Two-factor identity authentication method and system for power system
By employing SM2 and SM9 algorithms for dual signature authentication of equipment and operators in the power system, the problem of high coupling between equipment and personnel authentication and high management costs is solved, achieving high security and a convenient user experience, and meeting the security auditing needs of the power industry.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING GUODIAN NANZI POWER GRID AUTOMATION CO LTD
- Filing Date
- 2026-01-08
- Publication Date
- 2026-04-17
AI Technical Summary
In power systems, equipment certification and personnel certification are highly coupled, personnel turnover leads to high management costs, certification processes are simplistic, multi-factor authentication is lacking, and there is limited room for improvement in security.
The SM2 algorithm is used to register and authenticate power equipment. The operator's biometrics and identity information are collected to generate an identifier ID. The operator login and operation authorization are performed through the SM9 private key, realizing dual signature of the equipment and the operator. Operation details are recorded and stored in the database.
It enables precise traceability of equipment and operators, improves security and management efficiency, prevents identity theft, provides a convenient user experience, and complies with national cryptography management requirements.
Smart Images
Figure CN121887486A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to a two-factor authentication method and system for power systems. Background Technology
[0002] With the rapid development of smart grids and the Internet of Things (IoT) in the power sector, power production control systems are facing increasingly severe cybersecurity threats. Traditional "username + password" authentication methods are weak and vulnerable to brute-force attacks or phishing attacks. While hardware certificates such as UKeys improve security, they still have shortcomings in specific power system scenarios: 1. High coupling between equipment certification and personnel certification: One device is usually authorized to be used by multiple operators, making it difficult to trace and define responsibility in the event of a safety incident; 2. Management costs associated with staff turnover: When operators leave or are reassigned, certificates need to be collected and reissued, which is a cumbersome process and carries the risk of certificates not being revoked in a timely manner; 3. The authentication process is too simplistic: It lacks multi-factor authentication that combines strong identity markers such as biometrics, and there is still room for improvement in security.
[0003] As a commercial cryptographic standard system independently developed in my country, the national cryptographic algorithm has passed national and industry certifications for its security and reliability. However, existing technologies have not effectively solved the problems of coupling device and personnel authentication, dynamic identity management, and multi-factor fusion. Therefore, there is an urgent need to build a dual authentication system that can balance legitimate device access with accurate operator identity traceability to meet the high security and manageability requirements of the power system. Summary of the Invention
[0004] This application provides a two-factor authentication method and system for power systems, which decouples device identity from operator identity and uses different national cryptographic algorithms for authentication, thereby achieving a higher level of security and traceability.
[0005] Firstly, this application provides a two-factor authentication method for a power system, which is executed by a computing device. The computing device can be understood as a computer or similar device, and is not limited thereto in this application. The method includes: The SM2 algorithm is used for registration and authentication login of power equipment. On the authenticated power equipment, the operator's biometrics and identity information are collected, and an identifier ID is generated for the operator. Based on the biometrics, identity information, and identifier ID, an operator registration request is initiated to the key generation center, obtaining the SM9 private key sent by the key generation center, and completing the operator registration. The operator's identity is verified based on the identity information, identifier ID, and SM9 private key, and the operator is logged in. After the operator completes login, operation authentication is performed. Operation authentication includes: generating a one-time random number r2 when the operator performs a critical operation; signing the operation details containing the one-time random number r2 using the SM9 private key to generate a signature S1; jointly signing the signature S1 and the one-time random number r2 using the power equipment's SM2 private key to generate a signature S2; sending the one-time random number r2, signature S1, signature S2, and operation information to the server for verification and storing them in the database to form an audit record, thus completing the operation authentication.
[0006] Through the above methods, this application employs the SM2 algorithm for device authentication (requiring high efficiency and strong password protection) and the SM9 algorithm for operator authentication (high frequency and high personnel turnover), perfectly matching the security and management needs of different entities. Simultaneously, it strongly binds the operator's biometric characteristics (such as face, fingerprint, iris, etc.) to their unique digital identifier (random ID) within the system, achieving "person-identity-biometric feature" unity and preventing identity theft. By using the device's SM2 private key and the operator's SM9 private key to double-sign the operation record, it ensures that any critical operation instruction can be accurately traced back to the specific operator and physical device, achieving complete non-repudiation and providing irrefutable evidence for security audits.
[0007] In the aforementioned two-factor authentication method for power systems, device registration and authentication login processes are mandatory prerequisites and must be completed before the operator performs any authentication or operation.
[0008] Through the above methods, this application mandates "device authentication first, then operator authentication." All critical operations must be jointly signed using the random number of this session, and the record will be securely stored, achieving precise traceability across the entire chain from device to operator and meeting the stringent requirements of power industry safety audits.
[0009] In the aforementioned two-factor authentication method for power systems, operator login specifically includes: On the authenticated device, verify the operator's biometrics; after successful verification, issue a random challenge value r1; use the SM9 private key to sign the random challenge value r1 to complete authentication, and then complete the operator login.
[0010] Through the above methods, operators of this application use biometrics for authentication, eliminating the need to remember complex passwords or carry additional hardware (after registration), thus providing a convenient user experience while ensuring extremely high security.
[0011] In the aforementioned two-factor authentication method for power systems, the operation details include at least one of the following: random number r2, operator ID, operation type, operating device ID, and timestamp.
[0012] Through the above methods, this application provides a convenient user experience while ensuring extremely high security.
[0013] In the aforementioned two-factor authentication method for power systems, the registration and login operations of power equipment and operators are both implemented using national cryptographic algorithms.
[0014] Through the above methods, this application adopts the national cryptographic algorithms SM2 and SM9, which comply with national cryptographic management requirements. The algorithms are independently controllable and highly secure. The two-factor authentication mechanism (device certificate + operator biometrics and private key) greatly increases the difficulty of unauthorized access and operation.
[0015] Secondly, this application provides a two-factor authentication system for a power system, comprising: a client management module, an authentication server, a certificate center, a key generation center, and a security database server; The client management module is used to register and authenticate power equipment using the SM2 algorithm; the authentication server is used to collect the operator's biometrics and identity information on the authenticated power equipment and generate an identifier ID for the operator; the certificate center and key generation center are used to initiate an operator registration request to the key generation center based on the biometrics, identity information and identifier ID, obtain the SM9 private key sent by the key generation center, and complete the operator registration; the security database server is used to verify the operator's identity based on the identity information, identifier ID and SM9 private key, and perform operator login.
[0016] In the aforementioned two-factor authentication system for the power system, the client management module is also used for Ukey management, biometric information collection, cryptographic operations, and communication; the authentication server is also used for verifying device certificates and operator identities, generating challenge values, and verifying digital signatures; the certificate center and key generation center are also used for issuing device digital certificates and generating SM9 private keys for operators; the certificate center and key generation center are logically or physically integrated and together constitute the root of trust; the security database server is also used for storing device certificates, public keys, device information, operator identity information and their unique identifiers, and related operation logs of the device.
[0017] Thirdly, this application also provides a computing device, comprising: a memory for storing program instructions; and a processor for calling the program instructions stored in the memory and executing the method described in the first aspect according to the obtained program instructions.
[0018] Fourthly, this application also provides a computer-readable storage medium storing computer-readable instructions, which, when read and executed by a computer, implement the method described in the first aspect.
[0019] Fifthly, this application provides a computer program product including a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the method described in the first aspect.
[0020] Beneficial Effects: Through the above methods, this application employs the SM2 algorithm for device authentication (requiring high efficiency and strong password protection) and the SM9 algorithm for operator authentication (high frequency and high personnel turnover), perfectly matching the security and management needs of different entities. Simultaneously, it strongly binds the operator's biometric characteristics (such as face, fingerprint, iris, etc.) to their unique digital identifier (random ID) within the system, achieving "person-identity-biometric feature" unity and preventing identity theft. By using the device's SM2 private key and the operator's SM9 private key to double-sign the operation record, it ensures that any critical operation instruction can be accurately traced back to the specific operator and physical device, achieving complete non-repudiation and providing irrefutable evidence for security audits. Attached Figure Description
[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0022] Figure 1 A flowchart illustrating a two-factor authentication method for a power system provided in this application; Figure 2 A schematic diagram of the power equipment registration process for a two-factor authentication method for a power system provided in this application; Figure 3 A schematic diagram of the power equipment login process for a two-factor authentication method for a power system provided in this application; Figure 4 A schematic diagram of the operator registration process for a two-factor authentication method for a power system provided in this application; Figure 5Schematic diagram of the operator login process of a two-factor identity authentication method for a power system provided by this application; Figure 6 Schematic diagram of a two-factor identity authentication system for a power system provided by this application; Figure 7 Schematic diagram of the structure of a computing device provided by an embodiment of this application. Specific embodiments
[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.
[0024] In the following embodiments of this application, "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may indicate: A exists alone, A and B exist simultaneously, and B exists alone, where A and B may be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one (item) below" or similar expressions refer to any combination of these items, including any combination of single (item) or plural items. For example, at least one (item) of a, b, or c may indicate: a, b, c, a - b, a - c, b - c, or a - b - c, where a, b, c may be single or multiple. The singular expression forms "a", "one kind", "the", "above-mentioned", "this", and "this one" are also intended to include expressions such as "one or more" unless there is a clear opposite indication in the context. Also, unless there is a contrary statement, the ordinal numbers such as "first", "second", etc. mentioned in the embodiments of this application are used to distinguish multiple objects and are not used to limit the order, time sequence, priority, or importance of multiple objects.
[0025] Referring to "one embodiment" or "some embodiments" described in the specification of this application means that specific features, structures, or characteristics described in combination with that embodiment are included in one or more embodiments of this application. Thus, statements such as "in one embodiment", "in some embodiments", "in other some embodiments", "in still other embodiments", etc. that appear at different places in this specification are not necessarily all referring to the same embodiment, but mean "one or more but not all embodiments" unless otherwise specifically emphasized in another way. The terms "include", "comprise", "have" and their variants all mean "including but not limited to" unless otherwise specifically emphasized in another way.
[0026] Embodiment 1
[0027] Embodiment 1 of this application provides a two-factor identity authentication method for a power system, and the schematic diagram of this method is as follows Figure 1 As shown, the method is executed by a computing device, which can be understood as a computer or similar device, but is not limited thereto in this application. The method includes: Elliptic curve public key cryptography algorithm, SM2 algorithm is used for registration and authentication login of power equipment.
[0028] The registration process for power equipment is as follows: Figure 2 As shown, it includes: The administrator inserts the Ukey into the power equipment. The client management module initializes the Ukey, sets a PIN code for the Ukey, generates an SM2 public / private key pair, and securely stores the PIN code and the public / private key pair on the Ukey. Subsequently, a certificate is requested from a CA certificate center. After successful verification, the device's public key and information are stored in a secure database, completing device registration and the binding of the Ukey to the device.
[0029] The authentication and login process for power equipment is as follows: Figure 3 As shown, when logging into the device, the administrator inserts a Ukey and enters a PIN code. The client management module initiates an authentication request to the authentication server. The authentication server issues a random challenge value r1. After authorization via the PIN code entered by the administrator, the client uses the private key within the Ukey to perform an SM2 signature on r1 and the device ID. The server verifies the validity of the signature (including correctness, validity period, and revocation status). If successful, the device is confirmed as legitimate, allowing subsequent operations. Simultaneously, the client performs an SM2 signature on the login information, including the challenge value r1, timestamp, and device information, and stores it in the secure database server.
[0030] Collect the operator's biometrics and identity information on the authenticated and logged-in power equipment, and generate an identifier ID for the operator; based on the biometrics and identity information and the identifier ID, initiate an operator registration request to the key generation center, obtain the SM9 private key sent by the key generation center, and complete the operator registration.
[0031] The operator registration process is as follows: Figure 4 As shown, it includes: The operator registers after the device is already logged in.
[0032] The operator registration process includes collecting the operator's biometrics and identity information on an authenticated device; the device terminal generates a globally unique random identifier (ID) for the operator, which can be randomly generated or combined with information such as the operator's enterprise number; KGC generates an SM9 private key based on the identifier ID and distributes it to the client management module for secure storage; the server, as a module for verifying the operator's biometric information, can choose to directly store the operator's biometric information or not directly store the biometric information, but only store the biometric template.
[0033] Specifically, the client management module collects the operator's biometric information (such as facial recognition) and identity information (employee ID, name), and generates a random identifier ID for each operator (this identifier can be bound to their employee ID or a random number, as long as the identifier ID is unique) and stores it securely. Then, it initiates an operator registration request to the KGC server, simultaneously sending the employee's relevant information to the KGC. The KGC generates a corresponding SM9 private key based on this ID and returns it to the client management module for secure storage. Simultaneously, it signs the operator's ID, public key, name, employee ID, timestamp, and other related information T with a signature S, and sends this information, along with T, to the identity authentication server and the security database server for secure storage. Upon receiving this information, the identity authentication server sends supplementary biometric information to the client management module. After completing the supplementary biometric information, it stores it securely, completing the registration process. The operator's unique identifier is strongly bound to their biometric information.
[0034] The operator's identity is verified based on the identity information, the identifier ID, and the SM9 private key, and the operator logs in.
[0035] Operator login includes verifying the operator's biometrics on an authenticated device; after successful verification, issuing a random challenge value r1; signing the random challenge value r1 using an SM9 private key to complete authentication; and completing operator login after authentication.
[0036] as follows Figure 5 As shown, assuming the device is already logged in, the operator initiates the login process. First, the client collects the operator's biometric features (e.g., facial recognition) and sends them along with the device ID to the authentication server. The server verifies whether the biometric features are in the employee database and whether the operator has the necessary permissions for the current device. Upon successful verification, the server returns the operator's unique ID and a random challenge value r1. After receiving confirmation of the operator's identity, the client signs the random challenge value r1 and the device ID using the operator's SM9 private key and securely transmits it to the authentication server. The authentication server then verifies the signature.
[0037] After the operator completes the login, operation authentication is performed.
[0038] The operation authentication includes: when the operator performs a critical operation, generating a one-time random number r2; signing the operation details containing the one-time random number r2 using the SM9 private key to generate a signature S1; jointly signing the signature S1 and the one-time random number r2 using the SM2 private key of the power equipment to generate a signature S2; and sending the one-time random number r2, signature S1, signature S2, and operation information to the server for verification and storing them in the database to form an audit record, thus completing the operation authentication.
[0039] as follows Figure 5 As shown, after successful verification, a random challenge value r2 for the operation record is sent to the client. This random challenge value r2 will be used to record all device operations during this login period. Once the client receives successful verification, it notifies the operator of successful login and sends r2 along with SM2_Sig(operator ID, r1, device ID, timestamp) to the security database for storage. After successful login, the operator can perform any reasonable and compliant related operations. However, if the operator performs any regulatory operations, the client will perform a two-step signature on the relevant operation information T=(r2, operator ID, operation type, operating device ID, timestamp): The operation message is signed using the operator's SM9 private key: S1 = SM9_Sig(T) Sign the credential for this operation using the device's SM2 private key: S2 = SM2_Sig(r2, S1, timestamp) Finally, data such as r2, S1, S2, and T are sent to and stored in a secure database. This design ensures that every operation record contains information that is double-signed by both the operator's private key and the device's private key, achieving perfect non-repudiation.
[0040] At least one of the following: random number r2, operator ID, operation type, operation device ID, and timestamp.
[0041] The registration and authentication login process for power equipment is mandatory as a prerequisite and must be completed before the operator performs any authentication or operation. The registration and login operations of power equipment and the operator are implemented using national cryptographic algorithms, including but not limited to SM2 and SM4 algorithms.
[0042] The core innovations of this application are as follows: Dual-algorithm separate authentication: The SM2 algorithm is used for device authentication (which requires high efficiency and strong password protection); the SM9 algorithm is used for operator authentication (which is frequent and has high personnel turnover), perfectly matching the security and management needs of different entities.
[0043] Biometrics and digital identity binding: The operator's biometrics (such as face, fingerprint, iris and other biometric information) are strongly bound to the unique digital identifier (random ID) in the system, realizing the integration of "person-certificate-biometrics" and preventing identity theft.
[0044] Hierarchical authentication and traceability: It mandates "device authentication first, then operator authentication". All critical operations must be jointly signed using the random number of the current session, and the record is securely stored. This achieves precise traceability across the entire chain from device to operator, meeting the stringent requirements of safety audits in the power industry.
[0045] Compared with the prior art, the beneficial effects achieved by this application are as follows: Significantly enhanced security: Employing national cryptographic algorithms SM2 and SM9, it complies with national cryptographic management requirements, is independently controllable, and boasts high security. A two-factor authentication mechanism (device certificate + operator biometrics and private key) greatly increases the difficulty of unauthorized access and operation.
[0046] Precise traceability and non-repudiation: By using the device's SM2 private key and the operator's SM9 private key to double-sign the operation record, it is ensured that any critical operation instruction can be accurately traced back to the specific operator and physical device, achieving complete non-repudiation and providing irrefutable evidence for security audits.
[0047] Significantly improved management efficiency: The SM9 algorithm based on identifiers is used to manage operators. When personnel change, only the status needs to be updated at the KGC and database levels. There is no need to reclaim and reissue hardware certificates, which greatly simplifies the management process and reduces operation and maintenance costs.
[0048] Balancing user experience and security: Operators use biometric authentication, eliminating the need to remember complex passwords or carry additional hardware (after registration), providing a convenient user experience while ensuring extremely high security.
[0049] In line with the characteristics of the power industry: The solution design closely integrates with the characteristics of "stable equipment and mobile personnel" in the power system. Through a layered authentication architecture, it not only ensures the stable and reliable access of core equipment, but also flexibly addresses the needs of personnel management.
[0050] Example 2
[0051] This application provides a two-factor authentication system for a power system based on embodiment 1. The system is as follows: Figure 6 As shown, it includes: a client management module, an authentication server, a certificate center, a key generation center, and a security database server.
[0052] The client management module is used to register and authenticate power equipment using the SM2 algorithm; the authentication server is used to collect the operator's biometrics and identity information on the authenticated power equipment and generate an identifier ID for the operator; the certificate center and key generation center are used to initiate an operator registration request to the key generation center based on the biometrics, identity information and identifier ID, obtain the SM9 private key sent by the key generation center, and complete the operator registration; the security database server is used to verify the operator's identity based on the identity information, identifier ID and SM9 private key, and perform operator login.
[0053] The client management module is also used for Ukey management, biometric information collection, cryptographic operations, and communication; the authentication server is also used to verify device certificates and operator identities, generate challenge values, and verify digital signatures; the certificate center and key generation center are also used to issue device digital certificates and generate SM9 private keys for operators; the certificate center and key generation center are logically or physically integrated and together constitute the root of trust; the security database server is also used to store device certificates, public keys, device information, operator identity information and their unique identifiers, and related operation logs of the device.
[0054] Example 3
[0055] Having introduced the two-factor authentication system for a power system in an exemplary embodiment of this application, we will now introduce a computing device in another exemplary embodiment of this application.
[0056] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."
[0057] In some possible implementations, the computing device according to this application may include at least one processor and at least one memory. The memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the two-factor authentication method for a power system according to various exemplary embodiments of this application described above.
[0058] The following reference Figure 7 To describe a computing device 130 according to this embodiment of the present application. Figure 7 The computing device 130 shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this application. Figure 7 As shown, the computing device 130 is presented in the form of a general-purpose smart terminal (or Bluetooth headset). The components of the computing device 130 may include, but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including memory 132 and processor 131).
[0059] Bus 133 represents one or more of several bus architectures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus architectures. Memory 132 may include readable media in the form of volatile memory, such as random access memory (RAM) 1321 and / or cache memory 1322, and may further include read-only memory (ROM) 1323. Memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.
[0060] The computing device 130 can also communicate with one or more external devices 134 (e.g., keyboard, pointing device, etc.), and / or with any device that enables the computing device 130 to communicate with one or more other smart terminals (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 135. Furthermore, the computing device 130 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 136. As shown, network adapter 136 communicates with other modules used in the computing device 130 via bus 133. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the computing device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0061] In some possible implementations, various aspects of the two-factor authentication method for power systems provided in this application can also be implemented in the form of a program product, which includes a computer program that, when run on a computer device, causes the computer device to perform the steps in the two-factor authentication method for power systems according to various exemplary embodiments of this application as described above.
[0062] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0063] The program product for time-domain noise processing according to the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on a smart terminal. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0064] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.
[0065] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.
[0066] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.
[0067] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable access frequency prediction device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable access frequency prediction device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0068] These computer program instructions may also be stored in a computer-readable storage medium capable of directing a computer or other programmable access frequency predictive device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0069] These computer program instructions can also be loaded onto a computer or other programmable access device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0070] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.
[0071] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
Claims
1. A two-factor authentication method for a power system, characterized in that, include: The SM2 algorithm is used for registration and authentication login of power equipment; Collect the operator's biometrics and identity information on the authenticated and logged-in power equipment, and generate an identifier ID for the operator; Based on the biometrics and identity information and the identifier ID, an operator registration request is initiated to the key generation center, the SM9 private key sent by the key generation center is obtained, and the operator registration is completed. The operator's identity is verified based on the identity information, the identifier ID, and the SM9 private key, and the operator logs in. After the operator completes the login, operation authentication is performed; The operation authentication includes generating a one-time random number r2 when the operator performs a critical operation; Use the SM9 private key to sign the operation details containing the one-time random number r2, and generate signature S1; The signature S1 and the one-time random number r2 are jointly signed using the SM2 private key of the power equipment to generate signature S2; The one-time random number r2, signature S1, signature S2 and operation information are sent to the server for verification and stored in the database to form an audit record, thus completing the operation authentication.
2. The method according to claim 1, characterized in that, The registration and authentication login process for the aforementioned power equipment is mandatory and must be completed before the operator performs any authentication or operation.
3. The method according to claim 1, characterized in that, The operator login process specifically includes: On the certified device, verify the operator's biometrics; After successful verification, a random challenge value r1 will be issued. The random challenge value r1 is signed using the SM9 private key to complete authentication. After authentication, the operator logs in.
4. The method according to claim 1, characterized in that, The operation details include at least one of the following: random number r2, operator ID, operation type, operation device ID, and timestamp.
5. The method according to claim 1, characterized in that, The registration and login operations for both the power equipment and the operator are implemented using national cryptographic algorithms.
6. A two-factor authentication system for a power system, characterized in that, include: Client management module, authentication server, certificate center, key generation center, and security database server; The client management module is used to register and authenticate power equipment using the SM2 algorithm. The authentication server is used to collect the operator's biometrics and identity information on the authenticated and logged-in power equipment, and generate an identifier ID for the operator; The certificate center and key generation center are used to initiate an operator registration request to the key generation center based on the biometrics and identity information and the identifier ID, obtain the SM9 private key sent by the key generation center, and complete the operator registration; The secure database server is used to verify the operator's identity based on the identity information, the identifier ID, and the SM9 private key, and to log the operator in.
7. The system according to claim 6, characterized in that, The client management module is also used for Ukey management, biometric information collection, cryptographic operations, and communication. The authentication server is also used to verify device certificates and operator identities, generate challenge values, and verify digital signatures. The certificate center and key generation center are also used to issue device digital certificates and generate SM9 private keys for operators; the certificate center and key generation center are logically or physically integrated and together constitute a root of trust. The secure database server is also used to store device certificates, public keys, device information, operator identity information and their unique identifiers, and related operation logs of the device.
8. A computing device, characterized in that, Its features include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the method as described in any one of claims 1-5 according to the obtained program instructions.
9. A computer-readable storage medium, characterized in that, Includes computer-readable instructions that, when read and executed by a computer, cause the method as described in any one of claims 1 to 5 to be implemented.
10. A computer program product, characterized in that, It includes a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of the method according to any one of claims 1 to 5.