A new energy power grid hybrid authentication method and system based on post-quantum cryptography

Abstract

The application discloses a new energy power grid hybrid authentication method and system based on a post-quantum cryptogram and belongs to the field of power system construction and distributed new energy technologies. The method comprises the following steps: an authentication center generates a hybrid pseudonym certificate by double signing the to-be-signed certificate content by using an SM2 private key and a Falcon private key of the authentication center; a sending terminal divides the hybrid pseudonym certificate into multiple certificate fragments, double signs a service message, and continuously broadcasts a data packet encapsulated by combining the certificate fragments and the service message according to a circulating rotation rule in each certificate broadcast period; and a receiving terminal recombines the hybrid pseudonym certificate after collecting all the certificate fragments, verifies a service SM2 signature and a service Falcon signature corresponding to the buffered service message and the service message of a newly received data packet, and accepts the corresponding service message. The application improves the continuous sending capability of the service message of the sending terminal in a new energy station.

Description

Technical Field

[0001] This invention belongs to the field of power system construction and distributed new energy technology, and more specifically, relates to a hybrid authentication method and system for new energy power grids based on post-quantum cryptography. Background Technology

[0002] With the construction of new power systems and the large-scale integration of distributed renewable energy, power communication networks are characterized by large-scale terminals, complex communication links, and frequent dynamic interactions. Traditional authentication mechanisms are no longer sufficient to meet the secure communication requirements of renewable energy scenarios. In new power systems and distributed renewable energy scenarios, renewable energy terminals need to frequently complete identity authentication, business message transmission, and control command interaction. Traditional authentication mechanisms are no longer able to meet the requirements of high concurrency, low latency, and long-term secure communication. Authentication schemes based on traditional public-key cryptography systems such as RSA and ECC face potential quantum attack risks. The deployment performance of post-quantum signature schemes in resource-constrained wireless communication environments directly affects authentication efficiency and communication reliability.

[0003] Post-quantum signatures and certificates are large in size, and frequent transmission can easily lead to high wireless link communication overhead and excessive spectrum resource consumption, making them unsuitable for application scenarios with limited resources, low latency, and high concurrency in new energy terminals. Existing hybrid authentication schemes mostly focus on security enhancement and lack optimization for authentication efficiency in scenarios with limited resources and low latency in new energy terminals. Traditional fixed-period certificate broadcasting mechanisms lack dynamic adaptability to network load, terminal density, and link status, easily causing communication congestion and decreased stability. The existing authentication systems lack sufficient coordination between certificate verification, signature authentication, and message processing, making it difficult to meet the real-time security authentication requirements of high-concurrency dynamic interaction scenarios. Traditional fixed-period certificate transmission mechanisms lack dynamic adaptability to network status and terminal density, easily leading to high spectrum resource consumption and decreased communication efficiency.

[0004] Prior art document 1 (CN121967114A) discloses a post-quantum certificate transmission scheme for constrained communication links. Its shortcomings are: in broadcast scenarios, there is no connection establishment process, and service messages need to be continuously sent. However, this scheme cannot authenticate service messages until the certificate is restored, causing the receiving end to discard all service messages received during this period due to the lack of a trusted public key, resulting in service continuity interruption; furthermore, this scheme cannot trace and verify cached messages after the certificate is ready, making it difficult to meet the real-time and continuity requirements of power grid dispatch and control services.

[0005] Existing technical document 2 (CN118944894B) discloses a hybrid pseudo-name certificate system combining national cryptographic algorithms and post-quantum algorithms. Its shortcomings include: the post-quantum certificate is relatively large, making it difficult to send in its entirety on wireless broadcast links with limited unicast MTU; if forced into segmented transmission, it lacks fragment numbering, reassembly, and integrity verification mechanisms, preventing the receiving end from recovering the complete hybrid pseudo-name certificate; service messages received by the receiving end before the certificate is fully recovered cannot be verified due to the lack of a trusted public key and must be discarded entirely; furthermore, even after certificate recovery, it is impossible to trace and re-verify cached messages, causing service continuity interruptions and failing to meet the real-time and reliability requirements of power grid broadcast communication. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a hybrid authentication method and system for new energy terminals based on post-quantum cryptography. By constructing an SM2-Falcon hybrid authentication mechanism, a certificate fragmentation and broadcasting mechanism, and a dynamic scheduling mechanism, it achieves low-latency, high-security, and low-communication-overhead authentication of business messages in new energy terminal scenarios. The SM2-Falcon hybrid authentication mechanism provides quantum-resistant security capabilities while ensuring low-latency authentication performance, effectively solving the problems of large signature size and high computational and communication overhead in traditional post-quantum signature schemes. The use of a hybrid pseudo-certificate and dual-signature collaborative authentication mechanism enables efficient and reliable verification of business messages, improving identity authentication security in new energy terminal scenarios. The certificate fragmentation and broadcasting and dynamic scheduling mechanisms reduce the spectrum occupancy and link transmission pressure of post-quantum certificates in wireless communication environments, improving communication stability in complex power grid scenarios. The integration of certificate reconstruction, batch verification, and real-time authentication mechanisms balances authentication efficiency and system reliability in high-concurrency dynamic interaction scenarios, achieving efficient and secure communication in new power system environments. This results in a hybrid authentication and secure communication mechanism for new energy terminals that features quantum-resistant security, low communication overhead, and efficient dynamic authentication capabilities.

[0007] The present invention adopts the following technical solution.

[0008] The first aspect of this invention provides a hybrid authentication method for new energy power grids based on post-quantum cryptography, the specific steps of which include: The sending terminal dynamically adjusts the certificate broadcasting period based on terminal density and channel packet loss rate, and the certification center synchronously determines the validity period of the hybrid pseudo-certificate based on the adjusted certificate broadcasting period. The certification authority constructs the content of the certificate to be signed based on the sending terminal's SM2 public key and Falcon public key; it then uses the certification authority's SM2 private key and Falcon private key to double-sign the content of the certificate to be signed to obtain the certificate's SM2 signature and certificate's Falcon signature, and generates a hybrid pseudo-certificate based on the certificate's SM2 signature and certificate's Falcon signature. The sending terminal divides the hybrid pseudo-certificate into multiple certificate fragments. It uses the sending terminal's SM2 private key and Falcon private key to double-sign the business messages collected by the sending terminal to obtain the business SM2 signature and business Falcon signature. In each certificate broadcasting cycle, it continuously broadcasts the certificate fragments, business SM2 signatures, business Falcon signatures, and data packets encapsulated in the business messages selected according to the cyclic rotation rule. The receiving terminal caches certificate fragments, service SM2 signatures, service Falcon signatures, and service messages in the data packets. After collecting all certificate fragments, it reassembles the hybrid pseudo-certificate. It then verifies the hybrid pseudo-certificate using the SM2 public key and Falcon public key of the certification center. After successful verification, it performs SM2 signature verification and Falcon signature verification on the service SM2 signature and service Falcon signature corresponding to each service message in the cached service messages and the service messages in the newly received data packets, based on the SM2 public key and Falcon public key of the sending terminal. When both signature verifications pass, it accepts the corresponding service message and completes the power grid hybrid authentication.

[0009] Preferably, generating a hybrid pseudo-name certificate includes: The authentication center generates its own SM2 public key, SM2 private key, Falcon public key, and Falcon private key, and also generates the same for the sending terminal. The certification center generates a pseudo-identity identifier for the sending terminal based on the certificate lifecycle. Based on the pseudo-identity identifier, the sending terminal's SM2 public key, the sending terminal's Falcon public key, the hybrid pseudo-certificate version number, the region to which the terminal belongs, and the validity period of the hybrid pseudo-certificate, the certificate content to be signed is constructed. The certification authority uses its SM2 private key and Falcon private key to perform SM2 signing and Falcon signing on the content of the certificate to be signed, thus obtaining the certificate SM2 signature and certificate Falcon signature. Combine the SM2 signature of the certificate, the Falcon signature of the certificate, and the content of the certificate to be signed to form a hybrid pseudo-certificate; The authentication center sends the sending terminal's SM2 public key, SM2 private key, Falcon public key, Falcon private key, and hybrid pseudo-certificate to the sending terminal.

[0010] Preferably, the hybrid pseudo-certificate is divided into multiple certificate fragments. The total number of certificate fragments is determined by the total byte length of the hybrid pseudo-certificate and the maximum payload allocated to each certificate fragment in a single data packet, as expressed by the following formula:

[0011] In the formula, This represents the total number of certificate fragments obtained from the partitioning of the hybrid pseudo-certificate. This indicates the total byte length of the hybrid pseudo-certificate. This indicates the maximum payload allocated to a certificate fragment within a single data packet. Indicates rounding up; Each certificate fragment contains the current certificate fragment number, the total number of certificate fragments, and certificate fragment data.

[0012] Preferably, the certificate fragments selected according to the cyclical rotation rule include: Divide the hybrid pseudonym certificate into multiple certificate fragments. ,in, This represents the total number of certificate fragments obtained from the partitioning of the hybrid pseudo-certificate. Indicates the first A certificate fragment, Indicates the certificate fragment number; No. Each certificate broadcast cycle selects certificate fragments according to a cyclical rotation rule. ,in, Indicates the certificate broadcast cycle number. Indicates modulo; When the certificate broadcast cycle number Greater than At this time, the sending terminal restarts from certificate fragment number 1 and selects certificate fragments in a round-robin fashion according to the round-robin rule to poll and broadcast until the receiving terminal has received all certificate fragments.

[0013] Preferably, the reconstructed hybrid pseudo-certificate after collecting all certificate fragments includes: The receiving terminal initializes its status flag to an untrusted state and caches the service messages, dual-signature information, and corresponding certificate fragments in the data packets. The receiving terminal in the preset time window After collecting all n certificate fragments with different numbers, reassemble them to restore the complete hybrid pseudo-certificate; like If not all certificate fragments are collected within the specified time window, the currently cached certificate fragments in the receiving terminal are cleared, and subsequent data packets are received. The certificate fragment numbered 1, which is the first certificate fragment received, is used as the starting point for the next round of certificate fragment collection, and the process restarts within the preset time window. We are attempting to collect all the certificate fragments.

[0014] Preferably, verifying hybrid pseudo-certificates using the SM2 public key and Falcon public key of the certification authority includes: The receiving terminal calls the certificate verification function to verify whether the validity period of the recovered complete hybrid pseudo-certificate is within the valid range and whether the certificate's SM2 signature and Falcon signature are correct, using the SM2 public key and Falcon public key of the certification authority. When all verifications pass, the status flag is updated to trusted status, and the sending terminal's SM2 public key and Falcon public key are extracted from the hybrid pseudo-certificate.

[0015] Preferably, when the status flag is in a trusted state, the receiving terminal performs a loop-by-loop verification of all service messages cached during the untrusted state phase, along with their corresponding service SM2 signatures and service Falcon signatures. It sequentially retrieves each service message and its corresponding service SM2 signature and service Falcon signature, and uses the extracted SM2 public key and Falcon public key of the sending terminal to perform SM2 signature verification and Falcon signature verification, respectively. Simultaneously, it performs real-time SM2 signature verification and Falcon signature verification on service messages and their service SM2 signatures and service Falcon signatures in newly received data packets after the status flag is in a trusted state. If both the SM2 signature verification and Falcon signature verification of a service message pass, the service message is accepted; otherwise, the service message is discarded.

[0016] Preferably, the sending terminal dynamically adjusts the certificate broadcast period during the authentication process based on terminal density and channel packet loss rate, as expressed by the following formula:

[0017] In the formula, This indicates the adjusted certificate broadcast cycle. This is the default broadcast cycle. This represents the number of different pseudonyms received by the sending terminal per unit time, used to indicate terminal density. This indicates the preset maximum terminal density. This represents the channel packet loss rate detected by the sending terminal based on the continuous broadcast message sequence number. This indicates the rate at which the sending terminal generates service messages. Indicates the maximum communication rate; The certification center adjusts the validity period of hybrid pseudonymous certificates in sync with the adjusted certificate broadcast cycle.

[0018] Preferably, the certification center adjusts the validity period of hybrid pseudonymous certificates synchronously according to the adjusted certificate broadcast cycle, including: The certification authority sets a security factor greater than or equal to 1, and uses the result of multiplying this security factor by the adjusted certificate broadcast period as the validity period of the hybrid pseudo-certificate, so that the validity period of the hybrid pseudo-certificate is greater than or equal to the certificate broadcast period.

[0019] A second aspect of the present invention provides a hybrid authentication system for a new energy power grid based on post-quantum cryptography, which operates the hybrid authentication method for a new energy power grid based on post-quantum cryptography described in the first aspect, comprising: The dynamic adjustment module is used by the sending terminal to dynamically adjust the certificate broadcast period according to the terminal density and channel packet loss rate, and the certification center synchronously determines the validity period of the hybrid pseudo-certificate according to the adjusted certificate broadcast period. The certificate generation module is used by the certification authority to construct the content of the certificate to be signed based on the SM2 public key and Falcon public key of the sending terminal; to obtain the certificate SM2 signature and certificate Falcon signature by double signing the content of the certificate to be signed using the certification authority's SM2 private key and Falcon private key; and to generate a hybrid pseudo-certificate based on the certificate SM2 signature and certificate Falcon signature. The data packet generation module is used by the sending terminal to divide the hybrid pseudo-certificate into multiple certificate fragments, and use the sending terminal's SM2 private key and Falcon private key to double-sign the business messages collected by the sending terminal to obtain the business SM2 signature and business Falcon signature. In each certificate broadcasting cycle, the data packet containing the certificate fragments, business SM2 signature, business Falcon signature and business message encapsulated according to the cyclic rotation rule is continuously broadcast. The authentication module receives certificate fragments, service SM2 signatures, service Falcon signatures, and service messages from the terminal's cached data packets. After collecting all certificate fragments, it reassembles the hybrid pseudo-certificate and verifies it using the authentication center's SM2 and Falcon public keys. Once verified, it performs SM2 signature verification and Falcon signature verification on the cached service messages and the service messages in newly received data packets, based on the sending terminal's SM2 and Falcon public keys. When both signature verifications pass, it accepts the corresponding service message, completing the power grid hybrid authentication. Compared with the prior art, the beneficial effects of the present invention include at least the following: The certificate broadcast period is dynamically linked to the real-time network status, enabling it to adapt to changes in network load. During high-density, high-packet-loss scenarios, the broadcast period is automatically shortened to accelerate fragment rotation; during low-density, low-packet-loss scenarios, it is automatically extended to conserve spectrum resources. The transmitting terminal cyclically broadcasts fragments according to the adjusted broadcast period, directly affecting the probability of the receiving end receiving all fragments within the time window. Accelerating fragment rotation in high-density, high-packet-loss scenarios improves authentication real-time performance, while extending the period in low-load scenarios reduces spectrum usage and transmitting terminal power consumption. The certification authority writes the synchronously determined certificate validity period into the content of the certificate to be signed, making the certificate validity period an immutable part of the certificate and protected by double signatures. After receiving all fragments, the receiving end re-... The system collects and verifies the validity period of certificates. Since the validity period is bound to the broadcast period, the certificates are guaranteed to be valid once they are collected, reducing the probability that the receiver will be unable to switch to a trusted state due to certificate expiration. By shortening the validity period, the system forces SM2 public keys to be changed more frequently. If the broadcast period is shortened due to network deterioration, the old certificate may expire prematurely. The receiver will clear the cache and retry, eventually switching to the new certificate, ensuring the robustness of the authentication process and reducing the risk of long-term exposure of SM2 public keys in the post-quantum environment, thus improving the system's quantum security. Dynamic adjustment avoids the problems of wasting spectrum under low load and aggravating congestion under high load by using a fixed period, reducing the spectrum occupation caused by invalid certificate broadcasts and improving communication efficiency under limited bandwidth conditions.

[0020] This invention employs SM2 and Falcon to dual-sign the same certificate content, generating a hybrid pseudo-certificate. This certificate structure allows the receiving end to obtain both public keys from the sending terminal through an additional channel when subsequently verifying business messages; a single certificate is sufficient to simultaneously obtain two trusted public key sources: SM2 and Falcon. This improves the efficiency of public key acquisition for dual-signature verification of numerous sending terminals within a renewable energy power station, reduces the risk of public key tampering due to insecure public key distribution channels, and enhances the quantum security of the certificate over a 20-year operating cycle of the renewable energy power station. Even if SM2 is compromised by a quantum computer in the future, the Falcon signature will still guarantee the certificate's credibility, reducing the risk of the entire certificate system collapsing due to the failure of a single signature algorithm. This invention fragments hybrid pseudo-certificates and broadcasts them synchronously with business messages, enabling sending terminals to continuously send business messages even before the certificate is fully received. Receiving terminals cache business messages and double signatures before certificate recovery. After certificate recovery and verification, they perform double signature verification on each cached message and newly arrived message. This mechanism allows certificate broadcasting and business broadcasting to be completely parallel in time. Sending terminals do not need to interrupt business transmission for certificate transmission, and receiving terminals do not need to wait for a complete certificate to begin receiving business messages. This improves the continuous transmission capability of sending terminal clusters in new energy power plants under high-frequency start-stop and density fluctuation scenarios, transforming certificate transmission and business transmission from serial to parallel. It reduces the interruption time of scheduling instructions caused by waiting for a complete certificate and the load pressure on narrowband broadcast links from a single transmission of a large quantum certificate. This invention decouples the authentication process into three stages: caching before certificate recovery, verification after certificate recovery, and batch authentication after successful verification. This allows the receiving end to cache business messages while the certificate is not ready, preventing them from being discarded and awaiting subsequent authentication. Before certificate recovery, the receiving end does not perform any signature verification, avoiding the use of untrusted public keys. Only after the certificate is reassembled and verified does it use the trusted dual public keys extracted from the certificate to perform dual signature verification on cached messages and newly arrived messages. This improves the ability of the receiving end at new energy power stations to retain business messages and perform subsequent traceability authentication while the certificate is not ready, reducing the message discard rate due to certificate insecurity, and avoiding the risks of forgery attacks, man-in-the-middle attacks, and illegal public key replacement attacks caused by premature verification using untrusted public keys. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a hybrid authentication method for new energy power grids based on post-quantum cryptography, provided according to an embodiment of the present invention. Figure 2 This is a schematic diagram of a hybrid authentication approach for power grids based on post-quantum cryptography, provided in accordance with an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0023] like Figure 1 and Figure 2As shown, Embodiment 1 of the present invention provides a hybrid authentication method for new energy power grids based on post-quantum cryptography, applied to new energy power stations. The power station includes an authentication center, a new energy generation-side transmitting terminal, and a power station-side receiving terminal, and includes the following steps: Step 1: The sending terminal dynamically adjusts the certificate broadcast period based on the terminal density and channel packet loss rate, and the certification center synchronously determines the validity period of the hybrid pseudo-certificate based on the adjusted certificate broadcast period.

[0024] The sending terminal dynamically adjusts the certificate broadcast period during the authentication process based on terminal density and channel packet loss rate, as expressed by the following formula:

[0025] In the formula, This indicates the adjusted certificate broadcast cycle. This is the default broadcast cycle. This represents the number of different pseudonyms received by the sending terminal per unit time, used to indicate terminal density. Indicates the preset maximum terminal density. This represents the channel packet loss rate detected by the sending terminal based on the continuous broadcast message sequence number. This indicates the rate at which the sending terminal generates service messages. Indicates the maximum communication rate; The certification authority adjusts the validity period of the hybrid pseudonym certificate in sync with the adjusted certificate broadcast cycle, ensuring that the certificate validity period covers at least one complete certificate broadcast cycle and meets the system's preset security policy.

[0026] Preferably, the certification center adjusts the validity period of hybrid pseudonymous certificates synchronously according to the adjusted certificate broadcast cycle, including: The certification authority sets a security factor greater than or equal to 1, and uses the result of multiplying this security factor by the adjusted certificate broadcast period as the validity period of the hybrid pseudo-certificate, so that the validity period of the hybrid pseudo-certificate is greater than or equal to the certificate broadcast period.

[0027] The certificate broadcasting period and transmission frequency are dynamically adjusted based on parameters such as terminal deployment density and channel status. Simultaneously, by shortening the validity period of pseudo-certificates, the long-term exposure risk of traditional signature algorithms in the post-quantum environment is reduced. Furthermore, a fragmented collaborative transmission mechanism is used to reduce redundant certificate broadcasts, thereby improving spectrum utilization and overall system communication stability.

[0028] The system dynamically adjusts the broadcast period based on terminal communication rate, terminal density, and wireless channel status to improve authentication efficiency in high-density communication scenarios; the communication rate represents the number of different PIDs received in one period. By counting the number of different PIDs within the broadcast period, the terminal can estimate the terminal density in the current broadcast area.

[0029] The system enhances long-term security by shortening the validity period of pseudo-certificates, thereby reducing the long-term exposure risk of traditional SM2 signatures in a post-quantum environment.

[0030] Step 2: The certification authority constructs the content of the certificate to be signed based on the SM2 public key and Falcon public key of the sending terminal; it then uses the certification authority's SM2 private key and Falcon private key to double-sign the content of the certificate to be signed to obtain the certificate SM2 signature and certificate Falcon signature, and generates a hybrid pseudo-certificate based on the certificate SM2 signature and certificate Falcon signature.

[0031] In a preferred but non-limiting embodiment of the present invention, step 2 includes: Step 2.1, the Certificate Authority (CA) generates its own SM2 public key. SM2 private key of the certification center Falcon public key of the certification center Falcon private key of the certification center Simultaneously, it generates the SM2 public key for the sending terminal. SM2 private key of the sending terminal The Falcon public key of the sending terminal Falcon private key of the sending terminal .

[0032] Step 2.2: The authentication center generates a pseudo-identity identifier for the sending terminal based on the validity period of the hybrid pseudo-identity certificate. Based on the pseudo-identity identifier, the sending terminal's SM2 public key, the sending terminal's Falcon public key, the hybrid pseudo-certificate version number, the sending terminal's region, and the hybrid pseudo-certificate's validity period, the content of the certificate to be signed is constructed, expressed by the following formula:

[0033] in, This indicates the content of the certificate to be signed; This indicates the currently valid pseudonym identifier of the sending terminal; This represents the SM2 public key of the sending terminal; This represents the Falcon public key of the sending terminal; Indicates the certificate version number; Indicates the region to which the sending terminal belongs; This indicates the certificate's validity period.

[0034] Step 2.3: The certification authority uses its SM2 private key and Falcon private key to perform SM2 signing and Falcon signing on the content of the certificate to be signed, obtaining the certificate SM2 signature and certificate Falcon signature, expressed by the following formula:

[0035]

[0036] In the formula, This indicates that the certificate is SM2 signed. This indicates that the certificate is signed by Falcon. This represents the SM2 signature function. This represents the Falcon signature function.

[0037] It is worth noting that this invention proposes an SM2-Falcon hybrid authentication mechanism, which integrates traditional cryptography with post-quantum signatures to provide resistance to quantum attacks while ensuring low-latency authentication performance. This achieves a balance between authentication efficiency and security in new energy terminal scenarios. The application of the SM2-Falcon hybrid authentication mechanism, while maintaining the low-latency and high-efficiency characteristics of traditional authentication, introduces post-quantum security capabilities, effectively improving the long-term security and authentication reliability of new energy terminals in quantum computing environments. This invention employs a dual-signature collaborative authentication method using SM2 and Falcon. While retaining the efficient authentication performance of traditional cryptographic systems, it introduces post-quantum signature capabilities to enhance the long-term security of new energy terminals in quantum computing environments. The sending terminal uses SM2 and Falcon to sign the business message respectively, and constructs a structured authentication data packet by combining a hybrid pseudo-name certificate. The receiving terminal achieves secure and reliable verification of the business message through certificate reconstruction, signature verification, and trusted public key authentication. SM2 signatures are used to ensure low-latency authentication performance, while Falcon signatures provide resistance to quantum attacks. The fusion of dual signatures achieves a balance between authentication efficiency and security.

[0038] Step 2.4: Combine the SM2 signature, Falcon signature, and the content of the certificate to be signed to form a hybrid pseudo-certificate. It can be expressed by the following formula:

[0039] In the formula, This indicates a hybrid pseudonym certificate.

[0040] Step 2.5, the certification authority transmits the sending terminal's SM2 public key through a secure channel. SM2 private key of the sending terminal The Falcon public key of the sending terminal Falcon private key of the sending terminal and hybrid pseudonym certificates Send to the sending terminal.

[0041] It is worth noting that this invention designs a hybrid pseudo-certificate and dual-signature collaborative authentication mechanism. The sending terminal uses SM2 and Falcon to sign the business message respectively, and combines the hybrid pseudo-certificate to complete structured authentication encapsulation. This enhances the integrity and security of business messages while ensuring the trustworthiness of the terminal identity. The combination of the hybrid pseudo-certificate and dual-signature collaborative authentication mechanism realizes a trusted binding between business messages and terminal identity, improving the ability to verify message integrity and identity authenticity, while also enhancing the security authentication efficiency in new energy terminal scenarios.

[0042] Step 3: The sending terminal divides the hybrid pseudo-certificate into multiple certificate fragments. It uses the sending terminal's SM2 private key and Falcon private key to double-sign the business messages collected by the sending terminal to obtain the business SM2 signature and business Falcon signature. In each certificate broadcasting cycle, it continuously broadcasts the certificate fragments, business SM2 signatures, business Falcon signatures, and data packets encapsulated with business messages selected according to the cyclic rotation rule.

[0043] In a preferred but non-limiting embodiment of the present invention, step 3 includes: Step 3.1: Send the terminal to collect business data such as power grid status information, control commands, and equipment operation data, and generate business messages. .

[0044] Step 3.2, the sending terminal sends its SM2 private key. The business message is signed using the SM2 signature function to generate a business SM2 signature, which is expressed by the following formula:

[0045] In the formula, This represents the SM2 signature of the service during the i-th certificate broadcast period. This represents the SM2 signature function. This represents the business message for the i-th certificate broadcast cycle.

[0046] Step 3.3: The sending terminal uses its Falcon private key to generate a business Falcon signature for the business message using the Falcon signature algorithm, expressed as follows:

[0047] In the formula, This indicates the business Falcon signature. This represents the SM2 signature function. This indicates the i-th certificate broadcast cycle. This represents the business message for the i-th certificate broadcast cycle.

[0048] Step 3.4: The sending terminal divides the hybrid pseudo-certificate into multiple certificate fragments. ,in, This represents the total number of certificate fragments obtained from the partitioning of the hybrid pseudo-certificate. Indicates the first A certificate fragment, This indicates the certificate fragment number.

[0049] It is worth noting that this invention proposes a certificate fragmentation broadcasting and dynamic scheduling mechanism. This mechanism splits the post-quantum hybrid pseudo-certificate into multiple fragments for progressive transmission and dynamically adjusts the broadcasting strategy based on network load, terminal density, and link status, reducing spectrum occupancy and link transmission pressure in wireless communication environments. The introduction of this mechanism effectively reduces the single-transmission pressure and spectrum resource consumption of post-quantum certificates in wireless communication environments, alleviates link congestion, and improves communication stability and resource utilization in complex power grid scenarios. Addressing the issues of large post-quantum signature size and limited wireless communication resources, this invention introduces a certificate fragmentation broadcasting and dynamic scheduling mechanism. This mechanism splits the hybrid pseudo-certificate into multiple fragments for progressive transmission and dynamically adjusts the broadcasting strategy based on network load, terminal density, and communication status, thereby reducing spectrum occupancy and link transmission pressure in wireless communication environments. Simultaneously, the system combines certificate reconstruction, batch verification, and real-time authentication mechanisms to achieve efficient and secure authentication in high-concurrency dynamic interaction scenarios. The overall performance directly impacts the authentication efficiency, communication stability, and quantum security capabilities of new energy terminal communication systems.

[0050] Step 3.5: Within each certificate broadcast cycle, the sending terminal continuously broadcasts the certificate fragments selected according to the cyclic rotation rule, the service SM2 signature, the service Falcon signature, and the data packets encapsulated in the service message. It can be expressed by the following formula:

[0051] In the formula, Indicates the first Certificate fragments are selected according to a cyclical rotation rule during each certificate broadcast cycle. Indicates the certificate broadcast cycle number. This indicates modulo operation; the sending terminal transmits data packets according to the certificate broadcast period T. Continuous broadcasting.

[0052] When the certificate broadcast cycle number Greater than When the receiving terminal receives all certificate fragments, it restarts from certificate fragment number 1 and cycles through the fragments according to the cyclic rotation rule. When the certification authority reissues a hybrid pseudo-certificate, the sending terminal stops broadcasting the certificate fragments corresponding to the original hybrid pseudo-certificate and starts cyclically broadcasting the certificate fragments corresponding to the new hybrid pseudo-certificate according to the above rules.

[0053] The total number of certificate fragments is determined by the total byte length of the hybrid pseudo-certificate and the maximum payload allocated to certificate fragments in a single data packet, expressed by the following formula:

[0054] In the formula, This represents the total number of certificate fragments obtained from the partitioning of the hybrid pseudo-certificate. This indicates the total byte length of the hybrid pseudo-certificate. This indicates the maximum payload allocated to a certificate fragment within a single data packet. Indicates rounding up; Each certificate fragment contains the current certificate fragment number, the total number of certificate fragments, and certificate fragment data.

[0055] Because post-quantum certificates are large in size, the system will mix pseudo-certificates. It is divided into multiple certificate fragments and embedded according to different certificate broadcast cycles. The data packet is broadcast sequentially.

[0056] In existing technologies, certificates are transmitted and verified during the connection establishment phase, and business communication only begins after verification. Therefore, certificate transmission is a pre-communication process. This invention eliminates the connection establishment process, and since business messages need continuous broadcasting, hybrid pseudo-certificate fragments are broadcast synchronously with business messages. The receiving terminal gradually restores the hybrid pseudo-certificate while caching business messages, and completes cached message authentication uniformly after certificate verification, enabling parallel execution of business broadcasting and certificate broadcasting. Experimental testing shows that this solution completes authentication in just 1.20 milliseconds, freeing up 34% of spectrum resources.

[0057] Step 4: Receive the certificate fragments, service SM2 signature, service Falcon signature, and service message from the cached data packet in the receiving terminal. After collecting all the certificate fragments, reassemble the hybrid pseudo-certificate. Verify the hybrid pseudo-certificate using the SM2 public key and Falcon public key of the certification center. After successful verification, based on the SM2 public key and Falcon public key of the sending terminal, perform SM2 signature verification and Falcon signature verification on the service SM2 signature and service Falcon signature corresponding to each service message in the cached service message and the service message in the newly received data packet. When both signature verifications pass, accept the corresponding service message and complete the power grid hybrid authentication.

[0058] In a preferred but non-limiting embodiment of the present invention, step 4 includes: Step 4.1: The receiving terminal initializes the status flag bc to an untrusted state (bc=0). When bc=0, the receiving terminal performs SPDU on the received structured data packets. i It performs caching, receiving business messages, dual-signature information, and corresponding certificate fragments from the terminal's cached data packets, without performing any signature verification.

[0059] The system ensures that all certificate fragments are received within a specified time window to meet frame length limitations and real-time communication requirements in resource-constrained communication environments. It avoids performing message authentication when certificates are incomplete or the terminal's public key is not yet trusted, thereby reducing the risk of forgery attacks, man-in-the-middle attacks, and illegal public key substitution attacks. Since the sending terminal's public key has not yet established trust through a hybrid pseudo-certificate issued by the certification authority, performing SM2 or Falcon verification prematurely would use an uncertified public key, compromising the reliability of the verification result. Therefore, this invention follows an authentication process of "establishing public key trust first, then performing message authentication," rather than simply adhering to the principle of "verification first, then use."

[0060] Ideally, one certificate fragment is sent per broadcast cycle, thus the time window covers at least the broadcast process of all certificate fragments. In the broadcast scenario of this invention, business messages and certificate fragments are broadcast simultaneously. The receiving terminal may receive the business message first, but the complete hybrid pseudo-certificate has not yet been recovered, so a trusted public key cannot be established immediately. Without a caching mechanism, all business messages received before certificate recovery must be discarded directly, resulting in business message loss.

[0061] Step 4.2: The receiving terminal collects all certificate fragments within a preset time window τ and reassembles the hybrid pseudo-certificate.

[0062] The receiving terminal in the preset time window After collecting all n certificate fragments with different numbers, reassemble them to restore the complete hybrid pseudo-certificate.

[0063] Preferably, if If not all certificate fragments are collected within the specified time window, the currently cached certificate fragments in the receiving terminal are cleared, and subsequent data packets are received. The certificate fragment numbered 1, which is the first certificate fragment received, is used as the starting point for the next round of certificate fragment collection, and the process restarts within the preset time window. We are attempting to collect all the certificate fragments.

[0064] The receiving terminal determines whether it has collected all n fragments with different numbers by using the current fragment number and the total number of fragments.

[0065] A preset time window τ satisfies τ ≥ n·T, where T is the certificate broadcast period and n is the total number of certificate fragments, ensuring that at least one complete round of fragment broadcasting is completed within τ. If all n fragments with different numbers are collected within τ, the receiving terminal reassembles the cached fragments in numerical order to restore the complete hybrid pseudo-name certificate CS. If not all fragments are collected within τ, the current round of certificate broadcasting is considered a failure. The receiving terminal clears the currently cached certificate fragments, continues to receive subsequent data packets, and takes the first received certificate fragment with fragment number 1 as the starting point for the next round of certificate fragment collection, attempting to collect all fragments again within τ.

[0066] Hybrid pseudo-certificates only need to be recovered and verified once. The receiving terminal can then use the established trusted SM2 public key and Falcon public key to continuously perform double signature verification on business messages in the cache queue, without having to repeatedly perform certificate parsing, public key extraction, and certificate validity verification for each message.

[0067] Experimental results show that the average time for the entire authentication process of this invention is only 1.20 ms, indicating that low-latency authentication can be achieved on resource-constrained power grid terminals after adopting the cached message continuous authentication mechanism. Because this invention embeds certificate fragments into the service broadcast stream for synchronous transmission, it avoids the wireless resources occupied by independent certificate broadcasts. Experimental results show that this invention can release approximately 34% of spectrum resources and improve the utilization rate of wireless broadcast resources.

[0068] It is worth noting that this invention constructs a certificate reconstruction and batch verification mechanism. The receiving terminal reassembles the received certificate fragments and combines Falcon signature verification, SM2 signature verification, and trusted public key authentication to achieve efficient and secure authentication in high-concurrency dynamic interaction scenarios. The application of the certificate reconstruction and batch verification mechanism enables efficient reassembly and rapid authentication of certificate fragments, reduces authentication latency and computational overhead in high-concurrency dynamic interaction scenarios, and improves the overall authentication throughput and operational reliability of the system.

[0069] Step 4.3, verifying the hybrid pseudo-name certificate using the certification authority's SM2 public key and Falcon public key includes: The receiving terminal calls the certificate verification function. The system uses the SM2 public key and Falcon public key of the certification authority to verify whether the validity period of the recovered complete hybrid pseudo-certificate is within the valid range and whether the SM2 signature and Falcon signature of the certificate are correct. When all verifications pass, the status flag is updated to trusted status, and the SM2 public key and Falcon public key of the sending terminal are extracted from the hybrid pseudo-certificate.

[0070] When the receiving terminal has not yet completed the verification of the hybrid pseudo-name certificate, the system performs delayed caching on the received business messages, temporarily storing the messages without immediate verification to avoid using untrusted public keys for authentication. Once the hybrid pseudo-name certificate verification is successful, the receiving terminal uses the trusted public key to perform real-time signature verification on subsequent business messages, while simultaneously batch processing the cached messages. This reduces redundant computation overhead and improves the overall authentication efficiency and communication throughput of the system.

[0071] The receiving terminal accepts the corresponding service message and establishes a trusted communication state only when both the SM2 signature value verification and the quantum signature verification of the sending terminal pass. The receiving terminal performs batch processing on the service messages stored in the cache stage to reduce the computation and communication overhead caused by repeated signature verification.

[0072] Step 4.4: When bc=1, the receiving terminal performs signature verification on the service message.

[0073] When bc=1, the receiving terminal enters the instant authentication state. The receiving terminal uses the extracted SM2 public key and Falcon public key from the sending terminal to perform signature verification on the two types of service messages respectively: For all business messages cached during the bc=0 phase, along with their corresponding business SM2 signatures and business Falcon signatures, a loop-by-loop verification is performed. That is, each business message BSM is retrieved sequentially from the cache queue. i Its business SM2 signature and business Falcon signature, respectively call the SM2 verification algorithm. and Falcon verification algorithm The verification is performed using the following formula:

[0074]

[0075] Real-time verification is performed on the business messages and their signatures in newly received data packets after bc=1. The verification algorithm is the same as above.

[0076] Once the status flag is in a trusted state, the receiving terminal performs a loop-by-loop verification of all service messages cached during the untrusted state phase, along with their corresponding SM2 signatures and Falcon signatures. It sequentially retrieves each service message and its corresponding SM2 and Falcon signatures, and uses the extracted SM2 and Falcon public keys of the sending terminal to perform SM2 and Falcon signature verification, respectively. Simultaneously, it performs real-time SM2 and Falcon signature verification on service messages and their corresponding SM2 and Falcon signatures in newly received data packets after the status flag is in a trusted state. If both the SM2 and Falcon signature verifications for a service message pass, the service message is accepted; otherwise, it is discarded.

[0077] The hybrid pseudo-certificate only needs to be recovered and verified once. The receiving terminal can then use the established trusted SM2 public key and Falcon public key to continuously perform double-signature verification on service messages in the cache queue, without having to repeatedly perform certificate parsing, public key extraction, and certificate validity verification for each message. Experimental results show that the entire authentication process of this invention takes an average of only 1.20ms. After adopting the cached message continuous authentication mechanism, low-latency authentication can be achieved on resource-constrained power grid terminals. Because this invention embeds certificate fragments into the service broadcast stream for synchronous transmission, it avoids the wireless resources occupied by independent certificate broadcasts, freeing up approximately 34% of spectrum resources and improving the utilization rate of wireless broadcast resources.

[0078] It is worth noting that this invention employs a real-time authentication and low-overhead communication collaborative optimization mechanism. Through the integrated design of business message authentication, batch processing, and dynamic broadcasting, it balances the real-time authentication performance, communication stability, and system reliability in resource-constrained new energy terminal scenarios. The construction of the real-time authentication and low-overhead communication collaborative optimization mechanism balances the real-time authentication performance, communication efficiency, and system stability in resource-constrained new energy terminal scenarios, meeting the secure communication requirements of high-frequency dynamic interaction in new power system environments.

[0079] By integrating post-quantum signatures, national cryptographic signatures, and intelligent certificate scheduling mechanisms, this system collaboratively protects the identity authentication data and communication process of new energy terminals. While ensuring quantum-resistant security and terminal identity trustworthiness, it achieves low-latency secure authentication and efficient certificate transmission in resource-constrained scenarios. By constructing a dual-signature hybrid authentication mechanism and combining it with dynamic certificate scheduling and fragmented collaborative transmission technology, the system reduces the communication and spectrum overhead caused by post-quantum signatures, improving communication stability and spectrum utilization efficiency in complex new energy business scenarios.

[0080] The application scenarios are new power systems and distributed new energy terminal access scenarios, including high-frequency dynamic interaction environments such as new energy terminal identity authentication, secure transmission of business messages, wireless broadcast communication, and power grid dispatch control. The preferred solution adopts the SM2-Falcon hybrid authentication mechanism, combining hybrid certificates, certificate fragmentation broadcasting, and dynamic scheduling strategies. This ensures low-latency authentication performance while providing quantum security capabilities, and improves authentication efficiency and communication stability in high-concurrency scenarios through batch verification and real-time authentication mechanisms. This solution effectively reduces the spectrum occupancy and link transmission pressure of post-quantum certificates in wireless communication environments, meeting the application requirements of high security, low communication overhead, and high reliability authentication in resource-constrained new energy terminal scenarios. It is suitable for secure and reliable communication in smart grids, new energy access systems, and vehicle-to-everything (V2X) power communication scenarios.

[0081] This scheme comprises three entities: a Certificate Authority (CA), a sending terminal (S), and a receiving terminal (R). The CA is responsible for system initialization, terminal identity registration, and hybrid certificate generation; the sending terminal is responsible for business message signing, hybrid certificate fragmentation and transmission, and data broadcasting; and the receiving terminal is responsible for certificate reconstruction, signature verification, and business message authentication. The system employs the SM2-Falcon hybrid authentication mechanism, providing post-quantum security while ensuring low-latency authentication capabilities. The algorithm mainly includes five stages: system initialization, business message generation, hybrid certificate fragmentation and broadcasting, certificate reconstruction and verification, and message authentication.

[0082] This invention does not couple the dynamic broadcast period with the pseudonym lifecycle; the two address different technical problems. The dynamic broadcasting in this invention solves the problem of decreased certificate fragmentation broadcasting efficiency caused by changes in terminal density and wireless channels in a power grid broadcasting environment.

[0083] Unlike V2X systems, the pseudonym in this invention is not used to protect terminal anonymity or prevent communication trajectory correlation, but rather serves as a short-lifetime identifier for hybrid certificates, driving their periodic updates. In the post-quantum migration phase, because the system simultaneously employs the SM2 and Falcon signature algorithms, the SM2 algorithm, as a traditional cryptographic algorithm, faces the risk of long-term security degradation. This invention configures short-lifetime pseudonyms for hybrid certificates, causing the SM2 public key to be updated synchronously with the pseudonym. This shortens the continuous exposure time of the traditional SM2 public key, reducing the security risks associated with long-term use of traditional cryptography. Meanwhile, the Falcon public key is updated synchronously, ensuring the consistency of the hybrid authentication system. Therefore, the pseudonym update mechanism in this invention serves the security management of the hybrid authentication system in the post-quantum migration phase, rather than the privacy protection purpose of V2X. The two address different technical problems and have different technical motivations; therefore, they cannot be simply considered as a conventional technology transplant.

[0084] It is worth noting that this invention makes the certificate validity period no longer an independently set fixed value, but rather forms a quantitative binding relationship with the broadcast period, ensuring that the certificate remains valid for at least one complete broadcast period. This improves the matching degree between the certificate broadcast period and the certificate validity period, avoiding the problem of the receiver being unable to complete verification due to premature certificate expiration; it also reduces the continuous use time of SM2 public keys and the risk of long-term exposure in post-quantum environments, while reducing the waste of spectrum resources caused by broadcasting invalid certificates.

[0085] Embodiment 2 of the present invention proposes a hybrid authentication system for new energy power grids based on post-quantum cryptography, which implements the hybrid authentication method for new energy power grids based on post-quantum cryptography as described in any one of Embodiment 1, including: The dynamic adjustment module is used by the sending terminal to dynamically adjust the certificate broadcast period according to the terminal density and channel packet loss rate, and the certification center synchronously determines the validity period of the hybrid pseudo-certificate according to the adjusted certificate broadcast period. The certificate generation module is used by the certification authority to construct the content of the certificate to be signed based on the SM2 public key and Falcon public key of the sending terminal; to obtain the certificate SM2 signature and certificate Falcon signature by double signing the content of the certificate to be signed using the certification authority's SM2 private key and Falcon private key; and to generate a hybrid pseudo-certificate based on the certificate SM2 signature and certificate Falcon signature. The data packet generation module is used by the sending terminal to divide the hybrid pseudo-certificate into multiple certificate fragments, and use the sending terminal's SM2 private key and Falcon private key to double-sign the business messages collected by the sending terminal to obtain the business SM2 signature and business Falcon signature. In each certificate broadcasting cycle, the data packet containing the certificate fragments, business SM2 signature, business Falcon signature and business message encapsulated according to the cyclic rotation rule is continuously broadcast. The authentication module receives certificate fragments, service SM2 signatures, service Falcon signatures, and service messages from the terminal's cached data packets. After collecting all certificate fragments, it reassembles the hybrid pseudo-certificate and verifies it using the authentication center's SM2 and Falcon public keys. Once verified, it performs SM2 signature verification and Falcon signature verification on the cached service messages and the service messages in newly received data packets, based on the sending terminal's SM2 and Falcon public keys. When both signature verifications pass, it accepts the corresponding service message, completing the power grid hybrid authentication.

[0086] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A hybrid authentication method for new energy power grids based on post-quantum cryptography, characterized in that, Applied to new energy power stations, which include a certification center, a transmitting terminal on the new energy generator side, and a receiving terminal on the power station side, the method includes the following steps: The sending terminal dynamically adjusts the certificate broadcasting period based on terminal density and channel packet loss rate, and the certification center synchronously determines the validity period of the hybrid pseudo-certificate based on the adjusted certificate broadcasting period. The certification authority constructs the content of the certificate to be signed based on the SM2 public key and Falcon public key of the sending terminal; it then uses the certification authority's SM2 private key and Falcon private key to double-sign the content of the certificate to be signed to obtain the certificate SM2 signature and certificate Falcon signature; and generates a hybrid pseudo-certificate based on the certificate SM2 signature, certificate Falcon signature, and the validity period of the hybrid pseudo-certificate. The sending terminal divides the hybrid pseudo-certificate into multiple certificate fragments. It uses the sending terminal's SM2 private key and Falcon private key to double-sign the business messages collected by the sending terminal to obtain the business SM2 signature and business Falcon signature. In each certificate broadcasting cycle, it continuously broadcasts the certificate fragments, business SM2 signatures, business Falcon signatures, and data packets encapsulated in the business messages selected according to the cyclic rotation rule. The receiving terminal caches certificate fragments, service SM2 signatures, service Falcon signatures, and service messages in the data packets. After collecting all certificate fragments, it reassembles the hybrid pseudo-certificate. It verifies the validity period of the hybrid pseudo-certificate using the SM2 public key and Falcon public key of the certification center. After successful verification, it performs SM2 signature verification and Falcon signature verification on the service SM2 signature and service Falcon signature corresponding to each service message in the cached service messages and the service messages in the newly received data packets, based on the SM2 public key and Falcon public key of the sending terminal. When both signature verifications pass, it accepts the corresponding service messages and completes the power grid hybrid authentication.

2. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 1, characterized in that: The sending terminal dynamically adjusts the certificate broadcast period during the authentication process based on terminal density and channel packet loss rate, as expressed by the following formula: In the formula, This indicates the adjusted certificate broadcast cycle. This is the default broadcast cycle. This represents the number of different pseudonyms received by the sending terminal per unit time, used to indicate terminal density. This indicates the preset maximum terminal density. This represents the channel packet loss rate detected by the sending terminal based on the continuous broadcast message sequence number. This indicates the rate at which the sending terminal generates service messages. Indicates the maximum communication rate; The certification center adjusts the validity period of hybrid pseudonymous certificates in sync with the adjusted certificate broadcast cycle.

3. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 2, characterized in that: The certification center will adjust the validity period of hybrid pseudonymous certificates in accordance with the adjusted certificate broadcast cycle, including: The certification authority sets a security factor greater than or equal to 1, and uses the result of multiplying this security factor by the adjusted certificate broadcast period as the validity period of the hybrid pseudo-certificate, so that the validity period of the hybrid pseudo-certificate is greater than or equal to the certificate broadcast period.

4. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 1, characterized in that: Generating a hybrid pseudonym certificate includes: The authentication center generates its own SM2 public key, SM2 private key, Falcon public key, and Falcon private key, and also generates the same for the sending terminal. The certification center generates a pseudo-identity identifier for the sending terminal based on the certificate lifecycle. Based on the pseudo-identity identifier, the sending terminal's SM2 public key, the sending terminal's Falcon public key, the hybrid pseudo-certificate version number, the region to which the terminal belongs, and the validity period of the hybrid pseudo-certificate, the certificate content to be signed is constructed. The certification authority uses its SM2 private key and Falcon private key to perform SM2 signing and Falcon signing on the content of the certificate to be signed, thus obtaining the certificate SM2 signature and certificate Falcon signature. Combine the SM2 signature of the certificate, the Falcon signature of the certificate, and the content of the certificate to be signed to form a hybrid pseudo-certificate; The authentication center sends the sending terminal's SM2 public key, SM2 private key, Falcon public key, Falcon private key, and hybrid pseudo-certificate to the sending terminal.

5. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 1, characterized in that: The hybrid pseudo-certificate is divided into multiple certificate fragments. The total number of certificate fragments is determined by the total byte length of the hybrid pseudo-certificate and the maximum payload allocated to each certificate fragment in a single data packet, as expressed by the following formula: In the formula, This represents the total number of certificate fragments obtained from the partitioning of the hybrid pseudo-certificate. This indicates the total byte length of the hybrid pseudo-certificate. This indicates the maximum payload allocated to a certificate fragment within a single data packet. Indicates rounding up; Each certificate fragment contains the current certificate fragment number, the total number of certificate fragments, and certificate fragment data.

6. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 1, characterized in that: The certificate fragments selected according to the cyclical rotation rule include: Divide the hybrid pseudonym certificate into multiple certificate fragments. ,in, This represents the total number of certificate fragments obtained from the partitioning of the hybrid pseudo-certificate. Indicates the first A certificate fragment, Indicates the certificate fragment number; No. Each certificate broadcast cycle selects certificate fragments according to a cyclical rotation rule. ,in, Indicates the certificate broadcast cycle number. Indicates modulo; When the certificate broadcast cycle number Greater than At this time, the sending terminal restarts from certificate fragment number 1 and selects certificate fragments in a round-robin fashion according to the round-robin rule to poll and broadcast until the receiving terminal has received all certificate fragments.

7. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 1, characterized in that: After collecting all the certificate fragments, the reconstructed hybrid pseudo-certificate includes: The receiving terminal initializes its status flag to an untrusted state and caches the service messages, dual-signature information, and corresponding certificate fragments in the data packets. The receiving terminal in the preset time window After collecting all n certificate fragments with different numbers, reassemble them to restore the complete hybrid pseudo-certificate; like If not all certificate fragments are collected within the specified time window, the currently cached certificate fragments in the receiving terminal are cleared, and subsequent data packets are received. The certificate fragment numbered 1, which is the first certificate fragment received, is used as the starting point for the next round of certificate fragment collection, and the process restarts within the preset time window. We are attempting to collect all the certificate fragments.

8. The hybrid authentication method for new energy power grids based on post-quantum cryptography according to claim 7, characterized in that: Verifying the validity period of a hybrid pseudonym certificate using the SM2 public key and Falcon public key from the certification authority includes: The receiving terminal calls the certificate verification function to verify whether the validity period of the recovered complete hybrid pseudo-certificate is within the valid range and whether the certificate's SM2 signature and Falcon signature are correct, using the SM2 public key and Falcon public key of the certification authority. When all verifications pass, the status flag is updated to trusted status, and the sending terminal's SM2 public key and Falcon public key are extracted from the hybrid pseudo-certificate.

9. A hybrid authentication method for new energy power grids based on post-quantum cryptography as described in claim 8, characterized in that: Once the status flag is in a trusted state, the receiving terminal performs a loop-by-loop verification of all service messages cached during the untrusted state phase, along with their corresponding SM2 signatures and Falcon signatures. It sequentially retrieves each service message and its corresponding SM2 and Falcon signatures, and uses the extracted SM2 and Falcon public keys of the sending terminal to perform SM2 and Falcon signature verification, respectively. Simultaneously, it performs real-time SM2 and Falcon signature verification on service messages and their corresponding SM2 and Falcon signatures in newly received data packets after the status flag is in a trusted state. If both the SM2 and Falcon signature verifications for a service message pass, the service message is accepted; otherwise, it is discarded.

10. A hybrid authentication system for new energy power grids based on post-quantum cryptography, operating the hybrid authentication method for new energy power grids based on post-quantum cryptography as described in any one of claims 1-9, characterized in that, include: The dynamic adjustment module is used by the sending terminal to dynamically adjust the certificate broadcast period according to the terminal density and channel packet loss rate, and the certification center synchronously determines the validity period of the hybrid pseudo-certificate according to the adjusted certificate broadcast period. The certificate generation module is used by the certification authority to construct the content of the certificate to be signed based on the SM2 public key and Falcon public key of the sending terminal; to obtain the certificate SM2 signature and certificate Falcon signature by double signing the content of the certificate to be signed using the certification authority's SM2 private key and Falcon private key; and to generate a hybrid pseudo-certificate based on the certificate SM2 signature and certificate Falcon signature. The data packet generation module is used by the sending terminal to divide the hybrid pseudo-certificate into multiple certificate fragments, and use the sending terminal's SM2 private key and Falcon private key to double-sign the business messages collected by the sending terminal to obtain the business SM2 signature and business Falcon signature. In each certificate broadcasting cycle, the data packet containing the certificate fragments, business SM2 signature, business Falcon signature and business message encapsulated according to the cyclic rotation rule is continuously broadcast. The authentication module receives certificate fragments, service SM2 signatures, service Falcon signatures, and service messages from the terminal's cached data packets. After collecting all certificate fragments, it reassembles the hybrid pseudo-certificate and verifies it using the authentication center's SM2 and Falcon public keys. Once verified, it performs SM2 signature verification and Falcon signature verification on the cached service messages and the service messages in newly received data packets, based on the sending terminal's SM2 and Falcon public keys. When both signature verifications pass, it accepts the corresponding service message, completing the power grid hybrid authentication.

Images