CN114338071A - Network security identity authentication method based on wind power plant communication - Google Patents

Abstract

The invention discloses a network security identity authentication method based on wind farm communication. The method can include two stages of user registration and mutual authentication. In the network security identity authentication method based on wind farm communication provided by this application, each wind farm user needs to register with the service provider when he wants to join the wind farm communication network. Share a different symmetric key, and calculate the correlation value of the two entities after mutual verification, and finally send the calculated correlation value to the wind farm user. In the subsequent login and authentication phases, the identity of the legitimate user is verified and a session key is generated from it. The method can realize mutual authentication before the generation of session keys of two entities, and can ensure that each information in the authentication process will not be tampered with when transmitted through the public channel, thereby achieving the purpose of improving network communication security.

Description

A network security identity authentication method based on wind farm communication

technical field

The invention relates to the technical field of wind farm communication network security, in particular to a network security identity authentication method based on wind farm communication.

Background technique

Identity authentication technology is an effective means to verify the operator's identity in the computer network. In the network system, the user identity information can be represented by a specific data stream, and the computer can realize the user's digital identity authentication through the authentication of the data, thereby authorizing the user. Identity authentication is the first step to protect the security of network resources, and it is also the key to network information security.

At present, computer information technology has been widely popularized, and the requirements for use are also provided. In addition to various functions, the research of security technology is very important. The current user identity authentication technology can confirm the identity of users in the communication process of wind farms. The security of wind farm communication is greatly improved. Compared with traditional security measures, users need to remember a large number of passwords, and the actual application process is complicated and has low security. Therefore, the identity authentication technology is undoubtedly more convenient and has a higher security factor.

Therefore, it is necessary to increase the research on identity authentication technology, and promote its application in important places and fields to ensure the security of the system's computer information use.

SUMMARY OF THE INVENTION

The invention provides a network security identity authentication method based on wind farm communication.

The present invention provides following scheme:

A network security identity authentication method based on wind farm communication, comprising:

Step 1: User Registration

The wind farm client sends the user identity value ID _i input by the user and the selected random number a to the service provider through a secure channel;

The service provider side calculates and obtains numerical value _{Mi, numerical value G i and numerical} value Qi through the user identity value ID _i , random number a, service identity value ID _j and service provider secret value K _{sp ;} , the value _Gi is sent to the wind farm client through a secure channel, so that the wind farm client stores the value _Mi , the value _Gi and the first random number a, and the service The provider _side stores the third value Qi in its own database;

Step 2: Mutual Authentication

After completing the login operation through the wind farm client, select the random number b, and obtain the value N through the random number _a , the random number b and the wind farm secret value K _sm ; The obtained values N, L ₁ and time value Ti and the values Mi and G _i stored in the database are encrypted with a symmetric key s shared in advance to obtain E _s =[M _{i ,} G _{i ,} N,L ₁ ,T _i ], send the encrypted message E _s =[M _i ,G _i ,N,L ₁ ,T _i ] to the service provider through an open channel;

After receiving the encrypted message E _s =[M _i ,G _i ,N,L ₁ ,T _i ], the service provider side decrypts the message to obtain the value M′ _i , the value G′ _i , the value N′ _i , the value L′ ₁ , Time value T _i , calculate the message refresh value ΔT, if the value is within the range, perform the next operation, otherwise reject the service;

The service provider uses the symmetric key s to decrypt to obtain the value Q' _i , and judges whether the Q' _i is equal to the value of Qi stored in its own database _, so as to judge whether the message comes from the wind farm user that has completed the registration;

判断数值

与数值L'₁是否相等，用以判断经过加密接收到的消息里面的各项数值是否被篡改；The service provider calculates the value

Judgment value

Whether it is equal to the value L' ₁ , it is used to judge whether the values in the message received through encryption have been tampered with;

The service provider side selects the random number c and the random number d, and calculates to obtain the value L ₂ , the value U, and the time value T _i , and encrypts the value L ₂ , the value U, and the time value T _i with the symmetric key s Obtain the encrypted message E _s {L ₂ ,U,T _i }, and send the encrypted message E _s {L ₂ ,U,T _i } to the wind farm client;

After receiving the encrypted message E _s {L ₂ ,U,T _i }, the wind farm user terminal decrypts the encrypted message E _s {L ₂ ,U,T _i } to obtain the value L' ₂ , the value U', and the time value T _i , calculate the message refresh value ΔT to see if the value is within the range, obtain the value L" ₂ and verify whether L" ₂ =L' ₂ , to judge whether the encrypted message Es {L ₂ ,U,T _{i }} From the service provider and whether the content of the message has been tampered with;

After the authentication is passed, the session key SK=h(ID _i ||a||N||U) is obtained; the session key is used to encrypt the content of the session message.

Preferably: in step 1, the wind farm user terminal adopts the user identity value ID _i input by the user, the password value PW _i and the selected random number a to calculate and obtain the value A _i and store it;

Before step 2, the wind farm user terminal adopts the numerical value A _i to realize user login authentication.

和密码

风电场用户端计算获得数值

将计算得到的数值

与存储在自身数据库中的数值A_i进行比较，是否满足

如果满足条件则说明用户身份正确户登录认证通过。Preferably: the user login authentication includes the wind farm client receiving the identity value input by the user

and password

Wind farm user terminal calculates the value

the value that will be calculated

Compare it with the value A _i stored in its own database, whether it satisfies

If the conditions are met, it means that the user identity is correct and the user login authentication has passed.

Preferably: the numerical value A _i =h(ID _i ||a||PW _i ), the numerical value

所述数值

所述数值

Preferably: the numerical value

the value

the value

Preferably: the numerical value N=(K _sm *a)+b, the numerical value L ₁ =h(N||r), the

所述数值

其中，

Preferably: the service provider uses the symmetric key s to decrypt M' _i , G' _i to obtain

the value

in,

其中，所述r'＝h(ID"_i||a"||N')。Preferably: the numerical value

Wherein, the r'=h(ID" _i ||a"||N').

Preferably: the numerical value U=h(K _sp *c)+d, the numerical value L ₂ =h(U||SK), wherein the SK=h(ID" _i ||a"||N ||U).

Preferably: the numerical value L" ₂ =h(U'||SK'), wherein,

According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

Through the present invention, a network security identity authentication method based on wind farm communication can be realized, and in an implementation manner, the method can include two stages of user registration and mutual authentication. In the network security identity authentication method based on wind farm communication provided by this application, each wind farm user needs to register with the service provider when he wants to join the wind farm communication network. Share a different symmetric key, and calculate the correlation value of the two entities after mutual verification, and finally send the calculated correlation value to the wind farm user. In the subsequent login and authentication phases, the identity of the legitimate user is verified and a session key is generated from it. The method can realize mutual authentication before the generation of session keys of two entities, and can ensure that each information in the authentication process will not be tampered with when transmitted through the public channel, thereby achieving the purpose of improving network communication security.

Of course, it is not necessary for any product embodying the present invention to achieve all of the advantages described above simultaneously.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings required in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some of the present invention. In the embodiments, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

1 is a flowchart of a user registration stage in a network security identity authentication method based on wind farm communication provided by an embodiment of the present invention;

FIG. 2 is a flowchart of a mutual authentication stage in a network security identity authentication method based on wind farm communication provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art fall within the protection scope of the present invention.

Example

Referring to FIG. 1 and FIG. 2 , a network security identity authentication method based on wind farm communication provided by an embodiment of the present invention, as shown in FIG. 1 and FIG. 2 , the method includes the following steps:

Step 1: User Registration

The wind farm client sends the user identity value ID _i input by the user and the selected random number a to the service provider through a secure channel;

The service provider side calculates and obtains numerical value _{Mi, numerical value G i and numerical} value Qi through the user identity value ID _i , random number a, service identity value ID _j and service provider secret value K _{sp ;} , the value _Gi is sent to the wind farm client through a secure channel, so that the wind farm client stores the value _Mi , the value _Gi and the first random number a, and the service The provider _side stores the third value Qi in its own database;

Step 2: Mutual Authentication

After completing the login operation through the wind farm client, select the random number b, and obtain the value N through the random number _a , the random number b and the wind farm secret value K _sm ; The obtained values N, L ₁ and time value Ti and the values Mi and G _i stored in the database are encrypted with a symmetric key s shared in advance to obtain E _s =[M _{i ,} G _{i ,} N,L ₁ ,T _i ], send the encrypted message E _s =[M _i ,G _i ,N,L ₁ ,T _i ] to the service provider through an open channel;

After receiving the encrypted message E _s =[M _i ,G _i ,N,L ₁ ,T _i ], the service provider side decrypts the message to obtain the value M′ _i , the value G′ _i , the value N′ _i , the value L′ ₁ , Time value T _i , calculate the message refresh value ΔT, if the value is within the range, perform the next operation, otherwise reject the service;

The service provider uses the symmetric key s to decrypt to obtain the value Q' _i , and judges whether the Q' _i is equal to the value of Qi stored in its own database _, so as to judge whether the message comes from the wind farm user that has completed the registration;

判断数值

与数值L'₁是否相等，用以判断经过加密接收到的消息里面的各项数值是否被篡改；The service provider calculates the value

Judgment value

Whether it is equal to the value L' ₁ , it is used to judge whether the values in the message received through encryption have been tampered with;

The service provider side selects the random number c and the random number d, and calculates to obtain the value L ₂ , the value U, and the time value T _i , and encrypts the value L ₂ , the value U, and the time value T _i with the symmetric key s Obtain the encrypted message E _s {L ₂ ,U,T _i }, and send the encrypted message E _s {L ₂ ,U,T _i } to the wind farm client;

After receiving the encrypted message E _s {L ₂ ,U,T _i }, the wind farm user terminal decrypts the encrypted message E _s {L ₂ ,U,T _i } to obtain the value L' ₂ , the value U', and the time value T _i , calculate the message refresh value ΔT to see if the value is within the range, obtain the value L" ₂ and verify whether L" ₂ =L' ₂ , to judge whether the encrypted message Es {L ₂ ,U,T _{i }} From the service provider and whether the content of the message has been tampered with;

After the authentication is passed, the session key SK=h(ID _i ||a||N||U) is obtained; the session key is used to encrypt the content of the session message.

The network security identity authentication method based on wind farm communication provided by the embodiment of the present application includes two parts: registration and login key negotiation. The first part is the registration part, where wind farm users register with service providers through secure channels or offline registration. The second part is login key negotiation. The wind farm user first logs in and authenticates, and then mutually authenticates with the service provider and generates a session key with it.

In order to realize the authentication of the user's identity when the user logs in through the wind farm client. The embodiment of the present application can provide that in step 1, the wind farm client uses the user identity value ID _i input by the user, the password value PW _i and the selected random number a to calculate and store the value A _i ;

Before step 2, the wind farm user terminal adopts the numerical value A _i to realize user login authentication.

It can be understood that each value provided in the embodiment of the present application can be obtained by using a corresponding calculation formula. For example, in an implementation manner, a part of the numerical value provided by the embodiment of the present application can adopt the disclosed hash function h( ) is obtained by calculation, and a part of it can be obtained by using the homomorphic encryption algorithm E(). Specifically, the numerical value A _i =h(ID _i ||a||PW _i ), the numerical value

所述数值

所述数值

the value

the value

the value

The numerical value N=(K _sm *a)+b, the numerical value L ₁ =h(N||r), the

所述数值

其中，

The service provider uses the symmetric key s to decrypt M' _i , G' _i to obtain

the value

in,

其中，所述r'＝h(ID"_i||a"||N')。the value

Wherein, the r'=h(ID" _i ||a"||N').

The numerical value U=h(K _sp *c)+d, the numerical value L ₂ =h(U||SK), wherein the SK=h(ID" _i ||a"||N||U ).

The numerical value L" ₂ =h(U'||SK'), wherein,

In the network security identity authentication method based on wind farm communication provided by the embodiments of the present application, the two entities are the wind farm user (SM _i ) and the service provider (SP _j ) in the wind farm communication, respectively.

Wind farm user (SM _i ): the most basic user unit. Whenever a wind farm user wants to join the wind farm communication network, it needs to register with the service provider and store the relevant value calculated by the service provider for it. into its own memory. And finally reach a session key with the service provider for subsequent encrypted communication between the two entities.

Service Provider (SP _j ): Every time a wind farm user wants to join the wind farm communication network, it needs to register with the service provider. Symmetric key, and calculate the correlation value of the two entities after mutual verification, and finally send the calculated correlation value to the wind farm user. In the subsequent login and authentication phases, the identity of the legitimate user is verified and a session key is generated from it.

When implementing:

User registration

The wind farm user (SM _i ) first inputs the identity value ID _i and the password PW _i , then selects a random number a, then calculates A _i =h(ID _i ||a||PW _i ), and finally transfers the identity value through the secure channel. The value ID _i and the random number a are sent to the service provider (SP _j ).

K_sp为服务提供商的一个秘密值。接着将计算出的数值M_i、G_i通过安全信道发送给SM_i并将计算出的Q_i存入自身数据库。Calculated after the service provider (SP _j ) receives the information

K _sp is a secret value of the service provider. Then, the calculated values _Mi and _{Gi are sent to SM i through} a secure channel and the calculated _Qi is stored in its own database.

After receiving the message from SP _j , SM _i stores A _i , M _i , G _i , and a in its own database.

login authentication

和密码

然后风电场计算

并将计算得到的值与存储在自身数据库中的值A_i进行比较，是否满足

如果满足条件则说明用户身份正确可以进行接下来的操作，反之则拒绝服务。The wind farm user (SM _i ) first performs the login operation and enters the identity value

and password

Then the wind farm calculates

and compare the calculated value with the value A _i stored in its own database, whether it satisfies

If the conditions are met, the user's identity is correct and the next operation can be performed; otherwise, the service is refused.

mutual authentication

L₁＝h(N||r)，将计算得到的数值N、L₁和时间值T_i与自身数据库里存储的数值M_i、G_i用提前分享的一个对称密钥s进行加密E_s＝[M_i,G_i,N,L₁,T_i]，最后将加密过后的消息通过公开的信道发送给服务提供商。The wind farm user (SM _i ) then selects a random number b and calculates N=(K _sm *a)+b, where K _sm is a secret value of the wind farm. recalculate

L ₁ =h(N||r), encrypt the calculated value N, L ₁ and time value T _i with the values _{Mi and G i stored} in the database with a symmetric key s shared in advance E _s =[M _i ,G _i ,N,L ₁ ,T _i ], and finally send the encrypted message to the service provider through an open channel.

When the service provider (SP _j ) receives the encrypted message and decrypts the message to obtain M' _i , G' _i , N' _i , L' ₁ , and T _i , first calculate the message refresh value ΔT, and if the value is within the range, proceed to the next action, otherwise it is a denial of service.

并计算

然后验证计算得到的Q′_i值是否与储存在自身数据库中的Q_i的值相等即Q′_i＝Q_i，如果两个值相等则能证明消息来自之前注册的风电场用户，否则就拒绝服务。Then decrypt M' _i and G' _i to get

and calculate

Then verify whether the calculated value of Q' _i is equal to the value of Q _i stored in its own database, that is, Q' _i =Q _i , if the two values are equal, it can prove that the message comes from the previously registered wind farm user, otherwise it is rejected Serve.

并验证

如果两个数值相等则能证明经过加密接收到的消息里面的各项数值没有进行过篡改，否则拒绝服务。Next, the service provider (SP _j ) calculates r'=h(ID" _i ||a"||N'),

and verify

If the two values are equal, it can prove that the values in the encrypted received message have not been tampered with, otherwise the service will be refused.

Then the service provider (SP _j ) selects two random numbers c and d, and calculates U=h(K _sp *c)+d, SK=h(ID" _i ||a"||N||U), L ₂ =h(U||SK), finally L ₂ , U, T _i are encrypted with the symmetric key s shared in advance by the wind farm and the service provider, and then sent to the wind farm E _s {L ₂ ,U,T _i }.

L"₂＝h(U'||SK')并去验证是否L"₂＝L'₂，如果两数值相等则能证明消息来自服务提供商且消息内容没有被篡改，反之则拒绝服务。When the wind farm user receives the encrypted message, it first decrypts the message to obtain L' ₂ , U' and T _i , then calculates the message refresh value ΔT to see if the value is within the range, and then calculates

L" ₂ =h(U'||SK') and verify whether L" ₂ =L' ₂ , if the two values are equal, it can prove that the message comes from the service provider and the message content has not been tampered with, otherwise, the service is rejected.

Finally, SK=h(ID _i ||a||N||U) can be obtained, that is, the session key can be used to encrypt the content of the session message after the communication.

In a word, in the network security identity authentication method based on wind farm communication provided by this application, each wind farm user needs to register with the service provider when he wants to join the wind farm communication network, and the service provider will give each registered wind farm Users share a different symmetric key in advance, and calculate the correlation value of the two entities after mutual verification, and finally send the calculated correlation value to the wind farm user. In the subsequent login and authentication phases, the identity of the legitimate user is verified and a session key is generated from it. The method can realize mutual authentication before the generation of session keys of two entities, and can ensure that each information in the authentication process will not be tampered with when transmitted through the public channel, thereby achieving the purpose of improving network communication security.

It should be noted that, in this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. any such actual relationship or sequence exists. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion such that a process, method, article or device comprising a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims (10)

1. A network security identity authentication method based on wind power plant communication is characterized by comprising the following steps:

step 1: user registration

User identity value ID input by user at wind power plant user side_iSending the random number a and the selected random number a to a service provider end through a secure channel;

the service provider end passes the user identity value ID_iRandom number a, service identity value ID_jAnd a service provider secret value K_spCalculating to obtain a value M_iNumerical value G_iAnd a value Q_i(ii) a The value M is measured_iThe value G_iSending the value M to the wind power plant user side through a safety channel so that the wind power plant user side can conveniently use the value M_iThe value G_iAnd the first random number a is stored, and the service provider side stores the third value Q_iStoring the data into a self database;

step 2: mutual authentication

After the wind power plant user end finishes login operation, selecting a random number b, and obtaining a wind power plant secret value K through the random number a, the random number b and the wind power plant secret value K_smCalculating to obtain a numerical value N; then the value L is obtained by calculation₁Will calculate the value N, L₁And a time value T_iWith the value M stored in its own database_i、G_iEncryption with a symmetric key s shared in advance to obtain E_s＝[M_i,G_i,N,L₁,T_i]The encrypted message E_s＝[M_i,G_i,N,L₁,T_i]Sending the data to a service provider end through an open channel;

the service provider end receives the encrypted message E_s＝[M_i,G_i,N,L₁,T_i]Decrypting the message to obtain a value M'_iNumerical value G'_iNumerical value N'_iNumerical value L'₁Time value T_iCalculating a message refresh value delta T, if the value is within the range, carrying out the next operation, otherwise, rejecting the service;

the service provider side decrypts the data by adopting the symmetric key s to obtain a value Q'_iJudging Q'_iWhether or not to match Q stored in its own database_iThe values of the data are equal to each other, and the data are used for judging whether the message comes from the registered wind power plant user side;

service provider side calculates and obtains numerical value

Judging the value

And a numerical valueL'₁Whether the values are equal or not is used for judging whether all values in the encrypted and received message are tampered or not;

the service provider selects the random number c and the random number d, and calculates to obtain a value L₂Numerical value U and time value T_iAnd the value L is compared₂Numerical value U and time value T_iEncrypting with the symmetric key s to obtain an encrypted message E_s{L₂,U,T_iWill encrypt message E_s{L₂,U,T_iSending the wind power station to a user side of the wind power station;

the wind power plant user side receives the encrypted message E_s{L₂,U,T_iAfter the encryption, the message E is encrypted_s{L₂,U,T_iDeciphering to obtain a value L'₂Numerical value U', time value T_iCalculating message refresh value delta T to see if the value is within the value range, calculating to obtain the value L "₂And verifying whether L "₂＝L'₂For determining an encrypted message E_s{L₂,U,T_iWhether the message content comes from the service provider side or not is tampered;

obtaining a session key SK h (ID) after passing the authentication_iA N U); the session key is used to encrypt the session message content.

2. The network security identity authentication method based on wind farm communication according to claim 1, wherein in step 1, the wind farm user side adopts a user identity value ID input by a user_iA password value PW_iAnd calculating the selected random number a to obtain a value A_iAnd storing;

adopting a numerical value A at a wind power plant user end before step 2_iAnd realizing user login authentication.

3. The wind farm communication-based network security identity authentication method according to claim 1, wherein the user login authentication comprises a wind farm user side receiving an identity value input by a user

And a password

Wind power plant user side calculation to obtain numerical value

Will calculate the obtained value

With the value A stored in its own database_iComparing to determine whether the above-mentioned requirements are met

If the conditions are met, the user identity is correct, and the user login authentication is passed.

4. The wind farm communication-based network security identity authentication method according to claim 3, wherein the value A_i＝h(ID_i||a||PW_i) The value of

5. The wind farm communication-based network security identity authentication method according to claim 1, wherein the numerical value

The numerical value

The numerical value

6. Wind farm based on a wind park according to claim 1The network security identity authentication method of the credit is characterized in that the value N ═ K_smA) + b, the value L₁H (N | | r), the

7. The wind farm communication-based network security identity authentication method according to claim 1, wherein the service provider side decrypts M 'by using a symmetric key s'_i、G′_iTo obtain

The numerical value

Wherein,

8. the wind farm communication-based network security identity authentication method according to claim 1, wherein the numerical value

Wherein r' ═ h (ID ″)_i||a"||N')。

9. The wind farm communication-based network security identity authentication method according to claim 1, wherein the value U-h (K)_spC) + d, the value L₂H (U | | SK), wherein SK ═ h (ID ″)_i||a"||N||U)。

10. Network security identity based on wind farm communication according to claim 1An authentication method characterized in that said numerical value L "₂H (U '| SK'), wherein,

Images