity proof key AIK certificate and the legality of the attribute certificate and sending the platform evaluation results;

[0156] The trusted platform control module of the power authentication server and the trusted management center component, as the integrity measurement verifier, are located in the integrity measurement layer and are responsible for receiving, verifying, and evaluating the integrity measurement values of the power wireless terminal STA and the power wireless access point AP ;

[0157] Please refer to Figure 3 , Figure 3 which shows the process of certificate application and distribution in the embodiment of the present invention. Step S2 performs device certificate application and distribution according to the three - element three - layer architecture and includes the following steps:

[0158] Let \(G, G T be p a bilinear cyclic group of order \(n\), g , h be the generators of \(G\), and the bilinear mapping \(e: G\times G\rightarrow G T , such that , as a public parameter, where in represents the first bilinear pair, represents the bilinear mapping, the symbol is defined as; the identity certificate of the derived device SM2 public key and the identity certificate SM2 private key , the subscript device uniformly represents the power wireless terminal STA and the power wireless access point AP of the device; the power authentication server AS According to the security parameter 1 λ , the SM2 public key of the derived root certificate and the SM2 private key of the root certificate to generate a temporary key random number ;

[0159] The temporary key random number is generated by the true random number generator TPCM in the trusted platform control module RNG for the power authentication server AS to calculate the temporary key seed ).

[0160] The device packages the place of origin, user name, device name, device type, Internet Protocol IP address, Media Access Control MAC address and the public key of the identity certificate as identity information; packages the public key of the identity authentication key AIK , endorsement key EC certificate, platform certificate and consistency certificate as platform information; generates component configuration information , where in i = 1, …, k , k is the number of components, cs is the set of configuration information, and calculates the component configuration metric value according to the following formula H = SM3 ( cs 1 || cs 2 || … || cs k ), as the platform attribute, where in SM3 () represents performing SM3 algorithm processing; submits the above information to the power authentication server AS ;

[0161] The power authentication server ASSign the received device identity information and platform information to generate a device identity certificate and a device platform certificate ; Evaluate cs i the satisfied security attributes , p.s. which is a set of security attributes, such that , where represents the attribute certificate verification parameter, and the superscript in the parameter indicates exponentiation; Generate a device attribute certificate , where respectively represent the first parameter , the second parameter and the third parameter of the device attribute certificate, and the superscript in the parameter indicates exponentiation;

[0162] The power authentication server AS calculates the temporary key seed , and sends ( u , p.s. , , , , , ) to the device through a secure channel and stores it in the non-volatile memory NVM inside, where is the MAC address of the power authentication server, is the MAC address of each device, is the temporary key random number, u is the attribute certificate verification parameter, p.s. is the set of security attributes, is the SM2 public key of the root certificate, is the temporary key seed, is the device identity certificate, is the device platform certificate, is the device attribute certificate, and each device is preconfigured with a trusted platform control module;

[0163] The device uses the SM2 public key of the root certificate to verify the correctness of the device identity certificate and the device platform certificate , and verify whether the following equation holds. If it holds, the device attribute certificate is correct; otherwise, reapply for the certificate:

[0164]

[0165]

[0166] In the formula, is the attribute certificate verification parameter, indicates whether it holds, is the power operation with the first bilinear pair T as the base and the set of security attributes p.s. as the exponent, g , is the generator of G, represents the bilinear mapping e as the base and the set of security attributes p.s. as the exponent, represents the power operation with the bilinear mapping e as the base and the set of configuration information cs as the exponent.

[0167] Please refer to Figure 4 , Figure 4 which shows the process of the trusted access authentication for the device obtaining the certificate in the embodiment of the present invention. Among them, the two-way identity authentication based on the three - element three - layer architecture includes the following steps:

[0168] The power wireless access point AP sends the first power wireless access point random number STA to the power wireless terminal through the uncontrolled port as the authentication activation message;

[0169] After receiving the authentication activation message, the power wireless terminal STA checks the first power wireless access point random number to prevent replay attacks; if the check passes, it generates the first power wireless terminal random number , calculates , in the formula, represents STA与AS上行SM4 the temporary symmetric key, is STA the temporary key seed, represents the connection, SM3 () represents performing SM3 algorithm processing, encrypting and , STA the device identity certificate is obtained through the device identity certificate to obtain the ciphertext ; and uses STA the device identity certificate SM2 private key to sign, STA Device identity certificate SM2 Private key Derive the device identity certificate SM2 Private key Obtain, and get the signature information after signing ; Send an authentication request message to the power wireless access point AP The authentication request message includes the following formula:

[0170]

[0171] Power wireless access point AP After receiving the authentication request message, check the first power wireless terminal random number To prevent replay attacks, check the first power wireless terminal random number To confirm that it is a reply to the message sent by itself; If the check passes, calculate , Indicates AP And AS The uplink SM4 Temporary symmetric key, Is AP Temporary key seed, encrypt to get the ciphertext , where AP Device identity certificate Obtain through the device identity certificate ; And use AP Device identity certificate SM2 Private key Sign, AP Device identity certificate SM2 Private key Derive the device identity certificate SM2 Private key Obtain, and get the signature information after signing ; Send a certificate authentication request message to the power authentication server AS The certificate authentication request message includes the following formula:

[0172]

[0173] Power authentication server AS After receiving the certificate authentication request message, check the first power wireless access point random number And the first power wireless terminal random number , to prevent replay attacks; If the check passes, calculate And , decrypt to get STA Device identity certificate And AP Device identity certificate , verify and signatures in to verify the legitimacy of the identities of the power wireless terminal STA and the power wireless access point AP ; then use the STA device identity certificate SM2 public key and AP device identity certificate SM2 public key to verify the signatures and respectively, to verify that the power wireless terminal STA and the power wireless access point AP hold their own identity certificate private keys, STA device identity certificate SM2 public key and AP device identity certificate SM2 public key and both obtain the public key of the derived device's identity certificate SM2 public key and generate the corresponding certificate authentication results respectively according to the above certificate authentication process and ; then generate the first power authentication server random number and calculate and . In the formula, represents STA the downlink AS temporary symmetric key between SM4 ; represents STA the temporary key seed, represents AP the downlink AS temporary symmetric key between SM4 ; represents AP the temporary key seed, and encrypts to obtain the ciphertext and , represents STA the certificate authentication result, represents AP the certificate authentication result; send a certificate authentication response message to the power wireless access point AP . The certificate authentication response message includes the following formula:

[0174]

[0175] Power wireless access point AP After receiving the certificate authentication response message, check the first power authentication server random number , to prevent replay attacks; if the check passes, send an authentication response message to the power wireless terminal STA The authentication response message includes the following formula:

[0176]

[0177] Then the power wireless access point AP Calculates Decrypts To obtain ; if the identity certificate of the power wireless terminal STA Passes the authentication, continue with the platform evaluation, otherwise reject the power wireless terminal STA Access;

[0178] After receiving the authentication response message, the power wireless terminal STA Checks the first power authentication server random number , to prevent replay attacks; if the check passes, calculates Decrypts To obtain ; if the identity certificate of the power wireless access point AP Passes the authentication, continue with the platform evaluation, otherwise reject access to the power wireless access point AP .

[0179] The platform identity and integrity evaluation based on attributes includes the following steps:

[0180] The power wireless terminal STA Generates a second power wireless terminal random number , performs attribute proof calculation, and generates STA Component attribute signature ; calculates , encrypts the first power authentication server random number , STA Device platform certificate And STA Component attribute signature , STA Device platform certificate Is obtained from the device platform certificate To obtain the ciphertext ; sends a platform evaluation request message to the power wireless access point AP The platform evaluation request message includes the following formula:

[0181]

[0182] After receiving the platform evaluation request message, the power wireless access point AP Checks the second power wireless terminal random number , to prevent replay attacks; if the check passes, the power wireless access point AP generates a second power wireless access point random number , performs attribute proof calculation, and generates AP component attribute signature ; calculates , encrypts the first power authentication server random number , AP device platform certificate and AP component attribute signature , AP device platform certificate is obtained from the device platform certificate to obtain the ciphertext ; sends a platform authentication request message to the power authentication server AS , and the platform authentication request message includes the following formula:

[0183]

[0184] Power authentication server AS After receiving the platform authentication request message, checks the second power wireless terminal random number and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculates and , and decrypts them respectively to obtain STA device platform certificate , AP device platform certificate , STA component attribute signature , AP component attribute signature ; then verifies the digital signatures in and to evaluate the legitimacy of the respective platform identities of the power wireless terminal STA and the power wireless access point AP ; then performs an attribute verification algorithm on , to evaluate the integrity of the respective platforms of the power wireless terminal STA and the power wireless access point AP ; generates STA platform evaluation result and AP platform evaluation result ; generates a second power authentication server random number , and calculates and , and encrypts them to obtain the ciphertext and ; send a platform authentication response message to the power wireless access point AP The platform authentication response message includes the following formula:

[0185]

[0186] Power wireless access point AP After receiving the platform authentication response message, check the second power authentication server random number to prevent replay attacks; if the check passes, generate a third power wireless access point random number , SM2 Temporary public key and SM2 Temporary private key , and send a platform evaluation response message to the power wireless terminal STA The platform evaluation response message includes the following formula:

[0187]

[0188] Then calculate , decrypt , and obtain ; if both the platform identity and integrity evaluations of the power wireless terminal STA pass, continue with key negotiation, otherwise reject the access of the power wireless terminal STA;

[0189] Power wireless terminal STA After receiving the platform evaluation response message, check the second power authentication server random number and the third power wireless access point random number to prevent replay attacks; if the check passes, then calculate , decrypt , and obtain ; if both the platform identity and integrity evaluations of the power wireless access point AP pass, continue with key negotiation, otherwise reject the access to the power wireless access point AP .

[0190] SM2 is an asymmetric encryption algorithm, which has a public key and a private key; SM3 is a digest algorithm, which is an algorithm that maps data of any length to a fixed-length hash value (or called digest, message digest); SM4 is a symmetric encryption algorithm, and the same key is used for encryption and decryption; the above SM2 algorithm, SM3 algorithm and SM4 algorithm are all national commercial cryptographic algorithms.

[0191] Further, in a possible implementation manner, the attribute proof calculation of the embodiment of the present invention includes the following steps:

[0192] The device generates a random number N and random numbers r1 and r2 for blinding calculation; the random numbers N are taken from the random numbers of the second power wireless terminal and the random numbers of the second power wireless access point ;

[0193] Use to calculate the commitment value , where the superscript of the parameter represents the power operation. Calculate the commitment value N through the random number to obtain the signature value ;

[0194] The device performs blinding calculation, making the blinding value , where means defining Z as the following value, respectively represent the first blinding parameter , the second blinding parameter and the third blinding parameter , and the superscript in the parameter represents the power operation;

[0195] Calculate the first evidence value and the second evidence value according to the following formula, where the superscript in the parameter represents the power operation;

[0196] Generate the component attribute signature .

[0197] In a possible implementation manner, the attribute verification algorithm of the embodiment of the present invention includes the following steps:

[0198] Verify the signature value to verify the authenticity of ;

[0199] Calculate whether the following equation holds:

[0200]

[0201]

[0202] where represents the bilinear mapping, represents whether it holds, is the power operation with the first bilinear pair T as the base and - p.s. as the exponent, p.s.is a set of security attributes, is the first bilinear pairing T as the base, is the power operation with the exponent, cs is a set of configuration information, H is the component configuration metric value, g 、 is the generator of G, respectively represent the first evidence value and the second evidence value;

[0203] If the above equation does not hold, the attribute verification fails. Otherwise, use the platform configuration attribute pair as the index to query the revocation list. If it is not in the list, the verification passes; if it is in the list, the verification fails.

[0204] The key agreement based on the national cryptographic algorithm includes the following steps:

[0205] Power wireless terminal STA generates the third power wireless terminal random number , SM2 temporary public key and SM2 temporary private key ; then calculate the power wireless terminal base key seed according to the following formula ,calculate the power wireless terminal base key according to the following formula ,calculate the power wireless terminal base key confirmation serial number according to the following formula ,wherein, represents the power wireless terminal base key, represents the power wireless terminal STA 's MAC address, represents the power wireless access point AP 's MAC address; then send a key agreement request message to the power wireless access point AP The key agreement request message includes the following formula:

[0206]

[0207] Power wireless access point AP After receiving the key agreement request message, check the third power wireless terminal random number to prevent replay attacks, and check the third power wireless access point random number to confirm that it is the key agreement reply initiated by itself; if the check passes, calculate the power wireless access point base key seed according to the following formula ,calculate the power wireless access point base key according to the following formula ,calculate the power wireless access point base key identifier according to the following formula ,wherein, is the base key of the power wireless access point; compare the base key identifier of the power wireless access point and the base key identifier of the power wireless terminal . If they are the same, the key negotiation is successful; then calculate , and take the first 128 bits of the result as the unicast key USK , and take the last 128 bits of the result as the multicast key MSK for encryption key MEK ; then generate the fourth random number of the power wireless access point and calculate the random number with the multicast key , take the current system time and calculate the multicast identifier , where represents the current system time, represents performing string conversion function processing, , and encrypt it with MEK to obtain the ciphertext ; then send a key negotiation response message to the power wireless terminal STA . The key negotiation response message includes the following formula:

[0208]

[0209] Power wireless terminal STA After receiving the key negotiation response message, check the fourth random number of the power wireless access point to prevent replay attacks, and check the third random number of the power wireless terminal to confirm that it is the key negotiation request sent by itself; if the check passes, then calculate according to the following formula , and take the first 128 bits of the result as the unicast key USK , and take the last 128 bits of the result as the multicast key MSK for encryption key MEK ; then use MEK to decrypt the ciphertext to obtain M_ID and MSK ; then send a key negotiation confirmation message to the power wireless access point AP . The key negotiation confirmation message includes the following formula:

[0210]

[0211] Power wireless access point AP After receiving the key negotiation confirmation message, check the fourth random number of the power wireless access point to confirm that it is the key negotiation response sent by itself; check M_ID to confirm the key negotiation result; after that, both parties start communicating using the controlled port.

[0212] The method of the embodiment of the present invention introduces a trusted platform control module TPCM and the corresponding management components, which improve the security of each device body and can effectively prevent collusion attacks; the method of the embodiment of the present invention designs a three - element three - layer architecture to further ensure the trustworthiness of the access platform on the basis of legal identities; the method of the embodiment of the present invention designs an attribute - based platform identity and integrity evaluation method, which can effectively prevent the leakage of platform configuration information; the method of the embodiment of the present invention encrypts and stores certificates, keys, etc. in the trusted platform control module TPCM internally, physically isolated from the device body, which improves the security of privacy information and thus prevents identity authentication attacks; the method of the embodiment of the present invention designs a symmetric encryption and decryption method based on the device's media access control MAC address and random number, encrypts and transmits sensitive information such as certificates and public keys, improves the confidentiality of communication, has forward security, and can prevent replay attacks and man - in - the - middle attacks; the method of the embodiment of the present invention simplifies the key negotiation process and improves the access authentication efficiency.

[0213] Another embodiment of the present invention also proposes a power WLAN security reinforcement system based on trusted computing, including:

[0214] A trusted adaptation module, which is used to pre - install a trusted platform control module STA and the corresponding components on the power wireless terminal AP , the power wireless access point AS and the power authentication server TPCM respectively, to form a three - element three - layer architecture;

[0215] A certificate distribution module, which is used to apply for and distribute certificates for devices according to the three - element three - layer architecture, and is uniformly managed by the power authentication server AS , and the devices include the power wireless terminal STA and the power wireless access point AP ;

[0216] A trusted access authentication module, which is used to perform trusted access authentication on the devices that have obtained certificates, including two - way identity authentication based on the three - element three - layer architecture, attribute - based platform identity and integrity evaluation, and key negotiation based on national cryptographic algorithms, to realize the access of trusted power wireless terminals STA to trusted power wireless access points AP .

[0217] In a possible implementation manner, when the trusted adaptation module pre - installs a trusted platform control module STA and the corresponding components on the power wireless terminal TPCM , the power wireless terminal STA acts as an access requester and is deployed dispersedly geographically, including the following components:

[0218] The wireless communication component, as a network access requester, is located at the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0219] The network access control and management component and the terminal trusted control component, as a trusted network connection client, are located at the trusted platform evaluation layer and are responsible for executing network connection control and assisting in completing platform identity and integrity evaluation;

[0220] Power wireless terminal trusted platform control module And the terminal trusted control component, as an integrity measurement collector, is located at the integrity measurement layer and is responsible for measuring component integrity, encrypting and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0221] In a possible implementation, when the trusted adaptation module pre-deploys the trusted platform control module AP And corresponding components on the power wireless access point TPCM The power wireless access point AP As an access controller, is deployed at a specified geographical location and includes the following components:

[0222] The wireless communication component, as a network access controller, is located at the network access control layer and is responsible for starting and executing communication protocols, transmitting communication data, receiving access policies, and performing access control;

[0223] The network access control and management component and the terminal trusted control component, as a trusted network connection access point, are located at the trusted platform evaluation layer and are responsible for executing network connection control and assisting in completing platform identity and integrity evaluation;

[0224] Power wireless access point trusted platform control module And the terminal trusted control component, as an integrity measurement collector, is located at the integrity measurement layer and is responsible for measuring component integrity, encrypting and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

[0225] In a possible implementation, when the trusted adaptation module pre-deploys the trusted platform control module AS And corresponding components on the power authentication server TPCM The power authentication server AS As a policy manager, is deployed in the headquarters and provincial and municipal computer rooms and includes the following components:

[0226] The authentication policy component and the certificate verification component, as an authentication policy server, are located at the network access control layer and are responsible for, as a trusted third party, receiving identity authentication data, verifying the legality of identity certificates, and sending authentication results;

[0227] The evaluation policy component and the trusted management center component, as the evaluation policy service provider, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data, verifying the identity key AIK the legality of the certificate and the attribute certificate, and sending the platform evaluation result;

[0228] The trusted platform control module of the power authentication server and the trusted management center component, as the integrity measurement verifier, are located in the integrity measurement layer and are responsible for receiving, verifying, and evaluating the power wireless terminal STA and the power wireless access point AP of the integrity measurement value.

[0229] In a possible implementation manner, when the certificate distribution module performs device certificate application and distribution according to the three - element three - layer architecture, let G, G T be p a bilinear cyclic group of order g , h be the generators of G, and the bilinear mapping e: G×G→G T , such that , as the public parameter, where represents the first bilinear pair, represents the bilinear mapping, and the symbol is defined as; the identity certificate of the derived device SM2 public key and the identity certificate SM2 private key , with the subscript device collectively representing the devices of the power wireless terminal STA and the power wireless access point AP ; the power authentication server AS according to the security parameter 1 λ , derives the SM2 public key and the SM2 private key of the root certificate, and generates the temporary key random number ;

[0230] The device packages the place of origin, user name, device name, device type, Internet Protocol IP address, Media Access Control MAC address, and the identity certificate public key as the identity information; packages the identity authentication key AIK public key, endorsement key EC certificate, platform certificate, and consistency certificate as the platform information; generates the component configuration information , where i = 1, …, k , k is the number of components, cs is a set of configuration information, and the component configuration metric value is calculated according to the following formula H = SM3 ( cs 1|| cs 2||…|| cs k ), as a platform attribute, where SM3 ()represents performing SM3 algorithm processing; submit the above information to the power authentication server AS ;

[0231] Power authentication server AS signs the received device identity information and platform information to generate a device identity certificate , device platform certificate ; evaluate cs i the satisfied security attributes , p.s. is a set of security attributes, making , where represents the attribute certificate verification parameter, and the superscript in the parameter represents performing a power operation; generate a device attribute certificate , where respectively represent the first parameter , second parameter and third parameter of the device attribute certificate, and the superscript in the parameter represents performing a power operation;

[0232] Power authentication server AS calculates the temporary key seed , and sends ( u , p.s. , , , , , ) to the device through a secure channel and stores it in the non-volatile memory NVM inside, where is the MAC address of the power authentication server, is the MAC address of each device, is the temporary key random number, u is the attribute certificate verification parameter, p.s. is the set of security attributes, is the SM2 public key of the root certificate, is the temporary key seed, is the device identity certificate, It is the device platform certificate, It is the device attribute certificate, Each device is pre - installed with a trusted platform control module;

[0233] The public key of the root certificate used by the device SM2 public key Verify the device identity certificate and the device platform certificate for correctness, and verify whether the following equation holds. If it holds, the device attribute certificate is correct; otherwise, re - apply for the certificate:

[0234]

[0235]

[0236] In the formula, is the attribute certificate verification parameter, indicates whether it holds, is the power operation with the first bilinear pair T as the base and the security attribute set p.s. as the exponent, g , is the generator of G, represents the bilinear mapping e as the base and the security attribute set p.s. as the exponent of the power operation, represents the power operation with the bilinear mapping e as the base and the configuration information set cs as the exponent.

[0237] In a possible implementation, when the trusted access authentication module performs two - way identity authentication based on a three - element three - layer architecture, the power wireless access point AP sends the first power wireless access point random number STA to the power wireless terminal through an uncontrolled port as an authentication activation message;

[0238] After receiving the authentication activation message, the power wireless terminal STA checks the first power wireless access point random number to prevent replay attacks; if the check passes, it generates the first power wireless terminal random number , calculates , in the formula, represents STA与AS上行SM4 the temporary symmetric key, is STA the temporary key seed, represents connection, SM3 () represents performing SM3Algorithm processing, encryption and , STA Device identity certificate Obtain the ciphertext through the device identity certificate ; And use Device identity certificate STA Private key SM2 Sign , STA Device identity certificate SM2 Private key Obtain the private key by deriving the device's identity certificate SM2 Private key Obtain the signature information after signing ; Send an authentication request message to the power wireless access point AP The authentication request message includes the following formula:

[0239]

[0240] Power wireless access point AP After receiving the authentication request message, check the first power wireless terminal random number To prevent replay attacks, check the first power wireless terminal random number To confirm that it is a reply to the message sent by itself; If the check passes, then calculate , Indicates AP And AS The uplink SM4 Temporary symmetric key Is AP Temporary key seed, encrypt to get the ciphertext , where AP Device identity certificate Obtain through the device identity certificate ; And use AP Device identity certificate SM2 Private key Sign AP Device identity certificate SM2 Private key Obtain the private key by deriving the device's identity certificate SM2 Private key Obtain the signature information after signing ; Send a certificate authentication request message to the power authentication server AS The certificate authentication request message includes the following formula:

[0241]

[0242] Power authentication server ASAfter receiving the certificate authentication request message, check the random number of the first power wireless access point and the random number of the first power wireless terminal to prevent replay attacks; if the check passes, then calculate and , decrypt to obtain STA device identity certificate and AP device identity certificate , verify and the signatures in, so as to verify the legality of the identities of the power wireless terminal STA and the power wireless access point AP ; then use STA device identity certificate SM2 public key and AP device identity certificate SM2 public key to verify the signatures and respectively, to verify that the power wireless terminal STA and the power wireless access point AP hold their own identity certificate private keys, STA device identity certificate SM2 public key and AP device identity certificate SM2 public key and both obtain the public key of the derived device's identity certificate SM2 public key and generate the corresponding certificate authentication results and respectively according to the above certificate authentication process; then generate the random number of the first power authentication server , calculate and , where represents STA and AS the downlink SM4 temporary symmetric key between, represents STA temporary key seed, represents AP and AS the downlink SM4 temporary symmetric key between, represents AP temporary key seed, encrypt to obtain ciphertext and , represents STA certificate authentication result, represents AP Certificate authentication result; send to the power wireless access point AP Send a certificate authentication response message, and the certificate authentication response message includes the following formula:

[0243]

[0244] Power wireless access point AP After receiving the certificate authentication response message, check the first power authentication server random number to prevent replay attacks; if the check passes, send an authentication response message to the power wireless terminal STA The authentication response message includes the following formula:

[0245]

[0246] Then the power wireless access point AP Calculate Decrypt to obtain ; if the identity certificate authentication of the power wireless terminal STA passes, continue with the platform evaluation, otherwise reject the power wireless terminal STA from accessing;

[0247] Power wireless terminal STA After receiving the authentication response message, check the first power authentication server random number to prevent replay attacks; if the check passes, calculate Decrypt to obtain ; if the identity certificate authentication of the power wireless access point AP passes, continue with the platform evaluation, otherwise reject access to the power wireless access point AP .

[0248] In a possible implementation manner, when the trusted access authentication module performs attribute-based platform identity and integrity evaluation, it generates a second power wireless terminal random number STA through the power wireless terminal , performs attribute proof calculation, and generates STA Component attribute signature ; calculate , encrypt the first power authentication server random number , STA Device platform certificate and STA Component attribute signature , STA The device platform certificate is obtained from the device platform certificate to obtain the ciphertext ; Send a platform evaluation request message to the power wireless access point AP The platform evaluation request message includes the following formula:

[0249]

[0250] Power wireless access point AP After receiving the platform evaluation request message, check the second power wireless terminal random number , to prevent replay attacks; if the check passes, the power wireless access point AP Generates a second power wireless access point random number , performs attribute proof calculation, and generates AP Component attribute signature ; Calculate , encrypt the first power authentication server random number , AP Device platform certificate And AP Component attribute signature , AP Device platform certificate Is obtained from the device platform certificate , and the ciphertext ; Send a platform authentication request message to the power authentication server AS The platform authentication request message includes the following formula:

[0251]

[0252] Power authentication server AS After receiving the platform authentication request message, check the second power wireless terminal random number And the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate And , and decrypt them respectively to obtain STA Device platform certificate , AP Device platform certificate , STA Component attribute signature , AP Component attribute signature ; Then verify And The digital signatures in, so as to evaluate the power wireless terminal STA And the power wireless access point AP The legality of their respective platform identities; then for , Execute the attribute verification algorithm, so as to evaluate the power wireless terminal STA And the power wireless access point AP The integrity of each platform; generated according to the above process STA Platform evaluation result and AP Platform evaluation result ; generate the second power authentication server random number , and calculate and , encrypt to obtain ciphertext and ; send a platform authentication response message to the power wireless access point AP The platform authentication response message includes the following formula:

[0253]

[0254] Power wireless access point AP After receiving the platform authentication response message, check the second power authentication server random number to prevent replay attacks; if the check passes, generate the third power wireless access point random number , SM2 Temporary public key and SM2 Temporary private key , and send a platform evaluation response message to the power wireless terminal STA The platform evaluation response message includes the following formula:

[0255]

[0256] Then calculate , decrypt , and obtain ; if both the platform identity and integrity evaluations of the power wireless terminal STA pass, continue with key negotiation, otherwise reject the access of the power wireless terminal STA;

[0257] Power wireless terminal STA After receiving the platform evaluation response message, check the second power authentication server random number and the third power wireless access point random number to prevent replay attacks; if the check passes, then calculate , decrypt , and obtain ; if both the platform identity and integrity evaluations of the power wireless access point AP pass, continue with key negotiation, otherwise reject the access to the power wireless access point AP .

[0258] In a possible implementation manner, when the trusted access authentication module performs key negotiation based on the national cryptographic algorithm, through the power wireless terminal STA Generate a third power wireless terminal random number , SM2 Temporary public key and SM2 Temporary private key ; Then calculate the power wireless terminal base key seed as follows: , calculate the base key of the power wireless terminal as follows: , calculate the power wireless terminal base key confirmation serial number as follows: , where Indicates the base key of the power wireless terminal, Indicates power wireless terminal STA of MAC address, Indicates power wireless access point AP of MAC address; then send power to the wireless access point AP Send a key negotiation request message, which includes the following formula:

[0259]

[0260] Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, the base key seed of the power wireless access point is calculated according to the following formula , calculate the base key of the power wireless access point as follows: , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point And power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then generate a fourth power wireless access point random number Calculate the random number with the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK to encrypt the ciphertext ; Then send a key negotiation response message to the power wireless terminal STA The key negotiation response message includes the following formula:

[0261]

[0262] Power wireless terminal STA After receiving the key negotiation response message, check the fourth power wireless access point random number to prevent replay attacks, and check the third power wireless terminal random number to confirm that it is the key negotiation request sent by itself; if the check passes, then calculate according to the following formula , and take the first 128 bits of the result as the unicast key USK , and take the last 128 bits of the result as the encryption key of the multicast key MSK ; Then use MEK to decrypt the ciphertext MEK to obtain and M_ID and MSK ; Then send a key negotiation confirmation message to the power wireless access point AP The key negotiation confirmation message includes the following formula:

[0263]

[0264] Power wireless access point AP After receiving the key negotiation confirmation message, check the fourth power wireless access point random number to confirm that it is the key negotiation response sent by itself; check M_ID to confirm the key negotiation result; after that, the two parties start communicating using the controlled port.

[0265] Another embodiment of the present invention also proposes an electronic device, including a processor and a memory, and the processor is used to execute a computer program stored in the memory to implement the power WLAN security reinforcement method based on trusted computing.

[0266] Another embodiment of the present invention also proposes a computer-readable storage medium, and the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the power WLAN security reinforcement method based on trusted computing is implemented.

[0267] The computer program includes computer program code, which may be in the form of source code, object code, an executable file, or some intermediate form, etc. The computer-readable storage medium may include: any entity or device, medium, USB flash drive, mobile hard disk, magnetic disk, optical disc, computer memory, read-only memory, random access memory, electrical carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the content included in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice within the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals. For the sake of convenience of description, only the part related to the embodiments of the present invention is shown above. For the specific technical details not disclosed, please refer to the method part of the embodiments of the present invention. This computer-readable storage medium is non-transitory and can be stored in a storage device formed by various electronic devices, and can implement the execution process recorded in the method of the embodiments of the present invention.

[0268] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0269] The present invention is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram can be implemented by computer program instructions, and the combination of the flows and / or blocks in the flowchart and / or block diagram can also be implemented. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the functions specified in Figure one one flow or multiple flows and / or blocks Figure one one block or multiple blocks.

[0270] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the functions specified in Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0271] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one process or a plurality of processes and / or blocks Figure 1 one process or a plurality of processes and / or blocks Figure 1 or steps of functions specified in a plurality of blocks.

[0272] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: modifications or equivalent replacements can still be made to the specific embodiments of the present invention, and any modification or equivalent replacement without departing from the spirit and scope of the present invention shall be covered by the protection scope of the claims of the present invention.

Claims

1. A method for strengthening the security of power WLAN based on trusted computing, characterized in that: include: Power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Trusted Platform Control Module TPCM and corresponding components, forming a ternary three-layer architecture; According to the three-layer architecture, the device certificate application and distribution are carried out by the power identification server. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; include: Power Identification Server AS Sign the received device identity information and platform information to generate a device identity certificate , Equipment Platform Certificate ;Evaluate cs i Satisfied security properties , ps is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that a power operation is performed; Power Identification Server AS Calculate temporary key seed ,Will( u , ps , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory NVM Internal, in which For power identification server MAC address, For each device MAC address, is a temporary key random number, u is the attribute certificate verification parameter, ps is a set of security attributes, For root certificates SM2 Public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate SM2 Public Key Verify device identity certificate , Equipment Platform Certificate The correctness of the device attribute certificate is verified and the following equation is verified. If it is true, the device attribute certificate Correct, otherwise re-apply for the certificate: In the formula, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ps is the exponential power operation, g , is the generator of G, Represents a bilinear map e As the bottom, security attribute set ps is the exponential power operation, Represented by a bilinear map e As the base, configure the information collection cs is the exponential power operation; Conduct trusted access authentication for certified devices, including two-way identity authentication based on a ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on national secret algorithms, to achieve trusted power wireless terminals STA Access to a trusted power wireless access point AP .

2. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: In power wireless terminal STA Trusted Platform Control Module TPCM and corresponding components, the power wireless terminal STA As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

3. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: Powering Wireless Access Points AP Trusted Platform Control Module TPCM and corresponding components, the power wireless access point AP As an access controller, it is deployed in a specified geographical location and includes the following components: The wireless communication component, as a network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

4. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: Power Identification Server AS Trusted Platform Control Module TPCM and corresponding components, the power identification server AS As a policy manager, it is deployed in the headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party; The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying identity proof keys. AIK The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power Identification Server Trusted Platform Control Module and the trusted management center component, as the integrity measurement verifier, located in the integrity measurement layer, responsible for receiving, verifying and evaluating the power wireless terminal STA and Power Wireless Access Point AP The integrity metric of .

5. The power WLAN security reinforcement method based on trusted computing according to claim 1 is characterized in that: According to the three-layer architecture, the device certificate application and distribution are carried out by the power identification server. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP , including the following steps: Assume G, G T for p bilinear cyclic group of order, g , h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, Represents a bilinear map, symbol The device's identity certificate is defined as: SM2 Public Key With identity certificate SM2 Private Key , subscript device Unified representation of power wireless terminal STA and power wireless access points AP Equipment; Power Identification Server AS According to safety parameter 1 λ , from which the root certificate is derived SM2 Public Key With root certificate SM2 Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, internet protocol IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package identity certificate key AIK Public key, endorsement key EK Certificate, platform certificate and consistency certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, cs It is a collection of configuration information and calculates the component configuration metric value as follows H = SM3 ( cs 1|| cs 2||…|| cs k ), as a platform attribute, where SM3 () indicates proceed SM3 Algorithm processing; submit the above information to the power identification server AS .

6. The power WLAN security reinforcement method based on trusted computing according to claim 5 is characterized in that: The two-way identity authentication based on the ternary three-layer architecture includes the following steps: Power Wireless Access Point AP Through the uncontrolled port to the power wireless terminal STA Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express Uplink SM4 between STA and AS Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device Identity Certificate Via device identity certificate Get, get the ciphertext ; and use STA Device Identity Certificate SM2 Private Key sign, STA Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following: Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the first power wireless terminal random number To confirm that it is a reply to the message sent by itself; if the check passes, then calculate , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to get ciphertext ,in AP Device Identity Certificate Via device identity certificate obtain; and use AP Device Identity Certificate SM2 Private Key sign, AP Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To the power identification server AS Send a certificate authentication request message, which includes the following: Power Identification Server AS After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, then calculate and , decrypted to get STA Device Identity Certificate and AP Device Identity Certificate ,verify and The signature in the power wireless terminal is used to verify the STA and power wireless access points AP Legitimacy of identity; subsequent use STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public Key Verify signatures separately and , to verify the power wireless terminal STA and power wireless access points AP Hold your own identity certificate private key, STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public key and Both are derived from the device's identity certificate SM2 Public Key Obtain, according to the above certificate authentication process respectively generate the corresponding certificate authentication results and ; Then generate a random number for the first power authentication server ,calculate and , where express STA and AS Downstream SM4 Temporary symmetric key, express STA Temporary key seed, express AP and AS Downstream SM4 Temporary symmetric key, express AP Temporary key seed, encrypted to get ciphertext and , express STA Certificate authentication result, express AP Certificate authentication result; to the power wireless access point AP Send a certificate authentication response message, which includes the following: Power Wireless Access Point AP After receiving the certificate authentication response message, check the random number of the first power authentication server to prevent replay attacks; if the check passes, the power wireless terminal STA Send an authentication response message, which includes the following: Then power the wireless access point AP calculate , decrypt ,get ; If the power wireless terminal STA If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point AP If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the access to the power wireless access point will be denied. AP .

7. The power WLAN security reinforcement method based on trusted computing according to claim 6 is characterized in that: The attribute-based platform identity and integrity assessment includes the following steps: Power wireless terminal STA Generate a second power wireless terminal random number , perform attribute proof calculation and generate STA Component property signature ;calculate , encrypt the random number of the first power authentication server , STA Device Platform Certificate and STA Component property signature , STA Device Platform Certificate Device platform certificate Get, get the ciphertext ; To power wireless access point AP Send a platform evaluation request message, which includes the following formula: Power Wireless Access Point AP After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the wireless access point is powered AP Generate a random number for the second power wireless access point , perform attribute proof calculation and generate AP Component property signature ;calculate , encrypt the random number of the first power authentication server , AP Device Platform Certificate and AP Component property signature , AP Device Platform Certificate Device platform certificate Get, get the ciphertext ; To the power identification server AS Send a platform authentication request message, which includes the following formula: Power Identification Server AS After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted separately to obtain STA Device Platform Certificate , AP Device Platform Certificate , STA Component property signature , AP Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal STA and power wireless access points AP The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminal STA and power wireless access points AP The integrity of the respective platform; generated according to the above process STA Platform evaluation results and AP Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get the ciphertext and ; To power wireless access point AP Send a platform authentication response message, which includes the following formula: Power Wireless Access Point AP After receiving the platform authentication response message, check the random number of the second power authentication server to prevent replay attacks; if the check passes, a third power wireless access point random number is generated , SM2 Temporary public key and SM2 Temporary private key , and to the power wireless terminal STA Send a platform assessment response message, which includes the following formula: Then calculate , decrypt ,get ; If the power wireless terminal STA If the platform identity and integrity assessment are passed, key negotiation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the platform evaluation response message, check the random number of the second power identification server And the third power wireless access point random number , to prevent replay attacks; if the check passes, then calculate , decrypt ,get ; If the power wireless access point AP If the platform identity and integrity assessments are both passed, key negotiation will continue, otherwise access to the power wireless access point will be denied. AP .

8. The power WLAN security reinforcement method based on trusted computing according to claim 7 is characterized in that: The attribute proof calculation includes the following steps: Device generates random numbers N And the random numbers r1 and r2 used for blind calculation; random numbers N Random number taken from the second power wireless terminal With the second power wireless access point random number ; use Calculating Commitment Value , where the superscript of the parameter indicates the exponentiation operation, the random number is calculated as follows N Calculating Commitment Value The signature value ; The device performs blind calculations, and the blind value , where Indicates that Z Defined as the following value, Represent the first blinding parameters , the second blinding parameter and the third blinding parameter , the superscript in the parameter indicates that a power operation is performed; The first evidence value is calculated as follows: Second Evidence Value , the superscript in the parameter indicates that a power operation is performed; Generate component attribute signature .

9. The power WLAN security reinforcement method based on trusted computing according to claim 8 is characterized in that: The attribute verification algorithm comprises the following steps: Verify the signature value , to verify authenticity; Calculate whether the following equation holds: In the formula, represents a bilinear map, Indicates whether it is established. The first bilinear pairing T For the bottom, - ps is the exponential power operation, ps is a set of security attributes, The first bilinear pairing T For the bottom, is the exponential power operation, cs For configuration information collection, H Configure metrics for components, g , is the generator of G, Respectively represent the first evidence value and the second evidence value; If the above equation does not hold, the attribute verification fails. Otherwise, the platform configuration attribute is used to verify the attribute. For the index, query the revocation list. If it is not in the list, the verification passes. If it is in the list, the verification fails.

10. The method for strengthening the security of a power WLAN based on trusted computing according to claim 7, characterized in that: The key negotiation based on the national secret algorithm includes the following steps: Power wireless terminal STA Generate a third power wireless terminal random number , SM2 Temporary public key and SM2 Temporary private key ; Then calculate the power wireless terminal base key seed as follows: , calculate the base key of the power wireless terminal as follows: , calculate the power wireless terminal base key confirmation serial number as follows: , where Indicates the base key of the power wireless terminal, Indicates power wireless terminal STA of MAC address, Indicates power wireless access point AP of MAC address; then send power to the wireless access point AP Send a key negotiation request message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; if the check passes, the base key seed of the power wireless access point is calculated according to the following formula , calculate the base key of the power wireless access point as follows: , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point And power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then generate a fourth power wireless access point random number Calculate the random number with the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK to encrypt the ciphertext ; Then send the power wireless terminal STA Send a key negotiation response message, which includes the following formula: Power wireless terminal STA After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request sent by itself; if the check passes, the following formula is used to calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then use MEK Ciphertext Decrypt it and get M_ID and MSK ; then power the wireless access point AP Send a key negotiation confirmation message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response sent by itself; check M_ID To confirm the key negotiation result; then, both parties start communicating using the controlled port.

11. A power WLAN security reinforcement system based on trusted computing, characterized in that: include: Trusted adapter module, used for power wireless terminal STA , Power Wireless Access Point AP Power Identification Server AS Trusted Platform Control Module TPCM and corresponding components, forming a ternary three-layer architecture; The certificate distribution module is used to apply for and distribute device certificates according to the three-layer architecture. AS Unified management and control, equipment including power wireless terminals STA and power wireless access points AP ; Power Identification Server AS Sign the received device identity information and platform information to generate a device identity certificate , Equipment Platform Certificate ; Evaluate cs i Satisfied security properties , ps is a set of security attributes, , where Represents the attribute certificate verification parameter. The superscript in the parameter indicates the exponentiation operation. Generates the device attribute certificate , where Respectively represent the first parameter of the device attribute certificate , the second parameter With the third parameter , the superscript in the parameter indicates that a power operation is performed; Power Identification Server AS Calculate temporary key seed ,Will( u , ps , , , , , ) is sent to the device through a secure channel and stored in Non-volatile memory NVM Internal, in which For power identification server MAC address, For each device MAC address, is a temporary key random number, u is the attribute certificate verification parameter, ps is a set of security attributes, For root certificates SM2 Public key, is the temporary key seed, is the device identity certificate, For the device platform certificate, is the device attribute certificate, Pre-install a trusted platform control module for each device; Device using root certificate SM2 Public Key Verify device identity certificate , Equipment Platform Certificate The correctness of the device attribute certificate is verified and the following equation is verified. If it is true, the device attribute certificate Correct, otherwise re-apply for the certificate: In the formula, is the attribute certificate verification parameter, Indicates whether it is established. The first bilinear pairing T As the bottom, security attribute set ps is the exponential power operation, g , is the generator of G, Represents a bilinear map e As the bottom, security attribute set ps is the exponential power operation, Represented by a bilinear map e As the base, configure the information collection cs is the exponential power operation; The trusted access authentication module is used to perform trusted access authentication on devices that have obtained certificates, including two-way identity authentication based on a ternary three-layer architecture, attribute-based platform identity and integrity assessment, and key negotiation based on national secret algorithms, to achieve trusted power wireless terminals. STA Access to a trusted power wireless access point AP .

12. The power WLAN security reinforcement system based on trusted computing according to claim 11, characterized in that: The trusted adaptation module is in the power wireless terminal STA Trusted Platform Control Module TPCM and corresponding components, the power wireless terminal STA As access requesters, they are geographically dispersed and include the following components: The wireless communication component, as a network access requester, is located in the network access control layer and is responsible for executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection clients, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless terminal trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

13. The power WLAN security reinforcement system based on trusted computing according to claim 11 is characterized in that: The trusted adapter module is located at the power wireless access point AP Trusted Platform Control Module TPCM and corresponding components, the power wireless access point AP As an access controller, it is deployed in a specified geographical location and includes the following components: The wireless communication component, as a network access controller, is located in the network access control layer and is responsible for initiating and executing communication protocols, transmitting communication data, receiving access policies, and executing access control; The network access control component and the terminal trusted control component, as trusted network connection access points, are located in the trusted platform assessment layer and are responsible for executing network connection control and assisting in completing platform identity and integrity assessments. Power wireless access point trusted platform control module And the terminal trusted management and control component, as an integrity measurement collector, is located in the integrity measurement layer and is responsible for measuring component integrity, encryption and signing, and sending the processed integrity measurement value to the integrity measurement verifier.

14. The power WLAN security reinforcement system based on trusted computing according to claim 11, characterized in that: The trusted adapter module is located in the power identification server AS Trusted Platform Control Module TPCM and corresponding components, the power identification server AS As a policy manager, it is deployed in the headquarters and provincial and municipal computer rooms and includes the following components: The authentication strategy component and certificate verification component, as authentication strategy service providers, are located in the network access control layer and are responsible for receiving identity authentication data, verifying the legitimacy of identity certificates, and sending authentication results as a trusted third party; The evaluation strategy component and the trusted management center component, as evaluation strategy service providers, are located in the trusted platform evaluation layer and are responsible for receiving evaluation data and verifying the identity key. AIK The legitimacy of certificates and attribute certificates and the evaluation results of the sending platform; Power Identification Server Trusted Platform Control Module and the trusted management center component, as the integrity measurement verifier, located in the integrity measurement layer, responsible for receiving, verifying and evaluating the power wireless terminal STA and Power Wireless Access Point AP The integrity metric of .

15. The power WLAN security reinforcement system based on trusted computing according to claim 11, characterized in that: When the certificate distribution module applies for and distributes certificates for devices according to the ternary three-layer architecture, G, G T for p bilinear cyclic group of order, g , h is the generator of G, the bilinear map e:G×G→G T ,make , as a public parameter, where represents the first bilinear pairing, Represents a bilinear map, symbol The device's identity certificate is defined as: SM2 Public Key With identity certificate SM2 Private Key , subscript device Unified representation of power wireless terminal STA and power wireless access points AP Equipment; Power Identification Server AS According to safety parameter 1 λ , from which the root certificate is derived SM2 Public Key With root certificate SM2 Private Key , generate a temporary key random number ; Device packaging location, user name, device name, device type, internet protocol IP Address, Media Access Control MAC Address and identity certificate public key as identity information; package identity certificate key AIK Public key, endorsement key EK Certificate, platform certificate and consistency certificate as platform information; generate component configuration information , where i =1,…, k , k is the number of components, cs It is a collection of configuration information and calculates the component configuration metric value as follows H = SM3 ( cs 1|| cs 2||…|| cs k ), as a platform attribute, where SM3 () indicates proceed SM3 Algorithmic processing; Submit the above information to the power identification server AS .

16. The power WLAN security reinforcement system based on trusted computing according to claim 15, characterized in that: When the trusted access authentication module performs two-way identity authentication based on the ternary three-layer architecture, the power wireless access point AP Through the uncontrolled port to the power wireless terminal STA Send the first power wireless access point random number , as the authentication activation message; Power wireless terminal STA After receiving the authentication activation message, check the random number of the first power wireless access point To prevent replay attacks; if the check passes, a first power wireless terminal random number is generated ,calculate , where express Uplink SM4 between STA and AS Temporary symmetric key, for STA Temporary key seed, Indicates connection, SM3 () indicates proceed SM3 Algorithm processing, encryption and , STA Device Identity Certificate Via device identity certificate Get, get the ciphertext ; and use STA Device Identity Certificate SM2 Private Key sign, STA Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To power wireless access point AP Send an authentication request message, which includes the following: Power Wireless Access Point AP After receiving the authentication request message, check the random number of the first power wireless terminal To prevent replay attacks, check the first power wireless terminal random number To confirm that it is the reply to the message sent by oneself; If the check passes, then calculate , express AP and AS Uplink SM4 Temporary symmetric key, for AP Temporary key seed, encrypted to get ciphertext ,in AP Device Identity Certificate Via device identity certificate obtain; and use AP Device Identity Certificate SM2 Private Key sign, AP Device Identity Certificate SM2 Private Key By deriving the device's identity certificate SM2 Private Key Get, get signature information after signing ; To the power identification server AS Send a certificate authentication request message, which includes the following: Power Identification Server AS After receiving the certificate authentication request message, check the random number of the first power wireless access point and the first power wireless terminal random number , to prevent replay attacks; if the check passes, then calculate and , decrypted to get STA Device Identity Certificate and AP Device Identity Certificate ,verify and The signature in the power wireless terminal is used to verify the STA and power wireless access points AP Legitimacy of identity; subsequent use STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public Key Verify signatures separately and , to verify the power wireless terminal STA and power wireless access points AP Hold your own identity certificate private key, STA Device Identity Certificate SM2 Public Key and AP Device Identity Certificate SM2 Public key and Both are derived from the device's identity certificate SM2 Public Key Obtain, according to the above certificate authentication process respectively generate the corresponding certificate authentication results and ; Then generate the first power authentication server random number ,calculate and , where express STA and AS Downstream SM4 Temporary symmetric key, express STA Temporary key seed, express AP and AS Downstream SM4 Temporary symmetric key, express AP Temporary key seed, encrypted to get ciphertext and , express STA Certificate authentication result, express AP Certificate authentication result; to the power wireless access point AP Send a certificate authentication response message, which includes the following: Power Wireless Access Point AP After receiving the certificate authentication response message, check the random number of the first power authentication server to prevent replay attacks; if the check passes, the power wireless terminal STA Send an authentication response message, which includes the following: Then power the wireless access point AP calculate , decrypt ,get ; If the power wireless terminal STA If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the power wireless terminal will be rejected. STA Access; Power wireless terminal STA After receiving the authentication response message, check the random number of the first power authentication server , to prevent replay attacks; if the check passes, calculate , decrypt ,get ; If the power wireless access point AP If the identity certificate authentication is passed, the platform evaluation will continue, otherwise the access to the power wireless access point will be denied. AP .

17. The power WLAN security reinforcement system based on trusted computing according to claim 16, characterized in that: The trusted access authentication module performs attribute-based platform identity and integrity assessment through the power wireless terminal STA Generate a second power wireless terminal random number , perform attribute proof calculation and generate STA Component property signature ;calculate , encrypt the random number of the first power authentication server , STA Device Platform Certificate and STA Component property signature , STA Device Platform Certificate Device platform certificate Get, get the ciphertext ; To power wireless access point AP Send a platform evaluation request message, which includes the following formula: Power Wireless Access Point AP After receiving the platform evaluation request message, check the random number of the second power wireless terminal to prevent replay attacks; if the check passes, the wireless access point is powered AP Generate a random number for the second power wireless access point , perform attribute proof calculation and generate AP Component property signature ;calculate , encrypt the random number of the first power authentication server , AP Device Platform Certificate and AP Component property signature , AP Device Platform Certificate Device platform certificate Get, get the ciphertext ; To the power identification server AS Send a platform authentication request message, which includes the following formula: Power Identification Server AS After receiving the platform authentication request message, check the random number of the second power wireless terminal and the second power wireless access point random number , to prevent replay attacks; if the check passes, calculate and , decrypted separately to obtain STA Device Platform Certificate , AP Device Platform Certificate , STA Component property signature , AP Component property signature ; Then verify and Digital signature in order to evaluate the power wireless terminal STA and power wireless access points AP The legitimacy of their respective platform identities; then , Execute attribute verification algorithm to evaluate power wireless terminal STA and power wireless access points AP The integrity of the respective platform; generated according to the above process STA Platform evaluation results and AP Platform evaluation results ; Generate a random number for the second power authentication server , and calculate and , encrypted to get the ciphertext and ; To power wireless access point AP Send a platform authentication response message, which includes the following formula: Power Wireless Access Point AP After receiving the platform authentication response message, check the random number of the second power authentication server to prevent replay attacks; if the check passes, a third power wireless access point random number is generated , SM2 Temporary public key and SM2 Temporary private key , and to the power wireless terminal STA Send a platform assessment response message, which includes the following formula: Then calculate , decrypt ,get ; If the power wireless terminal STA If the platform identity and integrity assessments are both passed, key negotiation will continue. Otherwise, the power wireless terminal STA will be denied access. Power wireless terminal STA After receiving the platform evaluation response message, check the random number of the second power identification server And the third power wireless access point random number , to prevent replay attacks; if the check passes, then calculate , decrypt ,get ; If the power wireless access point AP If the platform identity and integrity assessments are both passed, key negotiation will continue, otherwise access to the power wireless access point will be denied. AP .

18. The power WLAN security reinforcement system based on trusted computing according to claim 17, characterized in that: The trusted access authentication module performs key negotiation based on the national secret algorithm through the power wireless terminal STA Generate a third power wireless terminal random number , SM2 Temporary public key and SM2 Temporary private key ; Then calculate the power wireless terminal base key seed as follows: , calculate the base key of the power wireless terminal as follows: , calculate the power wireless terminal base key confirmation serial number as follows: , where Indicates the base key of the power wireless terminal, Indicates power wireless terminal STA of MAC address, Indicates power wireless access point AP of MAC address; then send power to the wireless access point AP Send a key negotiation request message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation request message, check the random number of the third power wireless terminal To prevent replay attacks, check the random number of the third power wireless access point , to confirm that it is the key negotiation reply initiated by itself; If the check passes, calculate the power wireless access point base key seed as follows , calculate the base key of the power wireless access point as follows: , calculate the base key identifier of the power wireless access point as follows: , where is the base key of the power wireless access point; compare the base key identifier of the power wireless access point And power wireless terminal base key identification If they are the same, the key negotiation is successful; then calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then generate a fourth power wireless access point random number Calculate the random number with the multicast key , get the current system time and calculate the multicast ID , where Indicates the current system time. Indicates that string conversion function processing is performed. , use MEK to encrypt the ciphertext ; Then send the power wireless terminal STA Send a key negotiation response message, which includes the following formula: Power wireless terminal STA After receiving the key negotiation response message, check the random number of the fourth power wireless access point To prevent replay attacks, check the random number of the third power wireless terminal To confirm that it is the key negotiation request sent by itself; if the check passes, the following formula is used to calculate and use the first 128 bits of the result as the unicast key USK , and use the last 128 bits of the result as the multicast key MSK Encryption key MEK ; Then use MEK Ciphertext Decrypt it and get M_ID and MSK ; then power the wireless access point AP Send a key negotiation confirmation message, which includes the following formula: Power Wireless Access Point AP After receiving the key negotiation confirmation message, check the random number of the fourth power wireless access point To confirm that it is the key negotiation response sent by itself; check M_ID To confirm the key negotiation result; then, both parties start communicating using the controlled port.

19. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the power WLAN security reinforcement method based on trusted computing as claimed in any one of claims 1 to 10.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the power WLAN security reinforcement method based on trusted computing as claimed in any one of claims 1 to 10 is implemented.

Images