CN119363444A - Device access authentication system, method, device and medium for power Internet of Things - Google Patents
Device access authentication system, method, device and medium for power Internet of Things Download PDFInfo
- Publication number
- CN119363444A CN119363444A CN202411494041.0A CN202411494041A CN119363444A CN 119363444 A CN119363444 A CN 119363444A CN 202411494041 A CN202411494041 A CN 202411494041A CN 119363444 A CN119363444 A CN 119363444A
- Authority
- CN
- China
- Prior art keywords
- edge device
- management platform
- cloud management
- power edge
- access
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
- H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Power Engineering (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
本发明公开了一种电力物联网的设备访问认证系统、方法、设备及介质，该系统包括：云端管理平台和电力边端设备；云端管理平台，用于获取与电力边端设备相对应的访问请求，并根据访问请求验证电力边端设备的身份信息，并生成与电力边端设备相对应的访问令牌，并将访问令牌下发至电力边端设备；电力边端设备，用于获取云端管理平台下发的访问令牌，并基于访问令牌与云端管理平台进行通信；云端管理平台和电力边端设备采用传输层安全协议进行通信。基于上述技术方案，通过验证设备标识符和签名的合法性，确保请求的来源正确且未被篡改，在边端设备身份验证成功后，云端生成访问令牌并在后续请求中进行验证和定期更新，确保访问控制的动态性和有效性。
The present invention discloses a device access authentication system, method, device and medium of an electric power Internet of Things, the system comprising: a cloud management platform and an electric power edge device; the cloud management platform is used to obtain an access request corresponding to the electric power edge device, and verify the identity information of the electric power edge device according to the access request, and generate an access token corresponding to the electric power edge device, and send the access token to the electric power edge device; the electric power edge device is used to obtain the access token sent by the cloud management platform, and communicate with the cloud management platform based on the access token; the cloud management platform and the electric power edge device communicate using a transport layer security protocol. Based on the above technical solution, by verifying the legitimacy of the device identifier and signature, it is ensured that the source of the request is correct and has not been tampered with. After the identity authentication of the edge device is successful, the cloud generates an access token and verifies and regularly updates it in subsequent requests to ensure the dynamicity and effectiveness of access control.
Description
Technical Field
The invention relates to the technical field of power, in particular to a system, a method, equipment and a medium for authenticating equipment access of an electric power internet of things.
Background
In the cloud-edge system of the electric power internet of things, edge equipment comprises an intelligent ammeter, a sensor, a controller and the like, and the equipment needs to be continuously communicated with a cloud end to upload data or receive instructions. Because these edge devices are typically in a distributed, unattended environment, they are easily targeted by an attacker, resulting in security threats such as data theft, device hijacking, etc.
Conventional boundary defense models often assume that the connection of the internal network is trusted, but in the actual environment the above assumption is no longer true. The traditional boundary defense model therefore does not ensure that devices and communications are in any case tightly validated and controlled.
Disclosure of Invention
The invention provides a device access authentication system, a method, a device and a medium of an electric power Internet of things, which are used for realizing efficient and safe side device identity authentication and communication encryption and ensuring the technical problems of safety and credibility of an electric power system in the face of a distributed, dynamic and resource-limited environment.
According to one aspect of the invention, a device access authentication system of an electric power Internet of things is provided, the system comprises a cloud management platform and an electric power side device, wherein,
The cloud management platform is used for acquiring an access request corresponding to the electric power side equipment, verifying the identity information of the electric power side equipment according to the access request, generating an access token corresponding to the electric power side equipment, and issuing the access token to the electric power side equipment;
The power side device is used for acquiring the access token issued by the cloud management platform and communicating with the cloud management platform based on the access token, wherein the cloud management platform and the power side device communicate by adopting a transport layer security protocol.
According to another aspect of the invention, a device access authentication method of the electric power Internet of things is provided, and the method is applied to a device access authentication system of the electric power Internet of things, wherein the system comprises a cloud management platform and electric power side devices, and the method comprises the following steps:
Acquiring an access request corresponding to power side equipment through the cloud management platform, verifying the identity information of the power side equipment according to the access request, generating an access token corresponding to the power side equipment, and issuing the access token to the power side equipment;
The access token issued by the cloud management platform is obtained through the electric power side equipment, and communication is carried out with the cloud management platform based on the access token, wherein the cloud management platform and the electric power side equipment adopt a transmission layer security protocol for communication.
According to another aspect of the present invention, there is provided an electronic apparatus including:
at least one processor, and
A memory communicatively coupled to the at least one processor, wherein,
The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor, so that the at least one processor can execute the device access authentication method of the electric power internet of things according to any embodiment of the present invention.
According to another aspect of the present invention, there is provided a computer readable storage medium storing computer instructions for causing a processor to implement the device access authentication method of the power internet of things according to any embodiment of the present invention when executed.
According to the technical scheme, the access request corresponding to the electric power side equipment is obtained through the cloud management platform, the identity information of the electric power side equipment is verified according to the access request, the access token corresponding to the electric power side equipment is generated, the access token is issued to the electric power side equipment, the access token issued by the cloud management platform is obtained through the electric power side equipment, and communication is carried out with the cloud management platform based on the access token. Based on the technical scheme, the source of the request is ensured to be correct and not tampered by verifying the validity of the equipment identifier and the signature, after the authentication of the side equipment is successful, the cloud generates the access token and performs authentication and periodical updating in the subsequent request, the dynamic property and the validity of the access control are ensured, and the efficient and safe side equipment identity authentication and communication encryption are realized.
It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a block diagram of a device access authentication system of an electric power internet of things, provided by an embodiment of the invention;
Fig. 2 is a schematic flow chart of a device access authentication method of the electric power internet of things provided by the embodiment of the invention;
fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Example 1
Fig. 1 is a block diagram of a device access authentication system of an electric power internet of things according to an embodiment of the present invention. As shown in fig. 1, the system comprises a cloud management platform and a power side device, wherein,
The cloud management platform is used for acquiring an access request corresponding to the electric power side equipment, verifying the identity information of the electric power side equipment according to the access request, generating an access token corresponding to the electric power side equipment and sending the access token to the electric power side equipment, and the electric power side equipment is used for acquiring the access token sent by the cloud management platform and communicating with the cloud management platform based on the access token.
The cloud management platform can be understood as a cloud platform for uniformly managing the side power equipment. The electric power side equipment can be electric power equipment such as intelligent ammeter, sensor, controller, and the electric power equipment can communicate with the cloud management platform in a wireless or wired mode. An access request may be understood as a request sent by a peer device when data access or data upload is performed. The identity information may be identity information for determining access rights of the edge device, for example, the identity information of the edge device may be determined according to a unique identifier of the device. The access token may be a credential used to prove the identity of the edge device and authorize access to a particular resource. Cloud management platform and electric power side equipment communicate by adopting transport layer security protocol
The cloud end device is used for signing the request by using a private key, verifying the validity of the signature by using a public key of the device, acquiring an access token from the cloud end after the identity verification is successful, carrying the token in a subsequent request by the device, verifying the validity and the authority range of the token by using a cloud end system, and requesting a new token before the cloud end device expires by using the cloud end system to update the token in a preset time.
Further, the bidirectional TLS authentication comprises the steps that the side equipment sends a ClientHello message to the cloud, wherein the ClientHello message comprises an encryption algorithm list supported by the side equipment, a random number and related TLS protocol parameters, the cloud sends a ServerHello message to the electric side equipment after receiving the ClientHello message, the ServerHello message comprises an encryption algorithm, a random number and TLS parameters determined based on the encryption algorithm list, the cloud sends a digital certificate to the electric side equipment, the digital certificate comprises a digital certificate chain sent to the side equipment, the certificate chain comprises a cloud certificate and a certificate of an issuing mechanism thereof, the cloud sends a request to the side equipment, the cloud requests the side equipment to provide the digital certificate of the side equipment, the cloud lists a type list of the side equipment certificate, a signature and a hash algorithm supported by the cloud, the cloud provides a trusted CA list, the cloud sends a message to indicate that ServerHello is completed, the side equipment sends the digital certificate chain comprises the certificate of the side equipment and a certificate of a issuing mechanism thereof, the cloud verifies whether the certificate of the opposite party is signed by using the trusted CA root certificate, whether the certificate is valid or not in the current state of the certificate or not is valid, and whether the certificate of the opposite party is valid or not is valid is guaranteed by the certificate or not in the online state of the certificate list.
The bidirectional TLS authentication further comprises session key generation, wherein the side device generates a 48-byte premaster key, the cloud public key is used for encrypting the premaster key, the side device and the cloud compute the master key respectively by using the same premaster key, the side device random number and the cloud random number, the computing master key uses a pseudo-random function to compute the master key, the input of the pseudo-random number comprises the premaster key, a character string MASTER SECRET and the random number of the side device and the server, finally a 48-byte master key is output, the master key is used for deriving the session key for encryption and decryption, the pseudo-random function is used for computing session key materials, the input of the pseudo-random function comprises the master key, the character string key expansion, the random number of the side device and the cloud, the session key with the preset key material length is output, and communication verification between the side device and the cloud is achieved based on the session key.
On the basis of the technical scheme, the cloud management platform comprises a power side equipment registration module, wherein the power side equipment registration module is used for acquiring an equipment identifier corresponding to the power side equipment when the power side equipment is detected to be accessed to the cloud management platform for the first time, and equipment registration is carried out based on the equipment identifier.
Specifically, upon detecting device access, the platform may require the device to provide its unique device identifier. This identifier is usually preset in the device and is used for identifying the identity of the device in the registration process, based on the obtained device identifier, the cloud management platform creates a new device entry in its device information database, where the device entry contains information such as the identifier, registration time, status, etc. of the device, and after the device is successfully registered, the cloud management platform generates and distributes a digital certificate to the device. The certificate will contain the public key of the device, the identifier, and expiration date information for use in the subsequent two-way TLS authentication process. It should be noted that, during the registration process of the electric power side device, the cloud management platform can strictly verify the uniqueness of the device identifier so as to prevent the repeated registration or impossibility of the replacement, and the whole registration process and the subsequent communication between the electric power side device and the cloud are performed in an encryption manner, so that sensitive information (such as the device identifier, the digital certificate, etc.) is ensured not to be stolen or tampered in the transmission process
On the basis of the technical scheme, the cloud management platform comprises a digital certificate generation module, wherein the digital certificate generation module is used for acquiring a certificate issuing request sent by the electric side equipment and generating a digital certificate corresponding to the electric side equipment according to the certificate issuing request, and the certificate issuing request comprises a side equipment public key and a side equipment identifier.
Specifically, after receiving the request for issuing the certificate, the word certificate generation module firstly verifies the information in the request, including checking whether the device identifier is consistent with the registration information, whether the public key is valid, and the like, and further after verifying that the request information is correct, the digital certificate generation module signs the request for issuing the certificate by using the private key of the cloud, generates a digital certificate containing the information of the device public key, the identifier, the validity period, and the like, and the generated digital certificate is distributed back to the electric side device through a secure channel (such as TLS encrypted communication). After receipt of the certificate, the device stores it in the secure hardware module for use in subsequent communications. It should be noted that, when the digital certificate generation module generates the certificate, the private key of the cloud end is used to encrypt and sign the certificate issuing request, so that the certificate is prevented from being tampered or forged in the transmission process, and the generated digital certificate contains the public key and sensitive information of the device, so that the digital certificate must be stored in a safe location. In the cloud management platform, the credentials may be stored in an encrypted database to prevent unauthorized access.
On the basis of the technical scheme, the digital certificate generation module comprises an identity verification unit and a certificate generation unit, wherein the identity verification unit is used for analyzing the certificate issuing request to determine the side equipment identifier and verifying the identity information of the electric side equipment based on the side equipment identifier, and the certificate generation unit is used for signing a certificate issuing request by adopting a private key under the condition that the identity information is verified, generating a digital certificate corresponding to the electric side equipment and issuing the digital certificate to the electric side equipment, and the digital certificate comprises a side equipment public key, the side equipment identifier and a certificate validity period.
Specifically, the side device generates a certificate issuing request, the certificate issuing request comprises a device public key and a device identifier, a device private key is stored in a safety hardware module which can be stored in the electric side device, the side device sends the certificate issuing request to a cloud certificate management service through a safety channel, the cloud certificate management service verifies whether the device identifier in the certificate issuing request is matched with information in registration, if so, the request is continued, otherwise, the request is refused, after the identity verification is passed, the cloud certificate management service signs the certificate issuing request by using the private key, a digital certificate of the device is generated, the digital certificate comprises the public key, the identifier and validity period information of the device, and the signed digital certificate is transmitted back to the side device through the safety channel. It should be noted that, after the electric power side device completes registration and sends a certificate issue request, the digital certificate generation module of the cloud management platform generates a digital certificate containing information such as a device public key and an identifier, the generated digital certificate is encrypted and then stored in an encryption database of the cloud management platform, and the database system encrypts certificate data by using a preset encryption algorithm and a preset secret key.
On the basis of the technical scheme, the electric power side equipment comprises an equipment fingerprint generation module, wherein the equipment fingerprint generation module is used for collecting characteristic information of the electric power side equipment, producing equipment fingerprints corresponding to the electric power side equipment according to the characteristic information, and uploading the equipment fingerprints to the cloud management platform when the electric power side equipment is accessed to the cloud management platform for the first time.
The device fingerprint is understood as a device identifier for recording device information, and is distinguished from a MAC address of a device, and is identification information corresponding to a current power edge device determined according to characteristic information of the power edge device.
Specifically, the device fingerprint generation module is responsible for collecting characteristic information of the power side device, generating a unique device fingerprint according to the characteristic information, and uploading the generated device fingerprint to the cloud end by the device fingerprint generation module when the device is accessed to the cloud management platform for the first time so as to perform subsequent identity verification and security management.
The device fingerprint generation module comprises a characteristic information acquisition unit and a device fingerprint generation unit, wherein the characteristic information acquisition unit is used for acquiring characteristic information of the power side device, the characteristic information comprises hardware characteristics, software characteristics and network behavior characteristics, and the device fingerprint generation unit is used for carrying out hash processing on the characteristic information and carrying out weighting processing on the characteristic information after the hash processing to generate a device fingerprint of the power side device.
The method comprises the steps of collecting hardware characteristics, collecting software characteristics, collecting network behavior characteristics, and further carrying out hash processing on the collected hardware characteristics, the collected software characteristics and the collected network behavior characteristics, wherein the hardware characteristics comprise a CPU serial number, a MAC address and a hard disk serial number, the collected software characteristics comprise an operating system version and an installed software list, the collected network behavior characteristics comprise a communication port, a communication frequency and a data packet characteristic, a weighting combination method is adopted to generate a preliminary equipment fingerprint, and when the weighting combination is carried out, the weight of the hardware characteristics is higher than that of the software characteristics, and the weight of the software characteristics is higher than that of the network behavior characteristics. It should be noted that, setting the fault tolerance range of the communication frequency to ±10% for the network behavior feature allows to increase or decrease at most two ports in common use.
According to the technical scheme, the access request corresponding to the electric power side equipment is obtained through the cloud management platform, the identity information of the electric power side equipment is verified according to the access request, the access token corresponding to the electric power side equipment is generated, the access token is issued to the electric power side equipment, the access token issued by the cloud management platform is obtained through the electric power side equipment, and communication is carried out with the cloud management platform based on the access token. Based on the technical scheme, the source of the request is ensured to be correct and not tampered by verifying the validity of the equipment identifier and the signature, after the authentication of the side equipment is successful, the cloud generates the access token and performs authentication and periodical updating in the subsequent request, the dynamic property and the validity of the access control are ensured, and the efficient and safe side equipment identity authentication and communication encryption are realized.
Example two
Fig. 2 is a schematic flow chart of a device access authentication method of the electric power internet of things according to an embodiment of the present invention. The method is applied to a device access authentication system of the electric power Internet of things, the system comprises a cloud management platform and electric power side devices, and the method comprises the following steps:
S210, acquiring an access request corresponding to power side equipment through the cloud management platform, verifying identity information of the power side equipment according to the access request, generating an access token corresponding to the power side equipment, and issuing the access token to the power side equipment;
s220, acquiring the access token issued by the cloud management platform through the electric side equipment, and communicating with the cloud management platform based on the access token, wherein the cloud management platform and the electric side equipment communicate by adopting a transport layer security protocol.
The device access authentication method for the electric power Internet of things effectively solves the problems of safety and credibility in a distributed, dynamic and resource-limited environment. First, in the device registration and certificate distribution stage, each side device registers when first accessing to the cloud, and obtains a unique device identifier and a digital certificate, so as to ensure the uniqueness and identity credibility of the device. Then, through bidirectional TLS authentication, a secure communication channel is established between the side equipment and the cloud end, and the two parties exchange and verify the digital certificates, so that the communication security is further ensured. Then, based on an authentication mechanism of the device identity, when the cloud receives the request of the side device, the cloud verifies the validity of the device identifier and the signature to ensure that the source of the request is correct and not tampered. And finally, after the authentication of the side equipment is successful, the token generation mechanism generates an access token by the cloud end, and performs authentication and periodical update in a subsequent request, so that the dynamic property and the effectiveness of the access control are ensured. Through the measures, the invention realizes high-efficiency and safe side equipment identity authentication and communication encryption under the zero trust frame, and improves the safety and the credibility of the system in a complex environment.
It should be noted that, the authentication based on the device identity includes constructing a request Message, that is, the edge device constructs a Message containing the request content; the method comprises the steps of carrying out hash processing on request Message to generate a Message Digest, carrying out digital Signature generation, loading a private key SK of a device from a secure hardware module, carrying out Signature on the Message Digest by using the SK to generate a digital Signature, carrying out request transmission, combining the request Message, the Message Digest and the digital Signature to form a complete request packet, sending the request packet to a cloud through TLS, after receiving the request packet of a side device, unpacking to obtain the request Message, the Message Digest and the digital Signature, carrying out device identifier verification, extracting the device identifier from the request Message, checking whether the device identifier is registered in a cloud device information database, ensuring that the device is legal, carrying out Signature authentication, carrying out hash processing on the public key PK of the corresponding device again from the cloud information database, generating the Message Digest', carrying out verification on the digital Signature by using the public key, ensuring that the Signature is truly generated by the corresponding device, carrying out verification on the digital Signature, and carrying out verification on the fact that the Signature is not carried out the verification if the request Message is not carried out the verification, and if the verification of the security key is not carried out.
The specific step of token generation comprises the step of requesting a token after successful authentication, namely, the side device sends a request for obtaining an access token to the cloud system after the identity of the side device is authenticated through the device identifier and the digital certificate. And after receiving the token request, the cloud system verifies the validity of the request and the identity information of the equipment. If the verification is passed, the cloud system generates a unique access token. The token contains the identity information, authority range, validity period and other contents of the device. And (3) distributing the tokens, namely returning the generated access tokens to the side equipment by the cloud system. This process is typically performed over a secure communication channel (e.g., TLS) to ensure that the token is not intercepted or tampered with during transmission. Token carry and use-the edge device carries the access token in each subsequent request. And when the cloud system receives the request, the cloud system extracts the token from the request and verifies the token. The cloud system performs validity verification on the token, namely checking whether the token is in the validity period. Rights verification-checking whether the rights contained in the token are consistent with the currently requested operation. Integrity verification-ensuring that the token has not been tampered with. And (3) updating the token, namely sending a request for updating the token to the cloud system by the side equipment when the token is about to expire. The cloud system generates and distributes a new token after verifying the identity of the device and the validity of the original token.
According to the technical scheme, the access request corresponding to the electric power side equipment is obtained through the cloud management platform, the identity information of the electric power side equipment is verified according to the access request, the access token corresponding to the electric power side equipment is generated, the access token is issued to the electric power side equipment, the access token issued by the cloud management platform is obtained through the electric power side equipment, and communication is carried out with the cloud management platform based on the access token. Based on the technical scheme, the source of the request is ensured to be correct and not tampered by verifying the validity of the equipment identifier and the signature, after the authentication of the side equipment is successful, the cloud generates the access token and performs authentication and periodical updating in the subsequent request, the dynamic property and the validity of the access control are ensured, and the efficient and safe side equipment identity authentication and communication encryption are realized.
Example III
Fig. 3 shows a schematic diagram of the structure of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.
As shown in fig. 3, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, in which the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various appropriate actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.
Various components in the electronic device 10 are connected to the I/O interface 15, including an input unit 16, such as a keyboard, mouse, etc., an output unit 17, such as various types of displays, speakers, etc., a storage unit 18, such as a magnetic disk, optical disk, etc., and a communication unit 19, such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.
The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as the device access authentication method of the power internet of things.
In some embodiments, the device access authentication method of the power internet of things may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the above-described device access authentication method of the power internet of things may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the device access authentication method of the power internet of things in any other suitable way (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include being implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be a special or general purpose programmable processor, operable to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.
A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user, for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback), and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a Local Area Network (LAN), a Wide Area Network (WAN), a blockchain network, and the Internet.
The computing system may include a power edge device and a server. The power edge devices and servers are typically remote from each other and typically interact through a communication network. The relationship of power edge devices and servers arises by virtue of computer programs running on the respective computers and having a power edge device-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.
It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411494041.0A CN119363444A (en) | 2024-10-24 | 2024-10-24 | Device access authentication system, method, device and medium for power Internet of Things |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411494041.0A CN119363444A (en) | 2024-10-24 | 2024-10-24 | Device access authentication system, method, device and medium for power Internet of Things |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN119363444A true CN119363444A (en) | 2025-01-24 |
Family
ID=94319293
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202411494041.0A Pending CN119363444A (en) | 2024-10-24 | 2024-10-24 | Device access authentication system, method, device and medium for power Internet of Things |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN119363444A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN119557853A (en) * | 2025-01-26 | 2025-03-04 | 西安热工研究院有限公司 | A trusted controller business software trusted authorization method, system and related device |
| CN120105405A (en) * | 2025-05-09 | 2025-06-06 | 广东赛铂安智能科技有限公司 | A remote anti-code injection security protection method for industrial software |
| CN121037041A (en) * | 2025-08-21 | 2025-11-28 | 中国南方电网有限责任公司 | Method and apparatus for accessing components of a power grid dispatch cloud platform based on national cryptographic standards and key system management system |
| CN121530768A (en) * | 2026-01-16 | 2026-02-13 | 武汉利楚商务服务有限公司 | A dynamic key derivation method for two-way authentication between IoT devices and the cloud. |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104158802A (en) * | 2014-07-28 | 2014-11-19 | 百度在线网络技术（北京）有限公司 | Platform authorization method, platform service side, application client side and system |
| CN106254370A (en) * | 2016-08-30 | 2016-12-21 | 成都源知信息技术有限公司 | A kind of network equipment fingerprint generation method and detecting devices |
| CN110475249A (en) * | 2018-05-10 | 2019-11-19 | 华为技术有限公司 | An authentication method, related equipment and system |
| CN118631570A (en) * | 2024-07-03 | 2024-09-10 | 广州东兆信息科技有限公司 | A trusted authentication method and system for mobile terminal equipment based on the Internet of Things |
-
2024
- 2024-10-24 CN CN202411494041.0A patent/CN119363444A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104158802A (en) * | 2014-07-28 | 2014-11-19 | 百度在线网络技术（北京）有限公司 | Platform authorization method, platform service side, application client side and system |
| CN106254370A (en) * | 2016-08-30 | 2016-12-21 | 成都源知信息技术有限公司 | A kind of network equipment fingerprint generation method and detecting devices |
| CN110475249A (en) * | 2018-05-10 | 2019-11-19 | 华为技术有限公司 | An authentication method, related equipment and system |
| CN118631570A (en) * | 2024-07-03 | 2024-09-10 | 广州东兆信息科技有限公司 | A trusted authentication method and system for mobile terminal equipment based on the Internet of Things |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN119557853A (en) * | 2025-01-26 | 2025-03-04 | 西安热工研究院有限公司 | A trusted controller business software trusted authorization method, system and related device |
| CN120105405A (en) * | 2025-05-09 | 2025-06-06 | 广东赛铂安智能科技有限公司 | A remote anti-code injection security protection method for industrial software |
| CN121037041A (en) * | 2025-08-21 | 2025-11-28 | 中国南方电网有限责任公司 | Method and apparatus for accessing components of a power grid dispatch cloud platform based on national cryptographic standards and key system management system |
| CN121530768A (en) * | 2026-01-16 | 2026-02-13 | 武汉利楚商务服务有限公司 | A dynamic key derivation method for two-way authentication between IoT devices and the cloud. |
| CN121530768B (en) * | 2026-01-16 | 2026-03-27 | 武汉利楚商务服务有限公司 | Dynamic key derivation method for mutual authentication between Internet of things equipment and cloud |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111708991B (en) | Service authorization method, device, computer equipment and storage medium | |
| CN113312664B (en) | User data authorization method and user data authorization system | |
| US11095635B2 (en) | Server authentication using multiple authentication chains | |
| CN108092776B (en) | A system based on an authentication server and an authentication token | |
| CN102201915B (en) | A terminal authentication method and device based on single sign-on | |
| WO2022121461A1 (en) | Method, apparatus and device for constructing token for cloud platform resource access control | |
| CN104580184B (en) | Identity identifying method between mutual trust application system | |
| CN119363444A (en) | Device access authentication system, method, device and medium for power Internet of Things | |
| US9215064B2 (en) | Distributing keys for decrypting client data | |
| CN111639327A (en) | Authentication method and device for open platform | |
| CN108259438A (en) | A kind of method and apparatus of the certification based on block chain technology | |
| WO2024011863A1 (en) | Communication method and apparatus, sim card, electronic device, and terminal device | |
| CA3217688A1 (en) | Multi-factor authentication using blockchain | |
| CN117641352B (en) | Secure access method and device, cloud terminal device and storage medium | |
| CN114760070A (en) | Digital certificate issuing method, digital certificate issuing center and readable storage medium | |
| CN116248368B (en) | Blockchain-based identity authentication method, system, device, and storage medium | |
| JP7174730B2 (en) | Terminal device, information processing method and information processing program | |
| CN117675309A (en) | Data access method and device, storage medium and electronic equipment | |
| CN115150831B (en) | Method, device, server and medium for processing network access request | |
| CN119652526A (en) | A blockchain-based information authentication method and related equipment | |
| CN112235276B (en) | Master-slave equipment interaction method, device, system, electronic equipment and computer medium | |
| CN115801345A (en) | PKI (public Key infrastructure) -based personal strong password management method and system and electronic equipment | |
| CN114024682A (en) | Cross-domain single sign-on method, service equipment and authentication equipment | |
| Tiwari et al. | Design and Implementation of Enhanced Security Algorithm for Hybrid Cloud using Kerberos | |
| CN115730290A (en) | A single sign-on method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |