Authentication system

Abstract

The invention discloses an authentication system. Comprising an affirmation protocol subsystem configured with an affirmation protocol; the equipment management subsystem and the authorization management subsystem are respectively connected with the affirmation protocol subsystem, and respectively extract a corresponding equipment affirmation protocol, a corresponding user affirmation protocol and a corresponding certificate affirmation protocol from the affirmation protocol subsystem; the equipment management subsystem is connected with edge equipment in the power equipment system, and is used for activating the edge equipment under the condition that the edge equipment is successfully identified based on an equipment identification protocol; the authorization management subsystem identifies an operator of the edge equipment which is successfully identified through a user identification protocol and identifies a certificate of the operator through a certificate identification protocol for the edge equipment which is successfully identified, and if the operator of the edge equipment and the certificate of the operator are successfully identified, the authorization management subsystem identifies the operator of the edge equipment and the certificate of the operator; and setting the operation authority of the operator to the edge equipment. And multiple affirmations are carried out on the equipment and the operators in sequence, so that the equipment safety is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of power system control, and in particular to an authentication system. Background Art

[0002] In the power system, unified regulation of electricity, equipment and energy can facilitate the control of resource systems. However, in a complex power system environment, especially for the Dianhong operating system used in the power system, the Dianhong operating system is an interconnected, open and shared power Internet of Things system built for new power systems and new energy systems. The control process of the Dianhong operating system is relatively complicated. When controlling the Dianhong operating system, it is usually directly controlled by personnel. Since the Dianhong operating system involves a large number of equipment and personnel, the management of equipment and personnel identity permissions is of paramount importance. If there is a problem with identity permission management, it will lead to security risks during the operation of the Dianhong operating system, resulting in data loss or modification, or even the collapse of the entire Dianhong system. Therefore, authenticating the equipment and personnel corresponding to the Dianhong operating system is an urgent problem to be solved. There is no system in the prior art that can accurately perform comprehensive authentication of equipment and personnel. Summary of the invention

[0003] The present invention provides an authentication system to solve the problem that it is impossible to perform comprehensive authentication on a complex power system.

[0004] According to one aspect of the present invention, there is provided an authentication system, comprising:

[0005] The authentication protocol subsystem is configured with authentication protocols, wherein the authentication protocols include device authentication protocols, user authentication protocols and certificate authentication protocols; the device authentication protocol represents the device authentication process and authentication specifications for edge devices, the user authentication protocol represents the authentication process and authentication specifications for edge device operators, and the certificate authentication protocol represents the certificate authentication process and authentication specifications;

[0006] The device management subsystem is connected to the identification protocol subsystem, extracts the device identification protocol from the identification protocol subsystem; is connected to the edge device in the power equipment system, performs device identification on the edge device based on the device identification protocol, and activates the edge device if the device identification is successful;

[0007] The authorization management subsystem is connected to the identification protocol subsystem, and extracts the user identification protocol and the certificate identification protocol from the identification protocol subsystem; for edge devices with successful device identification, the operator of the edge device is identified through the user identification protocol, and the operator's certificate is identified through the certificate identification protocol; when the operator of the edge device is successfully identified and the operator's certificate is successfully identified, the operator's operating authority for the edge device is set based on the operator's certificate identification.

[0008] Optionally, a zero trust mechanism is configured in the identification protocol subsystem; the zero trust mechanism includes identification trigger conditions; based on the zero trust mechanism, the authorization management subsystem, when it detects that any edge device meets the identification trigger conditions, identifies the operator of the edge device and the operator's certificate, and updates the operator's operating authority for the edge device.

[0009] Optionally, a mutual trust mechanism is configured in the recognition protocol subsystem; the mutual trust mechanism includes trust conditions for establishing a mutual trust relationship between edge devices; the authorization management subsystem is based on the mutual trust mechanism, and when it is detected that at least two edge devices meet the trust conditions, establishes a mutual trust relationship between at least two edge devices, wherein the edge devices that establish the mutual trust relationship share data.

[0010] Optionally, the device management subsystem includes: a device identification module, a device activation module and a device data management module; wherein the device identification module is used to perform device identification on the edge device based on the device identification protocol; the device activation module is used to request a device activation code from the cloud when the edge device is successfully identified, and activate the edge device based on the device activation code; the device data management module is used to update the status information of the edge device, receive the business data and log data of the edge device, store the business data and log data of the edge device, and transmit the business data of the edge device to the business end.

[0011] Optionally, the authorization management subsystem includes: an information configuration module, a personnel identification module and a certificate identification module; wherein the information configuration module is configured with the correspondence between the edge device and the operator; the personnel identification module is used to obtain the edge device information of the device that has been successfully identified, and determine the operator information corresponding to the edge device information based on the correspondence between the edge device and the operator; the operator of the edge device is identified based on the operator information; the certificate identification module obtains the certificate corresponding to the operator of the edge device and identifies the certificate when the operator of the edge device is successfully identified.

[0012] Optionally, the authorization management subsystem also includes: an activation code generation module and an activation code management module; wherein the activation code generation module configures an activation code generation algorithm and generates an activation code based on the activation code generation algorithm; the personnel identification module matches and authenticates the activation code, edge device and operator of the edge device; and the activation code management module scraps the used activation code after matching and authentication.

[0013] Optionally, the recognition protocol subsystem also includes a certificate generation module, a certificate management module and a certificate storage module; wherein the certificate generation module is used to generate an operator's certificate in response to an operator's certificate request, and the certificate includes a temporary certificate and a formal certificate; the certificate storage module is used to store the certificates of each operator; the certificate management module includes multiple management conditions, and performs management operations on the stored certificates based on the multiple management conditions, and the management operations include one or more of the conversion operation of temporary certificates and formal certificates, the certificate validity period management operation, the certificate revocation operation, the certificate validity period update operation and the certificate information recording operation.

[0014] Optionally, the authentication system also includes: a cloud-edge certificate subsystem, which includes an algorithm module, in which multiple key generation algorithms are configured; a recognition protocol subsystem is connected to the cloud-edge certificate subsystem, and the recognition protocol subsystem also includes a key management module, which reads the key generation algorithm from the algorithm module, generates a certificate key based on the key generation algorithm, and encrypts the certificate through the certificate key; an authorization management subsystem is connected to the cloud-edge certificate subsystem, reads the key generation algorithm from the algorithm module, generates a certificate key based on the key generation algorithm, and decrypts the encrypted certificate through the certificate key.

[0015] Optionally, the cloud-edge certificate subsystem also includes: an information protection module and a security risk event reporting module; the information protection module is used to provide security protection for the information to be protected in the authorization management subsystem and the device management subsystem; the security risk event reporting module detects security risk events in the authentication system and reports the event when a security risk event is detected.

[0016] Optionally, the cloud-edge certificate subsystem also includes: a certificate log module, which is used to store log information corresponding to the certificate generation operation performed by the certificate generation module, and to store log information corresponding to the management operation performed by the certificate management module.

[0017] The technical solution of the embodiment of the present invention is configured with an identification protocol through an identification protocol subsystem, wherein the identification protocol includes a device identification protocol, a user identification protocol and a certificate identification protocol; the device identification protocol represents the device identification process and identification specifications for the edge device, the user identification protocol represents the identification process and identification specifications for the operator of the edge device, and the certificate identification protocol represents the certificate identification process and identification specifications; the device management subsystem is connected to the identification protocol subsystem, and extracts the device identification protocol from the identification protocol subsystem; it is connected to the edge device in the power equipment system, performs device identification on the edge device based on the device identification protocol, and activates the edge device when the device identification is successful; the authorization management subsystem is connected to the identification protocol subsystem, and extracts the user identification protocol and the certificate identification protocol from the identification protocol subsystem; for the edge device with successful device identification, the operator of the edge device is identified through the user identification protocol, and the operator's certificate is identified through the certificate identification protocol; when the operator of the edge device is successfully identified and the operator's certificate is successfully identified, the operator's operating authority for the edge device is set based on the operator's certificate identification. This solution performs multiple authentications on edge devices and corresponding operators in sequence. When the device corresponding to the edge device is successfully identified, the operator corresponding to the edge device and the operator's certificate are identified. When both the operator corresponding to the edge device and the operator's certificate are successfully identified, the operator's operating authority for the edge device is set according to the operator's certificate. This solves the problem of being unable to identify equipment and personnel in complex power operating systems, and can perform targeted and comprehensive identification of edge devices and corresponding operators, improving the accuracy and security of identification of equipment and personnel management in complex operating systems, helping to improve the security of data in the power system and improve the stability of the power system.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a structural diagram of an authentication system provided by an embodiment of the present invention;

[0021] Figure 2 It is a structural diagram of an identification protocol subsystem provided by an embodiment of the present invention;

[0022] Figure 3 It is a structural diagram of a device management subsystem provided by an embodiment of the present invention;

[0023] Figure 4 It is a structural diagram of an authorization management subsystem provided by an embodiment of the present invention;

[0024] Figure 5 It is a structural diagram of a cloud-edge certificate subsystem provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Figure 1 FIG. 1 is a schematic diagram of the structure of an authentication system provided by an embodiment of the present invention. Figure 1As shown, the authentication system 100 includes: an identification protocol subsystem 110, which is configured with an identification protocol, wherein the identification protocol includes a device identification protocol, a user identification protocol and a certificate identification protocol; the device identification protocol represents the device identification process and identification specifications for the edge device, the user identification protocol represents the identification process and identification specifications for the operator of the edge device, and the certificate identification protocol represents the certificate identification process and identification specifications; the device management subsystem 120 is connected to the identification protocol subsystem 110, and extracts the device identification protocol from the identification protocol subsystem 110; is connected to the edge device in the power equipment system, performs device identification on the edge device based on the device identification protocol, and activates the edge device when the device identification is successful; the authorization management subsystem 130 is connected to the identification protocol subsystem 110, and extracts the user identification protocol and the certificate identification protocol from the identification protocol subsystem 110; for the edge device with successful device identification, the operator of the edge device is identified through the user identification protocol, and the certificate of the operator is identified through the certificate identification protocol; when the operator of the edge device is successfully identified and the certificate of the operator is successfully identified, the operator's operating authority for the edge device is set based on the operator's certificate identification.

[0028] Among them, the identification protocol subsystem 110 can be specifically understood as a system for configuring corresponding identification protocols for each edge device and the operator corresponding to each edge device. The identification protocols configured in the identification protocol subsystem 110 include but are not limited to device identification protocols, user identification protocols and certificate identification protocols. The device identification protocol specifically represents the device identification process and identification specifications for edge devices. The edge device can be specifically understood as a device used to provide operation functions for power system operators, as a medium between operators and power equipment. For example, edge devices include but are not limited to mobile terminal devices and computers. The device identification process can be specifically understood as the operation steps set for device identification. The identification specifications specifically refer to the operation specifications corresponding to each operation step in the device identification process, including but not limited to the information format of the device identification information in each identification operation step and the judgment conditions for successful identification and security requirements. The identification information includes but is not limited to the device model information, device status information and device registration information of the edge device. The judgment conditions are specifically set according to the device identification steps of the device and can be adjusted according to the actual device identification situation. For example. If the device identification step includes device status verification, device model verification and device registration information verification, the judgment condition corresponding to the device status verification is set to that the device status must be in an idle state, the judgment condition corresponding to the device model verification can be set to that the device model should belong to a device model that has completed registration, and the judgment condition corresponding to the device registration information verification is that the device registration information meets the verification standard corresponding to the registration information. The user identification protocol specifically represents the user identification process and identification specifications set for identifying the operator corresponding to the edge device. The user identification process specifically refers to the operation steps for identifying the operator who operates the edge device. The identification specifications specifically refer to the operation specifications corresponding to each identification operation step, including but not limited to the information format of the user identification information in each identification operation step and the judgment conditions for successful identification. The user identification information includes but is not limited to the verification password and the user's biometric information. The user's biometric information includes but is not limited to the user's fingerprint and facial recognition information. The judgment conditions are specifically set according to the user identification steps of the operator. The certificate authentication protocol specifically represents the certificate authentication process and authentication specifications. The certificate authentication process specifically refers to the operational steps for authenticating the certificate corresponding to the operator. The authentication specifications specifically refer to the operational specifications corresponding to each authentication operation step, including but not limited to the information format of the certificate authentication information in each authentication operation step and the judgment conditions for successful authentication. The certificate authentication information includes but is not limited to the certificate content, certificate key and certificate authority corresponding to the operator of the edge device. The operating authority of the operator of the edge device can be set through the certificate corresponding to the operator.

[0029] The device management subsystem 120 is connected to the identification protocol subsystem 110 and is also connected to the edge device in the power device system. The device management subsystem 120 can extract the device identification protocol related to the edge device from the identification protocol subsystem 110, and then identify the edge device according to the device identification protocol. Specifically, the edge device is identified according to the protocol identification process and identification specification in the device identification protocol, and the identification result of the edge device is obtained. If the identification result is that the device identification is successful, the activation process is performed on the edge device that has been successfully identified. If the identification result is that the device identification fails, the corresponding abnormal information is generated and fed back to the target console to remind relevant staff to conduct verification.

[0030] The authorization management subsystem 130 specifically represents a system for authorization management of edge devices, operators corresponding to edge devices, and certificates of operators. The authorization management subsystem 130 is connected to the identification protocol subsystem 110, and can extract the user identification protocol and the certificate identification protocol from the identification protocol subsystem 110, which is used to identify the operator corresponding to the edge device that has successfully identified the device. Specifically, the identity of the operator is identified by executing the user identification process and identification specification corresponding to the user identification protocol. When the identity of the operator is successfully identified, the certificate of the operator is identified by executing the certificate identification process corresponding to the certificate identification protocol to obtain the certificate identification result. When the certificate identification result is successful, the operator is set to have the operation authority for the edge device through the operator's certificate. It should be noted that when each operator is authorized with a certificate, the operation authority of the operator can be set in the certificate, and then when the certificate authentication is successful, the operation authority is opened for the corresponding operator according to the operation authority in the certificate.

[0031] Optionally, a zero trust mechanism is configured in the identification protocol subsystem 110; the zero trust mechanism includes identification trigger conditions; based on the zero trust mechanism, the authorization management subsystem 130, when it is detected that any edge device meets the identification trigger conditions, performs identification processing on the operator of the edge device and the operator's certificate, and updates the operator's operating authority for the edge device.

[0032] Among them, the zero trust mechanism specifically represents that after the edge device is successfully authenticated, the edge device is not permanent information, but a mechanism that requires the operator corresponding to the edge device to be identified when the edge device is operated again, ensuring the security and reliability of the edge device and operator authentication, based on the principle of never trusting and always verifying, to implement fine-grained access control strategies and dynamically evaluate the trust status of edge devices. The zero trust mechanism includes an identification trigger condition. For example, if the edge device does not perform any operation within a preset time period after the successful identification, then when the edge device is operated again, the identification operation of the operator corresponding to the edge device is triggered; it can also be set that after the business operation task of the edge device is completed, when the edge device is operated again, the identification operation of the operator corresponding to the edge device is triggered; it can also be set that when the corresponding operator is detected to have changed after the successful identification, the identification operation of the edge device and the corresponding operator is triggered. It should be noted that the identification trigger condition can be set according to the actual situation.

[0033] Specifically, for any edge device, when it is detected that the edge device meets the identification trigger conditions set by the zero trust mechanism, the user identification agreement and certificate identification agreement are obtained, and the operator and the operator's certificate corresponding to the edge device are identified again. If the identification is successful, the operating permissions for the edge device are reset for the current operator.

[0034] Optionally, a mutual trust mechanism is configured in the recognition protocol subsystem 110; the mutual trust mechanism includes trust conditions for establishing a mutual trust relationship between edge devices; the authorization management subsystem 130 establishes a mutual trust relationship between at least two edge devices based on the mutual trust mechanism, when it is detected that at least two edge devices meet the trust conditions, wherein the edge devices that establish the mutual trust relationship share data.

[0035] Among them, the mutual trust mechanism specifically represents a cross-domain certificate mutual trust mechanism, which is used to establish trust between devices in different domains so that devices in different domains are in a state of mutual trust, and devices in different domains can share data. The mutual trust mechanism includes trust conditions for establishing a mutual trust relationship between edge devices. A corresponding device trust certificate can be assigned to each successfully identified device, so that devices are identified through device trust certificates, and successfully identified devices are in a state of mutual trust. Data can be shared between devices in a state of mutual trust. Trust mapping relationships between devices in different domains can also be pre-set. For successfully identified edge devices, it is determined whether the successfully identified edge devices are in a state of mutual trust based on the trust mapping relationship. If different edge devices are in a state of mutual trust, it is determined that different edge devices meet the trust conditions.

[0036] Specifically, the authorization management subsystem 130 obtains the trust conditions corresponding to the mutual trust mechanism from the identification protocol subsystem 110, and can match the device information corresponding to the edge device that has been successfully identified with the trust conditions to determine whether the trust conditions are met between the edge devices that have been successfully identified. If at least two edge devices are detected to meet the trust conditions, a mutual trust relationship is established between at least two edge devices. The edge devices that have established a mutual trust relationship can share data, so that operators can obtain data from other edge devices in a timely manner, which helps to improve business processing efficiency. Exemplarily, if at least two edge devices are detected to meet the trust conditions, for any edge device, other devices that meet the trust conditions will be updated in the list of sharable devices of the edge device, and operators can select other edge devices for data sharing according to actual needs.

[0037] Optionally, the device management subsystem 120 includes: a device identification module 1201, a device activation module 1202 and a device data management module 1203; wherein the device identification module 1201 is used to perform device identification on the edge device based on the device identification protocol; the device activation module 1202 is used to request a device activation code from the cloud when the edge device is successfully identified, and activate the edge device based on the device activation code; the device data management module 1203 is used to update the status information of the edge device, receive the business data and log data of the edge device, store the business data and log data of the edge device, and transmit the business data of the edge device to the business end.

[0038] Specifically, Figure 2The schematic diagram of the structure of the device management subsystem 120 shown in the figure, the device management subsystem 120 includes a device identification module 1201, a device activation module 1202 and a device data management module 1203. The device identification module 1201 obtains the device identification protocol, and performs device identification on the edge device through the device identification process and identification specification in the device identification protocol, and obtains the device identification result. When the device activation module 1202 identifies that the device identification result of the edge device is successful, it sends a request to obtain the device activation code to the cloud, receives the device activation code returned by the cloud, and performs activation processing on the edge identification according to the device activation code. When the activation processing is successful, the edge device is in a running state, and the device activation module 1202 can transmit the device activation state to the device data management module 1203. The device data management module 1203 receives the edge device activation status sent by the device activation module 1202, and updates the status of the corresponding edge device according to the edge device activation status, or sends a request for obtaining the device activation status to the device activation module 1202 to obtain the activation status of the edge device, and updates the status of the corresponding edge device according to the obtained edge device activation status. For example, if the activation status is successful activation, the status information of the edge device is set to the running status, and if the activation status is failed activation, the status information of the edge device is set to the idle status. In addition, the device data management module 1203 can also receive the business data and log data of the edge device, wherein the business data specifically refers to the data generated by the edge device during the execution of business operations, and the log data specifically refers to the data generated by the edge device during operation, including but not limited to the data generated by the device identification operation, the data generated by the device activation operation, and the data generated by the device data interaction. The device data management module 1203 can store the business data and log data of the edge device, and transmit the business data of the edge device to the business end. There is no need to transmit the log data to the business end, so as to avoid wasting storage resources on the task end. If the business end needs log data, it can send a request to the device data management module 1203. The device data management module 1203 extracts the corresponding log data according to the received request and transmits it to the business end.

[0039] Optionally, the authorization management subsystem 130 includes: an information configuration module 1301, a personnel identification module 1302 and a certificate identification module 1303; wherein the information configuration module 1301 is configured with the correspondence between the edge device and the operator; the personnel identification module 1302 is used to obtain the edge device information of the device that has been successfully identified, and determine the operator information corresponding to the edge device information based on the correspondence between the edge device and the operator; identify the operator of the edge device based on the operator information; the certificate identification module 1303, when the operator of the edge device is successfully identified, obtains the certificate corresponding to the operator of the edge device and identifies the certificate.

[0040] Specifically, Figure 3 The structural diagram of the authorization management subsystem 130 shown includes an information configuration module 1301, a personnel identification module 1302 and a certificate identification module 1303. The corresponding relationship between the edge device and the operator can be configured by the information configuration module 1301, and the corresponding relationship between the edge device and the operator can be adjusted according to the actual situation. The personnel identification module 1302 sends a data request to the edge device where the device is successfully identified, obtains the edge device information corresponding to the edge device, and matches the edge device information in the corresponding relationship between the edge device and the operator to obtain the operator information matching the edge device information; then, the operator operating the edge device is identified according to the matched operator information to obtain the operator identification result. The certificate identification module 1303, when detecting that the operator identification result is successful, obtains the certificate corresponding to the operator of the edge device, and then performs identification processing on the certificate through the corresponding certificate identification protocol.

[0041] Optionally, the authorization management subsystem 130 also includes: an activation code generation module 1305 and an activation code management module 1304; wherein the activation code generation module 1305 configures an activation code generation algorithm and generates an activation code based on the activation code generation algorithm; the personnel identification module 1302 matches and authenticates the activation code, the edge device and the operator of the edge device; and the activation code management module 1304 scraps the used activation code after matching and authentication.

[0042] Specifically, Figure 3The structural diagram of the authorization management subsystem 130 shown in the figure also includes an activation code generation module 1305 and an activation code management module 1304. The activation code generation module 1305 is configured with an activation code generation algorithm, and the activation code is generated by calling the activation code generation algorithm. The activation code generation algorithm includes but is not limited to a random string algorithm, an algorithm for generating an activation code based on time information, and an algorithm for generating an activation code based on hardware information. The activation code generation module 1305 can generate a corresponding activation code for it according to the received activation code request. After the activation code is generated, the activation code, the edge device, and the operator of the edge device need to be matched and authenticated by the personnel identification module 1302 to ensure that the activation code, the edge device, and the operator of the edge device are one-to-one corresponding, thereby avoiding the problem of activation code activating other devices and avoiding the problem of operators operating beyond their level. After detecting that the activation code, the edge device, and the operator of the edge device have successfully matched and authenticated, the activation code management module 1304 scraps the used activation code to avoid repeated use of the activation code, avoid using the activation code to activate different devices or reactivate the same device, and improve the security of the device.

[0043] Optionally, the recognition protocol subsystem 110 also includes a certificate generation module 1101, a certificate management module 1102 and a certificate storage module 1103; wherein the certificate generation module 1101 is used to generate an operator's certificate in response to an operator's certificate request, and the certificate includes a temporary certificate and a formal certificate; the certificate storage module 1103 is used to store the certificates of each operator; the certificate management module 1102 includes multiple management conditions, and performs management operations on the stored certificates based on the multiple management conditions, and the management operations include one or more of the conversion operation of temporary certificates and formal certificates, the certificate validity period management operation, the certificate revocation operation, the certificate validity period update operation and the certificate information recording operation.

[0044] Specifically, Figure 4The structural diagram of the identification protocol subsystem 110 shown in the figure also includes a certificate generation module 1101, a certificate management module 1102 and a certificate storage module 1103. Among them, the certificate generation module 1101 can receive a certificate request sent by an operator, and generate a certificate of the operator according to the received certificate request. The certificate includes a temporary certificate and a formal certificate. The corresponding temporary certificate or formal certificate is generated according to the received certificate request. The scope of use of the temporary certificate can be temporarily used by the staff of the power system to associate other equipment, thereby improving the coordination of the operation of the power system. The certificate storage module 1103 is used to store the certificates of each operator. The certificate management module 1102 includes multiple management conditions, which include but are not limited to the management conditions for the conversion of temporary certificates and formal certificates, the validity period of certificates, certificate revocation, the renewal of the validity period of certificates and the recording of certificate information. The corresponding management conditions can be set in advance according to the attributes of the certificate. Then, the certificate is managed according to the management operations corresponding to the multiple management conditions. The management operations include but are not limited to the conversion operation between the temporary certificate and the formal certificate, the certificate validity period management operation, the certificate revocation operation, the certificate validity period update operation and the certificate information recording operation. The conversion operation between the temporary certificate and the formal certificate can convert the temporary certificate and the formal certificate to each other. The temporary certificate can be converted into a formal certificate according to the actual usage, or the formal certificate can be converted into a temporary certificate. The certificate information can be matched with the management conditions to determine the management conditions corresponding to the certificate. If the certificate meets the corresponding management conditions, the corresponding management operation is performed. Exemplarily, if a certificate conversion request is received or the certificate meets the trigger conditions corresponding to the conversion operation, the conversion operation between the temporary certificate and the formal certificate can be performed, that is, the temporary certificate is converted into a formal certificate; if it is identified that the current time corresponding to the certificate has exceeded the validity period or the certificate is detected to have an illegal operation, the certificate is revoked; if a certificate time limit update request is received or the certificate is detected to meet compliance, the certificate validity period update operation is performed to update the validity period of the certificate. The management conditions corresponding to different management operations can be adjusted according to the actual usage of the certificate.

[0045] Optionally, the authentication system 100 also includes: a cloud-edge certificate subsystem 140, the cloud-edge certificate subsystem 140 includes an algorithm module 1401, and the algorithm module 1401 is configured with multiple key generation algorithms; the recognition protocol subsystem 110 is connected to the cloud-edge certificate subsystem 140, and the recognition protocol subsystem 110 also includes a key management module 1104, the key management module 1104 reads the key generation algorithm from the algorithm module 1401, generates a certificate key based on the key generation algorithm, and encrypts the certificate through the certificate key; the authorization management subsystem 130 is connected to the cloud-edge certificate subsystem 140, reads the key generation algorithm from the algorithm module 1401, generates a certificate key based on the key generation algorithm, and decrypts the encrypted certificate through the certificate key.

[0046] The cloud-edge certificate subsystem 140 can be specifically understood as a system for determining a cloud-edge mutual trust certificate, and a trust relationship between the cloud and edge devices is established by setting a cloud-edge mutual trust certificate. The cloud-edge certificate subsystem 140 includes an algorithm module 1401, and the algorithm module 1401 is configured with multiple key generation algorithms, including but not limited to RSA algorithm, ECC algorithm, hash algorithm and key exchange algorithm.

[0047] Specifically, the recognition protocol subsystem 110 is connected to the cloud edge certificate subsystem 140, and the recognition protocol subsystem 110 also includes a key management module 1104. The key management module 1104 can read the key generation algorithm from the algorithm module 1401, generate the certificate key of the corresponding certificate through the key generation algorithm, and encrypt the certificate through the certificate key to enhance the credibility of the certificate. The authorization management subsystem 130 is connected to the cloud edge certificate subsystem 140, and in the case of decrypting the encrypted certificate, reads the key generation algorithm from the algorithm module 1401, generates the certificate key of the encrypted certificate based on the key generation algorithm, and decrypts the encrypted certificate through the certificate key.

[0048] Optionally, the cloud-edge certificate subsystem 140 also includes: an information protection module 1402 and a security risk event reporting module 1403; the information protection module 1402 is used to provide security protection for the information to be protected in the authorization management subsystem 130 and the device management subsystem 120; the security risk event reporting module 1403 detects security risk events in the authentication system 100 and reports the events when security risk events are detected.

[0049] Specifically, Figure 5The schematic diagram of the structure of the cloud edge certificate subsystem 140 is shown. The cloud edge certificate subsystem 140 also includes an information protection module 1402 and a security risk event reporting module 1403. The information protection module 1402 provides security protection for the information to be protected in the authorization management subsystem 130 and the device management subsystem 120. The information to be protected can be specifically understood as sensitive information and important information appearing in the authorization management subsystem 130 and the device management subsystem 120. For example, sensitive information includes but is not limited to device information and biometric information and certificate information corresponding to the operator, and important information includes but is not limited to business data and log information of the device operation. The security risk event reporting module 1403 can detect security risk events on the authentication system 100, specifically detecting whether there are authentication operations that do not comply with the authentication process and authentication specifications during the operation of the authentication system 100, and whether there are suspicious information in the authentication information of the operator. It should be noted that the security risk event can be set according to the actual security requirements. When the security risk event is detected, the security risk event reporting module 1403 will report the detected security risk event.

[0050] Optionally, the cloud-edge certificate subsystem 140 also includes: a certificate log module 1404, which is used to store log information corresponding to the certificate generation operation performed by the certificate generation module 1101, and to store log information corresponding to the management operation performed by the certificate management module 1102.

[0051] Specifically, the cloud-edge certificate subsystem 140 also includes a certificate log module 1404, which stores the log information generated by the certificate generation module 1101 performing the certificate generation operation, and stores the log information generated by the certificate management module 1102 performing the management operation, thereby ensuring that the audit is traceable, facilitating the location of problems in the certificate generation process and the certificate management operation process, and avoiding illegal authorization operations on certificates, thereby improving the security and reliability of the authentication system 100 and enhancing the credibility and traceability of certificates.

[0052] The technical solution of this embodiment is configured with an identification protocol through an identification protocol subsystem, wherein the identification protocol includes a device identification protocol, a user identification protocol and a certificate identification protocol; the device identification protocol represents the device identification process and identification specifications for edge devices, the user identification protocol represents the identification process and identification specifications for operators of edge devices, and the certificate identification protocol represents the certificate identification process and identification specifications; the device management subsystem is connected to the identification protocol subsystem, and extracts the device identification protocol from the identification protocol subsystem; it is connected to the edge devices in the power equipment system, performs device identification on the edge devices based on the device identification protocol, and activates the edge devices when the device identification is successful; the authorization management subsystem is connected to the identification protocol subsystem, and extracts the user identification protocol and the certificate identification protocol from the identification protocol subsystem; for edge devices with successful device identification, the operator of the edge device is identified through the user identification protocol, and the operator's certificate is identified through the certificate identification protocol; when the operator of the edge device is successfully identified and the operator's certificate is successfully identified, the operator's operating authority for the edge device is set based on the operator's certificate identification. This solution performs multiple authentications on edge devices and corresponding operators in sequence. When the device corresponding to the edge device is successfully identified, the operator corresponding to the edge device and the operator's certificate are identified. When both the operator corresponding to the edge device and the operator's certificate are successfully identified, the operator's operating authority for the edge device is set according to the operator's certificate. This solves the problem of being unable to identify equipment and personnel in complex power operating systems, and can identify edge devices and corresponding operators in a targeted manner, improving the accuracy and security of identifying equipment and personnel management in complex operating systems, helping to improve the security of data in the power system and improve the stability of the power system.

Claims

1. An authentication system, characterized in that: include: The identification protocol subsystem is configured with an identification protocol, wherein the identification protocol includes a device identification protocol, a user identification protocol and a certificate identification protocol; the device identification protocol represents the device identification process and identification specification of the edge device, the user identification protocol represents the identification process and identification specification of the operator of the edge device, and the certificate identification protocol represents the certificate identification process and identification specification; The device management subsystem is connected to the identification protocol subsystem, extracts the device identification protocol from the identification protocol subsystem, is connected to the edge device in the power device system, performs device identification on the edge device based on the device identification protocol, and activates the edge device if the device identification is successful; The authorization management subsystem is connected to the identification protocol subsystem, and extracts the user identification protocol and the certificate identification protocol from the identification protocol subsystem; for edge devices with successful device identification, the operator of the edge device is identified through the user identification protocol, and the certificate of the operator is identified through the certificate identification protocol; when the operator of the edge device is successfully identified and the certificate of the operator is successfully identified, the operator's operating authority for the edge device is set based on the operator's certificate identification.

2. The authentication system according to claim 1, characterized in that: The identification protocol subsystem is configured with a zero trust mechanism; the zero trust mechanism includes an identification trigger condition; Based on the zero trust mechanism, the authorization management subsystem, when detecting that any of the edge devices meets the identification trigger condition, performs identification processing on the operator of the edge device and the operator's certificate, and updates the operator's operating authority for the edge device.

3. The authentication system according to claim 1, characterized in that: The identification protocol subsystem is configured with a mutual trust mechanism; the mutual trust mechanism includes trust conditions for establishing a mutual trust relationship between edge devices; Based on the mutual trust mechanism, the authorization management subsystem establishes a mutual trust relationship between the at least two edge devices when detecting that at least two edge devices satisfy the trust condition, wherein the edge devices that establish the mutual trust relationship share data.

4. The authentication system according to claim 1, characterized in that: The device management subsystem includes: a device identification module, a device activation module and a device data management module; Wherein, the device identification module is used to perform device identification on the edge device based on the device identification protocol; The device activation module is used to request a device activation code from the cloud when the edge device is successfully identified, and activate the edge device based on the device activation code; The device data management module is used to update the status information of the edge device, receive the business data and log data of the edge device, store the business data and log data of the edge device, and transmit the business data of the edge device to the business end.

5. The authentication system according to claim 1, characterized in that: The authorization management subsystem includes: an information configuration module, a personnel identification module and a certificate identification module; Wherein, the information configuration module is configured with a correspondence between edge devices and operators; The personnel identification module is used to obtain edge device information of which the device has been successfully identified, determine the operator information corresponding to the edge device information based on the correspondence between the edge device and the operator; and identify the operator of the edge device based on the operator information; The certificate authentication module obtains the certificate corresponding to the operator of the edge device and authenticates the certificate when the operator of the edge device is successfully authenticated.

6. The authentication system according to claim 5, characterized in that: The authorization management subsystem also includes: an activation code generation module and an activation code management module; Wherein, the activation code generation module configures an activation code generation algorithm and generates an activation code based on the activation code generation algorithm; The personnel identification module performs matching authentication on the activation code, the edge device and the operator of the edge device; The activation code management module discards the used activation code after matching and authentication.

7. The authentication system according to claim 1 or 5, characterized in that: The authentication protocol subsystem also includes a certificate generation module, a certificate management module and a certificate storage module; The certificate generation module is used to generate a certificate of the operator in response to a certificate request of the operator, wherein the certificate includes a temporary certificate and a formal certificate; The certificate storage module is used to store the certificates of each operator; The certificate management module includes multiple management conditions, and performs management operations on the stored certificates based on the multiple management conditions. The management operations include one or more of the conversion operation between the temporary certificate and the formal certificate, the certificate validity period management operation, the certificate revocation operation, the certificate validity period update operation and the certificate information recording operation.

8. The authentication system according to claim 7, characterized in that: The authentication system further includes: a cloud-edge certificate subsystem, the cloud-edge certificate subsystem including an algorithm module, the algorithm module being configured with a plurality of key generation algorithms; The authentication protocol subsystem is connected to the cloud-edge certificate subsystem, and the authentication protocol subsystem further includes a key management module, which reads the key generation algorithm from the algorithm module, generates a certificate key based on the key generation algorithm, and encrypts the certificate by using the certificate key; The authorization management subsystem is connected to the cloud-edge certificate subsystem, reads the key generation algorithm from the algorithm module, generates a certificate key based on the key generation algorithm, and decrypts the encrypted certificate using the certificate key.

9. The authentication system according to claim 8, wherein the cloud-edge certificate subsystem further comprises: Information protection module and security risk incident reporting module; The information protection module is used to provide security protection for the information to be protected in the authorization management subsystem and the device management subsystem; The potential safety hazard event reporting module detects potential safety hazard events on the authentication system and reports the events when the potential safety hazard events are detected.

10. The authentication system according to claim 8, wherein the cloud-side certificate subsystem further comprises: The certificate log module is used to store the log information corresponding to the certificate generation operation performed by the certificate generation module, and to store the log information corresponding to the management operation performed by the certificate management module.

Images