A WAPI-based dual security authentication method for the power industry

Abstract

The embodiment of the application provides a kind of based on WAPI's electric power industry dual security authentication method, belong to communication technical field.The dual security authentication method includes: in wireless communication terminal, it is integrated with single Beidou module to State Grid security chip;When wireless communication terminal attempts to access WAPI network, State Grid security chip requests the current wireless communication terminal's Beidou coordinate and Beidou timestamp to single Beidou module;Single Beidou module sends original Beidou data to State Grid security chip through security bus;State Grid security chip uses its internal private key to carry out digital signature to Beidou coordinate and Beidou timestamp, to generate the declaration information of position and time;Authenticator receives the certificate and position and time of wireless communication terminal Declaration information.The dual security authentication scheme can be based on WAPI verification, through the position and time information that Beidou system provides, cannot be forged, to carry out dual verification to the communication of wireless communication terminal, to enhance the security of communication.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically to a dual security authentication method for the power industry based on WAPI. Background Technology

[0002] With the construction of new power systems, new intelligent systems such as intelligent inspection, intelligent monitoring, and visualized operations have emerged in substations and other scenarios. These services are characterized by "high bandwidth and mobility," which traditional wired communication methods in power systems cannot meet. At the same time, power systems have extremely high requirements for communication security and stability, facing increasingly severe network security issues. A secure and reliable wireless communication technology is needed to ensure information security in power production, transmission, and management, and to prevent security incidents such as power system failures or data leaks caused by network attacks. WAPI, as a wireless LAN authentication and confidentiality infrastructure standard led by my country, provides the power industry with a compliant technical option. However, in specific scenarios (such as power inspection and equipment positioning), it cannot effectively verify the legitimacy of the terminal's physical location, and attackers may gain access to the network through location spoofing. Therefore, a method is needed that deeply integrates the hardware security capabilities of the State Grid security chip and the spatiotemporal security capabilities of a single Beidou module with the WAPI wireless communication system to enhance communication security. Summary of the Invention

[0003] The purpose of this invention is to provide a dual security authentication method for the power industry based on WAPI. This dual security authentication scheme can perform dual authentication of the communication of wireless communication terminals based on WAPI verification and the unforgeable location and time information provided by the Beidou system, thereby enhancing the security of communication.

[0004] To achieve the above objectives, embodiments of the present invention provide a dual security authentication method for the power industry based on WAPI, the dual security authentication method comprising:

[0005] The State Grid security chip and a single Beidou module are integrated into the wireless communication terminal;

[0006] When a wireless communication terminal attempts to access the WAPI network, the State Grid security chip requests the current BeiDou coordinates and BeiDou timestamp of the wireless communication terminal from the single BeiDou module.

[0007] The single Beidou module sends the raw Beidou data to the State Grid security chip via a secure bus;

[0008] The State Grid security chip uses its internal private key to digitally sign BeiDou coordinates and timestamps to generate location and time claims.

[0009] After receiving the certificate, location, and time declaration information from the wireless communication terminal, the authenticator first performs a standard WAPI certificate chain verification.

[0010] After verification, the validity of the signature is verified using the public key of the wireless communication terminal;

[0011] If the verification is valid, the BeiDou coordinates and timestamp are parsed, and the timestamp is verified to be the current valid time.

[0012] Check and verify the BeiDou coordinates to determine whether the wireless communication terminal is within the authorized geographical range;

[0013] If both the timestamp and BeiDou coordinates are verified, the discriminator determines that the wireless communication terminal is a legitimate terminal and allows it to access the WAPI network for information transmission.

[0014] Optionally, the wireless communication terminal is suitable for scenarios such as power distribution automation and mobile inspection.

[0015] Optionally, verify the BeiDou coordinates to determine whether the wireless communication terminal is within the authorized geographical range, including:

[0016] Obtain the historical BeiDou coordinates of the wireless communication terminal and form a sample set;

[0017] Set the neighborhood radius and the threshold number of points;

[0018] Randomly select historical BeiDou coordinates from the sample set and determine whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds a threshold.

[0019] If the number of points exceeds the threshold, the selected historical BeiDou coordinates are marked as core points, and all points within the neighborhood radius of the core point are added to the seed set.

[0020] Randomly select one of the historical BeiDou coordinates from the seed set, and determine whether the number of points within the neighborhood radius of the selected historical BeiDou coordinate exceeds the threshold number;

[0021] If the number of points exceeds the threshold, the selected historical BeiDou coordinates are marked as new core points, and the unclassified points within the neighborhood radius of the new core point are added to the seed set.

[0022] If the number of selected historical BeiDou coordinates does not exceed the threshold and the selected historical BeiDou coordinates are not classified, the selected historical BeiDou coordinates will be assigned to the seed set.

[0023] The process involves selecting the unselected historical BeiDou coordinates from the seed set again, and returning to the step of determining whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds a threshold number, until all historical BeiDou coordinates in the seed set are selected.

[0024] Randomly select unselected historical BeiDou coordinates from the sample set and return whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds a threshold number, until all the historical BeiDou coordinates are selected.

[0025] Optionally, verify the BeiDou coordinates to determine whether the wireless communication terminal is within the authorized geographical range, including:

[0026] Obtain all the core points and arrange them according to their coordinate positions;

[0027] After the arrangement is completed, the core points are fitted to form a core curve.

[0028] Set tolerance values, and set top and bottom tolerance lines with the core curve as the center line. The area between the top and bottom tolerance lines is the authorized area.

[0029] Optionally, verify the BeiDou coordinates to determine whether the wireless communication terminal is within the authorized geographical range, including:

[0030] Obtain the authorized area, and obtain the current BeiDou coordinates of the wireless communication terminal, as well as the BeiDou coordinates within a time period K segments prior to the current time point;

[0031] The obtained current BeiDou coordinates and the BeiDou coordinates over a forward K time period are fitted to form an initial curve;

[0032] The Fraser distance between the initial curve and the core curve at the same historical period is calculated as the similarity.

[0033] The initial curve and the core curve are unified in the same coordinate system. Then, based on the obtained similarity and the current BeiDou coordinates, as well as the coordinates in the corresponding core curve, the BeiDou coordinates at the next time point are predicted.

[0034] Based on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time, determine whether the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are both within the authorized area;

[0035] When both the BeiDou coordinates at the given time point and the BeiDou coordinates at the next time point are within the authorized area, it is determined that the wireless communication terminal is within the authorized geographical range.

[0036] Optionally, based on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time, determine whether both the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are within the authorized area, including:

[0037] Obtain the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point;

[0038] The positioning radius is set based on the obtained BeiDou coordinates to determine the positioning circle area centered on the BeiDou coordinates;

[0039] If the overlapping area between the positioning circle centered on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time and the authorized area both exceed a preset threshold, it is determined that the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are both within the authorized area.

[0040] Optionally, based on the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point, it is determined whether the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point are both within the authorized area, including: if the overlapping area between the positioning circle area centered on the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point and the authorized area does not both exceed a preset threshold, it is determined that the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point are not both within the authorized area.

[0041] Optionally, calculating the Fraser distance between the initial curve and the core curve at the same historical time as a similarity includes:

[0042] Obtain the BeiDou coordinates in the initial curve and the core curve;

[0043] Calculate the distance between the BeiDou coordinates in the core curve and the BeiDou coordinates in the initial curve to construct a distance matrix;

[0044] Construct a cost matrix based on the distance matrix and determine the final distance as the Fraser distance;

[0045] The Fraser distance is used as the similarity between the initial curve and the core curve.

[0046] Optionally, based on the obtained similarity and current BeiDou coordinates, as well as the coordinates in the corresponding core curve, the BeiDou coordinates at the next time point are predicted, including:

[0047] Obtain the similarity between the initial curve and the core curve, and determine whether the similarity exceeds a preset threshold;

[0048] If the similarity exceeds a preset threshold, discard the similarity and predict the BeiDou coordinates at the next time point using formula (1) based on the BeiDou coordinates and corresponding slope of the initial curve at the current time point:

[0049] Formula (1),

[0050] in, The x-coordinate of the BeiDou coordinates at the next point in time. The slope of the horizontal axis of the BeiDou coordinates with respect to time. Indicates the current time. The x-coordinate of the BeiDou coordinates at the current time point. The vertical coordinate of the BeiDou coordinates at the next time point. The slope of the ordinate of the BeiDou coordinates at the current time with respect to time. The vertical coordinate of the BeiDou coordinates at the current time point;

[0051] If the preset threshold is not exceeded, the influence weight is calculated using formula (2):

[0052] Formula (2),

[0053] in, Indicates the influence weight. Indicates the preset threshold. Indicates similarity;

[0054] Based on the obtained influence weights, the BeiDou coordinates at the next time point are predicted using formula (3):

[0055] Formula (3),

[0056] in, This represents the slope of the x-coordinate of a point on the core curve corresponding to the current BeiDou coordinates with respect to time. This represents the slope of the ordinate of a point on the core curve corresponding to the current BeiDou coordinates with respect to time.

[0057] Through the above technical solution, this invention provides a dual security authentication method for the power industry based on WAPI, which integrates a State Grid security chip and a single BeiDou module in a wireless communication terminal. When the wireless communication terminal attempts to access the WAPI network, the State Grid security chip can request the BeiDou coordinates and BeiDou timestamp of the current wireless communication terminal from the single BeiDou module. The single BeiDou module can send the raw BeiDou data to the State Grid security chip through a secure bus. Then, the State Grid security chip can use its internal private key to digitally sign the BeiDou coordinates and BeiDou timestamp, thereby generating location and time declaration information. After receiving the certificate and location and time declaration information from the wireless communication terminal, the authenticator can first perform standard WAPI certificate chain verification. After verification, the validity of the signature can be verified using the public key of the wireless communication terminal. If the verification is valid, the BeiDou coordinates and timestamp can be parsed, and it can be verified whether the timestamp is the current valid time. After verifying that the timestamp is the current valid time, the BeiDou coordinates can be checked to determine whether the wireless communication terminal is within the authorized geographical range. If both the timestamp and BeiDou coordinates pass verification, the authenticator can determine that the wireless communication terminal is a legitimate terminal, allowing it to access the WAPI network for stable information transmission. This dual security authentication scheme, based on WAPI verification, uses the unforgeable location and time information provided by the BeiDou system to perform dual verification of the wireless communication terminal's communication, thereby enhancing communication security.

[0058] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0059] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0060] Figure 1 This is a flowchart of a dual security authentication method for the power industry based on WAPI according to an embodiment of the present invention;

[0061] Figure 2 This is a first flowchart of a WAPI-based dual security authentication method for the power industry to determine the geographical range of a terminal, according to an embodiment of the present invention.

[0062] Figure 3 This is a second flowchart illustrating the determination of the geographical range of a terminal using a WAPI-based dual security authentication method for the power industry, according to an embodiment of the present invention.

[0063] Figure 4This is a third flowchart illustrating the determination of the geographical range of a terminal using a WAPI-based dual security authentication method for the power industry, according to an embodiment of the present invention.

[0064] Figure 5 This is a fourth flowchart illustrating the determination of the geographical range of a terminal using a WAPI-based dual security authentication method for the power industry, according to an embodiment of the present invention.

[0065] Figure 6 This is a fifth flowchart illustrating the determination of the geographical range of a terminal using a WAPI-based dual security authentication method for the power industry, according to an embodiment of the present invention.

[0066] Figure 7 This is the sixth flowchart of a WAPI-based dual security authentication method for the power industry, according to an embodiment of the present invention, for determining the geographical range of a terminal. Detailed Implementation

[0067] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0068] In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0069] Figure 1 This is a flowchart of a WAPI-based dual security authentication method for the power industry according to an embodiment of the present invention. In this invention, the process of the dual security authentication method may include:

[0070] In step S1, the State Grid security chip and the single Beidou module are integrated in the wireless communication terminal.

[0071] In step S2, when the wireless communication terminal attempts to access the WAPI network, the State Grid security chip requests the current BeiDou coordinates and BeiDou timestamp of the wireless communication terminal from the single BeiDou module.

[0072] In step S3, the single BeiDou module sends the raw BeiDou data to the State Grid security chip via the security bus.

[0073] In step S4, the State Grid security chip uses its internal private key to digitally sign the BeiDou coordinates and timestamp to generate a claim of location and time.

[0074] In step S5, after the discriminator receives the certificate, location, and time declaration information of the wireless communication terminal, it first performs standard WAPI certificate chain verification.

[0075] In step S6, after verification is completed, the validity of the signature is verified using the public key of the wireless communication terminal.

[0076] In step S7, if the verification is valid, the BeiDou coordinates and timestamp are parsed, and it is verified whether the timestamp is the current valid time.

[0077] In step S8, the BeiDou coordinates are checked and verified to determine whether the wireless communication terminal is within the authorized geographical range.

[0078] In step S9, if both the timestamp and BeiDou coordinates are verified, the discriminator determines that the wireless communication terminal is a legitimate terminal and allows it to access the WAPI network for information transmission.

[0079] In this invention, the wireless communication terminal integrates a State Grid security chip and a single BeiDou module for dual security authentication. When the wireless communication terminal attempts to access the WAPI network, the State Grid security chip requests the BeiDou coordinates and timestamp of the current wireless communication terminal from the single BeiDou module. The single BeiDou module sends the raw BeiDou data to the State Grid security chip via a secure bus. The State Grid security chip then uses its internal private key to digitally sign the BeiDou coordinates and timestamp, thereby generating a location and time declaration. After receiving the certificate and location and time declaration information from the wireless communication terminal, the authenticator first performs a standard WAPI certificate chain verification. After verification, the validity of the signature can be verified using the public key of the wireless communication terminal. If the verification is valid, the BeiDou coordinates and timestamp can be parsed, and it can be verified whether the timestamp is the current valid time. After verifying that the timestamp is the current valid time, the BeiDou coordinates can be checked to determine whether the wireless communication terminal is within the authorized geographical range. If both the timestamp and BeiDou coordinates pass verification, the authenticator can determine that the wireless communication terminal is a legitimate terminal, allowing it to access the WAPI network for stable information transmission. This dual security authentication scheme, based on WAPI verification, uses the unforgeable location and time information provided by the BeiDou system to perform dual verification of the wireless communication terminal's communication, thereby enhancing communication security.

[0080] In one embodiment of the present invention, the wireless communication terminal can be applied to the scenario of mobile inspection of power distribution automation, thereby ensuring the security of the wireless communication terminal accessing the network based on dual verification of Beidou coordinates and WAPI.

[0081] In one embodiment of the present invention, such as Figure 2 As shown, the first process for determining the geographical range of a terminal may include:

[0082] In step S10, the historical BeiDou coordinates of the wireless communication terminal are obtained and a sample set is formed.

[0083] In step S11, the neighborhood radius and the number of threshold points are set.

[0084] In step S12, historical BeiDou coordinates are randomly selected from the sample set, and it is determined whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds the threshold number.

[0085] In step S13, if the number of points exceeds the threshold, the selected historical BeiDou coordinates are marked as core points, and all points within the neighborhood radius of the core point are added to the seed set.

[0086] In step S14, a historical BeiDou coordinate is randomly selected from the seed set, and it is determined whether the number of points within the neighborhood radius of the selected historical BeiDou coordinate exceeds the threshold number.

[0087] In step S15, if the number of points exceeds the threshold, the selected historical BeiDou coordinates are marked as new core points, and the unclassified points within the neighborhood radius of the new core points are added to the seed set.

[0088] In step S16, if the number of selected historical BeiDou coordinates does not exceed the threshold and the selected historical BeiDou coordinates are not classified, the selected historical BeiDou coordinates are assigned to the seed set.

[0089] In step S17, the unselected historical BeiDou coordinates in the seed set are selected again, and the process returns to the step of determining whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds the threshold number, until all historical BeiDou coordinates in the seed set are selected.

[0090] In step S18, historical BeiDou coordinates that were not selected in the sample set are randomly selected, and the results are returned to determine whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds the threshold number, until all historical BeiDou coordinates are selected.

[0091] In this invention, when determining whether a wireless communication terminal is within an authorized geographical area, its historical BeiDou coordinates can be obtained first, forming a sample set. This sample set allows for the determination of the terminal's historical paths, thus improving the assessment of whether the terminal is currently within the authorized geographical area. After obtaining the sample set, a neighborhood radius and a threshold number of points can be set. Then, historical BeiDou coordinates from the sample set can be randomly selected, and it can be determined whether the number of points within the neighborhood radius of the selected coordinate exceeds the threshold number. If the threshold number is exceeded, the selected coordinate is marked as a core point, and all points within the neighborhood radius of the core point are added to a seed set. If the number of points within the neighborhood radius of the selected coordinate does not exceed the threshold number, the selected coordinate can be considered a regular point. A historical BeiDou coordinate can be randomly selected from the seed set, and it can be determined whether the number of points within its neighborhood radius exceeds the threshold number. If the threshold number is exceeded, the selected coordinate is marked as a new core point. This method allows for the search for more core points. After finding a new core point, unclassified points within its neighborhood radius can be added to the seed set. If the number of points within the neighborhood radius of the selected historical BeiDou coordinates does not exceed a threshold, and the selected historical BeiDou coordinates have not yet been classified, they can be assigned to the seed set. After assignment, unselected historical BeiDou coordinates in the seed set can be selected again, and the process can return to step S12 until all coordinates in the seed set have been selected. After all historical BeiDou coordinates in the seed set have been selected, unselected historical BeiDou coordinates in the sample set can be randomly selected, and the process can return to step S12 to continue searching for core points until all historical BeiDou coordinates have been selected and classified, at which point the search ends.

[0092] In one embodiment of the present invention, such as Figure 3 As shown, the second process for determining the geographical range of the terminal may include:

[0093] In step S19, all core points are obtained and arranged according to their coordinate positions.

[0094] In step S20, after the arrangement is completed, the core points are fitted to form the core curve.

[0095] In step S21, a tolerance value is set, and top and bottom tolerance lines are set with the core curve as the center line. The area between the top and bottom tolerance lines is the authorized area.

[0096] In this invention, when determining the authorized area of ​​the wireless communication terminal, all core points can be acquired first, and then these core points can be arranged according to their coordinate positions. After the arrangement is completed, the core points can be fitted to form a core curve. After setting the core curve, a tolerance value can be set, and then top and bottom tolerance lines can be set with the core curve as the center line. The top and bottom tolerance lines are curves extending above and below the center line to reach the tolerance value, with the core curve as the center line. The area between the top and bottom tolerance lines can be the authorized area.

[0097] In one embodiment of the present invention, such as Figure 4 As shown, the third process for determining the geographical range of a terminal may include:

[0098] In step S22, the authorized area is obtained, and the BeiDou coordinates of the current wireless communication terminal are obtained, as well as the BeiDou coordinates of the previous K time periods based on the current time point.

[0099] In step S23, the obtained current BeiDou coordinates and the BeiDou coordinates over a forward K time period are fitted into an initial curve.

[0100] In step S24, the Frescher distance between the initial curve and the core curve is calculated as the similarity.

[0101] In step S25, the initial curve and the core curve are unified in the same coordinate system. Then, based on the obtained similarity and the current BeiDou coordinates, as well as the coordinates in the corresponding core curve, the BeiDou coordinates at the next time point are predicted.

[0102] In step S26, based on the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point, it is determined whether the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point are both within the authorized area.

[0103] In step S27, when both the BeiDou coordinates and the BeiDou coordinates at the next time point are within the authorized area, it is determined that the wireless communication terminal is within the authorized geographical range.

[0104] In this invention, when determining whether a wireless communication terminal is within an authorized geographical area, the authorized area can be obtained. Then, the current BeiDou coordinates of the wireless communication terminal, and the BeiDou coordinates over a period of K time advance from the current point in time, can be obtained. Based on the obtained current BeiDou coordinates and the BeiDou coordinates over the previous K time periods, an initial curve can be fitted. After obtaining the initial curve, the Friesian distance between the initial curve and the core curve at the same historical time period can be calculated and used as a similarity score. After obtaining the similarity score, the initial curve and the core curve can be unified in the same coordinate system. Then, based on the obtained similarity score, the current BeiDou coordinates, and the coordinates in the corresponding core curve, the BeiDou coordinates at the next time point can be predicted. Based on the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point, it can be determined whether both the current BeiDou coordinates and the BeiDou coordinates at the next time point are within the authorized area. This method can determine the movement trend of the wireless communication terminal while judging its current BeiDou coordinates. If the trend indicates movement towards the outside of the authorized area, its location is deemed unreliable; that is, if both the current BeiDou coordinates and the BeiDou coordinates at the next time point are not within the authorized area, its location is unreliable, and authentication is stopped. If both the current BeiDou coordinates and the BeiDou coordinates at the next time point are within the authorized area, it can be determined that the wireless communication terminal is within the authorized geographical area, and its geographical location is reliable.

[0105] In one embodiment of the present invention, such as Figure 5 As shown, the fourth process for determining the geographical range of a terminal may include:

[0106] In step S28, the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point are obtained.

[0107] In step S29, the positioning radius is set based on the obtained BeiDou coordinates to determine the positioning circle area centered on the BeiDou coordinates.

[0108] In step S30, if the overlapping area between the positioning circle centered on the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point and the authorized area both exceed a preset threshold, it is determined that the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point are both within the authorized area.

[0109] In this invention, when determining whether BeiDou coordinates are within the authorized area, the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point can be obtained. Based on the obtained BeiDou coordinates, a positioning radius can be set, thereby determining a positioning circle centered on those BeiDou coordinates. The overlap area between the positioning circle centered on the current and next time point and the authorized area is obtained. If the overlap area between the corresponding positioning circle areas and the authorized area for both BeiDou coordinates exceeds a preset threshold, it can be determined that both the current and next time point BeiDou coordinates are within the authorized area.

[0110] If the overlapping area between the positioning circle centered on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time and the authorized area does not both exceed a preset threshold, it can be determined that the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are not both within the authorized area, and the geographical location of the corresponding wireless communication terminal is unreliable.

[0111] In one embodiment of the present invention, such as Figure 6 As shown, the fifth step in determining the geographical range of a terminal may include:

[0112] In step S31, the BeiDou coordinates in the initial curve and the core curve are obtained.

[0113] In step S32, the distance between the BeiDou coordinates in the core curve and the BeiDou coordinates in the initial curve is calculated to construct a distance matrix.

[0114] In step S33, a cost matrix is ​​constructed based on the distance matrix, and the final distance is determined as the Fraser distance.

[0115] In step S34, the Fraser distance is used as the similarity between the initial curve and the core curve.

[0116] In this invention, when determining the similarity between the initial curve and the core curve, the BeiDou coordinates in both curves can be obtained first. Then, the distance between the BeiDou coordinates in the core curve and the initial curve can be calculated, allowing the construction of a distance matrix. After constructing the distance matrix, a cost matrix can be built based on it, and the final distance can be determined as the Fraser distance. This Fraser distance can measure the similarity between the two curves, as it can be used as the similarity between the initial curve and the core curve.

[0117] In one embodiment of the present invention, such as Figure 7 As shown, the sixth process for determining the geographical range of a terminal may include:

[0118] In step S35, the similarity between the initial curve and the core curve is obtained and it is determined whether the similarity exceeds a preset threshold.

[0119] In step S36, if the similarity exceeds a preset threshold, the similarity is discarded, and the BeiDou coordinates at the next time point are predicted using formula (1) based on the BeiDou coordinates and corresponding slope of the initial curve at the current time point:

[0120] Formula (1),

[0121] in, The x-coordinate of the BeiDou coordinates at the next point in time. The slope of the horizontal axis of the BeiDou coordinates with respect to time. Indicates the current time. The x-coordinate of the BeiDou coordinates at the current time point. The vertical coordinate of the BeiDou coordinates at the next time point. The slope of the ordinate of the BeiDou coordinates at the current time with respect to time. The vertical coordinate of the BeiDou coordinates at the current time point.

[0122] In step S37, if the preset threshold is not exceeded, the influence weight is calculated using formula (2):

[0123] Formula (2),

[0124] in, Indicates the influence weight. Indicates the preset threshold. Indicates similarity.

[0125] In step S38, based on the obtained influence weights, the BeiDou coordinates at the next time point are predicted using formula (3):

[0126] Formula (3),

[0127] in, This represents the slope of the x-coordinate of a point on the core curve corresponding to the current BeiDou coordinates with respect to time. This represents the slope of the ordinate of a point on the core curve corresponding to the current BeiDou coordinates with respect to time.

[0128] In this invention, after obtaining the similarity between the initial curve and the core curve, if the similarity is too high, it indicates that the initial curve and the core curve are not similar. Therefore, it can be determined whether the obtained similarity exceeds a preset threshold. If it exceeds the threshold, it indicates that the initial curve and the core curve are not similar enough, and the similarity can be discarded without considering the influence of the core curve. Based on the BeiDou coordinates and corresponding slope of the initial curve at the current time point, the BeiDou coordinates at the next time point are predicted using formula (1). If the similarity does not exceed the preset threshold, it indicates that the core curve may have an influence on the coordinates of the initial curve at the next time point. Since the similarity is obtained through the Fraser distance, the smaller the Fraser distance, the higher the similarity between the two curves. If the similarity does not exceed the preset threshold, the influence weight is calculated using formula (2). The smaller the similarity value, the higher the influence weight. Based on the obtained influence weight, the BeiDou coordinates at the next time point can be predicted using formula (3). The BeiDou coordinates take into account the influence of the core curve, making the prediction more accurate.

[0129] Through the above technical solution, this invention provides a dual security authentication method for the power industry based on WAPI, which integrates a State Grid security chip and a single BeiDou module in a wireless communication terminal. When the wireless communication terminal attempts to access the WAPI network, the State Grid security chip can request the BeiDou coordinates and BeiDou timestamp of the current wireless communication terminal from the single BeiDou module. The single BeiDou module can send the raw BeiDou data to the State Grid security chip through a secure bus. Then, the State Grid security chip can use its internal private key to digitally sign the BeiDou coordinates and BeiDou timestamp, thereby generating location and time declaration information. After receiving the certificate and location and time declaration information from the wireless communication terminal, the authenticator can first perform standard WAPI certificate chain verification. After verification, the validity of the signature can be verified using the public key of the wireless communication terminal. If the verification is valid, the BeiDou coordinates and timestamp can be parsed, and it can be verified whether the timestamp is the current valid time. After verifying that the timestamp is the current valid time, the BeiDou coordinates can be checked to determine whether the wireless communication terminal is within the authorized geographical range. If both the timestamp and BeiDou coordinates pass verification, the authenticator can determine that the wireless communication terminal is a legitimate terminal, allowing it to access the WAPI network for stable information transmission. This dual security authentication scheme, based on WAPI verification, uses the unforgeable location and time information provided by the BeiDou system to perform dual verification of the wireless communication terminal's communication, thereby enhancing communication security.

[0130] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0131] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A dual security authentication method for the power industry based on WAPI, characterized in that, The dual security authentication method includes: The State Grid security chip and a single Beidou module are integrated into the wireless communication terminal; When a wireless communication terminal attempts to access the WAPI network, the State Grid security chip requests the current BeiDou coordinates and BeiDou timestamp of the wireless communication terminal from the single BeiDou module. The single Beidou module sends the raw Beidou data to the State Grid security chip via a secure bus; The State Grid security chip uses its internal private key to digitally sign BeiDou coordinates and timestamps to generate location and time claims. After receiving the certificate, location, and time declaration information from the wireless communication terminal, the authenticator first performs a standard WAPI certificate chain verification. After verification, the validity of the signature is verified using the public key of the wireless communication terminal; If the verification is valid, the BeiDou coordinates and timestamp are parsed, and the timestamp is verified to be the current valid time. Check and verify the BeiDou coordinates to determine whether the wireless communication terminal is within the authorized geographical range; If both the timestamp and BeiDou coordinates are verified, the discriminator determines that the wireless communication terminal is a legitimate terminal and allows it to access the WAPI network for information transmission. Verify BeiDou coordinates to determine if the wireless communication terminal is within the authorized geographical range, including: Obtain the historical BeiDou coordinates of the wireless communication terminal and form a sample set; Set the neighborhood radius and the threshold number of points; Randomly select historical BeiDou coordinates from the sample set and determine whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds a threshold. If the number of points exceeds the threshold, the selected historical BeiDou coordinates are marked as core points, and all points within the neighborhood radius of the core point are added to the seed set. Randomly select one of the historical BeiDou coordinates from the seed set, and determine whether the number of points within the neighborhood radius of the selected historical BeiDou coordinate exceeds the threshold number; If the number of points exceeds the threshold, the selected historical BeiDou coordinates are marked as new core points, and the unclassified points within the neighborhood radius of the new core point are added to the seed set. If the number of selected historical BeiDou coordinates does not exceed the threshold and the selected historical BeiDou coordinates are not classified, the selected historical BeiDou coordinates will be assigned to the seed set. The process involves selecting the unselected historical BeiDou coordinates from the seed set again, and returning to the step of determining whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds a threshold number, until all historical BeiDou coordinates in the seed set are selected. Randomly select unselected historical BeiDou coordinates from the sample set and return whether the number of points within the neighborhood radius of the selected historical BeiDou coordinates exceeds a threshold number, until all the historical BeiDou coordinates are selected; Obtain all the core points and arrange them according to their coordinate positions; After the arrangement is completed, the core points are fitted to form a core curve. Set tolerance values, and set top and bottom tolerance lines with the core curve as the center line. The area between the top and bottom tolerance lines is the authorized area.

2. The dual security authentication method according to claim 1, characterized in that, The wireless communication terminal is suitable for scenarios involving power distribution automation and mobile inspection.

3. The dual security authentication method according to claim 1, characterized in that, Verify BeiDou coordinates to determine if the wireless communication terminal is within the authorized geographical range, including: Obtain the authorized area, and obtain the current BeiDou coordinates of the wireless communication terminal, as well as the BeiDou coordinates within a time period K segments prior to the current time point; The obtained current BeiDou coordinates and the BeiDou coordinates over a forward K time period are fitted to form an initial curve; The Fraser distance between the initial curve and the core curve at the same historical period is calculated as the similarity. The initial curve and the core curve are unified in the same coordinate system. Then, based on the obtained similarity and the current BeiDou coordinates, as well as the coordinates in the corresponding core curve, the BeiDou coordinates at the next time point are predicted. Based on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time, determine whether the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are both within the authorized area; When both the BeiDou coordinates at the given time point and the BeiDou coordinates at the next time point are within the authorized area, it is determined that the wireless communication terminal is within the authorized geographical range.

4. The dual security authentication method according to claim 3, characterized in that, Based on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time, determine whether both the current BeiDou coordinates and the BeiDou coordinates at the next time are within the authorized area, including: Obtain the BeiDou coordinates at the current time point and the BeiDou coordinates at the next time point; The positioning radius is set based on the obtained BeiDou coordinates to determine the positioning circle area centered on the BeiDou coordinates; If the overlapping area between the positioning circle centered on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time and the authorized area both exceed a preset threshold, it is determined that the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are both within the authorized area.

5. The dual security authentication method according to claim 4, characterized in that, Based on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time, determine whether the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are both within the authorized area, including: if the overlapping area between the positioning circle centered on the BeiDou coordinates at the current time and the BeiDou coordinates at the next time and the authorized area does not both exceed a preset threshold, determine that the BeiDou coordinates at the current time and the BeiDou coordinates at the next time are not both within the authorized area.

6. The dual security authentication method according to claim 3, characterized in that, Calculating the Fraser distance as similarity between the initial curve and the core curve at the same historical period includes: Obtain the BeiDou coordinates in the initial curve and the core curve; Calculate the distance between the BeiDou coordinates in the core curve and the BeiDou coordinates in the initial curve to construct a distance matrix; Construct a cost matrix based on the distance matrix and determine the final distance as the Fraser distance; The Fraser distance is used as the similarity between the initial curve and the core curve.

7. The dual security authentication method according to claim 3, characterized in that, Based on the obtained similarity and current BeiDou coordinates, as well as the coordinates in the corresponding core curve, the BeiDou coordinates at the next time point are predicted, including: Obtain the similarity between the initial curve and the core curve, and determine whether the similarity exceeds a preset threshold; If the similarity exceeds a preset threshold, discard the similarity and predict the BeiDou coordinates at the next time point using formula (1) based on the BeiDou coordinates and corresponding slope of the initial curve at the current time point: Formula (1), in, The x-coordinate of the BeiDou coordinates at the next point in time. The slope of the horizontal axis of the BeiDou coordinates with respect to time. Indicates the current time. The x-coordinate of the BeiDou coordinates at the current time point. The vertical coordinate of the BeiDou coordinates at the next time point. The slope of the ordinate of the BeiDou coordinates at the current time with respect to time. The vertical coordinate of the BeiDou coordinates at the current time point; If the preset threshold is not exceeded, the influence weight is calculated using formula (2): Formula (2), in, Indicates the influence weight. Indicates the preset threshold. Indicates similarity; Based on the obtained influence weights, the BeiDou coordinates at the next time point are predicted using formula (3): Formula (3), in, This represents the slope of the x-coordinate of a point on the core curve corresponding to the current BeiDou coordinates with respect to time. This represents the slope of the ordinate of a point on the core curve corresponding to the current BeiDou coordinates with respect to time.

Images