Trusted DCS upper computer application software identity verification method, system, device and medium

Abstract

The invention discloses a trusted DCS upper computer application software identity verification method, system, device, medium and program, and belongs to the technical field of application software identity verification. The method comprises the following steps: inquiring the credible state of a current DCS system through credible DCS upper computer application software, and verifying the credible state of the DCS system; if the verification is passed, inputting a user name and a plaintext password into the trusted DCS upper computer application software, and encrypting the input plaintext password through a secret key to obtain a server verification code; and judging whether the server verification code is the same as the user verification code corresponding to the input same household name or not, and if yes, completing identity verification of the trusted DCS upper computer application software. According to the method, the user verification of the application program of the upper computer of the trusted DCS system is realized, the risk that the plaintext password of the user is captured during network transmission is eliminated, the situation that the plaintext password of the database is leaked is solved, and the security of the trusted DCS system is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of application software identity authentication, and in particular to a trusted DCS host computer application software identity authentication method, system, equipment, medium and program. Background Art

[0002] In the current power generation field, the Distributed Control System (DCS) system is the core control center, and its security is directly related to the stable operation of the entire power plant and the reliability of power supply. However, with the rapid development of the industrial Internet, the security threats faced by industrial control systems are becoming increasingly severe, and the traditional plug-in security protection strategies that rely on firewalls, intrusion monitoring systems, and virus detection software seem to be unable to cope with them. These strategies can often only respond to known threats passively, and it is difficult to effectively resist new attack methods, let alone achieve active immunity of the system to ensure long-term and stable operation safety.

[0003] In response to this situation, trusted computing technology came into being. It aims to build a computing environment that fundamentally improves security from the bottom-level architecture through key technologies such as logical correctness verification, innovative computing architecture, and computing models. Trusted computing not only focuses on preventing external attacks, but also is committed to solving security risks that may be caused by internal logic defects, ensuring the integrity and non-tamperability of computing tasks, and thus taking the initiative in attack and defense confrontation.

[0004] The development of a national trusted distributed control system based on trusted computing technology is an important breakthrough in the field of industrial control system security in my country. This system not only realizes the independent control of core software and hardware, but also takes a solid step in intrinsic safety, filling the technical gap in the intrinsic safety of domestic DCS systems. However, even in such a high-security system, the user verification link still faces challenges.

[0005] At present, the host computer application software of domestic trusted DCS system generally adopts the traditional authentication method of user name and plain text password. Although this method seems safe in the LAN environment, it actually has the risk of passwords being maliciously captured or stolen. Since it does not rely on the secure HTTP channel to transmit data, potential threats in the network may be more likely to succeed. In addition, even if the authentication signature-based verification method is adopted, although the direct circulation of plain text passwords in the network is reduced, once the password information in the database is illegally obtained, the attacker may still use this information to simulate login, thereby posing a serious threat to the system. Summary of the invention

[0006] Aiming at the problem that the trusted DCS host computer application software in the prior art adopts the authentication method of user name and plain text password, the plain text password of the database is easily leaked, resulting in malicious login of the trusted DCS system, the present invention provides a trusted DCS host computer application software identity authentication method, realizes the trusted DCS system host computer application user authentication, eliminates the risk of the user's plain text password being captured during transmission in the network, solves the problem of the plain text password of the database being leaked, and ensures the security of the trusted DCS system.

[0007] In order to achieve the above object, the present invention provides the following technical solutions.

[0008] In a first aspect, the present invention provides a trusted DCS host computer application software identity authentication method, comprising:

[0009] Query the trusted status of the current DCS system through the trusted DCS host computer application software and verify the trusted status of the DCS system;

[0010] After verification, enter the user name and plain text password into the trusted DCS host computer application software, and encrypt the entered plain text password with the secret key to obtain the server verification code;

[0011] Determine whether the server verification code is the same as the user verification code corresponding to the same account name. If they are the same, complete the identity authentication of the trusted DCS host computer application software.

[0012] As a further improvement of the present invention, the trusted state of the current DCS system is queried by the trusted DCS host computer application software, and the trusted state of the DCS is verified, including:

[0013] When the trusted DCS system needs to perform system trusted status verification, the trusted status verification module in the trusted DCS host computer application software is used to query the current trusted status of the trusted DCS system and perform verification;

[0014] If the verification fails, the verification process ends directly, and the identity authentication of the trusted DCS host computer application software cannot be performed.

[0015] As a further improvement of the present invention, the verification is passed, the user name and plain text password are input into the trusted DCS host computer application software, and the input plain text password is encrypted by a secret key to obtain a server verification code;

[0016] After verification, enter the user name and plain text password into the trusted DCS host computer application software;

[0017] The trusted DCS host computer application software encrypts the plain text password and generates a cache check code and a transmission information code;

[0018] The trusted DCS host computer application software extracts the corresponding user verification code based on the user name;

[0019] The user verification code and the transmission information code are encrypted together to generate a server verification code.

[0020] As a further improvement of the present invention, the cache verification code is generated by encrypting the plain text password together with the AK key generated by the system trusted root module;

[0021] The transmission information code is generated by encrypting the plain text password with the PCR key generated by the system trusted root module;

[0022] The server verification code is generated by encrypting the user verification code and the transmission information code together with the DevID key generated by the system trusted root module.

[0023] As a further improvement of the present invention, the method of judging whether the verification code of the server is the same as the verification code of the user corresponding to the same account name, and if they are the same, completing the identity authentication of the trusted DCS host computer application software, includes:

[0024] The server verification code is compared with the user verification code string. If they are all the same, the server verification code and the cache verification code are encrypted and calculated together to obtain the user access token. The verification process is completed and the identity authentication of the trusted DCS host computer application software is passed.

[0025] As a further improvement of the present invention, the server verification code is judged to be the same as the user verification code corresponding to the same account name. If they are not the same, the verification process is directly terminated and the identity authentication of the trusted DCS host computer application software cannot be performed.

[0026] In a second aspect, the present invention provides a trusted DCS host computer application software identity authentication system, comprising:

[0027] Initial verification module: used to query the trusted status of the current DCS system through the trusted DCS host computer application software and verify the trusted status of the DCS system;

[0028] Encryption verification module: used for verification, input username and plain text password, and encrypt the plain text password with the secret key to obtain the server verification code;

[0029] Judgment and verification module: used to judge whether the server verification code is the same as the user verification code corresponding to the same account name. If they are the same, the identity verification of the trusted DCS host computer application software is completed.

[0030] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of a trusted DCS host computer application software identity authentication method when executing the computer program.

[0031] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for identity authentication of a trusted DCS host computer application software are implemented.

[0032] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method for identity authentication of a trusted DCS host computer application software.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] The present invention introduces a secret key to encrypt the input plain text password and generate a server verification code, thereby effectively avoiding the risk of direct transmission of the user's plain text password in the network. This encryption measure significantly reduces the possibility of the password being captured by a man-in-the-middle attack, and enhances the security of the data transmission process. Secondly, the user's plain text password is not directly stored in the database, but is verified by a verification code generated based on the trusted DCS host computer application software and the secret key in the trusted DCS system. This mechanism ensures that even if the database is leaked, the attacker cannot directly obtain the user's plain text password, thereby protecting the user's account security. At the same time, by verifying the trusted state of the DCS system as a prerequisite for identity authentication, it is ensured that user verification is performed only under the premise that the system is trusted, effectively preventing malicious software or unauthorized devices from accessing the system, and reducing potential security vulnerabilities. Although the encryption and decryption processes are added, only the user name and plain text password need to be entered to complete the verification, and there is no need to understand the complex encryption mechanism. At the same time, due to the enhanced security protection, the risk of the user's plain text password being captured during transmission in the network is eliminated, the situation of the database plain text password being leaked is solved, and the security of the trusted DCS system is guaranteed.

[0035] Furthermore, the identity authentication method of the present invention has good flexibility and scalability, and can adjust the encryption algorithm and key management strategy according to actual needs to adapt to DCS systems of different scales and complexities. At the same time, it also reserves space for responding to possible security threats in the future.

[0036] Furthermore, the DCS system is based on a physical trusted chain and uses the secret key generated by the trusted DCS hardware trusted root for identity authentication, which not only enhances the security at the software level, but also integrates the security features at the hardware level. This combination of software and hardware further improves the inherent safety level of the trusted distributed control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are for illustrative purposes only and are not intended to limit the scope of the present disclosure in any way. In the drawings:

[0038] Figure 1 A flow chart of a trusted DCS host computer application software identity authentication method of the present invention;

[0039] Figure 2 A specific flow chart of a trusted DCS host computer application software identity authentication method of the present invention;

[0040] Figure 3 A structural schematic diagram of a trusted DCS host computer application software identity authentication system of the present invention;

[0041] Figure 4 Schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. The described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present invention.

[0043] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0044] In view of the problem that the trusted DCS host computer application software in the prior art adopts the authentication method of user name and plain text password, the plain text password of the database is easily leaked, resulting in malicious login to the trusted DCS system. The present invention provides a trusted DCS host computer application software identity authentication method, such as Figure 2 As shown, the method includes:

[0045] S101: query the trusted state of the current DCS system through the trusted DCS host computer application software, and verify the trusted state of the DCS system;

[0046] S102: After verification, the user name and plain text password are input into the trusted DCS host computer application software, and the input plain text password is encrypted with a secret key to obtain a server verification code;

[0047] S103: Determine whether the server verification code is the same as the user verification code corresponding to the same account name input. If they are the same, complete the identity verification of the trusted DCS host computer application software.

[0048] The method realizes user authentication of the host computer application of the trusted DCS system, eliminates the risk of the user's plain text password being captured during transmission in the network, solves the problem of the database plain text password being leaked, and ensures the security of the trusted DCS system.

[0049] The present invention is further explained below in conjunction with the specific drawings.

[0050] like Figure 2 As shown, the present invention provides a trusted DCS host computer application software identity authentication method, comprising:

[0051] S1: When the trusted DCS system needs to perform system trusted status verification, the trusted status of the current trusted DCS system is queried through the trusted DCS host computer application software, and the trusted status of the trusted DCS is verified;

[0052] If the DCS system trust status verification is passed, the user name and password are input into the trusted DCS host computer application software;

[0053] If the DCS system trusted status verification fails, the DCS system trusted status verification is abnormal, and the verification process is directly terminated, and the trusted DCS host computer application software cannot be authenticated.

[0054] Specifically, when the trusted DCS system needs to perform system trusted state verification, the trusted state verification module in the trusted DCS host computer application software is used to query the trusted state of the current trusted DCS system and verify the trusted state of the trusted DCS system.

[0055] S2: The DCS system trust status verification is passed, and the user name and plain text password are entered into the trusted DCS host computer application software, and the entered plain text password is encrypted;

[0056] Specifically, the plaintext password is encrypted with the AK key to generate a cache check code, and at the same time, the plaintext password is encrypted with the PCR key to generate a transmission information code.

[0057] The corresponding user verification code is retrieved through the user name, and encrypted together with the transmission information code and DevID key to generate a server verification code.

[0058] S3: Compare the user verification code with the server verification code to determine whether the user verification code and the server verification code are the same;

[0059] If they are the same, the server verification code and the cache verification code obtained in S2 are encrypted to generate a user access token, complete the identity authentication of the trusted DCS host computer application software, and the verification process ends.

[0060] If they are different, the DCS system trusted status check is abnormal, the verification process ends directly, and the trusted DCS host computer application software cannot be authenticated.

[0061] In summary, the present invention proposes a trusted DCS host computer application software identity authentication method, which encrypts the user input plain text and secret key so that the plain text secret key is not directly transmitted in the network, which can effectively prevent the hidden danger of the password generated when the trusted host computer application software logs in being captured; at the same time, the user's plain text password is not directly stored in the database, but a verification code generated based on the encryption module and the secret key is further generated after the match is correct, which solves the user account security problem caused by the user password being stolen; finally, the system is based on the physical trusted chain and makes full use of the secret key generated by the trusted root of the trusted DCS hardware, which further improves the inherent safety level of the trusted distributed control system.

[0062] The present invention is further explained below in conjunction with specific implementations.

[0063] Example

[0064] The present invention provides a trusted DCS host computer application software identity authentication method, comprising:

[0065] S1: When the trusted DCS system needs to perform system trusted status verification, the trusted status verification module in the trusted DCS host computer application software is called to query the trusted status of the current trusted DCS system and perform trusted verification on the current trusted DCS application software. After the verification is passed, the user login interface pops up, and the user can enter relevant information according to the instructions on the login interface; if the verification fails, the trusted status is abnormal, and the system exits directly and reports the abnormal trusted status;

[0066] The trusted state verification module is used to verify the trusted state of the trusted DCS system.

[0067] S2: The user enters the user name and plain text password according to the instructions on the login interface. The user-side module in the trusted DCS host computer application software calls the encryption module to encrypt the AK key generated by the system trusted root module together with the plain text password to generate a cache check code; the user-side module in the trusted DCS host computer application software calls the encryption module to encrypt the plain text password together with the PCR key generated by the system trusted root module to generate a transmission information code.

[0068] The user-side module, i.e. the user login interface, is used to provide the user with an input window for the user name and plain text password;

[0069] The encryption module performs encryption calculations on the data based on the hash algorithm to generate the information code and other data required by the method; this module can also perform encryption calculations on the data based on other algorithms to generate the information code and other data required by the method.

[0070] S3: The server module in the trusted DCS host computer application software receives the generated transmission information code and the user name entered by the user, calls the database module to retrieve the corresponding user verification code through the user name, and calls the encryption module to encrypt the transmission information code and the system trusted root module DevID key to generate a server verification code;

[0071] The data retrieved by the database module is pre-stored in the system based on the user name, plain text password and the secret key generated in the system hardware trusted root module. The encryption module is called to encrypt the plain text password and the PCR secret key generated by the system trusted root module, and the generated result is combined with the DevID secret key to encrypt and generate a user verification code, and replace the plain text password corresponding to the user name.

[0072] The server module is used to query information from the database module based on the user name, and call the encryption module to calculate the server verification code to compare with the queried information, and generate a user access token;

[0073] Database module, i.e., trusted DCS host computer database, is used to store system data;

[0074] The system hardware trusted root module is a trusted DCS hardware trusted root, which is used to automatically generate the AK key, DevID key and PCR key required by this method.

[0075] S4: Compare the user verification code with the server verification code, which is to directly compare the data of each bit of the two strings. If they are all the same, after confirming that they are the same, call the encryption module to encrypt the server verification code and the cache information code to generate a user access token to complete the identity authentication of the trusted DCS host computer application software. If they are not the same, the verification process is directly exited, the trusted DCS host computer application software cannot be authenticated, and the relevant information is reported.

[0076] The encryption module in the present invention encrypts data based on the hash algorithm, and is preferably applicable to hash algorithms such as MD4, MD5, hash1, ripeMD160, SHA256, SHA3, and the national standard SM3 (State Cryptography Administration); at the same time, the encryption process is to directly splice two data, with the secret key at the end, and bring the result into the algorithm.

[0077] The second object of the present invention is to provide a trusted DCS host computer application software identity authentication system, such as Figure 3 As shown, including:

[0078] Initial verification module 102: used to query the trusted state of the current DCS system through the trusted DCS host computer application software and verify the trusted state of the DCS system;

[0079] Encryption verification module 202: used to verify that the user name and plain text password are input into the trusted DCS host computer application software, and the input plain text password is encrypted by the secret key to obtain the server verification code;

[0080] The judgment and verification module 302 is used to judge whether the verification code of the server is the same as the user verification code corresponding to the same account name input. If they are the same, the identity verification of the trusted DCS host computer application software is completed.

[0081] like Figure 4 As shown, the third object of the present invention is to provide an electronic device, the electronic device comprising: a processor 501, a memory 502 and a display screen 503. Among them, the memory 502 and the display screen 503 are connected to the processor 501, such as through a bus 504. Optionally, the electronic device may also include a transceiver 505. It should be noted that in actual applications, the transceiver 505 is not limited to one, and the structure of the electronic device does not constitute a limitation on the embodiments of the present application.

[0082] Processor 501 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 501 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0083] The bus 504 may include a path to transmit information between the above components. The bus 504 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 504 may be divided into an address bus, a data bus, a control bus, etc.

[0084] The memory 502 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0085] The memory 502 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 501. The processor 501 is used to execute the application code stored in the memory 502 to implement the contents shown in the above method embodiment.

[0086] Figure 4 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0087] The fourth object of the present invention is to provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program is stored thereon, and when the program is executed by a processor, the aforementioned Figure 1 to Figure 2 The various processes of the method embodiment shown in the figure include, for example, a memory including instructions, and the instructions can be executed by a processor of an electronic device to complete the method.

[0088] A computer-readable storage medium may be a tangible device that holds and stores instructions used by an instruction execution device. A computer-readable storage medium may be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination thereof. Specifically, a computer-readable storage medium may be a portable computer disk, a hard disk, a USB flash drive, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a podium random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, an optical disk, a magnetic disk, a mechanical encoding device, and any combination thereof.

[0089] A fifth object of the present invention is to provide a computer program product, comprising computer instructions, which, when executed by a processor, implement the above Figure 1 to Figure 2 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0090] Many embodiments and many applications beyond the examples provided will be apparent to those skilled in the art upon reading the above description. Therefore, the scope of the present teachings should not be determined with reference to the above description, but rather with reference to the preceding claims and the full scope of equivalents to which such claims are entitled. For the purpose of comprehensiveness, all articles and references, including disclosures of patent applications and publications, are incorporated herein by reference. The omission of any aspect of the subject matter disclosed herein in the preceding claims is not intended to be a disclaimer of such subject matter, nor should it be considered that the applicants did not consider such subject matter to be part of the disclosed inventive subject matter.

[0091] The above content is a further detailed description of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these. For ordinary technicians in the technical field to which the present invention belongs, without departing from the concept of the present invention, they can also make several simple deductions or substitutions, which should be regarded as belonging to the protection scope of the present invention determined by the submitted claims.

Claims

1. A trusted DCS host computer application software identity authentication method, characterized in that: include: Query the trusted status of the current DCS system through the trusted DCS host computer application software and verify the trusted status of the DCS system; After verification, enter the user name and plain text password into the trusted DCS host computer application software, and encrypt the entered plain text password with the secret key to obtain the server verification code; Determine whether the server verification code is the same as the user verification code corresponding to the same account name. If they are the same, complete the identity authentication of the trusted DCS host computer application software.

2. A trusted DCS host computer application software identity authentication method according to claim 1, characterized in that: The process of querying the trusted state of the current DCS system through the trusted DCS host computer application software and verifying the trusted state of the DCS system includes: When the trusted DCS system needs to perform system trusted status verification, the trusted status verification module in the trusted DCS host computer application software is used to query the current trusted status of the trusted DCS system and perform verification; If the verification fails, the verification process ends directly, and the identity authentication of the trusted DCS host computer application software cannot be performed.

3. A trusted DCS host computer application software identity authentication method according to claim 1, characterized in that: If the verification is successful, the user name and plain text password are input into the trusted DCS host computer application software, and the input plain text password is encrypted with a secret key to obtain a server-side verification code; After verification, enter the user name and plain text password into the trusted DCS host computer application software; The trusted DCS host computer application software encrypts the plain text password and generates a cache check code and a transmission information code; The trusted DCS host computer application software extracts the corresponding user verification code based on the user name; The user verification code and the transmission information code are encrypted together to generate a server verification code.

4. A trusted DCS host computer application software identity authentication method according to claim 3, characterized in that: The cache verification code is generated by encrypting the plain text password with the AK key generated by the system trusted root module; The transmission information code is generated by encrypting the plain text password with the PCR key generated by the system trusted root module; The server verification code is generated by encrypting the user verification code and the transmission information code together with the DevID key generated by the system trusted root module.

5. A trusted DCS host computer application software identity authentication method according to claim 3, characterized in that: The step of judging whether the verification code of the server is the same as the verification code of the user corresponding to the same account name, and if they are the same, completing the identity verification of the trusted DCS host computer application software, includes: The server verification code is compared with the user verification code string. If they are all the same, the server verification code and the cache verification code are encrypted and calculated together to obtain the user access token. The verification process is completed and the identity authentication of the trusted DCS host computer application software is passed.

6. A trusted DCS host computer application software identity authentication method according to claim 1, characterized in that: The server verification code is judged to be the same as the user verification code corresponding to the same account name. If they are not the same, the verification process is directly terminated, and the identity authentication of the trusted DCS host computer application software cannot be performed.

7. A trusted DCS host computer application software identity authentication system, characterized in that: include: Initial verification module: used to query the trusted status of the current DCS system through the trusted DCS host computer application software and verify the trusted status of the DCS system; Encryption verification module: used for verification, input username and plain text password, and encrypt the plain text password with the secret key to obtain the server verification code; Judgment and verification module: used to judge whether the server verification code is the same as the user verification code corresponding to the same account name. If they are the same, the identity verification of the trusted DCS host computer application software is completed.

8. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of a trusted DCS host computer application software identity authentication method as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a trusted DCS host computer application software identity authentication method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that It comprises computer instructions, which, when executed by a processor, implement the steps of a trusted DCS host computer application software identity authentication method as described in any one of claims 1 to 6.

Images