Industrial internet trusted connection method and system based on neural network and MQTT

Abstract

The invention relates to an industrial internet credible connection method and system based on a neural network and MQTT, and the method comprises the steps: obtaining the network flow data of target equipment, and training a credibility discriminator based on a time convolution neural network according to the network flow data; based on the trained credibility discriminator, carrying out credibility judgment on the node initiating the credible connection to the target equipment: if the credibility is greater than a preset value, carrying out identity authentication according to the digital certificate of the node; otherwise, performing identity authentication on the node according to a preset access control rule of the target equipment; and for the trusted node passing the identity authentication, a digital certificate service of trusted connection is provided for the accessed trusted node through an MQTT protocol and a lightweight public key, and the digital certificate service comprises application, query, acquisition and verification of a digital certificate. Through the MQTT and the convolutional network, the lightweight of the trusted connection architecture and process is realized, and the security is improved.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet security technology, and specifically relates to an industrial Internet trusted connection method and system based on neural network and MQTT. Background Art

[0002] Trusted connections enhance the security status assessment of device platforms based on traditional network connection identity authentication, and can ensure the security and trustworthiness of device platforms in the network. In the process of building the industrial Internet, the originally relatively closed industrial production network will be connected to the Internet, exposing the open network environment and facing a large number of security risks such as Trojan attacks and network program vulnerabilities. Using trusted connections in the industrial Internet to fully check the system status and the trusted program running list can effectively improve the security of the industrial Internet.

[0003] At present, the trusted connection national standard GB∕T 29828-2013 "Information Security Technology Trusted Computing Specification Trusted Connection Architecture" is widely used in China's trusted connection. It adopts a three-element three-layer peer-to-peer network architecture. In the specific implementation, the trusted connection is mainly divided into 9 steps: (1) Before establishing a trusted connection, TNCC (Trusted Connection Client) and TNCAP (Trusted Connection Access Point) load their upper IMCs (Integrity Measurement Collectors) respectively, while EPS (Evaluation Policy Server) loads its upper IMVs (Integrity Measurement Verifiers); (2) NAR (network access requester) initiates a network access request to NAC (network access controller); (3) After receiving the access request, NAC executes the user identity authentication protocol with NAR and APS (Authentication Policy Service) to achieve two-way user identity authentication between AR (Access Requester) and AC (Access Controller). APS acts as a trusted third party in the authentication process; (4) Initiate the platform authentication process. NAR sends a platform authentication request to TNCC, and NAC sends a platform authentication request to TNCC; (5) When TNCAP receives a platform authentication request, it initiates the platform authentication process and executes the platform authentication protocol with TNCC and EPS; (6) During the platform authentication process, TNCC exchanges information with each IMC on its upper side through IF-IMC, and TNCAP exchanges information with each IMC on its upper side through IF-IMC; (7) EPS is responsible for verifying the PKI certificates of AR and AC, and calling the IMVs above it through IF-IMV to verify and evaluate the platform integrity metrics of AR and AC. EPS generates the platform integrity evaluation results of AR and AC based on the platform integrity evaluation strategy, and finally sends the PKI certificate verification results and platform integrity evaluation results to TNCC and TNCAP; (8) When the platform authentication of AR and AC is completed, TNCC and TNCAP generate access policies based on the PKI certificate verification results and platform integrity assessment results of AR and AC generated by EPS, and send them to NAR and NAC respectively; (9) NAR performs access control based on the access policy it generates or the access policy received from TNCC, and NAC performs access control based on the access policy it generates or the access policy received from TNCC, thereby achieving a trusted connection.

[0004] The national standard for trusted connections requires multi-step verification through the policy manager and access controller. Although this greatly improves security, it has the problem of multiple interactions and complex calculations. Starting from step (3), multiple measurements and interactions are directly performed between the policy access controller and the network access controller. The connection strategy to be executed is determined based on the verification results of the certificate and integrity measurement collector. Recalculation is required for each connection. The measurement is supported by the trusted computing algorithm. The measurement content includes the integrity measurement value stored in the PCR and the operating system information, kernel version, system version, etc. In large-scale industrial networks, due to the large number of devices and the variety of processes each device is responsible for, the scale of the system trusted list and process trusted list is generally large. The comparison and superposition of each item will increase the delay of more than 2s when executing the trusted connection process.

[0005] Through the above analysis, the problems and defects of the prior art are as follows: (1) The existing trusted connection architecture is heavy. An analysis of the interactive communication of the architecture itself shows that the identity certificate system that supports trusted connections uses the HTTP protocol, which brings heavy headers and additional computing overhead. In addition, the HTTP request-response interaction mode is too complex in design when the communication tasks are relatively fixed, and is not suitable for industrial Internet scenarios.

[0006] (2) The existing trusted connection process is cumbersome and complex. Although the whitelist can better ensure security by comparing and verifying the running processes, loaded programs and files one by one, the resulting increase in latency is still unacceptable in latency-sensitive scenarios of the Industrial Internet. Summary of the invention

[0007] In order to streamline the existing architecture of trusted connections of the Industrial Internet and improve security, a first aspect of the present invention provides an Industrial Internet trusted connection method based on a neural network and MQTT, including: obtaining network traffic data of a target device, and training a credibility discriminator based on a time convolutional neural network according to the network traffic data; based on the trained credibility discriminator, performing credibility judgment on the node that initiates a trusted connection to the target device: if the credibility is greater than a preset value, identity authentication is performed according to the digital certificate of the node; otherwise, the node is authenticated according to the preset access control rules of the target device; for trusted nodes that pass the identity authentication, a digital certificate service for a trusted connection is provided to the connected trusted node through the MQTT protocol and a lightweight public key, and the digital certificate service includes application, query, acquisition and verification of digital certificates.

[0008] In some embodiments of the present invention, the credibility discriminator includes: a detection module, which is used to continuously detect the network traffic of the target device and make credibility judgments on the nodes that initiate trusted connections of the target device; a verification module, which is used to determine the detection items of the node, and the detection items include the system kernel version and software loading information.

[0009] Furthermore, the training step of the credibility discriminator includes: cleaning the sample data by using the SMOTE-Tomek Links combined algorithm; and increasing the number of samples of the cleaned sample data by transfer learning.

[0010] In some embodiments of the present invention, authenticating the node according to a preset access control rule of the target device includes: the target device authenticating the node according to a three-element three-layer peer-to-peer trusted connection process.

[0011] In some embodiments of the present invention, the digital certificate service for providing a trusted connection to the connected trusted node through the MQTT protocol and lightweight public key includes: deploying the application interface and query interface of the digital certificate of the trusted connection in the MQTT Topic and the certificate authority respectively; issuing management commands through the MQTT protocol; managing the registration authority corresponding to the certificate authority through the management commands, and subscribing to the execution results.

[0012] Furthermore, the publishing of the management command through the MQTT protocol includes: publishing the management command to a designated Topic of the MQTT agent; acquiring and parsing the Topic to acquire the management command, executing the management command and returning the execution result.

[0013] The second aspect of the present invention provides an industrial Internet trusted connection system based on neural network and MQTT, including: an acquisition module, used to acquire network traffic data of a target device, and train a credibility discriminator based on a time convolutional neural network according to the network traffic data; a judgment module, used to make a credibility judgment on a node that initiates a trusted connection to a target device based on the trained credibility discriminator: if the credibility is greater than a preset value, identity authentication is performed according to the digital certificate of the node; otherwise, the node is authenticated according to the preset access control rules of the target device; an access module, used to provide a digital certificate service for a trusted connection to an accessed trusted node through the MQTT protocol and a lightweight public key for a trusted node that has passed identity authentication, wherein the digital certificate service includes application, query, acquisition and verification of a digital certificate.

[0014] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the industrial Internet trusted connection method based on neural network and MQTT provided in the first aspect of the present invention.

[0015] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the industrial Internet trusted connection method based on neural network and MQTT provided in the first aspect of the present invention is implemented.

[0016] The beneficial effects of the present invention are: (1) Lightweight trusted connection architecture. A lightweight public key infrastructure is designed and implemented based on the MQTT publish-subscribe model to solve the problem of heavy HTTP headers. Moreover, when the functions of various industrial Internet devices are fixed, the data interaction mode based on MQTT Topic is more conducive to management and iterative functional development than the HTTP request-response mode. It is only necessary to develop functions in the specified Topic without maintaining complicated HTTP interfaces. All industrial equipment only needs to interact with the MQTT agent in a centralized manner, reducing maintenance costs and logical complexity. Based on the lightweight header of MQTT, a certain degree of optimization in latency is achieved compared to the HTTP infrastructure, achieving the lightweight goals in terms of structure and latency. (2) Lightweight trusted connection process. A trustworthiness discriminator based on an improved temporal convolutional network is designed and implemented to execute simple or complex trusted connection processes based on trustworthiness. Transfer learning is used to train models on smaller datasets, so that the prediction effect can be maintained even when the network attack traffic is small. Structured pruning is used to further optimize the model's parameter quantity and network level, and finally the model is supported to be deployed on industrial Internet devices with limited computing power. The use of a lightweight trusted connection process greatly reduces the trusted connection interaction delay and shortens the trusted connection process in a secure environment.

[0017] (3) The lightweight trusted connection method for the industrial Internet proposed in the present invention simplifies the original trusted connection process in a safe manner, making the bloated and complex trusted connection clear and concise. While reducing the trusted connection steps, it also reduces the access delay, and strikes a good balance between security and delay performance. It is suitable for delay-sensitive scenarios of the industrial Internet. The lightweight public key infrastructure used to provide certificate services integrates basic cryptographic services, which can meet the basic security service requirements of various systems, thereby greatly reducing the repeated development of cryptographic services. Various cryptographic services are provided based on domestic cryptographic algorithms to avoid unknown security vulnerabilities of foreign cryptographic algorithms and achieve autonomous control in key application scenarios. The certificate service designed with a subscription-publish communication method through the MQTT protocol can provide small micro machines with low communication overhead and efficient certificate application services, and supports embedding attributes into certificates, which is convenient for attribute-based access control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of a basic process of a trusted connection of an industrial Internet based on a neural network and MQTT in some embodiments of the present invention; Figure 2 is a flow chart of a lightweight trusted connection method in some embodiments of the present invention; Figure 3 is a structural diagram of a credibility discriminator in some embodiments of the present invention; Figure 4 is a credibility discriminator implementation path diagram in some embodiments of the present invention; Figure 5 is a diagram of a lightweight public key infrastructure architecture in some embodiments of the present invention; Figure 6 is a command execution flow chart based on the MQTT protocol in some embodiments of the present invention; Figure 7 is a diagram showing changes in trusted connection delay with trustworthiness in some embodiments of the present invention; Figure 8 is a schematic diagram of a CA registration file in some embodiments of the present invention; Fig. 9is a diagram of the CA registration program operation results in some embodiments of the present invention; Fig.10 is a diagram of a CA management interface in some embodiments of the present invention; Fig.11 is a schematic diagram of a CA enabling completion interface in some embodiments of the present invention; Fig.12 is a schematic diagram of certificate application information content in some embodiments of the present invention; Fig.13 is a diagram of the operation result of the certificate request client in some embodiments of the present invention; Fig.14 is a schematic diagram of a certificate application approval interface in some embodiments of the present invention; Fig.15 is a diagram of certificate acquisition operation results in some embodiments of the present invention; Fig.16 is a diagram of a certificate storage directory structure in some embodiments of the present invention; Fig.17 is a schematic diagram of a certificate management interface in some embodiments of the present invention; Fig.18 is a schematic diagram of the operation results of the certificate query client in some embodiments of the present invention; Fig.19 It is a structural schematic diagram of an industrial Internet trusted connection system based on a neural network and MQTT in some embodiments of the present invention; Fig. 20 It is a schematic diagram of the structure of an electronic device in some embodiments of the present invention. DETAILED DESCRIPTION

[0019] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0020] refer to Figure 1 or Figure 3In the first aspect of the present invention, a method for trusted connection of industrial Internet based on neural network and MQTT is provided, including: S100. Obtaining network traffic data of the target device, and training a credibility discriminator based on a time convolutional neural network according to the network traffic data; S200. Based on the trained credibility discriminator, a credibility judgment is made on the node that initiates a trusted connection to the target device: if the credibility is greater than a preset value, identity authentication is performed according to the digital certificate of the node; otherwise, the node is authenticated according to the preset access control rule of the target device; S300. For the trusted node that has passed the identity authentication, a digital certificate service for trusted connection is provided to the connected trusted node through the MQTT protocol and a lightweight public key, and the digital certificate service includes application, query, acquisition and verification of the digital certificate.

[0021] It should be noted that the development environment provided by the embodiment of the present invention includes but is not limited to: the discriminator is developed based on Python, the system front end of the lightweight public key infrastructure is developed based on Vue, the management end is developed based on Java, and the CA (Certificate Authority), RA (Registration Authority) and the certificate calling end program are developed based on C language. The administrator can use the management end of the infrastructure by accessing the front-end interface through the website, and the user can obtain the certificate and query the certificate status by running the certificate issuance and query function calling end. It also supports self-written programs based on MQTT communication to request certificates and query the certificate status through the interface, and supports load balancing deployment.

[0022] refer to Figure 3In S100 of some embodiments of the present invention, the network traffic data of the target device is obtained, and a credibility discriminator based on a temporal convolutional neural network is trained according to the network traffic data. Specifically, the temporal convolutional network (TCN) takes into account the prediction problem of inputs with previous and subsequent correlations, such as time series, in its design. By introducing efficient convolution operations such as 1×1 convolution and dilated convolution, it has a better solution effect on sequence problems. Network attack traffic can also be regarded as a sequence problem. Therefore, a network behavior detection model is built based on TCN. On the basis of traditional TCN, a main network architecture consisting of 4 residual blocks is constructed. The residual reduces the problem of reduced training effect when the number of network layers is deepened. A two-layer composite time convolution design is used in the residual block to further increase the extraction and calculation capabilities of the features of the previous and next related data. Batch normalization is added on the basis of 1×1 convolution and extended causal convolution to further enhance the performance and prediction stability of the network. PReLU is used as the activation function with a random inactivation layer to enhance the prediction effect. The SoftMax layer is used for output, so that the model output results can match the requirements of network behavior monitoring and can output whether it is attacked as an unsafe state. In order to be deployed in industrial Internet devices with limited computing power, the trusted discriminator is lightweight, and a structured pruning algorithm is used to group the parameters in the trusted discriminator model and construct a dependency graph. According to the weight size, the node parameters that have little effect on the model discrimination are cut off to reduce the size of the trusted discriminator and speed up the inference speed.

[0023] refer to Figure 4 The training process of the trusted discriminator is shown. Network behavior monitoring continuously collects and detects network traffic to determine whether there is a security risk and then determines the credibility. This part is based on neural network implementation and uses network intrusion datasets for training and testing. First, the source domain and target domain datasets are defined. After the datasets are preprocessed, the feature selection module is used to further optimize the data. The TCN model transfer learning training of the source domain and target domain is performed to obtain the final network behavior monitoring model.

[0024] Since the TCN structure used by the credibility discriminator can better process data with contextual correlation such as network attack traffic, and since gradient explosion is more likely to occur during the training of recurrent neural networks, which reduces the model effect, in the network structure of the TCN model, causal convolution, residual blocks and other processing modules for contextual correlation data are designed, so the prediction performance when processing network attack traffic is better than that of traditional models.

[0025] Table 1 Comparison of detection effects of credible discriminator and other neural network models

[0026] The web target program DVWA with a malicious command execution vulnerability is run on the test machine, and the malicious command injection attack provided by the Metasploit toolbox is used to test the security of the trusted connection. The malicious command injection attack passes malicious commands (such as kill, rm, save itself and execute as a script program, etc.) as parameters into the interface of the web program through the execution vulnerability of the web program. If the web program has a corresponding vulnerability, the web program will execute the passed-in parameters as commands, which will bring serious consequences. This simulates the security and reliability of the present invention in real scenarios.

[0027] To facilitate recording and testing, the experiment was conducted in a VMware virtual machine, with an attacking machine A, two attacked machines B and C, and two trusted connection servers D and E. The access-end program of the original trusted connection framework was run in the attacked machine B, the access-end program of the trusted connection lightweight framework was run in the attacked machine C, the server program of the original trusted connection framework was run in D, and the trusted connection lightweight server program was run in E. After being attacked, B initiated a trusted connection request to D, and C initiated a trusted connection request to E to verify the trusted connection performance. The web target program DVWA with a malicious command execution vulnerability was run in the attacked machines to test the performance of the trusted connection after malicious intrusion.

[0028] Run the Metasploit automated attack tool program in the attacking machine, load the web_delivery module, which will generate a Trojan program, automatically start the server that publishes the Trojan program and give a command. If the attacked machine executes the command, it will automatically download the Trojan program and execute it. After executing the attack, request the trusted connection verification judgment from the trusted connection server. Based on Metasploit, a new Trojan program will be generated for each attack, and it will be automatically generated 500 times. The number of trusted connection rejections and passes of the lightweight architecture and the original architecture is counted. The results are shown in Table 2.

[0029] Table 2 Trusted connection security test results

[0030] The analysis results show that the original trusted connection architecture verifies the program list for each connection. Once a new Trojan program is found to be executed, it will reject the trusted connection request. Therefore, for the execution of new illegal programs that are not in the whitelist, the original trusted connection framework achieves a 100% risk recognition rate. The lightweight trusted connection architecture in this paper uses a neural network as a discriminator, so its recognition rate is slightly lower than that of the original trusted connection framework, but it is already a similar recognition rate.

[0031] refer to Figure 4In S200 of some embodiments of the present invention, the credibility discriminator includes: a detection module, which is used to continuously detect the network traffic of the target device and make credibility judgments on the node that initiates the trusted connection of the target device; a verification module, which is used to determine the detection items of the node, and the detection items include the system kernel version and software loading information.

[0032] Furthermore, the training step of the credibility discriminator includes: cleaning the sample data by using the SMOTE-Tomek Links combined algorithm; and increasing the number of samples by transfer learning for the cleaned sample data. Specifically, the SMOTE algorithm is used to oversample the samples of a few attack types to increase the number, and then the overlapping samples generated by the SMOTE algorithm are cleaned based on the Tomek Links technology, so that the pre-processed sample data is more reasonable. The execution process of SMOTE-Tomek Links is: (1) Randomly select samples from the minority class , set in the overall data The nearest neighbors are then generated in the sample and Neighbors randomly selected New samples to mix , and then add the new sample to the minority class, repeat until the minority class sample expansion is completed, and the new sample synthesis is shown in formula (1), where Represents a random number in the range [0,1]: (1); (2) Find overlapping samples by searching Tomek Links pairs and delete them. is a sample of the minority class, For the majority class samples, use express and The Euclidean distance between them. If there is no sample satisfy or ,but The pair is a Tomek Links pair, and there is overlap, so delete the pair.

[0033] The feature selection module of the credibility discriminator adopts an algorithm that integrates principal component analysis and information gain rate. Due to its solid mathematical theoretical foundation, the classic principal component analysis (PCA) algorithm can better calculate the feature items with a larger influence from many feature items to achieve feature screening, but its ability to retain features is relatively strong. When there are many features, the screening performance needs to be improved. Therefore, the PCA algorithm is optimized based on the information gain ratio (IGR), and they work together in the feature screening of the data set.

[0034] Information gain is a measure of the information contained in a feature. It calculates the amount of information each feature brings to the whole from a global level based on information entropy. The information gain rate obtained by splitting information based on information gain can effectively distinguish features of higher dimensions and optimize the direction of selecting high-dimensional features. Assuming a network attack traffic dataset ,in is the total number of samples, the feature set ,in is the number of feature types, then the calculation of information entropy can be expressed as shown in formula (2): (2); Different features can be selected from the feature set to form different feature subsets, so that the data set can be divided into Divide Subset types, Indicates The number of class subsets. Formula (3) represents the Divide the data into The split information after subsets: (3); Based on information gain, information splitting is introduced to obtain features The information gain rate is as follows: (4); According to the accurate definition of information entropy in information theory, the information gain rate can better remove redundant features with low information content, leaving features that are more important to the global data. However, since the information gain is for the global data and does not consider the relationship between features, it is easy to leave features that can replace each other but are important to the global data. Therefore, the PCA algorithm is used to determine the relationship between features for further screening. The main steps are as follows: Standardize the sample data: (5), Formula (5) is based on the mean value calculated from the feature data and standard deviation , get the standardized sample data .

[0035] Calculate the covariance matrix : (6), Formula (6) is the set of sample data after all standardization is completed The number of variables Participate in calculations.

[0036] from The eigenvalues ​​are obtained by eigenvalue decomposition and the corresponding eigenvector , the eigenvalues ​​are arranged from large to small according to the contribution rate. The eigenvectors form a new feature transformation matrix .based on as well as Construct the final selected sample matrix As a collection of features.

[0037] When conducting network behavior detection in real scenarios, the attack traffic is not as large as in the dataset used. Considering improving the detection ability of the model when the data volume is small, the model of the target domain is trained as the final model based on transfer learning. The data volume of the target domain dataset is set to about one-tenth of the source domain, which improves the performance of the model on small-scale datasets to a certain extent. After training on a larger dataset in the source domain, transfer learning is achieved by continuing to fine-tune the target domain. After obtaining the trained source domain model, the model is placed in the target domain dataset and fine-tuned based on the Adam algorithm. This round of training freezes the parameter weights of the model, and only fine-tunes within the hierarchy. Excessive parameter changes are no longer allowed to prevent overfitting.

[0038] It can be understood that the credibility discriminator is implemented based on the neural network design, and the trusted connection process from simple to complex is proposed based on the credibility. In view of the low latency requirements of the industrial Internet, structured pruning is used to optimize the model size and inference speed of the credibility discriminator to ensure that it can be deployed in industrial Internet devices with limited computing power. The lightweight trusted connection process uses the credibility discriminator to quickly detect the security status at the beginning of the trusted connection. When the credibility is high, a simplified trusted connection process is executed, and only the most basic certificate verification is performed to authenticate the identity. When the credibility is low, a complete trusted connection process including a whitelist of trusted programs and system kernel parameters is executed. Experiments have shown that when the credibility is high, the latency is reduced by 76.2% compared with the original process.

[0039] In S200 of some embodiments of the present invention, authenticating the node according to a preset access control rule of the target device includes: the target device authenticating the node according to a three-element three-layer peer-to-peer trusted connection process.

[0040] refer to Figure 5 and Figure 6 In S300 of some embodiments of the present invention, the digital certificate service for providing a trusted connection to the connected trusted node through the MQTT protocol and a lightweight public key includes: deploying the application interface and the query interface of the digital certificate of the trusted connection in the MQTT Topic and the certificate authority respectively; issuing management commands through the MQTT protocol; managing the registration authority corresponding to the certificate authority through the management commands, and subscribing to the execution results.

[0041] refer to Figure 5 , which shows the lightweight public key infrastructure architecture, which is mainly divided into the lightweight public key infrastructure management front-end operation page, basic service and management end, CA, RA, MQTT agent, log collection client, gateway management client, certificate application / acquisition call end, and certificate query call end.

[0042] The basic service and management end are responsible for receiving HTTPS requests sent by administrators when they access the management page in the browser, parsing the management commands in json format, and publishing management commands through the MQTT protocol when the management operation is for the certificate issuance module (including the management of CA and RA), and subscribing to the execution results. When managing the gateway, the management command is directly transmitted through the socket and the response is received. Certificate application, acquisition, and query are all communicated with CA and RA through the MQTT protocol. The system uses a database to store certificates, CA, gateways, keys, and audit information. The modules obtain data through the database to ensure the synchronization of information modification, addition, and deletion.

[0043] The present invention uses the open source TASSL package as the support for domestic cryptographic algorithms, and national cryptographic-related algorithms such as communication encryption and certificate signature are all implemented using this package.

[0044] The present invention uses Mosquitto (open source component) after domestic encryption transformation as the MQTT agent, replaces the encryption package used in Mosquitto with the TASSL encryption package, and adds a national encryption connection option to support national encryption SSL communication.

[0045] When performing load balancing deployment of basic services and management end, a load balancer needs to be added. The load balancer can adjust the solution by itself. In this invention, the open source Nginx is used in conjunction with LVS and Keepalived solutions. When MQTT agent load balancing is required, Mosquitto cluster mode is enabled for master-slave synchronization, and LVS is used for MQTT load balancing at the TCP level.

[0046] Infrastructure managers access the management page through a browser to manage CA, including CA activation, deactivation, modification of information (such as regional identification information, etc.), removal, and calling certificate application, acquisition, and query interfaces. The communication adopts the MQTT protocol. When the basic service and the management end initiate a command, they publish json format data on the MQTT Topic. The execution end obtains the message by subscribing to the Topic, executes it after parsing, and returns the operation result to the management end, which writes the data changes to the database. Figure 5 When managing the gateway, management commands are issued to the gateway management client through the TCP socket and responses are received. When managing and using other modules, since they have been integrated with the basic service and management end, no external interaction is involved and they are directly controlled through state variables within the program.

[0047] Furthermore, the CA and RA management includes: When operating CA (in the present invention, the certificate application is received and checked by the RA corresponding to CA, and RA and CA share the same ID, which is a one-to-one correspondence), the browser request is first transmitted to the basic service and management end, and then the MQTT protocol is used to issue management commands to CA and RA according to the instructions. The management of CA will be published on MQTT Topic:caMgmt / {ca_id} according to CA ID, and the management of RA will also be published on MQTT Topic:raMgmt / {ca_id} according to CA ID. CA obtains management commands by subscribing to MQTT Topic:caMgmt / {ca_id}, and RA obtains management commands by subscribing to MQTT Topic:raMgmt / {ca_id}. After CA and RA perform corresponding operations according to the management commands, they publish the execution results to MQTT Topic:caRes and MQTT Topic:raRes respectively. The basic service and management end obtain the success or failure of the command execution by subscribing to these two Topics, write the information changes into the database and log, and display the execution results on the front-end management page.

[0048] Furthermore, the certificate application, acquisition and query include: The certificate application interface is deployed on the MQTT Topic: certReq / {ca_id} / {balance_id}. The certificate application client generates a signature private key and public key locally, and publishes the public key, certificate subject, and attributes of the subject applying for the certificate (the attributes are embedded as extensions of X509 V3) into a PEM-formatted certificate request file CSR to the Topic. ca_id is the ID of the target CA, and balance_id is the server ID specified in the cluster, which is determined according to the actual deployment and used as a load balancing diversion.

[0049] After receiving the client request by subscribing to certReq (the RA receiving the request has the same ID as the target CA), RA verifies whether the signature of the CSR comes from the declared client, and based on the opening of the certificate approval for the CA on the management side, if it is opened, the CSR is stored in the database, if not, the CSR and RA approval information are directly published to MQTTTopic:raToken / {ca_id} / {balance_id}, and ca_id and balance_id remain unchanged. When certificate approval is turned on, RA will query the approval status of the certificate request from the database through a scheduled task, and publish the approved CSR.

[0050] CA receives CSR by subscribing to raToken, generates encrypted private key and public key, parses CSR, creates encryption certificate and decryption certificate, signs certificate with CA private key, and records certificate applicant information, attributes, and PEM format certificate in the certificate library. After the encrypted private key is converted to BASE64 format by SM2 public key encryption using the signed certificate, it is published to MQTT Topic: subCert / {client_id} together with the signed certificate and encrypted certificate. Client_id is the client ID, which will be included in the certificate request. After the certificate is issued, CA stores the certificate information in the database.

[0051] The certificate receiving client obtains the ciphertext of the signing certificate, encryption certificate, and encrypted private key by subscribing to subCert, decrypts the encrypted private key ciphertext using the previously local signing private key, and then saves the signing certificate, encryption certificate, and encrypted private key.

[0052] The certificate query interface is deployed in the CA module. This service is an online certificate status query service based on MQTT, MQTT Topic: vali_qury / {balance_id}, where balance_id is the load balancing id specified by the system administrator. The published content includes the serial number of the certificate to be queried and the client_id of the interface caller. CA obtains the certificate query request by subscribing to vali_qury, retrieves the certificate by the certificate serial number in the database, obtains the current status of the certificate (normal or revoked), and publishes the query result in MQTT Topic: vali_ret / {client_id}. The caller can obtain the status of the queried certificate by subscribing to vali_ret / {client_id}.

[0053] Furthermore, the basic service and management end include: when enabling, disabling, and editing keys and certificates, the basic service and management end directly operate the infrastructure database to complete data updates, and the modules of the present invention synchronize information through the database. When performing gateway and protocol management operations, the basic service and management end will use sockets to communicate with the gateway management client to transmit management commands. The client calls the corresponding interface of the gateway according to the command to perform management operations, including adjusting the protocols allowed to pass, etc., and returns the execution results to the management end as a response.

[0054] The log collection client is deployed in each server of each cluster. It is responsible for collecting the logs generated by the operation of each module and transmitting them to the basic service and management end for archiving. The client is implemented based on the Filebeat open source component. After setting the source log file location and the management end URL, the source file is transferred to the management end through the socket for archiving.

[0055] The present invention provides a certificate application interface, a certificate receiving interface, and a certificate query interface. The certificate application interface, the certificate receiving interface, and the certificate receiving interface have been described in the certificate issuance, acquisition, and query.

[0056] The embodiment of the present invention provides a control method for a lightweight public key infrastructure, including: accessing the system management front-end operation page through a browser to perform operations, calling encryption / decryption, key generation / acquisition interfaces, and sending HTTPS requests, parsing management commands in json format, and performing management of the CA, RA, gateway management, or certificate application, acquisition, and query.

[0057] It can be understood that a lightweight public key infrastructure is implemented based on the MQTT design. The lightweight certificate service provides support for the application, acquisition, and query of certificates required for trusted connections, supports communication encryption and identity authentication for trusted connections, and initiates verification to the lightweight public key infrastructure when verifying the trusted connection certificate. The infrastructure implements certificate services, MQTT proxy gateway management, certificate application-related logging, and certificate application and acquisition clients. Specific functions include key management, certificate services, gateway management, data transmission, protocol management, system logs, security audits, and system monitoring functions. Experiments have shown that the lightweight public key infrastructure reduces the interaction delay by 5% compared to the HTTP public key infrastructure.

[0058] The lightweight public key infrastructure designed by the present invention supports the use of user-specified attributes as extension items of X509 V3 when issuing certificates, and embeds them in the certificates together, effectively solving the technical problem that attribute-based access control systems need to rely on attribute libraries. Attributes can be directly read from certificates securely and reliably based on the certificate system, and users are granted corresponding permissions based on the attributes, thus simplifying the application of attribute-based access control systems.

[0059] The latency improvement of the lightweight trusted connection method comes from the lightweight public key infrastructure and the lightweight trusted connection process based on the credibility discriminator. The latency is composed of the verification of these two parts.

[0060] Since there are no papers based on MQTT public key infrastructure and no open source MQTT public key infrastructure, the certificate service time consumption is compared with HTTP-based PKI programs. The mainstream open source PKI programs EJBCA and XIPKI based on HTTP are selected to test the time required for lightweight public key infrastructure and EJBCA and XIPKI to accept applications, issue 100 certificates, and respond to 100 certificate status query responses, and simply count the time consumption of the sending and receiving stages. The time consumption of calling the certificate services of EJBCA and XIPKI through the HTTP interface and calling the certificate service of the lightweight public key infrastructure in this article through the MQTT interface is shown in Table 3. In general, the lightweight public key infrastructure has a latency optimization of more than 5% compared with the HTTP infrastructure.

[0061] Table 3 Comparison of network time consumption for 100 calls to lightweight public key infrastructure certificate service

[0062] Analyzing the interaction model of XIPKI and EJBCA, when receiving certificate requests and responses, the request-response mode requires the same HTTP header to be attached to each request and needs to wait for the request to be processed before entering the process of obtaining the response. At the same time, the HTTP header contains redundant parameters such as the host number, connection mode, and content type, which further leads to the HTTP header occupying a large proportion of the data in each interaction when the request body content is not large. When applying for a certificate, the request content is approximately 200 bytes, and its HTTP fixed header occupies nearly 20 bytes, which accounts for a large proportion. When querying a certificate, the request content is only the certificate serial number and client ID, which only occupies approximately 80 bytes. In this case, the HTTP fixed header is even heavier. In addition, the process of waiting for the return in the request-response mode also takes a certain amount of time.

[0063] In the publish-subscribe mode of lightweight public key infrastructure, the requester only needs to publish the content to the Topic and can subscribe to the Topic to obtain the results at the same time. At the same time, the MQTT header is only one-tenth of the HTTP header, which accounts for a very small proportion of the request content in the certificate scenario, so the optimization of time consumption is more obvious.

[0064] The pruned model is directly deployed in industrial Internet devices, and trusted connections are made under both attack and no network attack. The connection time consumption when the trustworthiness is high and low is compared. The results are shown in Table 4.

[0065] Table 4 Trusted connection time

[0066] The efficiency of the lightweight trusted connection process implemented based on trustworthiness design is greatly improved. However, due to the addition of trustworthiness judgment operations, if the trustworthiness obtained is low, the original trusted connection process needs to be performed, which takes more time than the original trusted connection process. However, in industrial Internet scenarios, most devices are still normal and safe, so most trusted connections will obtain highly trustworthy results. Overall, the lightweight trusted connection process proposed in this article is still very helpful in reducing latency.

[0067] In the original trusted connection process, the policy configured in the policy manager is directly used regardless of any situation. In general, the policy includes checking the trusted program whitelist, system kernel parameters, and system security configuration items. The most time-consuming part is checking the trusted program whitelist and security configuration items. In the whitelist verification, it is necessary to traverse all executed programs in the system to see if they are in the trusted whitelist. The program whitelist may be as many as thousands. At the same time, the hash value is used as the mark of each program. Calculating and comparing the hash values ​​item by item will take up most of the time. The system security configuration needs to obtain the system configuration file for pattern matching and check whether the security-related items are enabled, such as the timed expiration of the password and the opening of the firewall. These cumbersome and difficult to complete checks cause the original trusted connection to have a long delay.

[0068] In the proposed lightweight trusted connection process, the trusted discriminator deployed on the industrial Internet device replaces the traditional security check, introduces differentiated connection processes under different security environments, and simplifies the process without reducing security. The trained and pruned trust discriminator has an extremely fast reasoning speed. For network traffic within 5 seconds, it can output the security result within 0.3 seconds. When it is judged to be highly trustworthy, it only needs to perform certificate verification to complete the trusted connection. The certificate verification interaction can be completed in less than 0.1 seconds, so the overall delay is within 0.5 seconds. The lightweight design based on identifying the security environment can guarantee security to a great extent, and execute differentiated connection processes for different scenarios, taking into account security while accelerating trusted connections.

[0069] refer to Figures 7 to 18 , considering that the original time consumption will increase when the credibility judgment result is low, the impact of the number of security threats in the real environment on the delay of the lightweight trusted connection process is further simulated. 100 trusted connections are performed so that the trusted discriminator can force the judgment result to change proportionally after the judgment is completed to avoid statistical errors caused by a few judgment errors. When 80% of the connection cases are of low credibility, the time consumed by the lightweight trusted connection process will exceed that of the original trusted connection process. If it is below 80%, the lightweight trusted connection process has an advantage in latency, and the safer the environment, the smaller the probability of low credibility judgment, and the greater the latency advantage of the lightweight trusted connection process. Since the lightweight trusted connection process will degenerate to the original process to perform a complete trust verification when the credibility is judged to be low, the time for judging the credibility is increased compared to the original process, so it brings additional delay when the credibility is low. However, there are few scenarios where the credibility is low above 80%, which means that it is subject to a large number of network attacks and other network security defense facilities should be added. Therefore, the lightweight trusted connection process achieves the goal of shortening the process and reducing latency in most cases.

[0070] (1) Adding CA If a new CA is added, the program will generate a new certificate for RA and CA registration, where RA and CA correspond one to one, and RA is bound using CA's ID. After starting the infrastructure and management end programs, place the CA program package on the server where you want to deploy CA, edit the enrollType of the [mgmt] section of the registration file to 1 and add subject (certificate subject) information, run the registration program CA_RA_ENROLL, and after obtaining the registration information, start the RA and CA programs. RA, CA, and registration files must be run in the same folder. The registration file content is shown in 8, and the registration program is completed as shown in Figure 8 shown.

[0071] If an existing CA is introduced, the program will use the specified certificate for RA and CA registration. After starting the infrastructure and management end programs, place the CA program package on the server where you want to deploy the CA, edit the enrollType of the [mgmt] section of the registration file to 2, and fill in the [exist_ca] section. If the CA private key is encrypted with PEM, you need to fill in the caKeyPassword item, run the registration program, and after the registration is completed, start the CA and RA programs.

[0072] (2) CA management After logging in to the infrastructure management platform, enter the CA management interface, as shown in 10, where you can view all CAs. The CA with the newly registered caId 993daa05-6d64-49c4-b83b-456e3ca503ba is closed by default, and you can use the operation bar to perform corresponding management operations.

[0073] After the CA is enabled for certificate request approval, all certificate requests from the CA will be intercepted by the RA. The administrator can approve them in Certificate Issuance Management-Certificate Request Approval. If it is not enabled, the RA will directly pass the certificate application to the CA. First, enable CA: 993daa05-6d64-49c4-b83b-456e3ca503ba and enable its certificate approval function. Fig.10 As shown, the status of the CA is displayed as normal and the certificate application approval is displayed as enabled.

[0074] (3) Apply for a certificate through the client program Place the certificate client package on the machine that needs to apply for the certificate, and edit the certificate application configuration file cert_req.ini in the package. The content is as follows Fig.12As shown in the figure, the [mgmt] item is the information for connecting to mosquitto. The [req_info] item contains the subject and the expected certificate validity period (years), as well as the caId, where the caId will determine which ca will generate the certificate. The [attribute] item contains the attributes of the embedded certificate. Each attribute is a name and content pair. The suffix -Name is the attribute name, and the suffix -Content is the attribute content. The same name and content before the suffix are a pair, such as Fig.11 Sec_level-Name and Sec_level-Content shown in . After filling in, start client-pubCertReq, which will generate a certificate request and send it to the ra corresponding to the ca. Here, set the target ca to the newly added ca: 993daa05-6d64-49c4-b83b-456e3ca503ba. Fill in the variable common name in the [alt_name] item, the [client] item is used as the identifier of the certificate owner, clientId identifies the object of this certificate issuance, and is generally set to uuid. sigPriKeyPath is the storage directory for the locally generated signature private key, which will be stored after being generated by the client program. After setting password, the client program and the ca program can generate encrypted PEM private keys.

[0075] After completing the information filling, run the certificate application client program, which will generate an encrypted private key and a certificate request (CSR) in PEM format locally based on the filled information, and send the CSR to the RA. As shown in 3, the certificate subject Subject, certificate alternative name Alternative Name, and custom certificate attribute My Test Sec_level are all correctly reflected in the generated CSR.

[0076] (4) Certificate Generation When the certificate application approval is turned on, the certificate application initiated by the corresponding CA can be browsed in the Certificate Issuing Authority Management-Approval Certificate Application, and you can choose whether to approve it. After approval, the CA will generate and sign the certificate. As shown in 4, the previous certificate application can be seen in the interface, and the status is pending approval. After clicking Approve, the CA will generate an encryption certificate and an encryption private key, and sign the applicant's signature and encryption certificate.

[0077] (5) Obtaining a certificate The certificate client package contains a certificate acquisition client program. This program will use the clientId configured in cert_req.ini as the feature identification of certificate reception, and listen to the specified topic to obtain the certificate corresponding to the previously issued certificate request, such as Fig.15As shown in the figure, the client has successfully obtained the certificate from the server and saved it to the same directory as the signature private key (configured in sigPriKeyPath in cert_req.ini). Fig.16 As shown, the signature and encryption certificates and private keys have been successfully saved.

[0078] (6) Revoke / deactivate certificate The management platform can show the relevant certificates that have been successfully issued. If an unexpected situation occurs (such as key loss) and you need to stop using the certificate, you can click on the deactivate, remove and other operations on the page. The deactivation operation will not delete the certificate from the list, and it can be enabled again. The removal operation will delete it, which means that the certificate is revoked. Deactivate the encryption certificate that has just been issued. The encryption certificate has become deactivated. Fig.17 shown.

[0079] (7) Query the client status through the certificate query The certificate client package contains the certificate query client client_check. Run the client_check program and add command line parameters. The first parameter is clientId, which is used to distinguish the topic of the received request. The second parameter is the certificate location of the CA to which the verified certificate belongs, which is used as the public key decryption of the OCSP response. The third parameter is the location of the verified certificate (which must be PEM encoded). The program generates an OCSP request and sends it to the OCSP server, returning the status of the verified certificate. Fig.18 As shown, you can see that the status of the queried encryption certificate is revoke, which means that the certificate has been deactivated or revoked and cannot be used at present.

[0080] Example 2 refer to Fig.19 According to the second aspect of the present invention, an industrial Internet trusted connection system 1 based on neural network and MQTT is provided, comprising: an acquisition module 11, used to acquire network traffic data of a target device, and train a credibility discriminator based on a time convolutional neural network according to the network traffic data; a judgment module 12, used to judge the credibility of a node initiating a trusted connection to a target device based on the trained credibility discriminator: if the credibility is greater than a preset value, identity authentication is performed according to the digital certificate of the node; otherwise, the node is authenticated according to the preset access control rule of the target device; an access module 13, used to provide a digital certificate service for a trusted connection to an authenticated trusted node through the MQTT protocol and a lightweight public key, wherein the digital certificate service includes application, query, acquisition and verification of a digital certificate.

[0081] Furthermore, the access module 13 includes: a deployment unit, used to deploy the application interface and query interface of the digital certificate of the trusted connection in the MQTT Topic and the certificate authority respectively; a publishing unit, used to publish management commands through the MQTT protocol; an execution unit, used to manage the registration authority corresponding to the certificate authority through the management command, and subscribe to the execution results.

[0082] Example 3 refer to Fig. 20 According to a third aspect of the present invention, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method of the first aspect of the present invention.

[0083] The electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0084] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Fig. 20 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Fig. 20 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0085] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, the above functions defined in the method of the embodiment of the present disclosure are executed. It should be noted that the computer-readable medium described in the embodiment of the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In an embodiment of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, an apparatus, or a device. In an embodiment of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, an apparatus, or a device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wire, optical cable, RF (radio frequency), etc., or any suitable combination of the foregoing.

[0086] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0087] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A trusted connection method for industrial Internet based on neural network and MQTT, characterized in that: include: Acquire network traffic data of the target device, and train a credibility discriminator based on a time convolutional neural network according to the network traffic data; Based on the trained credibility discriminator, the credibility of the node initiating the trusted connection to the target device is judged: if the credibility is greater than the preset value, the identity is authenticated according to the digital certificate of the node; Otherwise, the node is authenticated according to the preset access control rules of the target device; For trusted nodes that have passed identity authentication, a digital certificate service for trusted connection is provided to the connected trusted nodes through the MQTT protocol and lightweight public key. The digital certificate service includes application, query, acquisition and verification of digital certificates.

2. The industrial Internet trusted connection method based on neural network and MQTT according to claim 1 is characterized in that: The credibility discriminator comprises: The detection module is used to continuously detect the network traffic of the target device and to judge the credibility of the node that initiates the trusted connection of the target device; The verification module is used to determine the detection items of the node, and the detection items include the system kernel version and software loading information.

3. The industrial Internet trusted connection method based on neural network and MQTT according to claim 2 is characterized in that: The training step of the credibility discriminator includes: The sample data is cleaned using the SMOTE-Tomek Links combined algorithm; For the cleaned sample data, the number of samples is increased through transfer learning.

4. The industrial Internet trusted connection method based on neural network and MQTT according to claim 1 is characterized in that: The performing identity authentication on the node according to the preset access control rule of the target device includes: the target device performs identity authentication on the node according to the three-element three-layer peer-to-peer trusted connection process.

5. The industrial Internet trusted connection method based on neural network and MQTT according to claim 1 is characterized in that: The digital certificate service for providing a trusted connection to the connected trusted node through the MQTT protocol and a lightweight public key includes: Deploy the application interface and query interface of the digital certificate of the trusted connection in the MQTT Topic and the certificate authority respectively; Publish management commands through the MQTT protocol; The registration authority corresponding to the certificate issuing authority is managed through the management command, and the execution result is subscribed.

6. The industrial Internet trusted connection method based on neural network and MQTT according to claim 5 is characterized in that: The issuing of management commands through the MQTT protocol includes: Publish to the specified Topic of the MQTT broker through management commands; Obtain and parse the Topic to obtain management commands, execute the management commands and return the execution results.

7. An industrial Internet trusted connection system based on neural network and MQTT, characterized in that: include: An acquisition module, used to acquire network traffic data of a target device, and train a credibility discriminator based on a time convolutional neural network according to the network traffic data; A judgment module is used to judge the credibility of the node that initiates the trusted connection to the target device based on the trained credibility discriminator: if the credibility is greater than a preset value, identity authentication is performed based on the digital certificate of the node; Otherwise, the node is authenticated according to the preset access control rules of the target device; The access module is used to provide a digital certificate service of a trusted connection to the connected trusted node through the MQTT protocol and a lightweight public key for the trusted node that has passed identity authentication. The digital certificate service includes the application, query, acquisition and verification of the digital certificate.

8. The industrial Internet trusted connection system based on neural network and MQTT according to claim 7, characterized in that: The access module comprises: A deployment unit, used to deploy the application interface and query interface of the digital certificate of the trusted connection in the MQTT Topic and the certificate authority respectively; Publishing unit, used to publish management commands through MQTT protocol; The execution unit is used to manage the registration authority corresponding to the certificate issuing authority through the management command and subscribe to the execution result.

9. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement an industrial Internet trusted connection method based on a neural network and MQTT as described in any one of claims 1 to 6.

10. A computer readable medium having a computer program stored thereon, characterized in that: in, When the computer program is executed by a processor, it implements an industrial Internet trusted connection method based on a neural network and MQTT as described in any one of claims 1 to 6.

Images