Nuclear power control station safety control system

Abstract

The present invention relates to the field of digital security, and specifically to a nuclear power control station safety control system, comprising: an initialization module, used to generate a key pair static hash value for all key pairs, and store it in a static storage area; a verification request module, used to generate a server identity authentication request, and send it to the nuclear power control client, and receive server identity authentication confirmation information; a signature verification module, used to receive a client identity authentication request of the nuclear power control client, verify the client identity authentication request, generate the client identity authentication confirmation information according to the verification result, and send it to the nuclear power control client; a control module, used to receive a control request of the nuclear power control client, and process the control request based on the verification results of the server identity authentication request and the client identity authentication request. The present invention better protects the data security of the nuclear power control station, thereby maintaining the normal operation and nuclear safety of the nuclear power plant.

Description

Technical Field

[0001] The invention relates to the field of digital security, and in particular to a safety control system for a nuclear power control station. Background Art

[0002] The nuclear power control station is the core part of the digital control system in the nuclear power plant. It realizes precise control of the nuclear power plant through the front-end engineer control client and operator control client, as well as the downstream connection with various nuclear power equipment. Among them, security control is a crucial link. Any leakage, tampering or falsification of data may lead to the collapse of the control system and even cause serious nuclear safety accidents. Therefore, ensuring the safety control of nuclear power plants, especially the data security of control stations, is crucial to maintaining the normal operation and nuclear safety of nuclear power plants.

[0003] At present, the security control of nuclear power control stations mainly relies on identity and password verification, that is, identity authentication through preset usernames and passwords to ensure that only authorized users and devices can access and control the system. However, this method has certain security risks. Once the password is leaked or cracked, malicious users or malware may impersonate legitimate users to access and control the nuclear power control station, thus causing security problems. Therefore, the existing identity and password verification methods have certain deficiencies in terms of security. Summary of the invention

[0004] In order to solve the above problems, the present invention provides a safety control system for a nuclear power control station.

[0005] The present invention discloses a safety control system for a nuclear power control station, wherein the safety control system for the nuclear power control station is connected to a nuclear power control client, and the safety control system for the nuclear power control station comprises:

[0006] An initialization module, used to generate a key pair static hash value for all key pairs and store it in a static storage area, wherein each of the key pairs is pre-generated based on a preset elliptic curve, and the key pairs include a server key pair and a nuclear power control client key pair;

[0007] A verification request module, used to generate a server identity authentication request based on the static hash value of the key pair corresponding to the server key pair, and send it to the nuclear power control client, and receive server identity authentication confirmation information corresponding to the server identity authentication request;

[0008] A signature verification module, used to receive a client identity authentication request from a nuclear power control client, verify the client identity authentication request based on the static hash value of the key pair corresponding to the nuclear power control client key pair, generate the client identity authentication confirmation information according to the verification result, and send it to the nuclear power control client;

[0009] The control module is used to receive a control request from a nuclear power control client and process the control request based on the verification results of the server identity verification request and the client identity verification request.

[0010] Furthermore, the initialization module includes:

[0011] A key pair static hash value generation submodule, used to calculate a hash value for the public key in each of the key pairs using the SM3 algorithm to obtain a key pair static hash value corresponding to the key pair;

[0012] The key pair static hash value storage submodule is used to generate a key-value pair for each key pair according to its public key and its corresponding key pair static hash value, and store the key-value pair in a static storage area.

[0013] Furthermore, the key pair static hash value generation submodule includes:

[0014] A first parameter generating unit, configured to generate, for a public key in each key pair, a first parameter of the public key according to the parameter of the elliptic curve and the coordinates of the public key corresponding to the elliptic curve;

[0015] The hash value generating unit is used to calculate the hash value of the first parameter by using the SM3 algorithm to obtain the key pair static hash value corresponding to the key pair.

[0016] Furthermore, the verification request module includes:

[0017] A first hash value generating submodule, configured to generate server signature information according to a static hash value of the key pair corresponding to the preset server request information and the server key pair, and calculate a hash value for the server signature information using an SM3 algorithm to obtain a first hash value;

[0018] The signature verification initiator module uses the private key in the server key pair to encrypt the first hash value based on the SM2 algorithm, generates a server identity authentication request based on the encryption result, sends it to the nuclear power control client, and receives the server identity authentication confirmation information corresponding to the server identity authentication request.

[0019] Furthermore, the signature verification module includes:

[0020] A second hash value generating unit is used to receive a client identity authentication request from a nuclear power control client, parse the client identity authentication request, obtain signature information to be verified and client request information, generate client signature information according to a static hash value of the key pair corresponding to the client request information and the nuclear power control client key pair, calculate a hash value for the client signature information using an SM3 algorithm, and obtain a second hash value;

[0021] The signature verification unit is used to decrypt the signature information to be verified based on the public key in the nuclear power control client key pair and the SM2 algorithm, compare the decryption result with the second hash value, generate the client identity authentication confirmation information according to the comparison result, and send it to the nuclear power control client.

[0022] Furthermore, the nuclear power control station safety control system also includes:

[0023] The log management module is used to record the statistical information of all the server identity authentication requests and the client identity authentication requests.

[0024] Furthermore, the nuclear power control station safety control system also includes:

[0025] The data storage module is used to receive a data storage request from a nuclear power control client, parse the data storage request, obtain the data to be stored, use the SM3 algorithm to calculate a first data summary for the data to be stored, generate data to be encrypted based on the data to be stored and the first data summary, and use the SM4 algorithm to encrypt and store the data to be encrypted.

[0026] Furthermore, the nuclear power control station safety control system also includes:

[0027] A data reading module is used to receive a data reading request from a nuclear power control client, parse the data reading request, obtain a data identifier, read the data to be decrypted according to the data identifier, decrypt the data to be decrypted using the SM4 algorithm, parse the decryption result to obtain a second data summary and the data to be read, and verify the integrity of the data to be read using the SM3 algorithm according to the second data summary, and after the integrity verification is passed, send the data to be read to the nuclear power control client.

[0028] Furthermore, the control module includes:

[0029] A judgment submodule, used to judge the verification results of the server identity authentication request and the client identity authentication request, and determine whether the verification is passed;

[0030] The control submodule is used to receive a control request from a nuclear power control client, and when the verification is passed, perform integrity verification on the received control request, and process the control request after the integrity verification is passed.

[0031] Furthermore, the control submodule includes:

[0032] A decryption unit, used to receive the encrypted control request from the nuclear power control client, and when the verification is passed, decrypt the control request according to the SM4 algorithm to obtain the first control request data;

[0033] an integrity verification unit, configured to parse the first control request data to obtain a third data summary and the second control request data, and perform integrity verification on the second control request data according to the third data summary and based on an SM3 algorithm;

[0034] A processing unit is used to process the control request according to the second control request data after the integrity verification of the second control request data is passed.

[0035] The present invention proposes a novel nuclear power control station security control system, which realizes efficient and secure two-way verification of the nuclear power control station by using a key pair based on preset elliptic curve parameters to generate a key pair static hash value. This method not only improves security and prevents identity impersonation and data tampering, but also improves the work efficiency of the system through optimized verification process. Through this novel security control method, the data security of the nuclear power control station can be better protected, thereby maintaining the normal operation and nuclear safety of the nuclear power plant. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 It is a structural schematic diagram of a safety control system for a nuclear power control station disclosed in an embodiment of the present invention;

[0038] Figure 2 It is a structural schematic diagram of another nuclear power control station safety control system disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, or product end including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products, or ends.

[0041] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0042] See also Figure 1 As shown, Figure 1 Schematic diagram of a nuclear power control station safety control system disclosed in an embodiment of the present invention. Figure 1 As shown, the nuclear power control station safety control system is connected to the nuclear power control client, and the nuclear power control station safety control system may include the following modules:

[0043] An initialization module, used to generate a key pair static hash value for all key pairs and store it in a static storage area, wherein each of the key pairs is pre-generated based on a preset elliptic curve, and the key pairs include a server key pair and a nuclear power control client key pair;

[0044] A verification request module, used to generate a server identity authentication request based on the static hash value of the key pair corresponding to the server key pair, and send it to the nuclear power control client, and receive server identity authentication confirmation information corresponding to the server identity authentication request;

[0045] A signature verification module, used to receive a client identity authentication request from a nuclear power control client, verify the client identity authentication request based on the static hash value of the key pair corresponding to the nuclear power control client key pair, generate the client identity authentication confirmation information according to the verification result, and send it to the nuclear power control client;

[0046] The control module is used to receive a control request from a nuclear power control client and process the control request based on the verification results of the server identity verification request and the client identity verification request.

[0047] A key pair refers to a pair of associated keys, including a public key and a private key. The public key is public and can be freely distributed, while the private key is confidential and can only be accessed by the key owner. In an asymmetric encryption system, the public key is used to encrypt data or verify digital signatures, and the private key is used to decrypt data or generate digital signatures. The security of the key pair is based on certain mathematical problems, such as factorization of large integers or discrete logarithm problems, which ensure that the private key cannot be derived from the public key. In this embodiment, the key pair is pre-generated and used for identity authentication and secure communication between the nuclear power control station and the nuclear power control client.

[0048] Elliptic curve is a special mathematical curve with a wide range of applications in cryptography. Elliptic curve cryptography (ECC) is based on mathematical operations on elliptic curves and provides security comparable to or higher than traditional public key cryptography (such as RSA), but uses a shorter key length. The points on the elliptic curve and the defined operation rules form the basis of elliptic curve cryptography. ECC is a public key cryptosystem whose security is based on the difficulty of the elliptic curve discrete logarithm problem. In ECC, the private key is a randomly selected integer, and the public key is another point obtained by multiplying the base point on the elliptic curve with the private key. The elliptic curve is defined by a set of parameters, including prime order, coefficient, base point, and order, which together determine the shape and security of the curve. The operations on the elliptic curve mainly include point addition and scalar multiplication, which satisfy certain mathematical properties and are used to generate key pairs, encryption, decryption, and digital signature operations, providing efficient and secure tools for modern cryptography.

[0049] A hash value is a fixed-length output obtained by calculating data using a hash function. A hash function is a one-way function that can map data of any length to a fixed-length hash value, and a small change in the input will result in a large change in the output. It is used to verify the integrity of data because even if the data is slightly changed, its hash value will change significantly.

[0050] Static storage area refers to a fixed memory area allocated when the program is running, which is used to store data that remains unchanged during the life cycle of the program. Unlike dynamically allocated memory, the static storage area is determined when the program is compiled and allocated when the program is loaded. Static storage area is usually used to store constants, global variables, static local variables, etc. In this optional embodiment, the static hash value of the key pair is stored in the static storage area for quick access and use in the subsequent identity authentication and signature verification process, which improves the efficiency and performance of the system.

[0051] It can be seen that this optional embodiment realizes the security control of the communication between the nuclear power control station and the nuclear power control client. Among them, the initialization module generates and stores the static hash value of the key pair, providing a basis for subsequent identity authentication; the verification request module generates and sends the server identity authentication request based on the static hash value of the key pair corresponding to the server key pair, ensuring the authenticity of the server identity; the signature verification module verifies the client identity authentication request based on the static hash value of the key pair corresponding to the nuclear power control client key pair, ensuring the legitimacy of the client identity; the control module processes the control request according to the server and client identity authentication results, ensuring the security of the control request. Through multiple identity authentication and key management, the system effectively improves the reliability and security of the safety control of the nuclear power control station.

[0052] In an optional embodiment, the initialization module includes:

[0053] A key pair static hash value generation submodule, used to calculate a hash value for the public key in each of the key pairs using the SM3 algorithm to obtain a key pair static hash value corresponding to the key pair;

[0054] The key pair static hash value storage submodule is used to generate a key-value pair for each key pair according to its public key and its corresponding key pair static hash value, and store the key-value pair in a static storage area.

[0055] It can be seen that in this optional embodiment, the key pair static hash value generation submodule uses the SM3 algorithm to calculate the hash value of the public key to obtain the key pair static hash value, thereby ensuring the security and uniqueness of the hash value; the key pair static hash value storage submodule generates a key-value pair from the public key and its corresponding key pair static hash value, and stores it in the static storage area, thereby realizing efficient storage and fast query of the key pair static hash value. By using the secure SM3 algorithm and key-value pair storage structure, the security and efficiency of the nuclear power control station safety control system are further enhanced.

[0056] In a further optional embodiment, the key pair static hash value generation submodule includes:

[0057] A first parameter generating unit, configured to generate, for a public key in each key pair, a first parameter of the public key according to the parameter of the elliptic curve and the coordinates of the public key corresponding to the elliptic curve;

[0058] The hash value generating unit is used to calculate the hash value of the first parameter by using the SM3 algorithm to obtain the key pair static hash value corresponding to the key pair.

[0059] In an optional embodiment, the first parameter generating unit generates the first parameter param according to the following formula:

[0060] param=param1||pub x ||pub y ;

[0061] Among them, param1 is the general parameter generated based on the parameters of the elliptic curve, pub x is the horizontal coordinate of the elliptic curve corresponding to a public key, pub y is the ordinate of the elliptic curve corresponding to a public key, || represents a concatenation operation, and in this embodiment, the calculation method of the general parameter param1 is as follows:

[0062] param1=IDA_leng||A||B||G x ||G y ;

[0063] Where IDA_leng is the length of the preset user identity in bytes, A represents the first parameter of the elliptic curve, B represents the second parameter of the elliptic curve, G represents the length of the preset user identity in bytes, x represents the abscissa of the base point of the elliptic curve corresponding to the elliptic curve, G y The ordinate representing the base point of the elliptic curve corresponds to the elliptic curve.

[0064] It can be seen that in this optional embodiment, the first parameter generation unit generates the first parameter of the public key according to the parameters of the elliptic curve and the public key coordinates, providing input for the subsequent hash value calculation; the hash value generation unit calculates the hash value of the first parameter using the SM3 algorithm to obtain the static hash value of the key pair, thereby ensuring the security and consistency of the hash value. This implementation method further improves the uniqueness and security of the static hash value of the key pair by incorporating the elliptic curve parameters and the public key coordinates into the hash value calculation, thereby enhancing the reliability of the safety control system of the nuclear power control station.

[0065] In an optional embodiment, the verification request module includes:

[0066] A first hash value generating submodule, configured to generate server signature information according to a static hash value of the key pair corresponding to the preset server request information and the server key pair, and calculate a hash value for the server signature information using an SM3 algorithm to obtain a first hash value;

[0067] The signature verification initiator module uses the private key in the server key pair to encrypt the first hash value based on the SM2 algorithm, generates a server identity authentication request based on the encryption result, sends it to the nuclear power control client, and receives the server identity authentication confirmation information corresponding to the server identity authentication request.

[0068] In this optional embodiment, the server request information is a pre-generated random number, and generating the server signature information based on the preset server request information and the static hash value of the key pair corresponding to the server key pair refers to: concatenating the server request information with the static hash value of the key pair corresponding to the server key pair to obtain the server signature information.

[0069] It can be seen that in this optional embodiment, the first hash value generation submodule generates server-side signature information based on the static hash value of the key pair corresponding to the preset server-side request information and the server-side key pair, and uses the SM3 algorithm to calculate the hash value to obtain the first hash value, providing a basis for signature verification; the signature verification initiation submodule uses the private key in the server-side key pair to encrypt the first hash value based on the SM2 algorithm, generates a server-side identity authentication request, and receives the corresponding confirmation information, thereby realizing the security verification of the server-side identity. This implementation method ensures the unforgeability and integrity of the server-side identity authentication request by using the secure SM2 signature algorithm and SM3 hash algorithm, thereby improving the security of the safety control system of the nuclear power control station.

[0070] In an optional embodiment, the signature verification module includes:

[0071] A second hash value generating unit is used to receive a client identity authentication request from a nuclear power control client, parse the client identity authentication request, obtain signature information to be verified and client request information, generate client signature information according to a static hash value of the key pair corresponding to the client request information and the nuclear power control client key pair, calculate a hash value for the client signature information using an SM3 algorithm, and obtain a second hash value;

[0072] The signature verification unit is used to decrypt the signature information to be verified based on the public key in the nuclear power control client key pair and the SM2 algorithm, compare the decryption result with the second hash value, generate the client identity authentication confirmation information according to the comparison result, and send it to the nuclear power control client.

[0073] In this optional embodiment, the client request information is a pre-generated random number.

[0074] It can be seen that in this optional embodiment, the second hash value generation unit receives and parses the client identity authentication request, obtains the signature information to be verified and the client request information, generates the client signature information according to the static hash value of the key pair corresponding to the client request information and the nuclear power control client key pair, and uses the SM3 algorithm to calculate the hash value to obtain the second hash value, which provides a basis for signature verification; the signature verification unit uses the public key in the nuclear power control client key pair, decrypts the signature information to be verified based on the SM2 algorithm, and compares it with the second hash value, and generates the client identity authentication confirmation information according to the comparison result, thereby realizing the security verification of the client identity. This implementation method ensures the authenticity and integrity of the client identity authentication request by using the secure SM2 signature algorithm and SM3 hash algorithm, and improves the reliability of the safety control system of the nuclear power control station.

[0075] In an optional embodiment, the nuclear power control station safety control system further includes:

[0076] The log management module is used to record the statistical information of all the server identity authentication requests and the client identity authentication requests.

[0077] It can be seen that this optional embodiment realizes the monitoring and auditing of the operating status of the nuclear power control station safety control system by counting and recording the identity authentication requests, and provides data support for the maintenance and optimization of the system. At the same time, the introduction of the log management module also enhances the traceability and accountability of the system, which is of great significance for the analysis and processing of post-event safety incidents, and improves the completeness and reliability of the nuclear power control station safety control system.

[0078] like Figure 2 As shown, in an optional embodiment, the nuclear power control station safety control system further includes:

[0079] The data storage module is used to receive a data storage request from a nuclear power control client, parse the data storage request, obtain the data to be stored, use the SM3 algorithm to calculate a first data summary for the data to be stored, generate data to be encrypted based on the data to be stored and the first data summary, and use the SM4 algorithm to encrypt and store the data to be encrypted.

[0080] It can be seen that this optional embodiment ensures the integrity and confidentiality of stored data by using the secure SM3 hash algorithm and SM4 symmetric encryption algorithm, prevents the risk of data tampering or leakage, and improves the data security and reliability of the nuclear power control station safety control system.

[0081] like Figure 2As shown, in an optional embodiment, the nuclear power control station safety control system further includes:

[0082] A data reading module is used to receive a data reading request from a nuclear power control client, parse the data reading request, obtain a data identifier, read the data to be decrypted according to the data identifier, decrypt the data to be decrypted using the SM4 algorithm, parse the decryption result to obtain a second data summary and the data to be read, and verify the integrity of the data to be read using the SM3 algorithm according to the second data summary, and after the integrity verification is passed, send the data to be read to the nuclear power control client.

[0083] It can be seen that this optional embodiment ensures the confidentiality and integrity of the read data by using the secure SM4 symmetric encryption algorithm and SM3 hash algorithm, prevents the risk of data tampering or leakage, and improves the data security and reliability of the nuclear power control station safety control system.

[0084] In an optional embodiment, the control module includes:

[0085] A judgment submodule, used to judge the verification results of the server identity authentication request and the client identity authentication request, and determine whether the verification is passed;

[0086] The control submodule is used to receive a control request from a nuclear power control client, and when the verification is passed, perform integrity verification on the received control request, and process the control request after the integrity verification is passed.

[0087] It can be seen that in this optional embodiment, the judgment submodule judges the verification results of the server-side identity authentication request and the client-side identity authentication request, determines whether the verification is passed, and provides a basis for the subsequent processing of control requests; the control submodule receives the control request of the nuclear power control client, and when the verification is passed, performs integrity verification on the control request, and processes the control request after the integrity verification is passed, thereby ensuring the security and reliability of the control request; by judging the identity authentication results and verifying the integrity of the control request, the security and reliability of the control request processing by the nuclear power control station safety control system are improved, preventing illegal or tampered control requests from affecting the system.

[0088] In an optional embodiment, the control submodule includes:

[0089] A decryption unit, used to receive the encrypted control request from the nuclear power control client, and when the verification is passed, decrypt the control request according to the SM4 algorithm to obtain the first control request data;

[0090] an integrity verification unit, configured to parse the first control request data to obtain a third data summary and the second control request data, and perform integrity verification on the second control request data according to the third data summary and based on an SM3 algorithm;

[0091] A processing unit is used to process the control request according to the second control request data after the integrity verification of the second control request data is passed.

[0092] It can be seen that in this optional embodiment, the decryption unit receives the encrypted control request of the nuclear power control client, and when the verification is passed, uses the SM4 algorithm to decrypt, obtains the first control request data, and ensures the confidentiality of the control request; the integrity verification unit parses the first control request data, obtains the third data summary and the second control request data, and uses the SM3 algorithm to verify the integrity of the second control request data, ensuring the integrity of the control request; after the integrity verification is passed, the processing unit processes the control request according to the second control request data, and realizes the effective processing of the legitimate control request. This implementation method ensures the confidentiality and integrity of the control request by using the secure SM4 symmetric encryption algorithm and the SM3 hash algorithm, and improves the security and reliability of the nuclear power control station safety control system in processing the control request.

[0093] In summary, the present invention discloses a nuclear power control station security control system, which realizes efficient and secure two-way verification of the nuclear power control station by using a key pair based on preset elliptic curve parameters to generate a key pair static hash value. This method not only improves security and prevents identity impersonation and data tampering, but also improves the work efficiency of the system through optimized verification processes. Through this novel security control method, the data security of the nuclear power control station can be better protected, thereby maintaining the normal operation and nuclear safety of the nuclear power plant. Therefore, the present invention effectively overcomes the various shortcomings in the prior art and has a high industrial utilization value.

[0094] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A safety control system for a nuclear power control station, characterized in that: The nuclear power control station safety control system is connected to the nuclear power control client, and the nuclear power control station safety control system includes: An initialization module, used to generate a key pair static hash value for all key pairs and store it in a static storage area, wherein each of the key pairs is pre-generated based on a preset elliptic curve, and the key pairs include a server key pair and a nuclear power control client key pair; A verification request module, used to generate a server identity authentication request based on the static hash value of the key pair corresponding to the server key pair, and send it to the nuclear power control client, and receive server identity authentication confirmation information corresponding to the server identity authentication request; A signature verification module, used to receive a client identity authentication request from a nuclear power control client, verify the client identity authentication request based on the static hash value of the key pair corresponding to the nuclear power control client key pair, generate the client identity authentication confirmation information according to the verification result, and send it to the nuclear power control client; The control module is used to receive a control request from a nuclear power control client and process the control request based on the verification results of the server identity verification request and the client identity verification request.

2. A nuclear power control station safety control system according to claim 1, characterized in that: The initialization module includes: A key pair static hash value generation submodule, used to calculate a hash value for the public key in each of the key pairs using the SM3 algorithm to obtain a key pair static hash value corresponding to the key pair; The key pair static hash value storage submodule is used to generate a key-value pair for each key pair according to its public key and its corresponding key pair static hash value, and store the key-value pair in a static storage area.

3. A nuclear power control station safety control system according to claim 2, characterized in that: The key pair static hash value generation submodule includes: A first parameter generating unit, configured to generate, for a public key in each key pair, a first parameter of the public key according to the parameter of the elliptic curve and the coordinates of the public key corresponding to the elliptic curve; The hash value generating unit is used to calculate the hash value of the first parameter by using the SM3 algorithm to obtain the key pair static hash value corresponding to the key pair.

4. A nuclear power control station safety control system according to claim 1, characterized in that: The verification request module includes: A first hash value generating submodule, configured to generate server signature information according to a static hash value of the key pair corresponding to the preset server request information and the server key pair, and calculate a hash value for the server signature information using an SM3 algorithm to obtain a first hash value; The signature verification initiator module uses the private key in the server key pair to encrypt the first hash value based on the SM2 algorithm, generates a server identity authentication request based on the encryption result, sends it to the nuclear power control client, and receives the server identity authentication confirmation information corresponding to the server identity authentication request.

5. A nuclear power control station safety control system according to claim 1, characterized in that: The signature verification module includes: A second hash value generating unit is used to receive a client identity authentication request from a nuclear power control client, parse the client identity authentication request, obtain signature information to be verified and client request information, generate client signature information according to a static hash value of the key pair corresponding to the client request information and the nuclear power control client key pair, calculate a hash value for the client signature information using an SM3 algorithm, and obtain a second hash value; The signature verification unit is used to decrypt the signature information to be verified based on the public key in the nuclear power control client key pair and the SM2 algorithm, compare the decryption result with the second hash value, generate the client identity authentication confirmation information according to the comparison result, and send it to the nuclear power control client.

6. A nuclear power control station safety control system according to claim 1, characterized in that: The nuclear power control station safety control system also includes: The log management module is used to record the statistical information of all the server identity authentication requests and the client identity authentication requests.

7. A nuclear power control station safety control system according to claim 1, characterized in that: The nuclear power control station safety control system also includes: The data storage module is used to receive a data storage request from a nuclear power control client, parse the data storage request, obtain the data to be stored, use the SM3 algorithm to calculate a first data summary for the data to be stored, generate data to be encrypted based on the data to be stored and the first data summary, and use the SM4 algorithm to encrypt and store the data to be encrypted.

8. A nuclear power control station safety control system according to claim 1, characterized in that: The nuclear power control station safety control system also includes: A data reading module is used to receive a data reading request from a nuclear power control client, parse the data reading request, obtain a data identifier, read the data to be decrypted according to the data identifier, decrypt the data to be decrypted using the SM4 algorithm, parse the decryption result to obtain a second data summary and the data to be read, and verify the integrity of the data to be read using the SM3 algorithm according to the second data summary, and after the integrity verification is passed, send the data to be read to the nuclear power control client.

9. A nuclear power control station safety control system according to claim 1, characterized in that: The control module comprises: A judgment submodule, used to judge the verification results of the server identity authentication request and the client identity authentication request, and determine whether the verification is passed; The control submodule is used to receive a control request from a nuclear power control client, and when the verification is passed, perform integrity verification on the received control request, and process the control request after the integrity verification is passed.

10. A nuclear power control station safety control system according to claim 1, characterized in that: The control submodule comprises: A decryption unit, used to receive the encrypted control request from the nuclear power control client, and when the verification is passed, decrypt the control request according to the SM4 algorithm to obtain the first control request data; an integrity verification unit, configured to parse the first control request data to obtain a third data summary and the second control request data, and perform integrity verification on the second control request data according to the third data summary and based on an SM3 algorithm; A processing unit is used to process the control request according to the second control request data after the integrity verification of the second control request data is passed.

Images