Zero-trust gateway single packet authentication method and system for new energy fan control system, computing equipment, computer storage medium, computer program product and chip

Abstract

The invention discloses a zero-trust gateway single packet authentication method and system for a new energy fan control system, computing equipment, a computer storage medium, a computer program product and a chip. The authentication method comprises the steps of generating an authentication material; exchanging and deriving a mixed key; binding Hash calculation is carried out; encrypting and assembling the message; receiving and verifying by the gateway; and binding verification and registration are carried out. The invention relates to a zero-trust gateway single packet authentication method combining a post quantum cryptography algorithm and a national commercial cryptography algorithm. The method is applied to secure communication between a wind power plant and a centralized control center, an SM2, SM3 and SM4 combined algorithm in a national secret system is combined with a post-quantum key agreement algorithm CRYSTALS-Kyber512, identity authentication, encryption and integrity verification are completed through a single message, confidentiality protection and anti-quantum security guarantee under one-time interaction are achieved, and the security of the wind power plant is improved. The method is especially suitable for new energy scenes with wide fan distribution, complex links and high real-time requirements.

Description

TECHNICAL FIELD

[0001] The application relates to a zero-trust gateway single packet authentication method, system, computing device, computer storage medium, computer program product and chip for a new energy fan control system, and belongs to the technical field of network and information security. BACKGROUND

[0002] With the rapid expansion of the installed capacity of wind farms, the number of wind turbines grows exponentially, and wind turbine terminals need to realize remote monitoring, operation data uploading and control command issuing through the SCADA system. The traditional long connection communication mechanism based on VPN or TLS has obvious shortcomings in a large-scale wind turbine network. On the one hand, the maintenance of long connection requires continuous handshake and heartbeat maintenance, which increases network overhead and control delay; on the other hand, in an unstable link environment, long connection is easily interrupted, resulting in authentication failure and command transmission failure. In addition, the traditional authentication system is mostly based on ECC or RSA algorithm, and such algorithm will no longer be secure under the condition of post-quantum computing, the key structure of which can be decomposed by a quantum computer in polynomial time, and it cannot resist quantum attacks.

[0003] In view of the above problems, the single packet authentication (SPA) mechanism proposed in recent years can complete authentication and key agreement in one packet, reduce the exposure surface and have the zero-trust feature. However, the existing schemes mostly rely on traditional public key algorithms and fixed timestamp mechanisms, and lack anti-quantum ability and multi-dimensional binding. Especially in the new energy fan control scene, due to the wide distribution of devices, complex network environment and limited computing resources of nodes, the existing methods are difficult to meet the requirements of high security and high real-time performance at the same time. Therefore, there is an urgent need for a single packet authentication method that introduces post-quantum cryptography mechanism within the framework of the national cryptographic algorithm system to resist quantum attacks, to meet the dual needs of security and compliance in the future quantum computing era. SUMMARY

[0004] The application aims to provide a zero-trust single packet authentication method, system, computing device, computer storage medium, computer program product and chip combined with post-quantum cryptography, to realize secure communication between wind turbine terminals and zero-trust gateways, so that the system completes identity verification, encrypted transmission, integrity protection and anti-replay functions in one-time authentication packet. The method not only meets the security standards of the national commercial cryptography system, but also embeds the CRYSTALS-Kyber512 post-quantum key agreement mechanism in the design to resist quantum computing attacks. At the same time, the application introduces a dynamic weight key derivation function and a multi-context binding hash structure, so that the authentication key is bound with the wind turbine running state, time window and device context information, thereby realizing secure authentication in a zero-trust environment in a single packet.

[0005] To solve the above technical problems, the technical solutions adopted by the present application are as follows: A zero-trust gateway single package authentication method for a new energy fan control system, comprising the following steps: Step 1: Generate authentication materials: When the fan terminal is preparing to send control commands or operation data to the control center, first read the terminal identity ID and context information ctx, then the fan terminal generates a one-time random number R and the current timestamp Ts, and reads its own SM2 key pair in the local cache And the key pair of the post-quantum key exchange algorithm CRYSTALS-Kyber512 ; wherein, And are the SM2 private key and public key of the fan terminal, And are the Kyber private key and public key of the fan terminal; Step 2: Hybrid key exchange and derivation: The fan terminal uses its private key And the gateway public key Execute the SM2 key exchange algorithm to calculate the first shared secret , and execute the Kyber512 encapsulation operation with the Kyber public key of the gateway as input to generate the second shared secret And the ciphertext part ; finally, the two are spliced to form the total hybrid shared secret , the calculation process is as follows:

[0006] wherein, And are the SM2 private key and public key of the fan terminal and the gateway, is the Kyber public key of the gateway, and Concat represents the result splicing operation. This hybrid shared secret has both national secret authentication constraints and post-quantum resistance, providing a basis for subsequent key derivation; The fan terminal then calls the dynamic weight key derivation function based on SM3, taking , , , , as input, automatically assigning weights ~ according to the real-time network status, CPU load and fan operation mode, so as to calculate the session encryption key with session authentication key , the derivation function is defined as follows:

[0007] wherein, is an encryption key, is an authentication key, is a fan identity, is context information (including station number, firmware version, policy version, etc.), is a current timestamp, is a one-time random number, is a system dynamic weight parameter, the value of which is dynamically adjusted according to network latency, load and control priority, the key value generated in different states is unique and unpredictable, and the entire process does not need to interact with the gateway, and the gateway can independently calculate the same key through its own private key after receiving the message; Step three: binding hash calculation: The fan terminal uses the SM3 hash algorithm to generate a binding hash to ensure the consistency of the message with the device identity, timestamp and context, and prevent it from being forged or replayed, and its calculation formula is:

[0008] Embedding the public key features of the double algorithm into the binding process makes the message have a unique corresponding relationship in identity and space-time; Step four: message encryption and assembly: The fan terminal uses the session encryption key as input, uses the CCM mode of the national standard SM4 to encrypt the payload , obtains the ciphertext and the authentication tag , and the encryption form is as follows: ; The message assembly format is: wherein, KyberCipher is the ciphertext part of the post-quantum key agreement; The SM4-CCM mode provides confidentiality and integrity protection in one transmission, which can effectively prevent man-in-the-middle tampering, and the final message can complete the whole process authentication with only one data packet; Step five: gateway reception and verification: After receiving the single-packet authentication message, the zero-trust gateway first checks whether the timestamp is within the allowed time window, and verifies whether the random number has not been marked as "used" in the cache. If the verification is passed, the gateway uses its own private key With Respectively execute SM2 key exchange and Kyber unpack, rebuild shared secret , and generate session key through the same dynamic weight derivation function With . Then the gateway decrypts the message using the SM4-CCM mode and verifies the correctness of the authentication tag . If decryption and tag verification are successful, it means that the message has not been tampered with; Step six: binding verification and registration: The gateway calculates the local binding hash of the decrypted content , and compares it with the hash value transmitted in the message. If they are consistent, it means that the authentication data is real and effective, and the gateway will register the random number As "used", and open the control authority for the corresponding fan node within the limited time window, establishing a short-time secure channel; if the hash is inconsistent or the time window is invalid, the message will be silently discarded and no response will be generated.

[0009] The single packet authentication method of the application includes three parts of fan terminal, zero trust gateway and control center in architecture. The fan terminal and the zero trust gateway establish short-time secure communication through one-time authentication message. The whole process consists of key negotiation, key derivation, binding hash calculation, encryption and verification steps.

[0010] In the above step one, the fan terminal and the zero trust gateway respectively save two sets of key pairs: one set is the SM2 public and private key pair of the national secret, and the other set is the public and private key pair of the post-quantum key exchange algorithm CRYSTALS-Kyber512.

[0011] In the above step two, in order to make the generated key have adaptive security in different running environments, the application proposes a dynamic weight key derivation function to assign weights to different input items in the derivation process.

[0012] The dynamic adjustment of the weight w i Is completed by the system strategy module, and the weight changes the influence proportion of the input item under different conditions to realize the context awareness characteristics of key generation, so that the key cannot be reconstructed offline.

[0013] In the above step three, the fan terminal further calculates the binding hash value after obtaining the session key to ensure the integrity and identity consistency of the message. The generation formula of the binding hash is:

[0014] Where, Indicates the splicing operation, represents bitwise XOR. The binding hash combines the timestamp, random number, context, and dual-algorithm public key features at the same time, forming a unique multi-dimensional binding structure, which fundamentally prevents replay and forgery attacks.

[0015] Subsequently, in step four, the fan terminal encrypts the session key The payload is encrypted using the SM4-CCM mode, which includes The encrypted form is as follows:

[0016] The final generated authentication message format is where KyberCipher is the ciphertext part of the post-quantum key agreement.

[0017] After receiving the message, the zero-trust gateway first verifies whether the timestamp is within the allowed window and checks whether the random number has been used. Then the gateway uses its own private key to calculate the shared secret , which is derived through the same KDF function , decrypts the message using the SM4-CCM mode and verifies the authentication tag Tag. If the decryption is successful, the gateway recalculates the binding hash and compares it with the hash value in the message. If they are consistent, the authentication message is considered real and valid, the random number R is marked as "used", and the corresponding control permissions are opened for the fan node.

[0018] In the above step one, the context information ctx includes the fan number, station ID, control strategy version, controller firmware version, and geographic location code, etc., which is used to uniquely identify the device operating environment.

[0019] A zero-trust gateway single-package authentication system for a new energy fan control system, comprising: An authentication material generation module: when the fan terminal is preparing to send control commands or operation data to the centralized control center, it first reads the terminal identity ID and context information ctx, then generates a one-time random number R and the current timestamp Ts, and reads its own SM2 key pair and the key pair of the post-quantum key exchange algorithm CRYSTALS-Kyber512 in the local cache; wherein, and are the SM2 private key and public key of the fan terminal, and are the Kyber private key and public key of the fan terminal; A hybrid key exchange and derivation module: the fan terminal uses its private key With gateway public key The SM2 key exchange algorithm is executed to calculate the first shared secret. At the same time, using the gateway's Kyber public key Perform a Kyber512 encapsulation operation on the input to generate a second shared secret. and ciphertext portion Ultimately, the two will be combined to form a total hybrid shared secret. The calculation process is as follows:

[0020] in, and These are the SM2 private and public keys for the wind turbine terminal and the gateway, respectively. The Kyber public key of the gateway is used, and Concat represents the result concatenation operation. This hybrid shared secret has both national cryptographic certification constraints and post-quantum resistance, providing a foundation for subsequent key derivation. The wind turbine terminal then calls the SM3-based dynamic weighted key derivation function to... , , , , As input, weights are automatically assigned based on real-time network status, CPU load, and wind turbine operating mode. ~ Thus, the session encryption key is calculated. With session authentication key The derived function is defined as follows:

[0021] In the formula, For encryption key, For authentication key, For identifying the wind turbine, This includes contextual information (including site number, firmware version, policy version, etc.). This is the current timestamp. A one-time random number. This is a dynamic weight parameter of the system. Its value is dynamically adjusted according to network latency, load and control priority. The key value generated under different states is unique and unpredictable. The whole process does not require interaction with the gateway. After receiving the message, the gateway can independently calculate the same key through its own private key. Binding hash calculation module: The wind turbine terminal uses the SM3 hash algorithm to generate binding hashes. To ensure the consistency of message identity, timestamp, and context with the device, and to prevent forgery or replay, the calculation formula is as follows:

[0022] By embedding the dual-algorithm public key features into the binding process, the message has a unique correspondence in terms of identity and time and space. Message encryption and assembly module: Uses the wind turbine terminal with a session encryption key. As input, the CCM mode of the national cryptographic standard SM4 is used for the load. Encrypt to obtain ciphertext With certification label The encryption method is as follows: ; The message assembly format is as follows: Where KyberCipher is the ciphertext portion after quantum key negotiation; The SM4-CCM mode provides both confidentiality and integrity protection in a single transmission, effectively preventing man-in-the-middle tampering, and the final message can complete the entire authentication process with only one data packet. Gateway Receiving and Authentication Module: After receiving a single-packet authentication message, the zero-trust gateway first checks the timestamp. Is it within the allowed time window, and verify the random number in the cache? Is it not marked as "used"? If the verification passes, the gateway uses its own private key. and Perform SM2 key exchange and Kyber decapsulation separately to reconstruct the shared secret. Session keys are generated using the same dynamic weight derivation function. and The gateway then uses SM4-CCM mode to decrypt the packet and verify the authentication tag. The correctness of the message is verified. If both decryption and tag verification are successful, it means the message has not been tampered with. Binding Verification and Registration Module: The gateway calculates the local binding hash for the decrypted content. The gateway then compares the hash value transmitted in the message with the hash value. If they match, the authentication data is considered authentic and valid, and the gateway will generate a random number. The message is registered as "used" and control permissions are granted to the corresponding wind turbine node within a limited time window to establish a short-term secure channel. If the hash is inconsistent or the time window expires, the message will be silently discarded without generating any response.

[0023] In the aforementioned module for generating certification materials, the context information ctx includes the wind turbine number, site ID, control strategy version, controller firmware version, and geolocation code.

[0024] A computing device includes: at least one processor and at least one memory, wherein instructions are stored in the memory, and when executed individually or jointly by the at least one processor, the computing device causes the computing device to perform the aforementioned zero-trust gateway single-packet authentication method for a new energy wind turbine control system.

[0025] A computer storage medium storing instructions that, when executed individually or jointly by at least one processor of a computing device, cause the computing device to perform the aforementioned zero-trust gateway single-packet authentication method for a new energy wind turbine control system.

[0026] A computer program product includes instructions that, when executed individually or jointly by at least one processor of a computing device, cause the computing device to perform the aforementioned zero-trust gateway single-packet authentication method for a new energy wind turbine control system.

[0027] A chip includes a circuit system configured to perform the aforementioned zero-trust gateway single-packet authentication method for new energy wind turbine control systems.

[0028] This invention presents a zero-trust gateway single-packet authentication method that combines post-quantum cryptography algorithms with national commercial cryptographic algorithms. This method is applied to secure communication between wind farms and control centers. It employs a combination of SM2, SM3, and SM4 algorithms from the national cryptographic system with the post-quantum key negotiation algorithm CRYSTALS-Kyber512. Through a single message, it completes identity authentication, encryption, and integrity verification, achieving confidentiality protection and quantum-resistant security under one-time interaction. This method is particularly suitable for new energy scenarios with widely distributed wind turbines, complex links, and high real-time requirements.

[0029] Any techniques not mentioned in this invention are based on existing technologies.

[0030] This invention presents a zero-trust gateway single-packet authentication method for new energy wind turbine control systems. By introducing the post-quantum key negotiation algorithm CRYSTALS-Kyber512 into the framework of the national cryptographic system, a quantum-secure zero-trust single-packet authentication mechanism is constructed. Compared with traditional schemes, this method has the following advantages: First, it adopts a two-layer negotiation structure of the national cryptographic standard SM2 and Kyber512, meeting domestic cryptographic standard compliance requirements while resisting quantum attacks; Second, through a dynamic weighted key derivation function, the generated key dynamically changes with the system state, exhibiting nonlinear and adaptive characteristics; Third, the binding hash structure comprehensively embeds identity, timestamp, random number, context, and public key features, making the message non-replayable under different environments; Fourth, this method requires only a single message to complete authentication and encryption operations, reducing the communication and computational burden on the wind turbine control system in complex link environments; Fifth, under the zero-trust architecture, the gateway port is completely invisible before authentication, preventing attackers from discovering the entry point through scanning, thus significantly reducing the attack surface. Attached Figure Description

[0031] Figure 1 is a schematic diagram of the overall architecture of the present invention.

[0032] Figure 2 is a flowchart of the hybrid key negotiation process of the present invention.

[0033] Figure 3 is a schematic diagram of the single-packet authentication message structure of the present invention. Detailed Implementation

[0034] To better understand the present invention, the following embodiments further illustrate the content of the present invention, but the content of the present invention is not limited to the following embodiments.

[0035] A zero-trust gateway single-packet authentication method for new energy wind turbine control systems includes the following steps: Step 1: Generate certification materials When preparing to send control commands or operational data to the central control center, the wind turbine terminal first reads its terminal identification ID and context information ctx. The context information includes the wind turbine number, site ID, control strategy version, controller firmware version, and geolocation code, used to uniquely identify the equipment's operating environment. Subsequently, the wind turbine terminal generates a one-time random number R and the current timestamp Ts, and reads its own SM2 key pair from its local cache. and key pairs of the post-quantum key exchange algorithm CRYSTALS-Kyber512 .

[0036] Step Two: Hybrid Key Exchange and Derivation The wind turbine terminal uses its private key With gateway public key The SM2 key exchange algorithm is executed to calculate the first shared secret. At the same time, using the gateway's Kyber public key Perform a Kyber512 encapsulation operation on the input to generate a second shared secret. and ciphertext portion Ultimately, the two will be combined to form a total hybrid shared secret. The wind turbine then calls the SM3-based dynamic weighted key derivation function to... , , , , As input, weights are automatically assigned based on real-time network status, CPU load, and wind turbine operating mode. ~ Thus, the session encryption key is calculated. With session authentication key The derived function is defined as follows:

[0037] The dynamic adjustment of the weight wᵢ is handled by the system policy module, and the key value generated under different states is unique and unpredictable. The entire process requires no interaction with the gateway; the gateway can independently calculate the same key using its own private key after receiving a message.

[0038] Step 3: Binding Hash Calculation The wind turbine terminal uses the SM3 hash algorithm to generate binding hashes. This ensures the consistency of the message with the device identity, timestamp, and context, preventing forgery or replay. The calculation formula is:

[0039] This structure embeds the dual-algorithm public key features into the binding process, ensuring that messages have a unique correspondence in terms of identity and time and space.

[0040] Step 4: Message Encryption and Assembly Wind turbine terminal uses session encryption key As input, the CCM mode of the national cryptographic standard SM4 is used to analyze the load. Encrypt to obtain ciphertext With certification label The message assembly format is The SM4-CCM mode provides both confidentiality and integrity protection in a single transmission, effectively preventing man-in-the-middle tampering. The final message completes the entire authentication process with just a single data packet.

[0041] Step 5: Gateway Reception and Verification After receiving a single-packet authentication message, the zero-trust gateway first checks the timestamp. Is it within the allowed time window, and verify the random number in the cache? Is it not marked as "used"? If the verification passes, the gateway uses its own private key. and Perform SM2 key exchange and Kyber decapsulation separately to reconstruct the shared secret. Session keys are generated using the same dynamic weight derivation function. and The gateway then uses SM4-CCM mode to decrypt the packet and verify the authentication tag. The correctness of the message is verified. If both decryption and tag verification are successful, it means the message has not been tampered with.

[0042] Step Six: Binding Verification and Registration The gateway calculates the local binding hash of the decrypted content. The gateway then compares the hash value transmitted in the message with the hash value. If they match, the authentication data is considered authentic and valid, and the gateway will generate a random number. The message is registered as "used" and control permissions are granted to the corresponding wind turbine node within a limited time window, establishing a short-term secure channel. If the hash is inconsistent or the time window expires, the message will be silently discarded without generating any response.

[0043] Figure 1 is a schematic diagram of the overall architecture of this invention, illustrating the process of single-packet authentication between the wind turbine terminal and the central control center through a zero-trust gateway. Figure 2 is a flowchart of the hybrid key negotiation process of this invention, illustrating the combination of SM2 and Kyber512 negotiation processes. Figure 3 is a schematic diagram of the single-packet authentication message structure of this invention, illustrating that the message consists of four parts: a random number R, encrypted ciphertext C, authentication tag Tag, and KyberCipher.

Claims

1. A zero-trust gateway single-packet authentication method for new energy wind turbine control systems, characterized in that: Includes the following steps: Step 1: Generate certification materials: When the wind turbine terminal is preparing to send control commands or operating data to the central control center, it first reads the terminal identification ID and context information ctx. Then, the wind turbine terminal generates a one-time random number R and the current timestamp Ts, and reads its own SM2 key pair from the local cache. and key pairs of the post-quantum key exchange algorithm CRYSTALS-Kyber512 ;in, and These are the SM2 private and public keys for the wind turbine terminal, respectively. and This refers to the Kyber private and public keys for the wind turbine terminal. Step Two: Hybrid Key Exchange and Derivation: The wind turbine terminal uses its private key With gateway public key The SM2 key exchange algorithm is executed to calculate the first shared secret. At the same time, using the gateway's Kyber public key Perform a Kyber512 encapsulation operation on the input to generate a second shared secret. and ciphertext portion Finally, the two are combined to form the overall hybrid shared secret. The calculation process is as follows: ； in, and These are the SM2 private and public keys for the wind turbine terminal and the gateway, respectively. The Kyber public key of the gateway is used, and Concat represents the result concatenation operation. This hybrid shared secret has both national cryptographic certification constraints and post-quantum resistance, providing a foundation for subsequent key derivation. The wind turbine terminal then calls the SM3-based dynamic weighted key derivation function to... , , , , As input, weights are automatically assigned based on real-time network status, CPU load, and wind turbine operating mode. ~ Thus, the session encryption key is calculated. With session authentication key The derived function is defined as follows: ； In the formula, For encryption key, For authentication key, For the identification of wind turbines, For contextual information, This is the current timestamp. A one-time random number. This is a dynamic weight parameter of the system. Its value is dynamically adjusted according to network latency, load and control priority. The key value generated under different states is unique and unpredictable. The whole process does not require interaction with the gateway. After receiving the message, the gateway can independently calculate the same key through its own private key. Step 3: Bind hash calculation: The wind turbine terminal uses the SM3 hash algorithm to generate binding hashes. To ensure the consistency of message identity, timestamp, and context with the device, and to prevent forgery or replay, the calculation formula is as follows: ； By embedding the dual-algorithm public key features into the binding process, the message has a unique correspondence in terms of identity and time and space. Step 4: Message Encryption and Assembly Wind turbine terminal uses session encryption key As input, the CCM mode of the national cryptographic standard SM4 is used for the load. Encrypt to obtain ciphertext With certification label The encryption method is as follows: ； The message assembly format is as follows: Where KyberCipher is the ciphertext portion after quantum key negotiation; The SM4-CCM mode provides both confidentiality and integrity protection in a single transmission, effectively preventing man-in-the-middle tampering, and the final message can complete the entire authentication process with only one data packet. Step 5: Gateway Reception and Verification: After receiving a single-packet authentication message, the zero-trust gateway first checks the timestamp. Is it within the allowed time window, and verify the random number in the cache? Whether it has not been marked as "used"; if the verification passes, the gateway uses its own private key. and Perform SM2 key exchange and Kyber decapsulation separately to reconstruct the shared secret. Session keys are generated using the same dynamic weight derivation function. and The gateway then uses SM4-CCM mode to decrypt the message and verify the authentication tag. The correctness of the message; if both decryption and tag verification are successful, it means the message has not been tampered with. Step Six: Binding Verification and Registration: The gateway calculates the local binding hash of the decrypted content. The gateway then compares the hash value transmitted in the message with the hash value. If they match, the authentication data is considered authentic and valid, and the gateway will generate a random number. The message is registered as "used" and control permissions are granted to the corresponding wind turbine node within a limited time window, establishing a short-term secure channel. If the hash is inconsistent or the time window expires, the message will be silently discarded without generating any response.

2. The zero-trust gateway single-packet authentication method for new energy wind turbine control systems according to claim 1, characterized in that: In step one, the context information ctx includes the wind turbine number, site ID, control strategy version, controller firmware version, and geolocation code, which are used to uniquely identify the equipment operating environment.

3. A zero-trust gateway single-package authentication system for new energy wind turbine control systems, characterized in that: include: The authentication material generation module is used by the wind turbine terminal to first read the terminal's identity identifier when preparing to send control commands or operating data to the central control center. With context information Subsequently, the wind turbine terminal generates a one-time random number. With current timestamp It also reads its own SM2 key pair from the local cache. and key pairs of the post-quantum key exchange algorithm CRYSTALS-Kyber512 ;in, and These are the SM2 private and public keys for the wind turbine terminal, respectively. and For the Kyber private and public keys of the wind turbine terminal; Hybrid Key Exchange and Derivation Module: Wind Turbine Terminal Uses Its Private Key With gateway public key The SM2 key exchange algorithm is executed to calculate the first shared secret. At the same time, using the gateway's Kyber public key Perform a Kyber512 encapsulation operation on the input to generate a second shared secret. and ciphertext portion Ultimately, the two will be combined to form a total hybrid shared secret. The specific calculation process is as follows: ； in, and These are the SM2 private and public keys for the wind turbine terminal and the gateway, respectively. The Kyber public key of the gateway is used, and Concat represents the result concatenation operation. This hybrid shared secret has both national cryptographic certification constraints and post-quantum resistance, providing a foundation for subsequent key derivation. The wind turbine terminal then calls the SM3-based dynamic weighted key derivation function to... , , , , As input, weights are automatically assigned based on real-time network status, CPU load, and wind turbine operating mode. ~ Thus, the session encryption key is calculated. With session authentication key The derived function is defined as follows: ； In the formula, For encryption key, For authentication key, For the identification of wind turbines, For contextual information, This is the current timestamp. A one-time random number. This is a dynamic weight parameter of the system. Its value is dynamically adjusted according to network latency, load and control priority. The key value generated under different states is unique and unpredictable. The whole process does not require interaction with the gateway. After receiving the message, the gateway can independently calculate the same key through its own private key. Binding hash calculation module: Used by the wind turbine terminal to generate binding hashes using the SM3 hash algorithm. To ensure the consistency of message identity, timestamp, and context with the device, and to prevent forgery or replay, the calculation formula is as follows: ； By embedding the dual-algorithm public key features into the binding process, the message has a unique correspondence in terms of identity and time and space. Message encryption and assembly module: used in wind turbine terminals to use session encryption keys As input, the CCM mode of the national cryptographic standard SM4 is used to analyze the load. Encrypt to obtain ciphertext With certification label The encryption method is as follows: ； The message assembly format is as follows: Where KyberCipher is the ciphertext portion after quantum key negotiation; The SM4-CCM mode provides both confidentiality and integrity protection in a single transmission, effectively preventing man-in-the-middle tampering, and the final message can complete the entire authentication process with only one data packet. Gateway receiving and authentication module: This module is used by the zero-trust gateway to first check the timestamp after receiving a single-packet authentication message. Is it within the allowed time window, and verify the random number in the cache? Whether it has not been marked as "used"; if the verification passes, the gateway uses its own private key. and Perform SM2 key exchange and Kyber decapsulation separately to reconstruct the shared secret. Session keys are generated using the same dynamic weight derivation function. and The gateway then uses SM4-CCM mode to decrypt the message and verify the authentication tag. The correctness of the message; if both decryption and tag verification are successful, it means the message has not been tampered with. Binding Verification and Registration Module: Used by the gateway to calculate the local binding hash of the decrypted content. The gateway then compares the hash value transmitted in the message with the hash value. If they match, the authentication data is considered authentic and valid, and the gateway will generate a random number. The message is registered as "used" and control permissions are granted to the corresponding wind turbine node within a limited time window, establishing a short-term secure channel. If the hash is inconsistent or the time window expires, the message will be silently discarded without generating any response.

4. The zero-trust gateway single-packet authentication system for new energy wind turbine control systems according to claim 3, characterized in that: The context information ctx includes the wind turbine number, site ID, control strategy version, controller firmware version, and geolocation code.

5. A computing device, characterized in that, include: The device comprises at least one processor and at least one memory, wherein the memory stores instructions that, when executed individually or jointly by the at least one processor, cause the computing device to perform the zero-trust gateway single-packet authentication method for a new energy wind turbine control system as described in claim 1 or 2.

6. A computer storage medium storing instructions thereon, characterized in that, When the instruction is executed individually or jointly by at least one processor of the computing device, the computing device performs the zero-trust gateway single-packet authentication method for new energy wind turbine control systems as described in claim 1 or 2.

7. A computer program product, characterized in that, The instruction includes instructions that, when executed individually or jointly by at least one processor of the computing device, cause the computing device to perform the zero-trust gateway single-packet authentication method for a new energy wind turbine control system as described in claim 1 or 2.

8. A chip, comprising a circuit system, characterized in that, The circuit system is configured to perform the zero-trust gateway single-packet authentication method for new energy wind turbine control systems as described in claim 1 or 2.

Images