Authentication method and system based on Ksession shared session key MAC

Abstract

The invention relates to the technical field of information security, and discloses an authentication method and system based on a Ksession shared session key MAC, and the method comprises the steps: obtaining to-be-encrypted data in a power monitoring system, dividing the to-be-encrypted data into key data and real-time data, and encrypting the key data and the real-time data; the method comprises the following steps: dynamically generating a Ksession key by using an ECDH protocol and an identity-based IBC technology, generating a message authentication code by using the Ksession key, carrying out integrity and authenticity verification on data in transmission through the message authentication code, transmitting encrypted data through a TLS / SSL protocol, and destroying the Ksession key at the end of a session; a quantum security digital certificate is generated by fusing quantum key distribution and a quantum security signature algorithm, and verification of the digital certificate is realized through a multi-party verification mechanism. The quantum security technology and the advanced encryption theory are integrated, and qualitative leap is achieved in the aspects of identity authentication, data encryption, integrity verification and access control.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an authentication method and system based on Ksession shared session key MAC. Background Art

[0002] Existing encryption technologies such as AES and RSA are widely used in data protection, but in the resource-constrained power monitoring device environment, these algorithms may not be applicable due to their high computational costs.

[0003] Identity authentication and permission management: Traditionally, power monitoring systems use technologies such as username / password, digital certificates, and biometrics for identity authentication. In recent years, multi-factor authentication and role-based access control (RBAC) have become more popular to enhance system security and refine permission management.

[0004] KLEIN algorithm and lightweight encryption scheme: KLEIN is a lightweight encryption algorithm designed for resource-constrained environments and has been applied in the Internet of Things (IoT) and embedded systems. It provides relatively low computational complexity and storage requirements, making it possible to achieve efficient and secure communication in terminal devices of power monitoring systems. Although KLEIN itself is not as popular as AES, combined with the strong encryption capabilities of AES, it can constitute a complementary advantage, especially in processing large data streams and ensuring the security of data during transmission.

[0005] Session key management and dynamic key distribution: In existing security practices, the generation and management of dynamic session keys are crucial to protecting communication security. In the TLS / SSL protocol, the session key (Ksession) is established at the beginning of each session and is limited to that session to prevent the risk of key reuse. This mechanism can effectively prevent the decryption of historical data caused by long-term key leakage and improve the security of the system.

[0006] Message Authentication Code (MAC) and Integrity Verification: MAC is a data integrity verification mechanism and is often used in conjunction with encryption algorithms to ensure that data has not been tampered with during transmission. HMAC (hash-based message authentication code) is a widely used form that uses a hash function such as SHA-256 and a key to generate a MAC value. In the power monitoring system, calculating the MAC based on the Ksession shared session key can further ensure the authenticity and integrity of the source of the data, and provide protection even in the face of a man-in-the-middle attack (MITM). Summary of the invention

[0007] In view of the above-mentioned problems, the present invention is proposed.

[0008] Therefore, the technical problems solved by the present invention are: the balance of encryption performance under resource constraint environment, the contradiction between efficiency and security of session key management, and the enhanced verification of data integrity and authenticity.

[0009] To solve the above technical problems, the present invention provides the following technical solutions: an authentication method based on Ksession shared session key MAC, comprising: obtaining data to be encrypted in a power monitoring system, dividing the data to be encrypted into key data and real-time data and encrypting them; dynamically generating a Ksession session key using ECDH protocol and identity-based IBC technology, generating a message authentication code using the Ksession session key, verifying the integrity and authenticity of the data in transmission through the message authentication code, transmitting the encrypted data through the TLS / SSL protocol, and destroying the Ksession session key at the end of the session; generating a quantum-secure digital certificate by integrating quantum key distribution and a quantum-secure signature algorithm, and verifying the digital certificate through a multi-party verification mechanism.

[0010] As a preferred solution of the authentication method based on Ksession shared session key MAC described in the present invention, wherein: the key data and real-time data include, according to the sensitivity S and real-time R of data D, it is divided into key data D critical and real-time data realtime , for D critical , using an optimized AES variant, reducing computational latency through parallel processing and hardware acceleration technology; for D realtime ,The Klein algorithm uses the ARX structure and round function to quickly encrypt; for data that meets both key data and real-time data requirements, the AES-KLEIN fusion algorithm is used to divide the data into multiple blocks, the key data blocks are encrypted using AES, and the real-time data blocks are encrypted using Klein.

[0011] As a preferred solution of the authentication method based on Ksession shared session key MAC described in the present invention, wherein: the Ksession session key includes: at the beginning of communication establishment, the communicating parties exchange and negotiate parameters through a secure channel, and the participants A and B generate their own elliptic curve public keys PK respectively. A and PK B , together with their respective identifiers ID A and ID B The data is exchanged through a preset secure channel; protocol parameters are negotiated to determine the parameters p, a, b and base point G of the elliptic curve EC, and the hash function H and key derivation function F′ are selected.

[0012] As a preferred solution of the authentication method based on Ksession shared session key MAC described in the present invention, wherein: the Ksession session key also includes, the key negotiation stage integrates ECDH and IBC technology, A and B each independently generate a one-time random number N nonce1 and N nonce2 , using the ECDH protocol, A and B respectively calculate the temporary shared key K temp ; Through IBC technology, combined with K temp 、ID A 、ID B and the public parameters α and β in IBC, and apply the key derivation function F′ to derive the session key K session ; Using the newly generated K session A predefined message M is encrypted and sent to the other party for decryption verification; the update conditions of the session key are set, and when the update conditions are met, the key update is triggered. A and B repeat the key negotiation steps, generate a new session key, and destroy the old session key.

[0013] As a preferred solution of the authentication method based on Ksession shared session key MAC described in the present invention, the key negotiation phase includes: A and B execute the quantum key distribution protocol through the quantum channel, realize the unconditional secure transmission of quantum bits by means of the polarization state of photons, and generate preliminary key material S quantum ; Based on the quantum key material, both parties independently generate an asymmetric random number N once1 and N once2 , and exchanged through a preset classical secure channel; combining the quantum key material with the classical key derivation function F′, as well as the asymmetric random numbers of both parties, to generate the final session key K session :

[0014] K session =QKD Exchange (S quantum ,N once1 ,N once2 )+F′(K master ,N once1 ,N once2 )

[0015] Among them, QKD Exchange represents the complete exchange process of the quantum key distribution protocol; K master Indicates the pre-negotiated master key.

[0016] As a preferred solution of the authentication method based on Ksession shared session key MAC described in the present invention, the message authentication code includes, for the original plaintext P, using the quantum-safe encryption algorithm QuantumEncrypt, combined with quantum error correction coding technology, to generate encrypted data C:

[0017]

[0018] Among them, QEC(P) represents the result of quantum error correction encoding of the original plaintext PPP; the hash function is introduced, combined with the timestamp T and the authentication random number N auth , calculate the message authentication code:

[0019]

[0020] Among them, MAC represents a message authentication code; Indicates the use of session key K session Calculate the quantum hash message authentication code; convert the data packet structure {C, MAC, T, N auth} is sent to the receiver through an insecure channel, and the receiver first verifies the key material S quantum After the integrity is verified, K session Decrypt C to obtain P′ and verify the validity of MAC; the receiver performs quantum decryption operation:

[0021]

[0022] Check T and N auth To prevent replay attacks, if MAC verification fails, the preset anti-replay mechanism is immediately activated; after the session ends, a destruction instruction is generated using a quantum random number generator to irreversibly destroy the quantum enhanced key and all copies.

[0023] As a preferred solution of the authentication method based on Ksession shared session key MAC described in the present invention, wherein: the digital certificate includes, in the issuance process of the digital certificate, introducing the quantum key generated by QKD, and calculating the summary value of the quantum key through the quantum secure summary algorithm QHash; the certification body uses the signature algorithm QSign based on the quantum security principle to sign the device information DI, the device public key DP and the quantum key summary QH to generate a quantum secure digital certificate; the verification of the digital certificate is no longer limited to a single certification body, but is completed by multiple trusted nodes in a distributed network. Each trusted node holds part of the quantum key information and participates in the quantum consensus process; the definition of the quantum consensus algorithm integrates the quantum key information of multiple trusted nodes and the quantum key summary QH of the digital certificate. When a sufficient number of trusted nodes reach a consensus, the certificate is considered valid.

[0024] An authentication system based on Ksession shared session key MAC adopting any of the methods described in the present invention, wherein: a power measurement and control data encryption module obtains data to be encrypted in a power monitoring system, divides the data to be encrypted into key data and real-time data according to sensitivity and real-time performance, and performs encryption processing through an encryption algorithm; a Ksession key module dynamically generates a Ksession session key using an ECDH protocol-based and identity-based IBC technology, introduces a quantum-safe hash function and a key update mechanism assisted by quantum key distribution, realizes theoretically unconditionally secure key exchange, generates a message authentication code, and destroys the quantum key and all copies at the end of the session; an identity authentication module generates a quantum-safe digital certificate by integrating quantum key distribution with a quantum-safe signature algorithm, and realizes verification of the digital certificate through a multi-party verification mechanism.

[0025] A computer device comprises: a memory and a processor; the memory stores a computer program, comprising: the steps of implementing any one of the methods of the present invention when the processor executes the computer program.

[0026] A computer-readable storage medium stores a computer program, comprising: when the computer program is executed by a processor, the steps of implementing any one of the methods of the present invention are implemented.

[0027] Beneficial effects of the present invention: The method of the present invention adopts the AES-KLEIN-ABC hybrid encryption technology, which not only provides high-intensity data protection, but also achieves an optimized balance between processing efficiency and resource consumption. In the AES-KLEIN-ABC hybrid encryption strategy, the use of the KLEIN algorithm reflects the flexibility and dynamism of the strategy, and the encryption strategy can be automatically adjusted according to the system status. The dynamic key management mechanism based on Ksession not only improves the key security to the theoretical unconditional security level, but also enhances the reliability and integrity protection of data transmission through quantum error correction coding and quantum security authentication protocol. By integrating quantum security technology and advanced encryption theory, the present invention has achieved a qualitative leap in identity authentication, data encryption, integrity verification and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0029] Figure 1An overall flow chart of an authentication method based on Ksession shared session key MAC provided by an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of an authentication method based on Ksession shared session key MAC provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0032] Example 1, reference Figure 1 and Figure 2 , as an embodiment of the present invention, provides an authentication method based on Ksession shared session key MAC, the method comprising the following steps S1 to S3:

[0033] In S1: the data to be encrypted in the power monitoring system is obtained, and the data to be encrypted is divided into key data and real-time data and encrypted.

[0034] In S2: The Ksession session key is dynamically generated using the ECDH protocol and identity-based IBC technology. The Ksession session key is used to generate a message authentication code. The integrity and authenticity of the data in transmission are verified using the message authentication code. The encrypted data is transmitted via the TLS / SSL protocol. At the end of the session, the Ksession session key is destroyed.

[0035] In S3: By integrating quantum key distribution and quantum secure signature algorithm, a quantum secure digital certificate is generated, and the digital certificate is verified through a multi-party verification mechanism.

[0036] Among them, obtaining the data to be encrypted in the power monitoring system includes continuously monitoring the power system data flow, covering multiple key indicators such as current, voltage, and power.

[0037] Furthermore, the specific steps of dividing the data to be encrypted into key data and real-time data and encrypting them are:

[0038] (1) Data classification and dynamic encryption selection

[0039] According to the sensitivity S and real-time R of data D, it is divided into key data D critical and real-time datarealtime , introduce a decision function It dynamically selects the most suitable encryption algorithm based on the characteristics of the data and the system state parameter Θ. The system state parameter Θ includes data sensitivity S, real-time requirement R, device resource status D, and network status N, which can be expressed as:

[0040]

[0041] Among them, τ s and τ r They are the predefined sensitivity threshold and real-time threshold respectively.

[0042] (2) Optimization and integration of encryption algorithms

[0043] For D critical , using an optimized AES variant to reduce computing delays through parallel processing and hardware acceleration technology.

[0044] For D realtime ,The Klein algorithm achieves fast encryption while maintaining sufficient security through efficient ARX structure and streamlined round function.

[0045] For data that meets both critical data and real-time data requirements, a novel encryption method is adopted, namely the AES-KLEIN fusion algorithm, which combines the strength of AES and the efficiency of Klein. In specific implementation, the data is divided into multiple blocks, the sensitive blocks are encrypted using AES, and the real-time blocks are encrypted using Klein.

[0046] (3) Key management and policy functions

[0047] Adopt dynamic key update mechanism to ensure K AES and K KLEIN The key update strategy λ adaptively adjusts the update frequency according to the statistical characteristics of the data stream.

[0048]

[0049]

[0050] Policy Function Design: Policy Function The decision logic of is based on a multi-objective optimization framework, which considers the comprehensive trade-offs among data security, processing efficiency and resource consumption. Among them, Cα(S) represents the cost of algorithm α under a given sensitivity S, E α (R) represents the processing efficiency under the real-time requirement R, R α (D) represents the resource consumption of the device in resource state D. λ1, λ2, and λ3 are adjustable weight coefficients.

[0051] Secure channel: The encrypted data C is transmitted through a secure communication protocol based on TLS / SSL, ensuring the integrity and confidentiality of the data during transmission.

[0052] Integrity verification: The receiving end uses HMAC or MAC algorithm and decryption algorithm Combined, verify the integrity of the data and the authenticity of the source.

[0053]

[0054] In one embodiment, the method of dynamically generating the Ksession session key using the ECDH protocol and the identity-based IBC technology also includes introducing a composite key derivation function F' based on ECDH and IBC to enhance the security and complexity of key negotiation. The function combines the classic Diffie-Hellman protocol with identity-based cryptography (IBS) to form a more powerful key generation engine:

[0055] K session =F′(K master ,N nonce1 ,N nonce2 ,ID A ,ID B ,α,β)

[0056] Among them, K master is the pre-shared master key; N nonce1 and N nonce2 Is a one-time random number; ID A and ID B is the participant identifier; α and β are public parameters in IBC; F′ is a composite function that combines the ECDH protocol with the IBC key derivation function.

[0057] Specifically, the internal working principle of F′ is as follows:

[0058] 1. ECDH exchange: Using the discrete logarithm problem on the elliptic curve, both parties select secret integers a and b based on the shared elliptic curve parameters P and the generator point G, calculate aG and bG, and exchange these public values:

[0059] K temp =a(bG)=b(aG)

[0060] 2. IBC key derivation: based on K temp and identity ID, derive the final session key K through IBC technology session :

[0061] K session =H(K temp ||IDA ||ID B ||sk A ||sk B )

[0062] Where H is a secure hash function used to ensure that the output key length is consistent. The private key sk of IBC i Based on the identity ID i And system parameters α, β are generated.

[0063] The key update mechanism uses a time or event-driven approach, combined with forward security features, to ensure that even if past session keys are leaked, it will not affect the security of future communications. The update formula is expressed as:

[0064]

[0065] Among them, T update The timestamp or event marker representing the key update ensures that each update has new randomness and uniqueness. To enhance security, the update process is combined with entropy injection to obtain additional randomness through the environmental noise collector E.

[0066]

[0067] in, Indicates the old key before the update; Indicates the new key after update.

[0068] The core process is expressed as:

[0069] (1) Initialization phase: security parameters and identity authentication

[0070] At the beginning of communication, both parties need to exchange and negotiate a series of necessary parameters through a secure channel. This stage involves the following key steps:

[0071] 1. Public key and identity ID exchange: Participants A and B generate their own elliptic curve public key PK respectively A and PK B , together with their respective identifiers ID A and ID B The exchange is carried out through a preset secure channel.

[0072] 2. Protocol parameter negotiation: Determine the parameters p, a, b and base point G of the elliptic curve EC, and select the appropriate hash function H and key derivation function F'.

[0073] (2) Key negotiation: innovation combining ECDH and IBC

[0074] The key negotiation phase combines ECDH and IBC technologies to ensure the security and uniqueness of the key.

[0075] 1. Random number generation: A and B each independently generate a one-time random number N nonce1 and N nonce2 .

[0076] 2. Temporary shared key calculation: Using the ECDH protocol, A and B calculate the temporary shared key K respectively temp :

[0077] K temp =a(bG)=b(aG)=K temp

[0078] Where a and b are the secret integers of A and B respectively.

[0079] 3.IBC key derivation: Through IBC technology, combined with K temp 、ID A 、ID B and public parameters α, β, and apply the composite key derivation function F′ to derive the session key K session

[0080] K session =F′(K temp ,ID A ,ID B ,α,β)

[0081] The realization of F' can be further refined as follows:

[0082] K session =H(H(K temp )H(ID A ||α)H(ID B ||β))

[0083] (3) Key confirmation and integrity verification:

[0084] Both parties use the newly generated K session Encrypt a predefined message M and send it to the other party for decryption verification to ensure that the key is correct.

[0085] C=E(K session ,M)

[0086] M′=D(K session ,C)

[0087] Among them, E represents the encryption function; D represents the decryption function.

[0088] (4) Dynamic update:

[0089] To ensure the forward security of the system, an event-triggered key renewal mechanism is designed, which automatically triggers the key regeneration process under certain conditions. 1. Event detection: The system continuously monitors specific events, such as the arrival of a time interval, the end of a session, or a security alarm. 2. Key renewal: Once the trigger condition is met, both parties repeat the key negotiation steps to generate a new session key. 3. Safely discard old keys: Ensure that old keys Completely destroyed to prevent potential key reuse attacks.

[0090] (5) Termination stage: secure destruction and information non-traceability

[0091] After the session ends, a comprehensive key destruction process is performed, including but not limited to K sesssion 、N nonce1 、N nonce2 , and other related sensitive data are cleared to ensure the absolute confidentiality of communication history.

[0092] In one embodiment, the use of the Ksession session key to generate a message authentication code and verifying the integrity and authenticity of the data in transmission through the message authentication code also includes integrating cutting-edge technologies such as quantum key distribution, quantum secure hashing, and quantum error correction coding, which significantly enhances the scientific nature and high-end characteristics of dynamic key management and MAC calculations, providing an unprecedented level of security protection for data communications.

[0093] In order to improve security and complexity, quantum secure hash functions (such as lattice-based hash functions GHash or hash functions SHA-3) and quantum key distribution (QKD)-assisted key update mechanisms are introduced to deepen the use of Ksession and the MAC calculation process. The MAC calculation formula is adjusted to:

[0094]

[0095] Among them, QHMAC is a hash message authentication code algorithm that integrates quantum security features; Ciphertext is the encrypted data; Timestamp maintains the timestamp to combat replay attacks, and the newly added Nonceauth is an authentication random number generated each time a data packet is sent, further enhancing anti-tampering capabilities.

[0096] In addition to traditional ECDH, the key negotiation phase incorporates quantum key distribution protocols (such as the BB84 protocol) to achieve theoretically unconditionally secure key exchange:

[0097] K session =QKD E xchange(Nonce1,Nonce2)+F'(K master,Nonce1,Nonce2)

[0098] In this formula, QKD_Exchange represents the exchange process of the quantum key distribution protocol, which is combined with the output of the classical key derivation function F′ to ensure that the key has both quantum security characteristics and can adapt to traditional network environments.

[0099] Implementation process:

[0100] (1) Quantum-secure key negotiation

[0101] Quantum key material generation: Both parties execute the BB84 protocol through the quantum channel, using the polarization state of photons to achieve unconditional secure transmission of quantum bits and generate preliminary key material S quantum .

[0102] Asymmetric random number exchange: Based on the quantum key material, both parties independently generate an asymmetric random number N once1 and N once2 , and exchanged through a preset classic secure channel.

[0103] Quantum and classical key fusion: Combine quantum key material with classical key derivation function F′ and asymmetric random numbers of both parties to generate the final session key K session :

[0104] K session =QKD Exchange (S quantum ,N once1 ,N once2 )+F′(K master ,N once1 ,N once2 )

[0105] Among them, QKD Exchange represents the complete exchange process of the quantum key distribution protocol; K master Indicates the pre-negotiated master key.

[0106] (2) Advanced Data Encapsulation and MAC Calculation

[0107] Quantum encryption and error correction coding: For the original plaintext P, the quantum-safe encryption algorithm QuantumEncrypt is used, combined with quantum error correction coding technology to generate the encrypted data C:

[0108]

[0109] Quantum Hash Message Authentication Code (QHMAC): Introduces a quantum-safe version of the lattice-based hash function GHash or SHA-3, combined with a timestamp T and an authentication random number N auth , calculate MAC

[0110]

[0111] Among them, MAC represents a message authentication code; Indicates the use of session key K session Computed quantum hash message authentication code; ∥ represents a string concatenation operation.

[0112] (3) Secure transmission and enhanced authentication

[0113] The data packet structure {C, MAC, T, N auth} is sent to the receiver through an insecure channel, and the receiver first verifies the key material S quantum After the integrity is verified, K session Decrypt C to get P′ and verify the validity of MAC to ensure that the data has not been tampered with.

[0114] (4) Precision data processing and replay protection

[0115] The receiver performs quantum decryption operations:

[0116]

[0117] And check T and N auth To prevent replay attacks.

[0118] Anti-replay mechanism: If MAC verification fails, the anti-replay mechanism is immediately activated, which may include policies such as key update, security audit or packet discard.

[0119] (5) Quantum-enhanced key destruction and session management

[0120] After the session ends, a quantum random number generator is used to generate a destruction instruction to ensure that K session and all its copies are irreversibly destroyed.

[0121] Implement a quantum-safe logging mechanism to track the entire lifecycle of keys and strengthen system compliance and traceability.

[0122] In one embodiment, the generation of quantum-safe digital certificates also includes an enhanced PKI and digital certificate mechanism, which integrates quantum key distribution (QKD) and quantum-safe signature algorithms to build an enhanced identity authentication system that resists quantum computing threats. This system not only improves the security of digital certificates, but also introduces a multi-party verification mechanism, significantly enhancing the overall resilience and credibility of the system.

[0123] Introducing quantum security elements and adopting a hybrid authentication mode assisted by quantum key distribution (QKD), the mathematical expression is upgraded to:

[0124] CA signature =QSign CAprv (DeviceInfo+DevicePubKey+QKey exchange )

[0125] Among them, QSign CAprv Indicates the exchange of device information, public key and quantum key information QKey based on quantum secure signature algorithm exchange Signing enhances the anti-attack capability of the traditional PKI system.

[0126] (1) Quantum Key Integration Authentication

[0127] Quantum key summary generation: In the process of issuing digital certificates, the quantum key QK generated by QKD is introduced, and its summary value QH is calculated by the quantum secure summary algorithm QHash:

[0128] QH=QHash(QK)

[0129] Quantum-safe signature: The certification authority (CA) uses the signature algorithm QSign based on the quantum-safe principle to sign the device information DI, the device public key DP, and the quantum key summary QH to generate a quantum-safe digital certificate Cert Q :

[0130] Cert Q =CA signature =QSign CAprv (DI+DP+QH)

[0131] Among them, CAprv is the private key of the certification authority.

[0132] (2) Multi-party verification extension

[0133] Distributed consensus mechanism: digital certificate Cert Q The verification is no longer limited to a single certification authority, but is completed by multiple trust nodes TN in a distributed network. Each trust node holds part of the quantum key QK i information to participate in the consensus process.

[0134] Define the quantum consensus algorithm QCAlg, which integrates the quantum key information of multiple trusted nodes and the digital certificate Cert Q The quantum key digest QH ensures that a certificate is considered valid only when a sufficient number of trusted nodes agree:

[0135] QCAlg(QK1,QK2,...,QK n ,Cert Q )→Validity

[0136] Among them, Validity is the validity mark of the certificate.

[0137] Furthermore, the quantum enhanced key exchange algorithm is introduced, and QChannelParams represents the transmission parameters of the QKD channel, ensuring that quantum communication can be used to improve the confidentiality of key negotiation even on the basis of traditional RSA / ECDHE.

[0138] K session

[0139] =QKD E nhanced K eyExchangeAlg(DeviceAprv,DeviceBpub,QChannelParams)

[0140] An encryption method that integrates quantum random numbers, timestamps, and one-time random numbers is used to improve the anti-replay capability and encryption strength of data packets.

[0141] EncryptedMsg=QuantumSecureEncrypt(K session ,Data||Timestamp||Nonce)

[0142] The quantum secure hash function QHMAC is introduced in combination with the geographic location ID LocationID to enhance data integrity verification while preventing geographic location-related attacks.

[0143]

[0144] Fusion of Attribute-Based Access Control (ABAC) and Quantum-Enhanced RBAC

[0145] Allow(subject,action,object)

[0146] =Λ ABAC (SubjectAttributes,ActionAttributes,ObjectAttributes,QSecurityLevel)·RBAC(Role(subject),Permissions(action))

[0147] Among them, Λ ABAC It is a comprehensive evaluation function based on the subject, action, object attributes and quantum security level QSecurityLevel. Combined with the RBAC model, it forms a multi-dimensional dynamic authorization mechanism. While ensuring fine-grained access control, it introduces the quantum security dimension to improve the intelligence and security of decision-making.

[0148] On the other hand, this embodiment also provides an authentication system based on the Ksession shared session key MAC, which includes: an electric power measurement and control data encryption module, which obtains the data to be encrypted in the electric power monitoring system, divides the data to be encrypted into key data and real-time data according to sensitivity and real-time performance, and encrypts the data through an encryption algorithm; a Ksession key module, which uses the ECDH protocol and identity-based IBC technology to dynamically generate the Ksession session key, introduces a quantum-safe hash function and a key update mechanism assisted by quantum key distribution, realizes theoretically unconditionally secure key exchange, and generates a message authentication code, and destroys the quantum key and all copies at the end of the session; an identity authentication module, which generates a quantum-safe digital certificate by integrating quantum key distribution with a quantum-safe signature algorithm, and verifies the digital certificate through a multi-party verification mechanism.

[0149] Example 2

[0150] This embodiment shows in detail an encryption and authentication solution for power monitoring systems, integrating AES-KLEIN-ABC hybrid encryption, Ksession-based dynamic key management, quantum security identity authentication, and multi-dimensional dynamic access control technology. This embodiment shows the entire process from data processing, encryption, authentication to access control, and deeply integrates quantum security technology and advanced encryption algorithms. This solution aims to ensure the transmission security of power monitoring data, the reliability of identity authentication, and the sophistication of access control through advanced encryption methods and quantum security features, meeting the high standards for security and efficiency of modern power systems.

[0151] AES-KLEIN-ABC hybrid encryption implementation:

[0152]

[0153] Where C is the ciphertext; P is the plaintext; θ = (S, R, D) is the system state parameter; and Represents encryption operations using AES and Klein algorithms respectively; Represents an exclusive-or operation, which is used to combine the results of two encryption algorithms and is applicable to data under certain conditions to achieve a higher balance between security and efficiency.

[0154] Dynamic key management based on Ksession:

[0155]

[0156] Among them, F' (t)is the key update function at a specific time t, taking into account the change of the timestamp Tupdate to enhance forward security.

[0157] This function combines the original session key New random number and and participant ID A and ID B , using an advanced combination of IBC technology and ECDH protocol to achieve dynamic key updates.

[0158] Quantum-safe authentication and access control implementation:

[0159] CA signature =QSign CAprv (DeviceInfo+DevicePubKey+QKey exchange +LocationID)

[0160] Allow

[0161] =Λ ABAC (SubjectAttributes,ActionAttributes,ObjectAttributes,QSecurityLevel)·RBAC(Role(subject),Permissions(action))·Ω QGeo (LocationID)

[0162] The location ID LocationID is introduced into the quantum security signature and access control strategy, where Ω QGeo It is an evaluation function based on geographic location security, which ensures that access requests not only comply with the traditional ABAC-RBAC model, but also must undergo quantum secure geographic verification, further enhancing the security and logical rigor of the system.

[0163] Furthermore, the specific implementation process includes:

[0164] 1. Data preprocessing and classification

[0165] 1. Data collection and multi-dimensional feature extraction

[0166] Real-time monitoring and multi-variable acquisition: Continuously monitor the power system data flow, covering multiple key indicators such as current I(t), voltage V(t), power P(t), etc.

[0167] Introducing a more complex quantization model S i =g(I i ,V i ,P i; θ), where θ is a model parameter, representing a weight matrix learned based on physical quantity thresholds, safety impact assessments, and historical data. The model is trained through a deep neural network (DNN) and can automatically adjust weights to adapt to sensitivity grading in different scenarios.

[0168] S i =g(I i ,V i ,P i ; θ) = σ(W T [I i ,V i ,P i ]+b)

[0169] Among them, σ is the activation function, W and b are the weight matrix and bias vector respectively.

[0170] Real-time demand analysis: Adopt dynamic time window adjustment strategy, according to data update frequency Δt i , through the nonlinear mapping function h(Δt i ; α) Calculate the real-time index R i , where α is the adjustment coefficient, reflecting the trade-off between data timeliness and system response speed, and the real-time index R i It is expressed as:

[0171]

[0172] Wherein, μ is the average value of data update frequency.

[0173] Comprehensive evaluation of equipment resource status: Introducing multi-factor fusion analysis and evaluating equipment resource status through fuzzy logic system (FLS) j , consider the equipment load Load j Memory usage j 、CPU utilizationCPU j And other multi-dimensional indicators, expressed as:

[0174]

[0175] Among them, L max 、M max and C max These are the maximum thresholds for device load, memory usage, and CPU utilization, respectively.

[0176] Implementation process:

[0177] (1) Real-time data stream capture and preprocessing

[0178] An array integrating multiple sensor technologies is used, including current transformers, voltage transformers, temperature sensors, vibration sensors, etc., to achieve all-round monitoring of dynamic changes in current I(t), voltage V(t)), power P(t), temperature T(t), vibration amplitude A(t), etc. in the power system.

[0179] X(t)=[I(t),V(t),P(t),T(t),A(t)]

[0180] (2) Multi-dimensional feature extraction and quantification

[0181] Digital signal processing technology is used to remove noise, smooth signals, and standardize data formats to prepare for subsequent analysis. Sensitivity quantification model: Based on the deep learning model g, the input is pre-processed power system dynamic data, and the output is the sensitivity level S i , reflecting the importance of data and the sensitivity of anomaly detection.

[0182] S i =g(X i ; W g ,b g )

[0183] Among them, W g and b g are the weight matrix and bias vector of the model respectively.

[0184] Equipment resource status assessment: Introducing the fuzzy logic system φ, comprehensively considering the equipment load Load j Memory usage j 、CPU utilizationCPU j Evaluate the real-time resource status of the equipment based on factors such as j :

[0185] D j =φ(Load j ,Memory j ,CPU j ; W φ ,b φ )

[0186] Among them, W φ and b φ are the weight and bias parameters of the fuzzy logic system.

[0187] (3) Balance between real-time performance and effectiveness

[0188] Adopting the adaptive time window mechanism, according to the real-time demand index R i Dynamically adjust the time window size for data processing to ensure the timeliness and efficiency of data processing.

[0189]

[0190] Through the nonlinear mapping function h, the data update frequency Δt i Transformed into real-time demand index R i , reflecting the real-time processing requirements of data:

[0191] R i =h(Δt i ;α)=exp(-αΔt i )

[0192] Among them, α is the adjustment coefficient.

[0193] (4) Anomaly detection and classification

[0194] Using the quantized sensitivity level S i , real-time demand index R i and device resource status D j , combined with support vector machine (SVM) or other machine learning algorithms, an anomaly detection model is constructed to achieve early warning and classification of power system faults. The support vector machine (SVM) model is expressed as:

[0195]

[0196] in, is the anomaly detection result, W SVM and b SVM are the weight and bias parameters of the SVM model.

[0197] 2. Dynamic Key Generation and Update

[0198] Ksession dynamic evolution model: given the current time t, the master key K m aster, both parties' identity ID A With ID B , random number N n once1 (t) and N n once2, weight factors α and β, and timestamp t define the dynamic key K s ession (t) The generation and update function F (t) as follows:

[0199]

[0200] Among them, F (t) Specifically, it can be expressed as:

[0201]

[0202] Among them, ECDH (K master ,ID A ,ID B ) represents the elliptic curve Diffie-Hellman protocol, using K master and the IDs of both parties A With ID B The generated shared key; H represents a secure hash function, which is used to enhance the irreversibility and randomness of the key; α and β are preset weight factors that control the random number and The degree of impact on the final key; t is the current timestamp, which ensures the timeliness and dynamic update characteristics of the key.

[0203] 3. Encryption and MAC Calculation

[0204] Consider the data classification result θ i =9S i ,R i ,D j ), where S i Indicates the sensitivity level, R i Indicates the importance level, D j Indicates the data distribution domain.

[0205] (1) Deepening the application of AES encryption algorithm

[0206] When S i =3 or S i ≤2 and D j ≥2, the AES encryption algorithm is used to encrypt the plaintext P i Encrypt and get the ciphertext C i .

[0207] To increase encryption strength, we combine the AES encryption algorithm with a key exchange protocol based on elliptic curves to form a composite encryption layer. The encryption process is:

[0208]

[0209] in, represents an encryption function; Indicates bitwise XOR operation; K AES Indicates the key used for AES encryption; K EC Represents a key based on the Elliptic Curve Digital Signature Algorithm (ECDSA), which is used to enhance the security and unpredictability of the key.

[0210] (2) Klein encryption algorithm

[0211] When S i ≤2 and R i =3 and D j=3, use the Klein encryption algorithm to encrypt the plaintext P i encryption.

[0212] In order to improve the encryption effect, we combine the Klein encryption algorithm with a lattice-based cryptography technology to form a composite encryption scheme. The encryption process is:

[0213]

[0214] Among them, K KLEIN is the key used by Klein encryption, K LWE It is a key based on the Learning With Errors (LWE) problem, which is used to increase the quantum resistance of encryption.

[0215] (3) Composite encryption strategy

[0216] For other cases that do not meet the above two conditions, the plaintext P is encrypted using the XOR operation of AES and Klein encryption. i .

[0217] In order to further improve security, we added identity-based encryption (IBE) and multilinear mapping (MultilinearMaps) technology on this basis to form a multi-layer encryption protection. The encryption process is expressed as:

[0218]

[0219] Among them, K IBE is the key used for identity-based encryption, K MM It is the key used for encryption based on multilinear mapping.

[0220] (4) Quantum-secure MAC computing

[0221] In order to enhance data integrity and tamper resistance, we introduce quantum secure hash message authentication code (QHMAC) and deepen it to enable it to cope with higher-level security challenges. The quantum secure MAC calculation formula is as follows:

[0222]

[0223] in, It is a session key that is dynamically updated over time. Its generation process is based on a novel time series prediction algorithm to ensure the randomness and unpredictability of the key. is a quantum-safe hash function used to calculate the ciphertext C i The hash value of T enhances the robustness of MAC calculation; τ Is a timestamp conversion function used to convert the original timestampi Convert it into a form that is difficult to reverse analyze by quantum computing, increasing the security of the timestamp; It is an authentication random number generated for each data packet. Its generation mechanism is based on a quantum random number generator to ensure the true randomness and quantum security of the random number.

[0224] 4. Quantum Safety Certification

[0225] (1) Generation of quantum key digest

[0226] The generation process of quantum key summary adopts cascade operation and advanced quantum network topology (Advanced Quantum Network Topology, AQNT), combined with dynamic quantum entanglement optimization algorithm (Dynamic Quantum Entanglement Optimization Algorithm, DQEOA). This algorithm can dynamically adjust the distribution order and entanglement strength of quantum keys according to the real-time status of quantum nodes in the network and the stability of quantum channels, forming a highly complex quantum key network, expressed as:

[0227]

[0228] in, It is an N-cascaded quantum-safe hash function; It is an N-cascade dynamic quantum entanglement optimization algorithm; Λ is a dynamic adjustment function of the entanglement strength between quantum keys.

[0229] (2) Generation of digital certificate enhanced signature

[0230] The generation process of the digital certificate enhanced signature adopts the Deep Quantum Learning Signature Algorithm (DQLSA), which combines quantum deep neural network and quantum reinforcement learning to achieve quantum-level unforgeability of the signature. The expression is:

[0231]

[0232] in, Represents a signature enhancement function based on deep quantum learning, which is used to improve the robustness and resistance to quantum attacks of the signature.

[0233] (3) Verification of digital certificate validity

[0234] The validity verification process of the digital certificate involves the quantum state reconstruction algorithm (Quantum State Reconstruction Algorithm, QSRA) and the quantum signature verification algorithm (Quantum Signature Verification Algorithm, QSV Algorithm), which ensures the integrity and authenticity of the signature through multi-step quantum calculations.

[0235]

[0236] The generation and verification process of quantum hash message authentication codes, as well as the creation and verification process of quantum geographic tags, are combined through the Quantum Fusion Algorithm (QFA) to form a more complex quantum verification framework that enhances the integrity and geographic origin verification of data packets. The expression is:

[0237]

[0238] The verification process of the dynamic quantum signature adopts the dynamic quantum signature verification algorithm (Dynamic Quantum Signature Verification Algorithm, DQSV Algorithm) to ensure the continuity and tamper-proofness of the data packet during transmission.

[0239]

[0240] (4) Quantum state destruction and audit

[0241] The quantum state destruction process is carried out through the Deeply Optimized Quantum Destruction Algorithm (DOQDA), which ensures the complete destruction of the quantum key and avoids any information residue. The expression is:

[0242]

[0243] (5) Adaptive adjustment mechanism

[0244] The adaptive adjustment mechanism dynamically adjusts the quantum random number sequence R according to the current threat model and system performance. (t) and S (t) The length of , as well as the strength of quantum state perturbation and verification function, ensures the adaptability and flexibility of the quantum security authentication framework, expressed as:

[0245]

[0246] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0247] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0248] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0249] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0250] Example 3

[0251] As an embodiment of the present invention, an authentication method based on Ksession shared session key MAC is provided. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through smart grid application.

[0252] In the smart grid scenario, high-speed data transmission and security are crucial. The AES-KLEIN-ABC hybrid encryption strategy can adopt the optimal encryption scheme for different data types. AES encryption is used to protect core data such as grid load adjustment instructions to ensure the highest security of control information; at the same time, the KLEIN algorithm is used to quickly encrypt a large amount of real-time monitoring data (current and voltage measurements) to optimize transmission efficiency while maintaining data security. The communication-intensive characteristics of the smart grid require efficient and secure key management. The dynamic key management mechanism based on Ksession, combined with quantum security technology, realizes instant key update and high security to meet the needs of high-frequency data exchange. In addition, the integration of enhanced PKI and quantum security elements improves the strictness of device access authentication, effectively resists external threats, and ensures the safety of the automated monitoring, fault detection and energy management functions of the smart grid. This technical solution builds a highly intelligent, secure and efficient smart grid data protection system by deepening the scientificity and complexity of encryption algorithms, key management, data processing and authentication access control. Its unique integration of ABC mode encryption strategy and quantum security technology not only improves the speed and security of data processing, but also provides an unprecedented protection barrier for the automated monitoring, fault detection, energy management and other functions of smart grids, fully demonstrating the innovation and practicality of the invention patent.

[0253] 1. AES-KLEIN-ABC hybrid encryption algorithm

[0254] AES encryption part: core data D c The encryption of the load adjustment instructions (such as power grid load adjustment instructions) uses the AES algorithm, where K AES Represents an AES key:

[0255]

[0256] Introduce a dynamic encryption strength adjustment mechanism based on the sensitivity and real-time requirements of the data:

[0257]

[0258] Among them, H represents a secure hash function, S, R, and D represent the sensitivity of the data, real-time requirements, and device resource status, respectively. This adjustment mechanism ensures the dynamic adaptability of encryption strength.

[0259] KLEIN encryption part: real-time monitoring data D r The encryption of (current and voltage measurement values) uses the KLEIN algorithm, K KLEIN Key for KLEIN:

[0260]

[0261] To enhance security, the key length of the KLEIN algorithm is dynamically adjusted according to the real-time requirements of the data:

[0262] K KLEIN =Resize(K KLEIN ,r×128)

[0263] The Resize function is used to adjust the key length, and r is the real-time requirement coefficient.

[0264] ABC mode fusion algorithm: In order to dynamically determine the encryption method, the policy function f is introduced to achieve intelligent adaptability of the encryption strategy based on data sensitivity S, real-time requirements R and device resource status D:

[0265] C=f(D,S,R,K AES ,K KLEIN )

[0266] Among them, f can be implemented through deep reinforcement learning algorithms to ensure the intelligence and flexibility of encryption strategies. Furthermore, the decision process of f can be designed as a multi-objective optimization problem to consider the balance between encryption strength, computing cost and real-time requirements:

[0267]

[0268] Among them, Cost represents the cost function of the encryption operation.

[0269] 2. Deepening of the dynamic key management algorithm based on Ksession

[0270] Key negotiation: In combination with quantum security technology, key management adopts the following model:

[0271] Ksession =F'(K master ,N nonce1 ,N nonce2 ,ID A ,ID B ,α,β)

[0272] Among them, F' is a key derivation function that combines ECDH and IBC technologies, which enhances the security and complexity of key negotiation. In order to further improve security, F' is designed as a hierarchical function, which contains multiple sub-functions:

[0273]

[0274] Among them, F'1, F'2, and F'3 are responsible for quantum entropy injection, classical entropy mixing, and key strength adjustment, respectively.

[0275] Key update: using time or event driven mechanism:

[0276]

[0277] In order to ensure the forward security of the key and enhance the unpredictability of the key through quantum random numbers, F' introduces a time-based dynamic entropy update mechanism:

[0278]

[0279] Among them, Q entropy represents the quantum entropy function, which depends on the timestamp T update .

[0280] 3. Implement core processes

[0281] (1) Data classification and intelligent strategy selection model:

[0282] Data item i According to its sensitivity SensitivityThreshold and timeliness requirement, it is classified into the sensitive category SensitiveClass i The policy function f dynamically selects the most suitable encryption algorithm AlgorithmChoice based on the classification results and the pre-set encryption policy matrix EncryptionPolicyMatrix. j :

[0283] SensitiveClass i =

[0284] Categorize(Data i;SensitivityThreshold,TimelinessRequirement)

[0285] AlgorithmChoice j =f(SensitiveClass i ;EncryptionPolicyMatrix)

[0286] Realize intelligent customization of strategies to ensure the efficiency and security of data processing. In order to further enhance the intelligence of strategies, f is designed as a machine learning-based model to optimize encryption strategies through historical data training:

[0287]

[0288] Among them, P(AlgorithmChoice j |Data i ) represents a given data item Data i AlgorithmChoice j probability.

[0289] (2) Dual-track key management and dynamic generation:

[0290] Combining the quantum key material generated by the quantum key distribution protocol (such as BB84) with the classical key material generated by the traditional elliptic curve Diffle-Hellman (ECDH) protocol, through the advanced key derivation function F':

[0291] InitialKeyMaterial = BB84 P rotocol()∪ECDH K eyExchange( )

[0292] K session =F'(InitialKeyMaterial;QuantumEntropy,ClassicalEntropy)

[0293] Integrate quantum entropy and classical entropy to generate a highly secure session key K session , realizing dynamic generation and distribution of keys, significantly improving the security and efficiency of key management.

[0294] In order to further improve the randomness of the key, F' is designed as an entropy mixer based on deep learning, which optimizes the entropy mixing strategy through training:

[0295]

[0296] Among them, P QuantumEntropy and P ClassicalEntropy They represent the probability distribution of quantum entropy and classical entropy respectively, and KL-Divergence represents KL divergence, which measures the difference between two probability distributions.

[0297] (3) Advanced data protection and integrity verification:

[0298] Using the session key K session , encrypt the plaintext and calculate the quantum secure hash message authentication code QHMAC at the same time, covering the encrypted data, timestamp Timestamp and authentication random number Nonce auth , significantly enhancing the integrity verification and anti-tampering capabilities of data packets:

[0299]

[0300]

[0301] To further enhance the security of MAC, QHMAC is designed as a deep learning-based model that optimizes the MAC generation strategy through training:

[0302] QHMAC=argmin QHMAC FalsePositiveRate(QHMAC)

[0303] Among them, FalsePositiveRate represents the false positive rate, which measures the probability of MAC error verification.

[0304] (4) Secure transmission and multi-dimensional authentication:

[0305] The secure data packet contains encrypted content, quantum secure MAC, timestamp and authentication random number, and is transmitted over the public network. The receiver performs MAC verification to ensure that the data has not been tampered with and correctly decrypts the data, achieving dual protection of secure transmission and authentication:

[0306] SecurePacket=(EncryptedData,MAC,Timestamp,Nonce auth )

[0307]

[0308] To further improve the robustness of authentication, VerifyMAC is designed as a deep learning-based model that optimizes authentication strategies through training:

[0309] VerifyMAC=argmax VerifyMACTruePositiveRate(VerifyMAC)

[0310] Among them, TruePositiveRate represents the true positive rate, which measures the probability of correctly verifying the MAC.

[0311] (5) Enhanced identity authentication and quantum secure access control:

[0312] Introducing quantum-secure signatures QSignature CA , issued by a certificate authority (CA) using a quantum private key CA prv Sign device information, public keys, and quantum key exchange results to improve the unforgeability of authentication.

[0313] Access control adopts an enhanced model, combined with attribute-based access control (ABAC) logic ABAC And role-based access control (RBAC), which takes into account subject, action, object attributes, and quantum security level QSecurityLevel, ensuring that only entities that meet strict security policies can perform specified operations:

[0314]

[0315] In order to further improve the intelligence of access control, ABAC RBAC is designed as a deep learning-based model that optimizes access control policies through training:

[0316]

[0317] RBAC=argmax RBAC TruePositiveRate(RBAC)

[0318] Among them, TruePositiveRate represents the true positive rate, which measures the probability of correctly granting or denying access rights.

[0319] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An authentication method based on Ksession shared session key MAC, characterized in that: include: Acquire data to be encrypted in the power monitoring system, divide the data to be encrypted into key data and real-time data, and encrypt them; Use ECDH protocol and identity-based IBC technology to dynamically generate Ksession session keys, use Ksession session keys to generate message authentication codes, use message authentication codes to verify the integrity and authenticity of data in transit, and transmit encrypted data through TLS / SSL protocol. At the end of the session, destroy the Ksession session key. By integrating quantum key distribution and quantum secure signature algorithm, a quantum secure digital certificate is generated, and the digital certificate is verified through a multi-party verification mechanism.

2. The authentication method based on Ksession shared session key MAC as claimed in claim 1, characterized in that: The key data and real-time data include: key data D is divided into key data D according to the sensitivity S and real-time R of data D. critical and real-time data realtime , for D critical , using an optimized AES variant to reduce computational latency through parallel processing and hardware acceleration technology; For D realtime , Klein algorithm uses ARX structure and round function for fast encryption; For data that meets the requirements of both key data and real-time data, the AES-KLEIN fusion algorithm is used to split the data into multiple blocks. The key data blocks are encrypted using AES, and the real-time data blocks are encrypted using Klein.

3. The authentication method based on Ksession shared session key MAC as claimed in claim 2, characterized in that: The Ksession session key includes: In the early stage of communication, the two parties exchange and negotiate parameters through a secure channel, and participants A and B generate their own elliptic curve public keys PK A and PK B , together with their respective identifiers ID A and ID B Exchange through a pre-set secure channel; The protocol parameters are negotiated to determine the parameters p, a, b and base point G of the elliptic curve EC, and the hash function H and key derivation function F′ are selected.

4. The authentication method based on Ksession shared session key MAC as claimed in claim 3, characterized in that: The Ksession session key also includes the integration of ECDH and IBC technologies in the key negotiation phase, and A and B each independently generate a one-time random number N nonce1 and N nonce2 , using the ECDH protocol, A and B respectively calculate the temporary shared key K temp ; Through IBC technology, combined with K temp 、ID A 、ID B and the public parameters α and β in IBC, and apply the key derivation function F′ to derive the session key K session ; Using the newly generated K session Encrypt a predefined message M and send it to the other party for decryption verification; Set the update conditions for the session key. When the update conditions are met, the key update is triggered. A and B repeat the key negotiation steps to generate a new session key and destroy the old session key.

5. The authentication method based on Ksession shared session key MAC as claimed in claim 4, characterized in that: The key negotiation phase includes: A and B execute the quantum key distribution protocol through the quantum channel, realize the unconditional secure transmission of quantum bits by using the polarization state of photons, and generate preliminary key material S quantum ; Based on the quantum key material, both parties independently generate an asymmetric random number N once1 and N once2 , and exchanged through a preset classic secure channel; Combine the quantum key material with the classical key derivation function F′ and the asymmetric random numbers of both parties to generate the final session key K session : K session =QKD Exchange (S quantum ,N once1 ,N once2 )+F′(K master ,N once1 ,N once2 ) Among them, QKD Exchange represents the complete exchange process of the quantum key distribution protocol; K master Indicates the pre-negotiated master key.

6. The authentication method based on Ksession shared session key MAC as claimed in claim 5, characterized in that: The message authentication code includes, for the original plaintext P, using the quantum-safe encryption algorithm QuantumEncrypt, combined with quantum error correction coding technology, to generate encrypted data C: Wherein, QEC(P) represents the result of quantum error correction encoding of the original plaintext PPP; Introduce a hash function, combining the timestamp T and the authentication random number N auth , calculate the message authentication code: Among them, MAC represents a message authentication code; Indicates the use of session key K session Computational quantum hash message authentication codes; The data packet structure {C, MAC, T, N auth } is sent to the receiver through an insecure channel, and the receiver first verifies the key material S quantum After the integrity is verified, K session Decrypt C to get P′ and verify the validity of MAC; The receiver performs quantum decryption operations: Check T and N auth To prevent replay attacks, if MAC verification fails, the preset anti-replay mechanism is immediately activated; After the session ends, a quantum random number generator is used to generate a destruction instruction to irreversibly destroy the quantum enhanced key and all copies.

7. The authentication method based on Ksession shared session key MAC as claimed in claim 6, characterized in that: The digital certificate includes, in the process of issuing the digital certificate, introducing the quantum key generated by QKD, and calculating the summary value of the quantum key by using the quantum secure summary algorithm QHash; The certification authority uses the signature algorithm QSign based on the quantum security principle to sign the device information DI, the device public key DP and the quantum key summary QH to generate a quantum-secure digital certificate; The verification of digital certificates is no longer limited to a single certification authority, but is completed by multiple trust nodes in a distributed network. Each trust node holds part of the quantum key information and participates in the quantum consensus process. The definition of the quantum consensus algorithm integrates the quantum key information of multiple trusted nodes and the quantum key digest QH of the digital certificate. The certificate is considered valid only when a sufficient number of trusted nodes reach a consensus.

8. An authentication system based on Ksession shared session key MAC according to any one of the methods of claims 1 to 7, characterized in that: include, The power measurement and control data encryption module obtains the data to be encrypted in the power monitoring system, divides the data to be encrypted into key data and real-time data according to sensitivity and real-time nature, and encrypts the data through encryption algorithms; The Ksession key module uses the ECDH protocol and identity-based IBC technology to dynamically generate Ksession session keys, introduces quantum-safe hash functions and a key update mechanism assisted by quantum key distribution, implements theoretically unconditionally secure key exchange, and generates message authentication codes, destroying quantum keys and all copies at the end of the session; The identity authentication module generates a quantum-secure digital certificate by integrating quantum key distribution and quantum-secure signature algorithm, and verifies the digital certificate through a multi-party verification mechanism.

9. A computer device comprising: Memory and processor; The memory stores a computer program, characterized in that: when the processor executes the computer program, the steps of the authentication method based on Ksession shared session key MAC as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the authentication method based on Ksession shared session key MAC as described in any one of claims 1-7 are implemented.

Images