Identity authentication method and device of new energy power station communication network and electronic equipment

Abstract

The invention provides an identity authentication method and device for a new energy power station communication network and electronic equipment, and belongs to the technical field of identity authentication. The method comprises the following steps: sending a registration request to network equipment, so that the network equipment generates first attribute information of the network equipment based on the registration request; receiving first attribute information sent by the network equipment, and calculating first authentication data based on the first attribute information and the identity information; sending the first authentication data to the network equipment, so that the network equipment calculates anonymous identity data based on the first attribute information and second attribute information of the station equipment; receiving anonymous identity data sent by the network equipment, and constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; and sending the privacy authentication information to the network equipment, so that the network equipment performs privacy authentication. The problem that the attack prevention effect of the existing identity authentication method is still not ideal enough is solved.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication technology, and specifically to an identity authentication method for a new energy power station communication network, an identity authentication device for a new energy power station communication network, an electronic device, a machine-readable storage medium and a computer program product. Background Art

[0002] Identity authentication technology is an effective means of verifying the identity of operators in computer networks. In a network system, user identity information can be represented by a specific data stream, and the computer can authenticate the user's digital identity by authenticating the data, thereby authorizing the user. Current user identity authentication technology can confirm the identity of users in the communication process of new energy power stations (such as photovoltaic power stations), greatly improving the security of photovoltaic power station communications. Compared with traditional security measures, users need to remember a large number of passwords, and they are complex and less secure in actual use. Therefore, identity authentication technology is undoubtedly more convenient and has a higher safety factor. However, the existing identity authentication methods are still not ideal for preventing attacks. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide an identity authentication method, device and electronic device for a new energy power station communication network, so as to solve the defect that the existing identity authentication method is still not ideal in preventing attacks.

[0004] In order to achieve the above-mentioned purpose, an embodiment of the present invention provides an identity authentication method for a new energy power station communication network, which is applied to a station device, and the method includes:

[0005] Sending a registration request to the network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes the identity information of the site device;

[0006] Receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information;

[0007] Sending the first authentication data to a network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device;

[0008] receiving the anonymous identity data sent by the network device, and constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information, and the second attribute information;

[0009] The privacy authentication information is sent to the network device so that the network device performs privacy authentication.

[0010] Optionally, the receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information includes:

[0011] Receiving first attribute information sent by the network device;

[0012] Calculate the fusion authentication information based on the first attribute information and the identity information;

[0013] Calculate first authentication data based on the first attribute information, the identity information and the fused authentication information;

[0014] Among them, the first attribute information The network device selects a random number after receiving the registration request And calculate the private key Public Key And calculate private information Obtained; Fusion authentication information id i is the identity information; the first authentication data is g1 is a bilinear group of order q, q is the base domain feature, m is the message, X is a random number, and H() is the hash function.

[0015] Optionally, the first attribute information also includes an initial public key of the network device;

[0016] The constructing of privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information includes:

[0017] Calculate a first intermediate parameter and a second intermediate parameter based on the anonymous identity data and the first authentication data;

[0018] Obtaining privacy authentication information based on the first intermediate parameter, the second intermediate parameter, the first attribute information, and the second attribute information;

[0019] Among them, the first intermediate parameter The second intermediate parameter Represents anonymous identity data; first authentication data Is the privacy information of the network device; the first authentication data A i is the fusion authentication information, the first attribute information Y is the initial public key of the network device, and the second attribute information is the initial public key of the field device, privacy authentication information H() is a hash function.

[0020] Optionally, after sending the privacy authentication information to the network device so that the network device performs privacy authentication, the method further includes:

[0021] In the case where the privacy authentication of the network device passes, constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp;

[0022] Sending the first session key to the network device so that the network device performs identity authentication;

[0023] If the network device identity authentication is passed, generating a second session key and receiving a first timestamp and a third session key sent by the network device;

[0024] In a case where the field station device successfully verifies the first timestamp, session key negotiation is performed based on the second session key and the third session key.

[0025] Optionally, constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp includes:

[0026] constructing a third intermediate parameter, a fourth intermediate parameter, and a fifth intermediate parameter based on the anonymous identity data, the first authentication data, and the first attribute information;

[0027] Constructing the first session key based on the third intermediate parameter, the fourth intermediate parameter, the fifth intermediate parameter and the first timestamp;

[0028] The first session key is The third intermediate parameter The first intermediate parameter First authentication data Is the privacy information of the network device, the first authentication data A i is the fusion authentication information, δ=Y a , the first attribute information Y is the initial public key of the network device, represents anonymous identifiable data; is the initial public key of the field station equipment, the fourth intermediate parameter g1 is a bilinear group of order q, q is the base domain characteristic, and the fifth intermediate parameter τ=H(δ||θ||ρ), H() is the hash function, TS i is the first timestamp.

[0029] On the other hand, an embodiment of the present invention further provides an identity authentication method for a new energy power station communication network, which is applied to a network device, and the method includes:

[0030] Receiving a registration request sent by a field station device, and generating first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device;

[0031] Sending the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information;

[0032] receiving the first authentication data, and calculating anonymous identity data based on the first attribute information and second attribute information of the field station device;

[0033] Sending the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information;

[0034] The privacy authentication information sent by the field station device is received so that the network device performs privacy authentication.

[0035] Optionally, the anonymous identity data is calculated based on the first attribute information and the second attribute information of the field station device, and is calculated by the following formula:

[0036]

[0037] in, Represents anonymous identity data; first authentication data It is the privacy information of the network device; the second attribute information It is the initial public key of the field station device.

[0038] Optionally, after receiving the privacy authentication information sent by the field station device so that the network device performs privacy authentication, the method further includes:

[0039] In the case where the privacy authentication of the network device passes, receiving a first session key sent by the field station device, and performing identity authentication based on the first session key; the first session key is constructed by the field station device based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp;

[0040] When the network device identity authentication is passed, a first timestamp is obtained based on the first session key parsing, and the first timestamp and the third session key are sent to the site station device so that the site station device verifies the first timestamp and performs session key negotiation based on the generated second session key and the third session key.

[0041] On the other hand, an embodiment of the present invention further provides an identity authentication device for a new energy power station communication network, comprising:

[0042] A first sending module is used to send a registration request to a network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes identity information of the site device;

[0043] A first receiving module, used to receive the first attribute information sent by the network device, and calculate first authentication data based on the first attribute information and the identity information;

[0044] A second sending module, configured to send the first authentication data to a network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device;

[0045] A second receiving module, configured to receive the anonymous identity data sent by the network device, and construct privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information, and the second attribute information;

[0046] The third sending module is used to send the privacy authentication information to the network device so that the network device performs privacy authentication.

[0047] On the other hand, an embodiment of the present invention further provides an identity authentication device for a new energy power station communication network, comprising:

[0048] A first receiving module, configured to receive a registration request sent by a field station device, and generate first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device;

[0049] A first sending module, used for sending the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information;

[0050] A second receiving module, configured to receive the first authentication data, and calculate anonymous identity data based on the first attribute information and second attribute information of the site device;

[0051] A second sending module, configured to send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information;

[0052] The third receiving module is used to receive the privacy authentication information sent by the site device so that the network device can perform privacy authentication.

[0053] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned identity authentication method of the new energy power station communication network when executing the program.

[0054] On the other hand, the present invention also provides a machine-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the identity authentication method of the new energy power station communication network.

[0055] On the other hand, the present invention also provides a computer program product, including a computer program, which implements the above-mentioned identity authentication method of the new energy power station communication network when executed by a processor.

[0056] Through the above technical scheme, the embodiment of the present invention calculates anonymous identity data based on the first attribute information of the network device and the second attribute information of the site device, and then constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information to perform privacy authentication. Therefore, the embodiment of the present invention can resist identity guessing attacks, fake user attacks, replay attacks, denial of service attacks and internal privilege attacks based on multiple value verification of anonymous identity data, thereby improving the effect of preventing attacks.

[0057] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0059] Figure 1 This is one of the flow charts of the identity authentication method of the new energy power station communication network provided by the present invention;

[0060] Figure 2 This is the second flow chart of the identity authentication method of the new energy power station communication network provided by the present invention;

[0061] Figure 3 This is one of the structural schematic diagrams of the identity authentication device of the new energy power station communication network provided by the present invention;

[0062] Figure 4 This is the second structural diagram of the identity authentication device of the new energy power station communication network provided by the present invention;

[0063] Figure 5It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0064] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0065] Method Embodiment

[0066] Please refer to Figure 1 The embodiment of the present invention provides an identity authentication method for a new energy power station communication network, which is applied to a station device. The method includes:

[0067] Step 101: Send a registration request to a network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes the identity information of the site device.

[0068] It should be noted that the new energy power station in the embodiment of the present invention can be a solar power station (photovoltaic power station), a wind power station, a hydropower station, etc. The new energy power station in the embodiment of the present invention is described by taking a photovoltaic power station as an example. The field station equipment can be an inverter, photovoltaic modules, etc. in a photovoltaic power station. The network equipment can be the equipment of a cloud service provider. Before formal registration, the field station equipment E i Will choose to pass From the restricted area Choose a random number a as your private key, and use it to calculate the station equipment E i Public Key Network equipment CS will be through From the restricted area Select a random number X as your master key and private key, and calculate the public key from it The network device CS will select the hash function And publish the parameters {g1, g2, G1, G2, e, q, Y, H(·)}. G1 and G2 represent bilinear groups respectively; g1 and g2 represent the generators corresponding to the bilinear groups G1 and G2 respectively; e represents the bilinear pairing operation; q represents the base domain feature; Y represents the public key of the network device; H() represents the hash function.

[0069] User i Operate the station equipment to send the station equipment's identity information id i (such as device ID or device production number, etc.) and registration request EN req The network device receives the registration request information and selects a From the restricted area Select a random number r and calculate the private key of the network device and the public key of the network device Network equipment calculates privacy information And send the first attribute information through the secure channel To station equipment.

[0070] Step 102: Receive the first attribute information sent by the network device, and calculate first authentication data based on the first attribute information and the identity information.

[0071] Specifically, the receiving the first attribute information sent by the network device, and calculating the first authentication data based on the first attribute information and the identity information includes:

[0072] Step 1021: Receive first attribute information sent by the network device.

[0073] Step 1022: Calculate fusion authentication information based on the first attribute information and identity information.

[0074] Step 1023: Calculate first authentication data based on the first attribute information, the identity information and the fused authentication information.

[0075] The station equipment receives the first attribute information Post-calculation fusion authentication information And the first authentication data Sent to the network device.

[0076] Among them, the first attribute information After the network device receives the registration request, From the restricted area Select a random number r and calculate the private key Public Key And calculate private information Obtained; Fusion authentication information id i is the identity information of the station equipment; the first authentication data is g1 is a bilinear group of order q, q is the base domain feature, m is the message, and X is obtained by From the restricted area The random number selected in , H() is the hash function.

[0077] Step 103: Send the first authentication data to a network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device.

[0078] The station equipment sends the first authentication data To the network device. The network device receives the first authentication data After sending, calculate the anonymous identity data of the field equipment And send anonymous identity data and fusion authentication information through a secure channel To station equipment.

[0079] Step 104: receiving the anonymous identity data sent by the network device, and constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information, and the second attribute information;

[0080] Specifically, the first attribute information also includes an initial public key of the network device; Step 104, constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information, including:

[0081] Step 1041: Calculate a first intermediate parameter and a second intermediate parameter based on the anonymous identity data and the first authentication data.

[0082] Step 1042: Obtain privacy authentication information based on the first intermediate parameter, the second intermediate parameter, the first attribute information, and the second attribute information.

[0083] The station device receives the anonymous identity data and the first authentication data sent by the network device After that, the station equipment E i calculate and As the first intermediate parameter and the second intermediate parameter. The field equipment calculates the privacy authentication information And the information Sent to user ui. User receives the information Then extract the first intermediate parameter α and the second intermediate parameter β to reconstruct the privacy authentication information Network devices can use privacy authentication information To verify the legitimacy of users operating site equipment.

[0084] Among them, the first intermediate parameter The second intermediate parameter Represents anonymous identity data; first authentication data Is the privacy information of the network device; the first authentication data A i is the fusion authentication information, the first attribute information Y is the initial public key of the network device, and the second attribute information is the initial public key of the field device, privacy authentication information H() is a hash function.

[0085] Step 105: Send the privacy authentication information to the network device so that the network device performs privacy authentication.

[0086] User ui operates the site equipment and the corresponding privacy authentication information As an authentication request sent to the network device through an insecure channel, the network device receives the authentication request Post-calculation fusion authentication information The first intermediate parameter α and the second intermediate parameter β are then used to calculate the privacy authentication information. verify If the verification is successful, the network device will accept the authentication request service proposed by the user. If the verification fails, the identity authentication request will be terminated.

[0087] The embodiment of the present invention calculates anonymous identity data based on the first attribute information of the network device and the second attribute information of the site device, and then constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information to perform privacy authentication. Therefore, the embodiment of the present invention can resist identity guessing attacks, fake user attacks, replay attacks, denial of service attacks and internal privilege attacks based on multiple value verification of anonymous identity data, thereby improving the effect of preventing attacks.

[0088] In other aspects of the embodiments of the present invention, after step 105, sending the privacy authentication information to the network device so that the network device performs privacy authentication, the process further includes:

[0089] Step 106: When the privacy authentication of the network device passes, construct a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp.

[0090] Step 107: Send the first session key to the network device so that the network device performs identity authentication.

[0091] Wherein, step 106, constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp, includes:

[0092] Step 1061: construct a third intermediate parameter, a fourth intermediate parameter, and a fifth intermediate parameter based on the anonymous identity data, the first authentication data, and the first attribute information.

[0093] Step 1062: Construct the first session key based on the third intermediate parameter, the fourth intermediate parameter, the fifth intermediate parameter and the first timestamp.

[0094] The first session key is The third intermediate parameter σ=δ⊕θ,θ=α⊕A i , the first intermediate parameter First authentication data Is the privacy information of the network device, the first authentication data A i is the fusion authentication information, δ=Y a , the first attribute information Y is the initial public key of the network device, represents anonymous identifiable data; is the initial public key of the field station equipment, the fourth intermediate parameter g1 is a bilinear group of order q, q is the base domain characteristic, and the fifth intermediate parameter τ=H(δ||θ||ρ), H() is the hash function, TS i is the first timestamp.

[0095] Station Equipment i Calculate the third intermediate parameter σ, the fourth intermediate parameter ρ, and the fifth intermediate parameter in The first session key Suppose it is sent to the network device, where TS i is the first timestamp. When the network device receives the first session key After that, calculate and verify δ'=ρ X 、δ'=δ. Network equipment calculation And verify If authentication is passed the network device accepts the authentication request from the field station device.

[0096] Step 108: When the network device identity authentication is passed, generate a second session key and receive a first timestamp and a third session key sent by the network device.

[0097] Step 109: When the site station device passes verification of the first timestamp, perform session key negotiation based on the second session key and the third session key.

[0098] Finally, if the network device identity authentication is passed, the station device E i Generate the second session key SK between the network device and the site device E i calculate It is the station equipment E i Where a is the random number selected by the site device when creating the public key in the initial stage, and X is the random number selected by the network device when creating the public key in the initial stage. Network device CS calculation is the public key of the network device CS. Then the network device passes From the restricted area Choose a random number n and calculate Network equipment computing And the first timestamp and the third session key {Y1,TS i}Sent to the field equipment.

[0099] Station Equipment i Receive the first timestamp and the third session key {Y1,TS i}, first verify the first timestamp TS i And calculate and Network equipment CS can also be calculated and SK=e(SK' C ' S ,g2). Network equipment CS and site equipment E i The session key is agreed upon.

[0100]

[0101] The embodiment of the present invention constructs a first session key for identity authentication based on anonymous identity data, the first authentication data, the first attribute information and the first timestamp. Therefore, the embodiment of the present invention can further resist identity guessing attacks, fake user attacks, replay attacks, denial of service attacks and internal privilege attacks based on multiple value verification of anonymous identity data and timestamps, and further improve the effect of preventing attacks.

[0102] Please refer to Figure 2 On the other hand, an embodiment of the present invention provides an identity authentication method for a new energy power station communication network, which is applied to a network device, and the method includes:

[0103] Step 201: Receive a registration request sent by a field station device, and generate first attribute information of a network device based on the registration request. The registration request includes identity information of the field station device.

[0104] Before formal registration, the station equipment E i Will choose to pass From the restricted area Choose a random number a as your private key, and use it to calculate the station equipment E i Public Key Network equipment CS will be through From the restricted area Select a random number X as your master key and private key, and calculate the public key from it The network device CS will select the hash function And publish the parameters {g1, g2, G1, G2, e, q, Y, H(·)}. G1 and G2 represent bilinear groups respectively; g1 and g2 represent the generators corresponding to the bilinear groups G1 and G2 respectively; e represents the bilinear pairing operation; q represents the base domain feature; Y represents the public key of the network device; H() represents the hash function.

[0105] After receiving the registration request, the network device selects a From the restricted area Select a random number r and calculate the private key of the network device and the public key of the network device Network equipment calculates privacy information And send the first attribute information through the secure channel To station equipment.

[0106] Step 202: Send the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information.

[0107] The station equipment receives the first attribute information Post-calculation fusion authentication information And the first authentication data Sent to the network device.

[0108] Step 203: Receive the first authentication data, and calculate anonymous identity data based on the first attribute information and the second attribute information of the site device.

[0109] The network device receives the first authentication data Then, the anonymous identity data is calculated based on the first attribute information and the second attribute information of the field station device, and is calculated by the following formula:

[0110]

[0111] in, Represents anonymous identity data; first authentication data It is the privacy information of the network device; the second attribute information It is the initial public key of the field station device.

[0112] Step 204: Send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information.

[0113] Step 205: Receive the privacy authentication information sent by the site device, so that the network device performs privacy authentication.

[0114] The network device sends the anonymous identity data to the field station device. The field station device receives the anonymous identity data and the first authentication data sent by the network device. After that, the station equipment E i calculate and As the first intermediate parameter and the second intermediate parameter. The field equipment calculates the privacy authentication information And the information Sent to user ui. User receives the information Then extract the first intermediate parameter α and the second intermediate parameter β to reconstruct the privacy authentication information Network devices can use privacy authentication information To verify the legitimacy of users operating site equipment.

[0115] Among them, the first intermediate parameter The second intermediate parameter Represents anonymous identity data; first authentication data Is the privacy information of the network device; the first authentication data A i is the fusion authentication information, the first attribute information Y is the initial public key of the network device, and the second attribute information is the initial public key of the field device, privacy authentication information H() is a hash function.

[0116] User i The operation site equipment will correspond to the privacy authentication information As an authentication request sent to the network device through an insecure channel, the network device receives the authentication request Post-calculation fusion authentication information The first intermediate parameter α and the second intermediate parameter β are then used to calculate the privacy authentication information. verify If the verification is successful, the network device will accept the authentication request service proposed by the user. If the verification fails, the identity authentication request will be terminated.

[0117] The embodiment of the present invention calculates anonymous identity data based on the first attribute information of the network device and the second attribute information of the site device, and then constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information to perform privacy authentication. Therefore, the embodiment of the present invention can resist identity guessing attacks, fake user attacks, replay attacks, denial of service attacks and internal privilege attacks based on multiple value verification of anonymous identity data, thereby improving the effect of preventing attacks.

[0118] In other aspects of the embodiments of the present invention, after step 205, receiving the privacy authentication information sent by the site device so that the network device performs privacy authentication, it also includes:

[0119] Step 206: When the privacy authentication of the network device passes, receive the first session key sent by the site station device, and perform identity authentication based on the first session key; the first session key is constructed by the site station device based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp.

[0120] Step 207: When the network device identity authentication is passed, a first timestamp is obtained based on the first session key parsing, and the first timestamp and the third session key are sent to the site station device, so that the site station device verifies the first timestamp and performs session key negotiation based on the generated second session key and the third session key.

[0121] Station Equipment i Calculate the third intermediate parameter σ, the fourth intermediate parameter ρ, and the fifth intermediate parameter φ.

[0122] in The first session key Suppose it is sent to the network device, where TS i is the first timestamp. When the network device receives the first session key After that, calculate and verify δ'=ρ X 、δ'=δ. Network equipment calculation And verify If the verification is successful, the network device accepts the identity authentication request of the field station device. The network device parses the first session key to obtain a first timestamp TS i .

[0123] Finally, if the network device identity authentication is passed, the station device E i Generate the second session key SK between the network device and the site device E i calculate It is the station equipment E i Where a is the random number selected by the site device when creating the public key in the initial stage, and X is the random number selected by the network device when creating the public key in the initial stage. Network device CS calculation is the public key of the network device CS. Then the network device passes From the restricted area Choose a random number n and calculate Network equipment computing And the first timestamp and the third session key {Y1,TS i}Sent to the field equipment.

[0124] Station Equipment i Receive the first timestamp and the third session key {Y1,TS i}, first verify the first timestamp TS i And calculate and Network equipment CS can also be calculated and SK=e(SK' C ' S ,g2). Network equipment CS and site equipment E i The session key is agreed upon.

[0125]

[0126] The embodiment of the present invention constructs a first session key for identity authentication based on anonymous identity data, the first authentication data, the first attribute information and the first timestamp. Therefore, the embodiment of the present invention can further resist identity guessing attacks, fake user attacks, replay attacks, denial of service attacks and internal privilege attacks based on multiple value verification of anonymous identity data and timestamps, and further improve the effect of preventing attacks.

[0127] Device Embodiment

[0128] Please refer to Figure 3 On the other hand, an embodiment of the present invention further provides an identity authentication device for a new energy power station communication network, comprising:

[0129] The first sending module 301 is used to send a registration request to the network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes identity information of the site device;

[0130] A first receiving module 302 is used to receive the first attribute information sent by the network device, and calculate first authentication data based on the first attribute information and the identity information;

[0131] A second sending module 303 is used to send the first authentication data to a network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device;

[0132] A second receiving module 304 is used to receive the anonymous identity data sent by the network device, and construct privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information;

[0133] The third sending module 305 is used to send the privacy authentication information to the network device so that the network device performs privacy authentication.

[0134] Optionally, the receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information includes:

[0135] Receiving first attribute information sent by the network device;

[0136] Calculate the fusion authentication information based on the first attribute information and the identity information;

[0137] Calculate first authentication data based on the first attribute information, the identity information and the fused authentication information;

[0138] Among them, the first attribute information The network device selects a random number after receiving the registration request And calculate the private key Public Key And calculate private information Obtained; Fusion authentication information id i is the identity information; the first authentication data is g1 is a bilinear group of order q, q is the base domain feature, m is the message, X is a random number, and H() is the hash function.

[0139] Optionally, the first attribute information also includes an initial public key of the network device;

[0140] The constructing of privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information includes:

[0141] Calculate a first intermediate parameter and a second intermediate parameter based on the anonymous identity data and the first authentication data;

[0142] Obtaining privacy authentication information based on the first intermediate parameter, the second intermediate parameter, the first attribute information, and the second attribute information;

[0143] Among them, the first intermediate parameter The second intermediate parameter Represents anonymous identity data; first authentication data Is the privacy information of the network device; the first authentication data A i is the fusion authentication information, the first attribute information Y is the initial public key of the network device, and the second attribute information is the initial public key of the field device, privacy authentication information H() is a hash function.

[0144] Optionally, after sending the privacy authentication information to the network device so that the network device performs privacy authentication, the method further includes:

[0145] In the case where the privacy authentication of the network device passes, constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp;

[0146] Sending the first session key to the network device so that the network device performs identity authentication;

[0147] If the network device identity authentication is passed, generating a second session key and receiving a first timestamp and a third session key sent by the network device;

[0148] In a case where the field station device successfully verifies the first timestamp, session key negotiation is performed based on the second session key and the third session key.

[0149] Optionally, constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp includes:

[0150] constructing a third intermediate parameter, a fourth intermediate parameter, and a fifth intermediate parameter based on the anonymous identity data, the first authentication data, and the first attribute information;

[0151] Constructing the first session key based on the third intermediate parameter, the fourth intermediate parameter, the fifth intermediate parameter and the first timestamp;

[0152] The first session key is The third intermediate parameter The first intermediate parameter First authentication data Is the privacy information of the network device, the first authentication data A i is the fusion authentication information, δ=Y a , the first attribute information Y is the initial public key of the network device, represents anonymous identifiable data; is the initial public key of the field station equipment, the fourth intermediate parameter g1 is a bilinear group of order q, q is the base domain characteristic, and the fifth intermediate parameter τ=H(δ||θ||ρ), H() is the hash function, TS i is the first timestamp.

[0153] The identity authentication device of the new energy power station communication network includes a processor and a memory. The above-mentioned first sending module 301, first receiving module 302, second sending module 303, second receiving module 304 and third sending module 305 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0154] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0155] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0156] On the other hand, please refer to Figure 4 The embodiment of the present invention further provides an identity authentication device for a new energy power station communication network, comprising:

[0157] The first receiving module 401 is used to receive a registration request sent by a field station device, and generate first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device;

[0158] A first sending module 402, configured to send the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information;

[0159] A second receiving module 403 is used to receive the first authentication data, and calculate anonymous identity data based on the first attribute information and the second attribute information of the site device;

[0160] A second sending module 404 is used to send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information;

[0161] The third receiving module 405 is used to receive the privacy authentication information sent by the site device, so that the network device can perform privacy authentication.

[0162] Optionally, the anonymous identity data is calculated based on the first attribute information and the second attribute information of the field station device, and is calculated by the following formula:

[0163]

[0164] in, Represents anonymous identity data; first authentication data It is the privacy information of the network device; the second attribute information It is the initial public key of the field station device.

[0165] Optionally, after receiving the privacy authentication information sent by the field station device so that the network device performs privacy authentication, the method further includes:

[0166] In the case where the privacy authentication of the network device passes, receiving a first session key sent by the field station device, and performing identity authentication based on the first session key; the first session key is constructed by the field station device based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp;

[0167] When the network device identity authentication is passed, a first timestamp is obtained based on the first session key parsing, and the first timestamp and the third session key are sent to the site station device so that the site station device verifies the first timestamp and performs session key negotiation based on the generated second session key and the third session key.

[0168] The identity authentication device of the new energy power station communication network includes a processor and a memory. The above-mentioned first sending module 401, first receiving module 402, second sending module 403, second receiving module 404 and third sending module 405 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0169] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0170] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor (processor) 510, a communication interface (Communications Interface) 520, a memory (memory) 530 and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 complete mutual communication through the communication bus 540. The processor 510 can call the logic instructions in the memory 530 to execute the identity authentication method of the new energy power station communication network, the method comprising: sending a registration request to the network device, so that the network device generates the first attribute information of the network device based on the registration request; the registration request includes the identity information of the site device; receiving the first attribute information sent by the network device, and calculating the first authentication data based on the first attribute information and the identity information; sending the first authentication data to the network device, so that the network device calculates the anonymous identity data based on the first attribute information and the second attribute information of the site device; receiving the anonymous identity data sent by the network device, and constructing the privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; sending the privacy authentication information to the network device, so that the network device performs privacy authentication. Or,

[0171] Receive a registration request sent by a field station device, and generate first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device; send the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information; receive the first authentication data, and calculate anonymous identity data based on the first attribute information and second attribute information of the field station device; send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; receive the privacy authentication information sent by the field station device, so that the network device performs privacy authentication.

[0172] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0173] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a machine-readable storage medium. When the computer program is executed by a processor, the computer can execute an identity authentication method for a new energy power station communication network, the method including: sending a registration request to a network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes the identity information of the site device; receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information; sending the first authentication data to the network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device; receiving the anonymous identity data sent by the network device, and constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; sending the privacy authentication information to the network device, so that the network device performs privacy authentication. Or,

[0174] Receive a registration request sent by a field station device, and generate first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device; send the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information; receive the first authentication data, and calculate anonymous identity data based on the first attribute information and second attribute information of the field station device; send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; receive the privacy authentication information sent by the field station device, so that the network device performs privacy authentication.

[0175] On another aspect, the present invention also provides a machine-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform an identity authentication method for a new energy power station communication network, the method comprising: sending a registration request to a network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes the identity information of the site device; receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information; sending the first authentication data to the network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device; receiving the anonymous identity data sent by the network device, and constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; sending the privacy authentication information to the network device, so that the network device performs privacy authentication. Or,

[0176] Receive a registration request sent by a field station device, and generate first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device; send the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information; receive the first authentication data, and calculate anonymous identity data based on the first attribute information and second attribute information of the field station device; send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; receive the privacy authentication information sent by the field station device, so that the network device performs privacy authentication.

[0177] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0178] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0179] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identity authentication of a new energy power station communication network, characterized in that: Applied to field station equipment, the method comprises: Sending a registration request to the network device, so that the network device generates first attribute information of the network device based on the registration request; the registration request includes the identity information of the site device; Receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information; Sending the first authentication data to a network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device; receiving the anonymous identity data sent by the network device, and constructing privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information, and the second attribute information; The privacy authentication information is sent to the network device so that the network device performs privacy authentication.

2. The identity authentication method of the new energy power station communication network according to claim 1 is characterized in that: The receiving the first attribute information sent by the network device, and calculating first authentication data based on the first attribute information and the identity information, includes: Receiving first attribute information sent by the network device; Calculate the fusion authentication information based on the first attribute information and the identity information; Calculate first authentication data based on the first attribute information, the identity information and the fused authentication information; Among them, the first attribute information The network device selects a random number after receiving the registration request And calculate the private key Public Key And calculate private information Obtained; Fusion authentication information id i is the identity information; the first authentication data is g1 is a bilinear group of order q, q is the base domain feature, m is the message, X is a random number, and H() is the hash function.

3. The identity authentication method of the new energy power station communication network according to claim 2 is characterized in that: The first attribute information also includes an initial public key of the network device; The constructing of privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information includes: Calculate a first intermediate parameter and a second intermediate parameter based on the anonymous identity data and the first authentication data; Obtaining privacy authentication information based on the first intermediate parameter, the second intermediate parameter, the first attribute information, and the second attribute information; Among them, the first intermediate parameter The second intermediate parameter Represents anonymous identity data; first authentication data Is the privacy information of the network device; the first authentication data A i is the fusion authentication information, the first attribute information Y is the initial public key of the network device, and the second attribute information is the initial public key of the field device, privacy authentication information H() is a hash function.

4. The identity authentication method of the new energy power station communication network according to claim 3 is characterized in that: After sending the privacy authentication information to the network device so that the network device performs privacy authentication, the method further includes: In the case where the privacy authentication of the network device passes, constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp; Sending the first session key to the network device so that the network device performs identity authentication; If the network device identity authentication is passed, generating a second session key and receiving a first timestamp and a third session key sent by the network device; In a case where the field station device successfully verifies the first timestamp, session key negotiation is performed based on the second session key and the third session key.

5. The identity authentication method of the new energy power station communication network according to claim 4 is characterized in that: The constructing a first session key based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp comprises: constructing a third intermediate parameter, a fourth intermediate parameter, and a fifth intermediate parameter based on the anonymous identity data, the first authentication data, and the first attribute information; Constructing the first session key based on the third intermediate parameter, the fourth intermediate parameter, the fifth intermediate parameter and the first timestamp; The first session key is The third intermediate parameter The first intermediate parameter First authentication data Is the privacy information of the network device, the first authentication data A i is the fusion authentication information, δ=Y a , the first attribute information Y is the initial public key of the network device, represents anonymous identifiable data; is the initial public key of the field station equipment, the fourth intermediate parameter g1 is a bilinear group of order q, q is the base domain characteristic, and the fifth intermediate parameter H() is a hash function, TS i is the first timestamp.

6. A method for identity authentication of a new energy power station communication network, characterized in that: Applied to a network device, the method comprises: Receiving a registration request sent by a field station device, and generating first attribute information of a network device based on the registration request; the registration request includes identity information of the field station device; Sending the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information; receiving the first authentication data, and calculating anonymous identity data based on the first attribute information and second attribute information of the field station device; Sending the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; The privacy authentication information sent by the field station device is received so that the network device performs privacy authentication.

7. The identity authentication method of the new energy power station communication network according to claim 6 is characterized in that: The anonymous identity data is calculated based on the first attribute information and the second attribute information of the field station device, and is calculated by the following formula: in, Represents anonymous identity data; first authentication data It is the privacy information of the network device; the second attribute information It is the initial public key of the field station device.

8. The identity authentication method of the new energy power station communication network according to claim 6, characterized in that: After receiving the privacy authentication information sent by the field station device so that the network device performs privacy authentication, the method further includes: In the case where the privacy authentication of the network device passes, receiving a first session key sent by the field station device, and performing identity authentication based on the first session key; the first session key is constructed by the field station device based on the anonymous identity data, the first authentication data, the first attribute information and the first timestamp; When the network device identity authentication is passed, a first timestamp is obtained based on the first session key parsing, and the first timestamp and the third session key are sent to the site station device, so that the site station device verifies the first timestamp and performs session key negotiation based on the generated second session key and the third session key.

9. An identity authentication device for a new energy power station communication network, characterized in that: include: A first sending module, configured to send a registration request to a network device, so that the network device generates first attribute information of the network device based on the registration request; The registration request includes the identity information of the site equipment; A first receiving module, used to receive the first attribute information sent by the network device, and calculate first authentication data based on the first attribute information and the identity information; A second sending module, configured to send the first authentication data to a network device, so that the network device calculates anonymous identity data based on the first attribute information and the second attribute information of the site device; A second receiving module, configured to receive the anonymous identity data sent by the network device, and construct privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information, and the second attribute information; The third sending module is used to send the privacy authentication information to the network device so that the network device performs privacy authentication.

10. An identity authentication device for a new energy power station communication network, characterized in that: include: A first receiving module, used for receiving a registration request sent by a site station device, and generating first attribute information of a network device based on the registration request; The registration request includes the identity information of the field station equipment; A first sending module, used for sending the first attribute information to the field station device, so that the field station device calculates first authentication data based on the first attribute information and the identity information; A second receiving module, configured to receive the first authentication data, and calculate anonymous identity data based on the first attribute information and second attribute information of the site device; A second sending module, configured to send the anonymous identity data to the field station device, so that the field station device constructs privacy authentication information based on the anonymous identity data, the first authentication data, the first attribute information and the second attribute information; The third receiving module is used to receive the privacy authentication information sent by the site device so that the network device can perform privacy authentication.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the identity authentication method of the new energy power station communication network described in any one of claims 1 to 5 is implemented, or the identity authentication method of the new energy power station communication network described in any one of claims 6 to 8 is implemented.

12. A machine-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the identity authentication method of the new energy power station communication network described in any one of claims 1 to 5 is implemented, or the identity authentication method of the new energy power station communication network described in any one of claims 6 to 8 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the identity authentication method of the new energy power station communication network described in any one of claims 1 to 5 is implemented, or the identity authentication method of the new energy power station communication network described in any one of claims 6 to 8 is implemented.

Images