CN116455661A - Multi-factor dynamic identity authentication method based on cryptographic algorithm - Google Patents

Abstract

The invention discloses a multi-factor dynamic identity authentication method based on a national secret algorithm, comprising: generating a public-private key pair and a symmetric key according to the national secret algorithm, and performing cryptographic operations on the verification factor by using the generated key and the SM3 national secret algorithm; In the first authentication stage, the terminal generates a non-repeating random number, generates a dynamic password combined with hash and XOR operations, uses a symmetric cryptographic algorithm to encrypt the dynamic password, and uses an asymmetric cryptographic algorithm to encrypt the symmetric key, and sends it together with the encrypted dynamic password to the configuration The power gateway performs identity authentication; in the second authentication stage, the power distribution gateway generates a new non-repeated random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it with a symmetric key, and sends it to the smart terminal Authenticate. The invention can resist common attacks such as man-in-the-middle attack, replay attack, impersonation attack, etc., and the method does not need to install additional hardware or issue digital certificates, thereby reducing cost and difficulty in operation and maintenance.

Description

A Multi-factor Dynamic Identity Authentication Method Based on National Secret Algorithm

technical field

The invention relates to the technical field of power data transmission security, in particular to a multi-factor dynamic identity authentication method based on a national secret algorithm.

Background technique

In recent years, power companies have vigorously promoted the construction of smart grids, and more and more smart power terminals have been connected to the distribution network. However, with the continuous development of computer, communication and other technologies, as well as the continuous integration of power grids and information networks, while smart terminals bring convenience, higher efficiency and other advantages, they also introduce more security risks into the distribution network. Especially in the 10kV and below medium and low voltage distribution network automation system, for remote terminals such as feeders and distribution transformers that do not have optical fiber communication conditions, due to the use of public wireless communication (GPRS, CDMA, TD-SCDMA, etc.), power distribution The Internet faces huge risks of external public network attacks, such as illegal eavesdropping, malicious tampering, and identity deception. Therefore, it is extremely important to ensure the communication security of a large number of intelligent power distribution terminals, and then maintain the overall security and stability of the distribution network.

Safe and efficient identity authentication methods are playing an increasingly important role in the distribution network, which is the basis and premise to ensure the safe transmission of data between terminals in the distribution network or between the terminal and the master station. However, there are currently existing solutions for identity authentication, and there are generally the following problems: (1) Intelligent terminals or power distribution master stations are required to be equipped with additional hardware carriers, such as TPM trusted security chips, USB hardware media, etc. (2) The CA certification center is required to issue corresponding digital certificates for the power distribution master station and all intelligent terminals, which increases the difficulty of management and maintenance. (3) It is vulnerable to malicious attacks such as man-in-the-middle attacks and impersonation attacks, and the authentication security is low, which brings huge security risks to the distribution network.

Contents of the invention

In view of the above existing problems, the present invention is proposed.

Therefore, the present invention provides a multi-factor dynamic identity authentication method based on the national secret algorithm to solve the current need for smart terminals or power distribution master stations to be equipped with additional hardware carriers; CA certification centers are required to issue certificates for power distribution master stations and all smart terminals. Corresponding digital certificates are difficult to manage and maintain; they are vulnerable to malicious attacks such as man-in-the-middle attacks and impersonation attacks, and the authentication security is low.

In order to solve the above technical problems,

The invention provides a multi-factor dynamic identity authentication method based on the national secret algorithm, including:

Generate a public-private key pair and a symmetric key according to the national secret algorithm, and use the generated key and the SM3 national secret algorithm to perform cryptographic operations on the verification factor, which includes the terminal identity ID, hardware address MAC and shared password value PW;

In the first authentication stage, the terminal generates a non-repeating random number, generates a dynamic password combined with hash and XOR operations, uses a symmetric cryptographic algorithm to encrypt the dynamic password, and uses an asymmetric cryptographic algorithm to encrypt the symmetric key, and sends it together with the encrypted dynamic password to the configuration The electricity gateway conducts identity authentication;

In the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it with a symmetric key, and sends it to the smart terminal for identity authentication.

As a preferred solution of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, wherein: in the generation of the public-private key pair and the symmetric key according to the national secret algorithm, the national secret algorithms are SM2 and SM4 algorithms.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, it also includes: in the registration stage before the first authentication, the smart terminal to be registered encrypts the device information using an asymmetric cryptographic algorithm , send the encrypted registration data to the power distribution gateway, and the power distribution gateway decrypts the data and verifies the correctness of the data, and saves the registration data after the verification is passed.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, wherein: the encrypted registration data is sent to the power distribution gateway, and the power distribution gateway verifies the correctness of the data after decrypting the data, specifically include,

The power distribution gateway generates a key pair through the SM2 national secret algorithm, sends its own public key K _P to the terminal, and the private key K _S is safely stored;

The terminal uses the SM3 national secret algorithm to perform calculations on its own device hardware address MAC and the shared password value PW respectively, together with the terminal identity ID _i uses the gateway public key K _P to encrypt through the SM2 national secret algorithm, and sends the encrypted data to the power distribution gateway to register;

After the power distribution gateway receives the terminal registration information, it uses its own private key _KS to decrypt it, and verifies whether the same registered user exists in the list according to the ID _i . If it does not exist, it replies with a successful registration message, and saves the ID _i and the corresponding verification Factors H(MAC), H(PW), denoted as H'(MAC), H'(PW);

Wherein, H(x) represents the hash value obtained after hashing the data x using the SM3 algorithm.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, wherein: in the first authentication stage, the terminal generates a non-repetitive random number, and generates a dynamic password in combination with hash and XOR operation, and uses The dynamic password is encrypted with a symmetric cryptographic algorithm, and the symmetric key is encrypted with an asymmetric cryptographic algorithm, and sent together with the encrypted dynamic password to the power distribution gateway for identity authentication, specifically including,

The terminal generates a random number R ₁ , and calculates and H(H(MAC)||R ₁ );

Call the SM4 national secret algorithm and generate a symmetric key K, use the key K to encrypt the calculation result and ID _i , and use the gateway public key to encrypt the key K, and send all the encrypted information to the gateway;

in, Represents an XOR operation, and || represents a join operation.

As a preferred solution of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, it also includes: in the first authentication, after the power distribution gateway receives the encrypted data, it uses the private key and the symmetric key to perform The dynamic password is obtained by decrypting, and the corresponding terminal and its stored verification factor are found according to the dynamic password, and the dynamic password is further verified in combination with the verification factor.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm described in the present invention, wherein: in the first authentication stage, after the power distribution gateway receives the encrypted data, it uses the private key and the symmetric key to decrypt the obtained Dynamic password, according to the dynamic password to find the corresponding terminal and its stored verification factor, combined with the verification factor to further verify the dynamic password, specifically including,

After receiving the encrypted authentication message, the power distribution gateway decrypts it with its own private key _KS to obtain the symmetric key K;

Use the symmetric key K to decrypt the data through the SM4 algorithm;

The power distribution gateway obtains the corresponding H'(PW) and H'(MAC) according to the ID _i , and calculates And verify whether H(H(MAC)||R ₁ ) is equal to H(H'(MAC)||R' ₁ ), if they are equal, the power distribution gateway passes the identity authentication of the terminal.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, wherein: in the second authentication stage, the power distribution gateway generates a new non-repeating random number, and hashes the decrypted data , XOR operation to generate a new dynamic password, which is encrypted with a symmetric key and sent to the smart terminal for identity authentication, specifically including,

After the power distribution gateway passes the authentication of the terminal, it generates a random number R ₂ and calculates and H(H′(MAC)||R ₂ ), and then use the SM4 algorithm to encrypt the data with the key K and send it to the terminal.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, it also includes that in the second authentication, after the smart terminal receives the encrypted data, it decrypts it using a symmetric key to obtain a new Dynamic password, verify the new dynamic password according to the saved local data, and pass the identity authentication of the power distribution gateway if it is verified to be correct.

As a preferred scheme of the multi-factor dynamic identity authentication method based on the national secret algorithm in the present invention, wherein: in the second authentication, after the smart terminal receives the encrypted data, it uses a symmetric key to decrypt to obtain a new dynamic password, Verify the new dynamic password according to the saved local data, and if it is verified to be correct, pass the identity authentication of the power distribution gateway, specifically including,

After the terminal receives the encrypted data, it calls the SM4 algorithm to decrypt the message;

According to the stored R ₁ and H(MAC), the terminal calculates And verify whether H(H'(MAC)||R ₂ ) is equal to H(H(MAC)||R' ₂ ), and if they are equal, the terminal passes the identity authentication of the power distribution gateway.

Compared with the prior art, the present invention has beneficial effects: the present invention is based on SM2, SM3, and SM4 national secret algorithms, combined with factors such as terminal identity ID _i , hardware address MAC, and shared password value PW, and uses random numbers to generate dynamic passwords, It has the advantages of multi-factor authentication, simple authentication method, and high algorithm security strength, and can resist common malicious attacks on power distribution automation systems such as impersonation attacks, replay attacks, and man-in-the-middle attacks. This method does not require the power distribution master station or intelligent terminal to be equipped with additional hardware carriers, which reduces hardware costs, and does not require the installation of PKI-based digital certificates, avoiding the difficulties in certificate management and maintenance. In the encrypted plaintext, user authentication information is further encrypted using XOR operations and hash operations, so it can actually resist key disclosure attacks and prevent user authentication information leakage during communication.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort. in:

Fig. 1 is a schematic diagram of the overall process of the multi-factor dynamic identity authentication method based on the national secret algorithm described in one embodiment of the present invention;

Fig. 2 is a schematic diagram of the registration stage of the dynamic identity authentication method in the multi-factor dynamic identity authentication method based on the national secret algorithm described in one embodiment of the present invention;

Fig. 3 is a schematic diagram of the authentication phase of the dynamic identity authentication method in the multi-factor dynamic identity authentication method based on the national secret algorithm according to an embodiment of the present invention.

Detailed ways

In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation modes of the present invention will be described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Example. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative efforts shall fall within the protection scope of the present invention.

In the following description, a lot of specific details are set forth in order to fully understand the present invention, but the present invention can also be implemented in other ways different from those described here, and those skilled in the art can do it without departing from the meaning of the present invention. By analogy, the present invention is therefore not limited to the specific examples disclosed below.

Second, "one embodiment" or "an embodiment" referred to herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present invention. "In one embodiment" appearing in different places in this specification does not all refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

The present invention is described in detail in conjunction with schematic diagrams. When describing the embodiments of the present invention in detail, for the convenience of explanation, the cross-sectional view showing the device structure will not be partially enlarged according to the general scale, and the schematic diagram is only an example, which should not limit the present invention. scope of protection. In addition, the three-dimensional space dimensions of length, width and depth should be included in actual production.

At the same time, in the description of the present invention, it should be noted that the orientation or positional relationship indicated by "upper, lower, inner and outer" in the terms is based on the orientation or positional relationship shown in the accompanying drawings, and is only for the convenience of describing the present invention. The invention and the simplified description do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and thus should not be construed as limiting the present invention. In addition, the terms "first, second or third" are used for descriptive purposes only, and should not be construed as indicating or implying relative importance.

Unless otherwise specified and limited in the present invention, the term "installation, connection, connection" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integrated connection; it can also be a mechanical connection, an electrical connection or a direct connection. A connection can also be an indirect connection through an intermediary, or it can be an internal communication between two elements. Those of ordinary skill in the art can understand the specific meanings of the above terms in the present invention in specific situations.

Example 1

Referring to Fig. 1, an embodiment of the present invention provides a multi-factor dynamic identity authentication method based on a national secret algorithm, including:

S1: Generate a public-private key pair and a symmetric key according to the national secret algorithm, and use the generated key and the SM3 national secret algorithm to perform cryptographic operations on the verification factor. The verification factor includes terminal identity ID, hardware address MAC and shared password value PW;

Furthermore, among the public-private key pairs and symmetric keys generated according to the national secret algorithm, the national secret algorithm is the SM2 and SM4 algorithms.

S2: In the registration stage before the first authentication, the smart terminal to be registered encrypts the device information using an asymmetric cryptographic algorithm, and sends the encrypted registration data to the power distribution gateway. After the power distribution gateway decrypts the data, it verifies the correctness of the data. Save the registration data.

Furthermore, the encrypted registration data is sent to the power distribution gateway, and the power distribution gateway decrypts the data and verifies the correctness of the data, specifically including,

The power distribution gateway generates a key pair through the SM2 national secret algorithm, sends its own public key K _P to the terminal, and the private key K _S is safely stored;

The terminal uses the SM3 national secret algorithm to perform calculations on its own device hardware address MAC and the shared password value PW respectively, together with the terminal identity ID _i uses the gateway public key K _P to encrypt through the SM2 national secret algorithm, and sends the encrypted data to the power distribution gateway to register;

After the power distribution gateway receives the terminal registration information, it uses its own private key _KS to decrypt it, and verifies whether the same registered user exists in the list according to the ID _i . If it does not exist, it replies with a successful registration message, and saves the ID _i and the corresponding verification Factors H(MAC), H(PW), denoted as H'(MAC), H'(PW);

Wherein, H(x) represents the hash value obtained after hashing the data x using the SM3 algorithm.

S3: In the first authentication stage, the terminal generates a non-repeating random number, combines hash and XOR operations to generate a dynamic password, uses a symmetric cryptographic algorithm to encrypt the dynamic password, and uses an asymmetric cryptographic algorithm to encrypt the symmetric key, and sends it together with the encrypted dynamic password To the power distribution gateway for identity authentication;

Furthermore, in the first certification stage, it specifically includes,

The terminal generates a random number R ₁ , and calculates and H(H(MAC)||R ₁ );

Call the SM4 national secret algorithm and generate a symmetric key K, use the key K to encrypt the calculation result and ID _i , and use the gateway public key to encrypt the key K, and send all the encrypted information to the gateway;

in, Represents an XOR operation, and || represents a join operation.

It should be noted that, if Indicates the value obtained after the bitwise XOR operation of x and y; x||y indicates the value obtained after connecting x and y in sequence.

Furthermore, in the first authentication, after the power distribution gateway receives the encrypted data, it uses the private key and symmetric key to decrypt the dynamic password, and finds the corresponding terminal and its stored verification factor according to the dynamic password, and combines the verification factor with the dynamic password. The password is further verified, specifically including,

After receiving the encrypted authentication message, the power distribution gateway decrypts it with its own private key _KS to obtain the symmetric key K;

Use the symmetric key K to decrypt the data through the SM4 algorithm;

The power distribution gateway obtains the corresponding H'(PW) and H'(MAC) according to the ID _i , and calculates And verify whether H(H(MAC)||R ₁ ) is equal to H(H'(MAC)||R' ₁ ), if they are equal, the power distribution gateway passes the identity authentication of the terminal.

It should be noted that the above-mentioned first authentication stage is passing the identity authentication of the terminal or terminating the identity authentication process.

S4: In the second authentication stage, the power distribution gateway generates a new non-repeating random number, performs hash and XOR operations on the decrypted data to generate a new dynamic password, encrypts it with a symmetric key, and sends it to the smart terminal for identity authentication.

Further, it specifically includes,

After the power distribution gateway passes the authentication of the terminal, it generates a random number R ₂ and calculates and H(H′(MAC)||R ₂ ), and then use the SM4 algorithm to encrypt the data with the key K and send it to the terminal.

Further, it also includes, in the second authentication, after the smart terminal receives the encrypted data, it uses a symmetric key to decrypt to obtain a new dynamic password, and verifies the new dynamic password according to the saved local data, and if it is verified to be correct, then Through the identity authentication of the power distribution gateway.

Further, it specifically includes,

After the terminal receives the encrypted data, it calls the SM4 algorithm to decrypt the message;

According to the stored R ₁ and H(MAC), the terminal calculates And verify whether H(H'(MAC)||R ₂ ) is equal to H(H(MAC)||R' ₂ ), and if they are equal, the terminal passes the identity authentication of the power distribution gateway.

Example 2

Referring to Figures 2-3, an embodiment of the present invention provides an actual operation scenario logic of a multi-factor dynamic identity authentication method based on a national secret algorithm.

As shown in Figure 2, a schematic diagram of the registration phase between the smart terminal and the power distribution gateway, including:

The terminal initiates a registration request to the power distribution gateway.

S101: The power distribution gateway generates a key pair through the SM2 national secret algorithm, sends its own public key K _P to the terminal, and securely stores the private key K _S. Note that in this scheme, E _KP (x) means the encrypted data obtained by using the SM2 algorithm to encrypt the plaintext x through the public key K _P , and D _KS (x) means using the SM2 algorithm to encrypt the ciphertext through the private key K _S x is the plaintext data obtained after the decryption operation.

S102: The terminal saves the public key K _P of the power distribution gateway after receiving it. The hardware address MAC of the own device and the shared password value PW are respectively processed using the SM3 national secret algorithm to obtain H(MAC) and H(PW), and then together with the terminal identity ID _i , the gateway public key K _P is used to encrypt through the SM2 national secret algorithm. Get R=E _KP (ID _i , H(MAC), H(PW)) and send it to the power distribution gateway.

S103: After the power distribution gateway receives R, it uses its own private key _KS to decrypt, that is, takes out ID _i , H(MAC), and H(PW) through D _KS (R), and then verifies whether the same key exists in the list according to ID _i . If the registered user does not exist, the registration success message will be replied, and the ID _i and the corresponding verification factor will be saved, that is, H(MAC) and H(PW) will be marked as H'(MAC) and H'(PW) respectively.

As shown in Figure 3, a schematic diagram of the authentication phase between the smart terminal and the power distribution gateway, including:

The terminal or power distribution gateway sends an identity authentication request message.

S201: The terminal generates a random number R ₁ and calculates and H(H(MAC)||R ₁ ). Afterwards, the terminal invokes the SM4 national secret algorithm and generates a symmetric key K, which is encrypted and calculated to obtain /> At the same time, use the SM2 algorithm to encrypt the symmetric key K to obtain E _KP (K), and then send m and E _KP (K) to the power distribution gateway together, where E _K (x) means using the SM4 algorithm to pair the plaintext with the symmetric key K x is the encrypted data obtained after the symmetric encryption operation.

S202: After receiving the authentication message, the power distribution gateway first decrypts E _KP (K) with its own private key K _S to obtain the symmetric key K, that is, K=D _KS (E _KP (K)), and then uses the symmetric key K to decrypt m is D _K (m), get ID _i , H(H(MAC)||R ₁ ). The power distribution gateway obtains the corresponding H'(PW) and H'(MAC) according to the ID _i , and calculates /> Then verify whether H(H(MAC)||R ₁ ) and H(H'(MAC)||R' ₁ ) are equal, if they are equal, the power distribution gateway will pass the identity authentication of the terminal; if they are not equal, the authentication process will be terminated . The above symbol D _K (m) means the plaintext data obtained by decrypting the ciphertext x with the symmetric key K using the SM4 algorithm.

S203: The power distribution gateway generates a random number R ₂ and calculates and H(H′(MAC)||R ₂ ), and then encrypted by SM4 algorithm to get /> Send M to the terminal.

S204: After receiving M, the terminal calls the SM4 algorithm to decrypt the message M, that is, D _K (M), and obtains and H(H'(MAC)||R ₂ ). Then according to R ₁ and H(MAC) stored in the terminal, calculate /> Then verify whether H(H'(MAC)||R ₂ ) is equal to H(H(MAC)||R' ₂ ), if they are equal, the terminal passes the identity authentication of the power distribution gateway; if they are not equal, the authentication process is terminated .

S205: Terminal Computing Send it to the power distribution gateway, and the gateway calls the SM4 algorithm and uses the symmetric key K to decrypt it to get /> and verify it with /> Whether they are equal, if they are equal, the two-way identity authentication is successful, and the two parties can carry out secure data communication.

Example 3

Referring to Table 1-2, it is an embodiment of the present invention. In combination with the above embodiments, it can be known that the multi-factor dynamic identity authentication method based on the national secret algorithm provided by the present invention does not require additional hardware carriers for power distribution master stations or intelligent terminals, reducing The cost of hardware is reduced, and there is no need to install PKI-based digital certificates, which avoids the difficulties of certificate management and maintenance. At the same time, for common malicious attacks on power distribution automation systems such as impersonation attacks, replay attacks, and man-in-the-middle attacks, the dynamic identity authentication method provided by the present invention has the following theoretical basis for security.

If the attacker wants to impersonate the power distribution master station, he must have the gateway private key K _S to obtain the symmetric key K to decrypt the message m. Even if the attacker can brute force crack the data information contained in m, since there is no verification factor H′(PW), it is impossible to extract the correct random number R′ ₁ from the message, and then generate the correct verification message M. Even if R′ ₁ can be stolen, the correct verification message M cannot be generated without H′ (MAC), so the attacker cannot pass the verification of the smart terminal.

If an attacker wants to impersonate a smart terminal, since there is no terminal identification ID _i and its corresponding hardware address MAC, he cannot impersonate a registered terminal user in the power distribution gateway. Even if the attacker steals ID _i and MAC, since there is no hash value H(PW) of the shared password value PW, the correct password cannot be generated Therefore, the power distribution gateway according to Wrong R′ ₁ will be calculated, so that H(H(MAX)||R ₁ )=H(H′(MAX)||R′ ₁ ) is no longer established, so the attacker cannot pass the verification of the power distribution gateway.

From the implementation process of the two-way identity authentication stage, we can see that when the intelligent terminal or the power distribution gateway sends the authentication message, the random number R ₁ or R ₂ is introduced, so that the scheme has a dynamic verification password. Even if the authentication message is intercepted by an attacker, since it cannot be deciphered and only the value of the random number can be modified, only the expired fixed message can only be replayed. The correct authentication message is based on the non-repetitive data of the dynamic password, so the intelligent terminal or the power distribution gateway can easily judge the malicious attack behavior, so the dynamic identity authentication method provided by the present invention can resist replay attacks.

In the dynamic identity authentication method provided by the present invention, the authentication information stored in the terminal or the gateway is encrypted and transmitted using a highly secure national secret algorithm, and the communication data in the network are all encrypted ciphertexts. Therefore, even if the attacker acts as an intermediary to communicate with the smart terminal and the power distribution gateway without the knowledge of the two parties, it is difficult to decrypt the plaintext information from the network communication data, so as to correctly reply to the authentication message, and it cannot obtain After identity authentication, the negotiation key of the communication parties. In the encrypted plaintext, user authentication information is further encrypted using XOR operations and hash operations, which can actually resist key leak attacks and prevent user authentication information leakage during communication. Therefore, the dynamic identity authentication provided by the present invention The method is resistant to man-in-the-middle attacks.

Referring to Table 1, an embodiment of the present invention provides a multi-factor dynamic identity authentication method based on the national secret algorithm. In order to verify its beneficial effect, according to the above description process, the comparison results of the three schemes are provided.

It can be seen from the above table 1 that the use of the present invention can avoid installing additional hardware carriers or digital certificates, and also has the characteristics of resisting malicious attacks such as impersonation attacks, replay attacks, and man-in-the-middle attacks, thereby verifying the beneficial effects of the present invention.

It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention without limitation, although the present invention has been described in detail with reference to preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be carried out Modifications or equivalent replacements without departing from the spirit and scope of the technical solution of the present invention shall be covered by the claims of the present invention.

Claims (10)

1. A multi-factor dynamic identity authentication method based on a cryptographic algorithm is characterized by comprising the following steps:

generating a public and private key pair and a symmetric key according to a national encryption algorithm, and carrying out password operation on a verification factor by utilizing the generated key and an SM3 national encryption algorithm, wherein the verification factor comprises a terminal identity ID, a hardware address MAC and a shared password value PW;

in the first authentication stage, the terminal generates a non-repeated random number, generates a dynamic password by combining hash and exclusive-or operation, encrypts the dynamic password by using a symmetric cryptographic algorithm, encrypts a symmetric key by using an asymmetric cryptographic algorithm, and sends the symmetric key and the encrypted dynamic password to the power distribution gateway for identity authentication;

and in the second authentication stage, the power distribution gateway generates a new non-repeated random number, hashes and exclusive-or operations are carried out on the decrypted data to generate a new dynamic password, and the new dynamic password is encrypted by using a symmetric key and then sent to the intelligent terminal for identity authentication.

2. The multi-factor dynamic identity authentication method based on the national cryptographic algorithm as claimed in claim 1, wherein the national cryptographic algorithm is SM2 and SM4 in the public-private key pair and the symmetric key generated according to the national cryptographic algorithm.

3. The multi-factor dynamic identity authentication method based on a cryptographic algorithm as in claim 1 or 2, further comprising, in a registration stage before the first authentication, the intelligent terminal to be registered encrypts the device information using an asymmetric cryptographic algorithm, sends the encrypted registration data to the distribution gateway, and verifies the correctness of the data after the distribution gateway decrypts the data, and saves the registration data after the verification passes.

4. The multi-factor dynamic identity authentication method based on the cryptographic algorithm of claim 3, wherein the encrypted registration data is sent to the distribution gateway, the distribution gateway verifies the correctness of the data after decrypting the data, and the method specifically comprises,

the distribution gateway generates a key pair through SM2 national encryption algorithm and uses the public key K thereof _P Sent to the terminal, private key K _S Safe storage;

the terminal respectively uses SM3 cryptographic algorithm to compute the hardware address MAC and the shared password PW of the self equipment together with the terminal identity ID _i Using gateway public key K _P Secret calculation by SM2 countryEncrypting by a method, and sending the encrypted data to a distribution gateway for registration;

after receiving the terminal registration information, the distribution gateway uses the private key K _S Decryption is performed according to the ID _i Verifying whether the same registered user exists in the list, if not, replying to the registration success message, and storing the ID _i And corresponding validation factors H (MAC), H (PW), labeled H '(MAC), H' (PW);

wherein H (x) represents a hash value obtained by performing a hash operation on the data x using the SM3 algorithm.

5. The multi-factor dynamic identity authentication method based on the cryptographic algorithm of claim 4, wherein in the first authentication stage, the terminal generates a non-repeated random number, generates a dynamic password by combining hash and exclusive-or operations, encrypts the dynamic password by using a symmetric cryptographic algorithm, encrypts a symmetric key by using the asymmetric cryptographic algorithm, and sends the encrypted dynamic password to the distribution gateway for identity authentication, and specifically comprises,

terminal generating random number R ₁ Calculation ofH (H (MAC) R) ₁ )；

Invoking SM4 national encryption algorithm and generating symmetric key K, encrypting calculation result and ID by using the key K _i The gateway public key is used for encrypting the key K, and the encrypted information is completely sent to the gateway;

wherein,,representing an exclusive-or operation, the expression "is used to denote a join operation.

6. The multi-factor dynamic identity authentication method based on the cryptographic algorithm as in claim 4 or 5, further comprising, in the first authentication, after the distribution gateway receives the encrypted data, decrypting the encrypted data using the private key and the symmetric key to obtain a dynamic password, finding out the corresponding terminal and the verification factor stored therein according to the dynamic password, and further verifying the dynamic password in combination with the verification factor.

7. The multi-factor dynamic identity authentication method based on cryptographic algorithm of claim 6, wherein in the first authentication stage, after the distribution gateway receives the encrypted data, the distribution gateway decrypts the encrypted data by using the private key and the symmetric key to obtain a dynamic password, finds the corresponding terminal and the authentication factor stored therein according to the dynamic password, and further authenticates the dynamic password in combination with the authentication factor, specifically comprising,

after receiving the encryption authentication information, the distribution gateway uses its own private key K _S Decrypting to obtain a symmetric key K;

decrypting the data via SM4 algorithm using the symmetric key K;

distribution gateway based on ID _i Corresponding H '(PW) and H' (MAC) are obtained, and calculated And verifies H (H (MAC) |R ₁ ) With H (H '(MAC) R' ₁ ) And if the power distribution gateways are equal, the power distribution gateways pass the identity authentication of the terminals.

8. The multi-factor dynamic identity authentication method based on the cryptographic algorithm of claim 1 or 7, wherein in the second authentication stage, the power distribution gateway generates a new non-repeated random number, hashes and exclusive-ors the decrypted data to generate a new dynamic password, encrypts the dynamic password by using a symmetric key, and sends the encrypted dynamic password to the intelligent terminal for identity authentication,

after the distribution gateway passes the authentication of the terminal, a random number R is generated ₂ Calculation ofAnd H (H' (MAC) R ₂ ) The data is then encrypted using the key K via SM4 algorithm and sent to the terminal.

9. The multi-factor dynamic identity authentication method based on the cryptographic algorithm as in claim 8, further comprising, in the second authentication, after receiving the encrypted data, decrypting the encrypted data by using the symmetric key to obtain a new dynamic password, verifying the new dynamic password according to the stored local data, and if the verification is correct, passing the identity authentication of the distribution gateway.

10. The multi-factor dynamic identity authentication method based on the cryptographic algorithm of claim 9, wherein in the second authentication, after the intelligent terminal receives the encrypted data, the intelligent terminal decrypts the encrypted data by using the symmetric key to obtain a new dynamic password, verifies the new dynamic password according to the stored local data, and if the verification is correct, passes the identity authentication of the distribution gateway,

after receiving the encrypted data, the terminal calls an SM4 algorithm to decrypt the message;

the terminal stores R according to the R ₁ And H (MAC), calculatedAnd verifies H (H' (MAC) R ₂ ) With H (H (MAC) ||R' ₂ ) And if the power distribution gateways are equal, the terminals pass the identity authentication of the power distribution gateways.