Electric power communication unified authentication method based on quantum

Abstract

The invention relates to an electric power communication unified authentication method based on quantum. The method comprises the following steps: a terminal device initiates an authentication request to a unified authentication platform; the unified authentication platform forwards the equipment identifier to the quantum key service system based on the authentication request; the quantum key service system obtains a true random quantum key, dynamically allocates a disposable session key pair for the current authentication session, and returns a session public key to the unified authentication platform; the unified authentication platform sends challenge information to the terminal equipment; the terminal equipment generates a temporary private key corresponding to the current session based on the root key and the session public key, performs digital signature and returns a signature result; the unified authentication platform sends the signature data, the device identifier and the session public key to a quantum key service system for signature verification; and the quantum key service system executes black box type signature verification operation, verifies the signature validity through a key derivation function, and returns a Boolean type signature verification result to the unified authentication platform.

Description

Technical Field

[0001] This invention relates to a quantum-based unified authentication method for power communication, which belongs to the interdisciplinary field of information security and power communication technology. Background Technology

[0002] With the rapid development of smart grids and the Internet of Things in the power sector, a massive number of terminal devices (such as smart meters, line monitoring terminals, and distributed energy controllers) need to be connected to the power communication network. The authentication of these devices is the first line of defense in ensuring the safe and stable operation of the power grid.

[0003] Currently, mainstream identity authentication schemes generally adopt a PKI-based digital certificate system. In this system, the terminal device holds a digital certificate issued by a trusted certification authority (CA). During authentication, the device uses its private key to sign the challenge information, and the server uses the CA's root certificate public key to verify the signature, thereby confirming the device's identity. However, this traditional scheme has inherent security flaws: 1. Static root key risk: The CA's root certificate private key is the cornerstone of the entire trust system. Once cracked or stolen, attackers can forge certificates for any device, causing the entire trust system to collapse. Root keys typically remain unchanged for a long period, providing a window of opportunity for attacks.

[0004] 2. Risks of centralized key storage: The server or CA center stores a large number of key pairs, making them high-value attack targets and vulnerable to internal and external attacks.

[0005] 3. High logical coupling: The authentication server is responsible for both business processes and core cryptographic operations. Once it is compromised, it will directly lead to key leakage and authentication failure. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention proposes a quantum-based unified authentication method for power communication, aiming to solve the problems of static root key security bottleneck and single point of vulnerability in system architecture in traditional power communication authentication.

[0007] The technical solution of the present invention is as follows: A quantum-based unified authentication method for power communication includes the following steps: The terminal device initiates an authentication request to the unified authentication platform, which includes the device identifier and a first random number; The unified authentication platform generates a second random number based on the authentication request and forwards the device identifier to the quantum key service system; The quantum key service system obtains truly random quantum keys through the quantum key distribution network, dynamically allocates one-time session key pairs for the current authentication session, and returns the session public key to the unified authentication platform; The unified authentication platform sends a challenge message to the terminal device containing a first random number, a second random number, and the session public key; The terminal device generates a temporary private key corresponding to the current session based on the root key and the session public key through a key derivation function, and uses the temporary private key to digitally sign the challenge information, and returns the signature result to the unified authentication platform; the root key is pre-installed in the terminal device and shared with the quantum key service system; The unified authentication platform sends the signature data, device identifier, and session public key to the quantum key service system for signature verification; The quantum key service system performs a black-box signature verification operation, verifies the validity of the signature through the key derivation function, and returns a Boolean signature verification result to the unified authentication platform. The unified authentication platform makes authentication decisions based on the signature verification results and destroys the temporary key materials related to the current session after successful authentication. In a preferred embodiment, the quantum key service system obtains truly random quantum keys through a quantum key distribution network that conform to the characteristics of quantum randomness, and the session key pair is allocated only once in each authentication process and destroyed immediately after use.

[0008] In a preferred embodiment, the process by which the terminal device generates a temporary private key includes: Based on the preset root key and session public key, cryptographic operations are performed through key derivation functions to generate a temporary private key that uniquely corresponds to the current session.

[0009] In a preferred embodiment, the quantum key service system performs a black-box signature verification operation, performing cryptographic verification only based on the input signature data, device identifier, and session public key, without parsing or being aware of any business-level related information in the input data.

[0010] In a preferred embodiment, the root key is pre-installed in the T-card of the terminal device and initially distributed with the corresponding root key maintained by the quantum key service system through quantum key distribution technology.

[0011] In a preferred embodiment, the unified authentication platform is physically and logically separated from the quantum key service system, and the unified authentication platform does not store any root key or terminal private key.

[0012] In a preferred embodiment, the quantum key service system dynamically allocates session key pairs through its maintained key pool, and the system protects the master key using a quantum-safe storage mechanism.

[0013] In a preferred embodiment, the device identifier in the authentication request is used to uniquely index the root key of the corresponding terminal device in the quantum key service system.

[0014] As a preferred implementation, the unified authentication platform immediately triggers a process to destroy temporary key materials after successful authentication, including clearing the session public key, temporary private key derivation intermediate results, and related random numbers from memory.

[0015] As a preferred implementation, an authentication failure handling mechanism is also included, specifically: when the signature verification result fails, the unified authentication platform records the security event and delays the processing of subsequent authentication requests, while the quantum key service system marks the abnormal device identifier. Compared with the prior art, the beneficial effects of the present invention are: This invention generates session key pairs using truly random quantum keys obtained through a quantum key distribution network, fundamentally ensuring the unpredictability and attack resistance of the keys. Employing a one-time pad session key mechanism combined with temporary private key derivation technology effectively prevents key reuse and replay attacks. The black-box signature verification design of the quantum key service system ensures the isolation of core key materials from business systems, and the unified authentication platform does not store any root keys, significantly reducing the risk of key leakage.

[0016] This invention achieves the security principle of separation of duties by physically and logically separating the unified authentication platform and the quantum key service system. Terminal devices protect the root key through T-card security hardware, and combined with a quantum-secure storage mechanism, construct a multi-layered security protection system. Dynamic key pool management and an instant key destruction mechanism ensure the security of key materials throughout their entire lifecycle.

[0017] This invention maintains quantum-level security while ensuring excellent compatibility with existing power communication infrastructure through a standardized authentication process design. The device identifier indexing mechanism simplifies key management, and the Boolean signature verification result interface facilitates system integration. The authentication failure handling mechanism enhances the system's resistance to attacks and security auditing capabilities, providing a complete identity authentication solution for power communication systems.

[0018] Additional aspects and advantages of the invention will be set forth in the following description, and some of them will be obvious from the description, or may be learned by practicing the invention. Furthermore, various aspects and advantages of the invention may be realized and obtained by means of method steps and combinations particularly pointed out in the appended claims. Attached Figure Description

[0019] Figure 1 This is a logic block diagram of an embodiment of the present invention; Figure 2 This is a schematic diagram of the method flow according to an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0022] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0024] The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0025] See Figure 1-2 This embodiment presents a quantum-based unified authentication method for power communication, comprising the following steps: S1. The terminal device initiates an authentication request to the unified authentication platform, which includes a device identifier and a first random number. The terminal device, through a pre-set secure medium, works with the quantum key service system to derive a temporary private key corresponding to this session. The temporary private key corresponds to this authentication session. The device identifier in the authentication request is used to index the corresponding session key pair in the quantum key service system.

[0026] It should be noted that the system includes terminal devices, a unified authentication platform, and a quantum key service system; Each terminal device is equipped with a T-card with secure storage capabilities. During the production or initialization phase of the terminal device, the root key is securely pre-installed into the T-card using quantum key distribution technology. This root key is completely identical to the corresponding root key maintained in the quantum key service system and remains protected by secure hardware (T-card) throughout the terminal device's lifecycle, never to be leaked. The terminal device has functions such as initiating authentication requests to the unified authentication platform, receiving challenge information, generating temporary private keys, performing digital signatures, and returning signature results. In the unified authentication platform, an independent unified authentication platform server is built, which is physically and logically separated from the quantum key service system. The unified authentication platform does not store any root key or terminal long-term private key, but is only responsible for coordinating and managing the authentication process, including receiving authentication requests from terminal devices, forwarding device identifiers, sending challenge information, receiving signature results, requesting signature verification from the quantum key service system, and making authentication decisions based on the signature verification results. In the quantum key distribution system, truly random quantum keys are obtained through a quantum key distribution network, and these keys conform to the characteristics of quantum randomness. The system maintains a key pool for dynamically allocating session key pairs, and the master key is protected using a quantum-secure storage mechanism to ensure key security. The quantum key distribution system has functions such as indexing the root key of terminal devices based on device identifiers, dynamically allocating session key pairs, and performing black-box signature verification operations. Before the system goes into operation, the following initialization tasks need to be completed: Terminal device initialization: During the production and filling stage, each smart meter will have a globally unique device identifier written into its hardware security module, and a seed key distributed by the quantum key service system through a secure channel will be pre-installed. The smart meter supports a quantum-safe 5G communication protocol. Quantum Key Service System Initialization: The quantum key service system generates and stores a large number of theoretically secure quantum keys through a quantum key distribution network, forming a dynamic quantum key pool. The system deploys standard cryptographic service APIs. Unified Authentication Platform Initialization: The unified authentication platform synchronizes the device identifiers of all legitimate smart meters from the device management system to form a device whitelist. The platform itself does not store any key materials.

[0027] Before the authentication process is executed, authentication initialization is required. The smart meter needs to report electricity consumption data to the data acquisition platform. First, it sends an authentication request to the unified authentication platform. The authentication request data packet contains at least two key elements: its own device identifier and a highly random number generated in real time by the meter's security chip. When a terminal device initiates an authentication request, it sends the request to the unified authentication platform when it needs to access the power communication network. The authentication request includes a device identifier and a first random number. The device identifier is used to uniquely index the root key of the corresponding terminal device in the quantum key service system. The first random number is randomly generated by the terminal device to increase the security of the authentication process and prevent replay attacks.

[0028] S2. The unified authentication platform generates a second random number and forwards the device identifier to the quantum key service system. The unified authentication platform and the quantum key service system are physically and logically separated. The unified authentication platform does not store any root key or terminal long-term private key. S3. The quantum key service system obtains a truly random quantum key through the quantum key distribution network, dynamically allocates a one-time session key pair for this authentication session, and returns the session public key to the unified authentication platform. The truly random quantum key obtained by the quantum key service system through the quantum key distribution network conforms to the characteristics of quantum randomness, and the session key pair is allocated only once in each authentication process and destroyed immediately after use.

[0029] It should be noted that after receiving an authentication request from a terminal device, the unified authentication platform generates a second random number. Simultaneously, it forwards the device identifier to the quantum key service system so that the quantum key service system can obtain the corresponding root key for the terminal device. After receiving the device identifier, the quantum key distribution system obtains a truly random quantum key through the quantum key distribution network. Then, it dynamically allocates a one-time session key pair for this authentication session, including a session public key and a session private key (the session private key is stored within the quantum key distribution system and not transmitted externally). After allocation, the session public key is returned to the unified authentication platform. Furthermore, the session key pair is allocated only once in each authentication process and destroyed immediately after use to ensure key freshness and security.

[0030] S4. The quantum key service system obtains truly random quantum keys through the quantum key distribution network, dynamically allocates one-time session key pairs for this authentication session, and returns the session public key to the unified authentication platform; the key pool maintained by the quantum key service system dynamically allocates session key pairs, and the system uses a quantum-safe storage mechanism to protect the master key.

[0031] It should be noted that after receiving the session public key returned by the quantum key service system, the unified authentication platform sends a challenge message to the terminal device containing a first random number, a second random number, and the session public key. This information will be used by the terminal device to generate a temporary private key and perform digital signatures.

[0032] S5. The terminal device, based on the root key pre-installed in its T-card and shared with the quantum key service system, combines the session public key with the key derivation function to generate a temporary private key corresponding to the current session, and uses the temporary private key to digitally sign the challenge information, returning the signature result to the unified authentication platform; the process of the terminal device generating the temporary private key includes: based on the pre-installed root key and session public key, performing cryptographic operations through the key derivation function to generate a temporary private key uniquely corresponding to the current authentication session; The root key pre-installed in the T-card of the terminal device and the corresponding root key maintained by the quantum key service system are initially distributed through quantum key distribution technology, and the root key is always protected by secure hardware throughout the life cycle of the terminal device and will never be leaked.

[0033] It should be noted that after receiving the challenge information, the terminal device, based on the root key pre-installed in its T-card and shared with the quantum key service system, combines it with the session public key and performs cryptographic operations through a key derivation function to generate a temporary private key uniquely corresponding to this authentication session. Specifically, the process involves taking the pre-installed root key and session public key as input, performing complex operations through the key derivation function, and outputting the temporary private key for this session. After generating the temporary private key, the terminal device uses this temporary private key to digitally sign the challenge information (containing a first random number, a second random number, and the session public key).

[0034] S6. The unified authentication platform sends the signature data, device identifier, and session public key to the quantum key service system for signature verification. S7. The quantum key service system performs a black-box signature verification operation, verifying the validity of the signature through the same key derivation function, and is unaware of the business meaning of the verification data, only returning a Boolean signature verification result. The quantum key service system performs a black-box signature verification operation, only performing cryptographic verification based on the input signature result, device identifier, and session public key, without parsing or being aware of the business meaning of these data.

[0035] It should be noted that after receiving the signature result returned by the terminal device, the unified authentication platform sends the signature data, device identifier, and session public key to the quantum key service system for verification. The quantum key service system performs a black-box verification operation, performing cryptographic verification only based on the input signature result, device identifier, and session public key. It uses the same key derivation function, combined with the root key indexed from the device identifier and the input session public key, to regenerate the same temporary private key as the terminal device (operated internally and not exposed externally), and then uses this temporary private key to verify the signature result. The quantum key service system is unaware of the business meaning of the verification data, does not parse or perceive the business-level meaning of this data, and only returns a Boolean verification result (success or failure).

[0036] S8. The unified authentication platform completes the authentication decision based on the signature verification result and immediately destroys the temporary key materials related to this session after successful authentication.

[0037] It should be noted that the unified authentication platform makes authentication decisions based on the signature verification results returned by the quantum key service system. If the signature verification result is successful, the terminal device is allowed to access the power communication network; if the signature verification result fails, the terminal device's access request is rejected. Regardless of whether the authentication is successful or not, after the authentication process is completed, the unified authentication platform immediately triggers the destruction process of temporary key materials upon successful authentication, including clearing the session public key, the intermediate results of the temporary private key derivation, and related random numbers (first random number, second random number) from memory, to prevent security risks caused by key leakage.

[0038] It also includes an authentication failure handling mechanism, specifically: when the signature verification result fails, the unified authentication platform records the security event and delays the processing of subsequent authentication requests, while the quantum key service system marks the abnormal device identifier.

[0039] It should be noted that when the verification result fails, the unified authentication platform records the security event and records the relevant information of the failed authentication request (such as device identifier, authentication time, reason for failure, etc.) in the security log for subsequent security audit and analysis. The unified authentication platform delays the processing of subsequent authentication requests by setting a certain delay time (e.g., 5 minutes) to prevent malicious devices from frequently initiating authentication requests for attacks. During the delay period, all authentication requests corresponding to that device identifier are rejected. Simultaneously, the quantum key distribution system identifies anomalous devices and records this identifier in the list of anomalous devices. During subsequent authentication processes, this anomalous device identifier undergoes more rigorous review and verification, such as by adding extra verification steps or lowering the authentication pass threshold, to enhance system security.

[0040] In summary, this invention generates a "one-time pad" temporary key pair based on a pre-set seed key and a quantum key service system. Simultaneously, the system decouples the traditional centralized authentication process into two independent stages: business processing and cryptographic computation. The unified authentication platform is only responsible for scheduling the authentication process, while the core cryptographic computation is handled by the completely "business-agnostic" quantum key service system in a black-box manner. This eliminates the systemic risks associated with static root keys and ensures, through physical isolation, that even if the business layer is compromised, the core key remains secure, ultimately achieving true dynamic authentication and forward security.

[0041] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0042] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0043] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0044] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0045] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A quantum-based power communication unified authentication method, characterized in that, The method comprises the following steps: a terminal device initiates an authentication request containing a device identifier and a first random number to a unified authentication platform; the unified authentication platform generates a second random number based on the authentication request, and forwards the device identifier to a quantum key service system; the quantum key service system obtains a true random quantum key through a quantum key distribution network, dynamically allocates a one-time use session key pair for the current authentication session, and returns a session public key to the unified authentication platform; the unified authentication platform sends challenge information containing the first random number, the second random number and the session public key to the terminal device; the terminal device generates a temporary private key corresponding to the current session based on a root key and the session public key through a key derivation function, and uses the temporary private key to digitally sign the challenge information, and returns the signature result to the unified authentication platform; the root key is pre-installed in the terminal device and shared with the quantum key service system; the unified authentication platform sends the signature data, the device identifier and the session public key to the quantum key service system for signature verification; the quantum key service system performs a black-box signature verification operation, verifies the validity of the signature through the key derivation function, and returns a Boolean signature verification result to the unified authentication platform; the unified authentication platform completes the authentication decision according to the signature verification result, and destroys the temporary key material related to the current session after the authentication is successful.

2. The quantum-based power communication unified authentication method according to claim 1, wherein, The true random quantum key obtained by the quantum key service system through the quantum key distribution network meets the quantum randomness characteristics, and the session key pair is allocated only once in each authentication process and is destroyed immediately after use.

3. The quantum-based power communication unified authentication method of claim 1, wherein, The process of generating the temporary private key by the terminal device comprises: Based on the pre-installed root key and the session public key, the key derivation function is used for cryptographic operation to generate a temporary private key corresponding to the current session.

4. The quantum-based power communication unified authentication method of claim 1, wherein, The quantum key service system performs a black-box signature verification operation, which only performs cryptographic verification according to the input signature data, device identifier and session public key, without analyzing or perceiving the related information of the input data in the business layer.

5. The quantum-based power communication unified authentication method of claim 1, wherein, The root key is pre-installed in the T card of the terminal device, and the corresponding root key maintained by the quantum key service system is initially distributed through quantum key distribution technology.

6. The quantum-based power communication unified authentication method of claim 1, wherein, The unified authentication platform and the quantum key service system are physically and logically separated, and the unified authentication platform does not store any root key or terminal private key.

7. The quantum-based power communication unified authentication method of claim 1, wherein, The quantum key service system dynamically allocates the session key pair through the key pool maintained by the system, and the system protects the master key by using a quantum secure storage mechanism. 8.The quantum-based power communication unified authentication method of claim 1, wherein, The device identifier in the authentication request is used to uniquely index the corresponding terminal device root key in the quantum key service system. 9.The quantum-based power communication unified authentication method of claim 1, wherein, The unified authentication platform triggers the destruction process of the temporary key material immediately after the authentication is successful, including clearing the session public key, the temporary private key derivation intermediate result and the related random number in the memory.

10. The quantum-based power communication unified authentication method of claim 1, wherein, It also includes an authentication failure processing mechanism, specifically: when the signature verification result is failed, the unified authentication platform records a security event and delays the processing of the subsequent authentication request, and the quantum key service system marks the abnormal device identifier.

Images