Block chain-based power Internet of Things terminal security access method and system

Abstract

The invention relates to a block chain-based power Internet of Things terminal security access method and system. The method comprises the following steps of S1, dividing a virtual local area network; s2, deploying an SDN controller to manage and control network traffic; s3, performing decentralized identity recognition by using a block chain, and executing an automatic identity authentication process by using a smart contract; s4, carrying out preliminary identity verification based on the certificate, and carrying out secondary authentication in combination with the biological characteristics and the position information of the Internet of Things equipment; s5, performing uplink according to the critical degree, generating a unique fingerprint of the data by using a hash function, and storing the unique fingerprint in a block chain to ensure data integrity and prevent tampering; and S6, applying a strong encryption algorithm in a transmission layer and a data storage process to ensure data security and realize a homomorphic encryption technology, so that data operation is performed in an encryption state, and privacy is protected. According to the invention, the efficiency and security of terminal access are improved, and comprehensive protection and flexible management of the network and data are realized through the block chain and SDN technology.

Description

Technical Field

[0001] The present invention relates to the field of electric power Internet of Things, and in particular to a blockchain-based electric power Internet of Things terminal security access method and system. Background Art

[0002] In modern power IoT systems, it is crucial to ensure secure access and data integrity of terminal devices. With the surge in the number of IoT devices and the intelligent transformation of power systems, security threats are becoming increasingly complex, and innovative solutions are urgently needed to protect system integrity and data security. Traditional centralized security mechanisms are difficult to cope with distributed IoT architectures.

[0003] Moreover, the criticality of the power system and its significant impact on society make it a high-risk area for cyber attacks. Unauthorized access, data tampering and cyber attacks may lead to serious economic losses and social crises. At the same time, due to the wide coverage of the power Internet of Things, from smart meters, renewable energy equipment to smart devices in users' homes, there are many types of equipment, and the factors affecting its security are complex. Summary of the invention

[0004] In order to solve the above problems, the purpose of the present invention is to provide a blockchain-based power Internet of Things terminal security access method and system, which not only improves the efficiency and security of terminal access, but also realizes comprehensive protection and flexible management of networks and data through blockchain and SDN technology.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A blockchain-based power Internet of Things terminal security access method includes the following steps:

[0007] S1: Divide virtual local area networks (VLANs) based on device function, data type or security level to achieve logical isolation within the physical network;

[0008] S2: Deploy SDN controllers to manage and control network traffic, dynamically define and adjust traffic paths, so as to quickly respond to changes in network conditions and improve bandwidth utilization and network security;

[0009] S3: Use blockchain for decentralized identity recognition, register device IDs, distribute and verify digital certificates, and use smart contracts to execute automated identity authentication processes to ensure fast and secure device access.

[0010] S4: Perform initial identity authentication based on certificates, and perform secondary authentication based on the biometrics and location information of the IoT device;

[0011] S5: Select the most important data based on their criticality and upload them to the blockchain, such as status changes, device public keys, and important transaction records. Use hash functions to generate unique fingerprints of the data and store them in the blockchain to ensure data integrity and prevent tampering.

[0012] S6: Apply strong encryption algorithms in the transmission layer and data storage process to ensure data security and implement homomorphic encryption technology so that data operations are performed in an encrypted state to protect privacy.

[0013] Furthermore, virtual local area networks (VLANs) are divided based on device functions, data types, or security levels to achieve logical isolation within the physical network, as follows:

[0014] Classify all devices within the network and identify them based on device function, data type, and security level; assign unique VLAN IDs to different types of devices;

[0015] Use routing policies to control traffic between different VLANs to ensure traffic isolation between VLANs; only allow necessary cross-VLAN communication;

[0016] For cross-VLAN traffic control, the following conditions are used to refer to the state:

[0017]

[0018] T1 and T2 represent different VLANs, and AllowTraffic is a high-level policy that allows communication between VLANs under specific conditions.

[0019] Use policy-based network management tools to dynamically manage VLANs, allocate and adjust VLANs through device authentication, implement role-aware mechanisms, and automatically adjust the VLAN affiliation of devices in the network;

[0020] Dynamically adjust VLAN policies based on device ID, user role or data type to ensure dynamic attribution management of users and devices.

[0021] Furthermore, a policy-based network management tool is used to dynamically manage VLANs, allocate and adjust VLANs through device authentication, implement a role-aware mechanism, and automatically adjust the VLAN affiliation of devices in the network, as follows:

[0022] Configure AAA server information on network devices, pointing to the network management tool Cisco ISE;

[0023] When a device accesses the network, it performs identity authentication through RADIUS / TACACS+ to confirm the legitimacy of the device and user;

[0024] Define policies in Cisco ISE based on device type, user role, and device ID; use identification information to assign devices to the appropriate role category to assist in subsequent VLAN assignment;

[0025] Create a policy set in Cisco ISE and define policy rules based on different roles and identification information; each policy rule determines how a certain role is mapped to a specific VLAN;

[0026] The RADIUS attributes are used to tell the network device to assign the device to the indicated VLAN. After the device passes the authentication, it is automatically added to the corresponding VLAN according to the policy.

[0027] Furthermore, S2 is specifically:

[0028] S2.1: Select OpenDaylight and install it, ensure that the controller is compatible with the network equipment, configure the communication interface between the controller and the network equipment, and use the OpenFlow protocol for control and management.

[0029] S2.2: Enable OpenFlow on network devices and register them with the OpenDaylight controller; ensure that network devices can report traffic status and topology changes in real time; the network devices include switches and routers;

[0030] S2.3: Use OpenDaylight's topology module to discover the network architecture and visualize the status of network devices and links; record and continuously update the current global view of the network to support path optimization and adjustment;

[0031] S2.4: Use the OpenDaylight controller to monitor network traffic and analyze performance, identify network bottlenecks, congestion points, and abnormal traffic, and assist in the formulation of dynamic adjustment strategies;

[0032] S2.5: The controller calculates the optimal traffic path and uses Dijkstra to optimize path selection. It also uses real-time network data to dynamically adjust the traffic path to adapt to changes in network conditions and strengthen the management of bandwidth and latency.

[0033] S2.6: In traffic path adjustment, the OpenDaylight controller sends new flow table rules to network devices based on the calculation results;

[0034] S2.7: Integrate security policies into SDN controllers to automatically adjust network attack detection and defense responses.

[0035] S2.8: Use traffic anomaly detection algorithms and intrusion detection system information to update flow tables in real time to defend against security threats; formulate north-south and east-west traffic strategies, filter and isolate traffic at the network edge, dynamically configure virtual LAN VLANs, and separate traffic according to different security requirements.

[0036] Furthermore, S2.5 is specifically:

[0037] S2.5.1: Consider the network as a graph model G = (V, E), where V is a set of nodes, including routers and switches; E is a set of edges, i.e., links; each edge e∈E is assigned a weight, indicating bandwidth consumption;

[0038] S2.5.2: Use Dijkstra algorithm to calculate the shortest path from the source node to the destination node, optimize based on the path weight, and select the path with sufficient bandwidth and low delay;

[0039] S2.5.3: Monitor the status of the current path. If a bottleneck or network congestion is found, trigger path recalculation and dynamically update the path selection weight using real-time data;

[0040] S2.5.4: Recalculate the optimal path on the controller, send updated flow table rules through OpenFlow, and redirect traffic;

[0041] S2.5.5: Add bandwidth utilization as an optimization goal in path selection, improve overall network performance through traffic engineering technology, and ensure optimal bandwidth allocation based on the solution of the maximum flow-minimum cost problem;

[0042] S2.5.6: Reduce path delay through network monitoring and add delay weight to the path selection model.

[0043] Further, S2.5.5 is as follows:

[0044] Assign weight w(e) to each edge e∈E, including bandwidth weight w bw (e), reflects the inverse of the available bandwidth; delay weight w latency (e) is to use the delay value directly; total weight:

[0045] w(e)=α·w bw (e)+β·w latency (e);

[0046] Among them, α and β are adjustment coefficients;

[0047] The maximum flow-minimum cost optimization objective function is:

[0048]

[0049] Among them, f ij is the flow from node i to node j, c ij is the unit flow cost from node i to node j;

[0050] When selecting a path to meet the maximum flow, ensure that the transmission cost is the lowest.

[0051] A linear programming algorithm is used to solve the maximum flow-minimum cost optimization problem to ensure that the reallocated paths can both optimize bandwidth utilization and control latency.

[0052] Furthermore, S3 is specifically:

[0053] Deploy blockchain network nodes, including power companies, equipment manufacturers, and third-party security agencies, configure nodes to participate in consensus, and ensure data is uploaded and verified on the blockchain;

[0054] Each power IoT device generates a unique device ID and public key pair; the device ID is its unique identifier on the blockchain; transactions are used to write the device ID and public key information into the blockchain to ensure that it cannot be tampered with and is traceable;

[0055] The device digital certificate is issued by a third-party security organization and distributed and stored on the blockchain. The stored certificate information includes the device ID, device public key and certificate validity period metadata;

[0056] Create smart contracts to manage the authentication process, including device registration functions, authentication request processing functions, and status update functions, to automate the authentication process; when the device is connected, submit the ID and public key to request access. The smart contract verifies the submitted data: check whether the device ID is recorded on the blockchain; verify whether the public key matches the certificate; if the verification passes, update the device status to authenticated; if the verification fails, deny device access and record the exception;

[0057] The core data of the identity is put on the chain. For large-capacity certificates, a distributed file system is used for off-chain storage. The blockchain only stores file fingerprints and links.

[0058] Furthermore, S4 is specifically:

[0059] S4.1: Issue an X.509 digital certificate to each IoT device, which contains the device ID, public key, and CA signature; when the device attempts to connect to the network, it is required to provide the X.509 certificate;

[0060] S4.2: The system verifies the signature of the certificate and confirms its validity by checking the CA chain and validity period in the certificate. After the verification is passed, the device is authorized to enter the network for the first time.

[0061] S4.3: The device has a built-in biometric sensor to collect unique biometric data, implement encrypted matching of biometrics on the network or on the device, and process it locally on the device or through edge computing nodes;

[0062] S4.4: Use GPS to obtain the physical location of the device and verify whether the device location matches the registered information or is within a predefined geo-fence as an additional security layer.

[0063] S4.5: Use a multi-factor authentication strategy that combines certificates, biometrics, and location information to achieve strong identity authentication.

[0064] Furthermore, S5 is specifically:

[0065] S5.1: According to business needs and security levels, select key information and upload it to the chain, and use a secure hash algorithm to generate a unique fingerprint for the selected data;

[0066] S5.2: Store the generated hash value and related index information on the blockchain, and ensure the integrity and tamper-proofness of the on-chain data through the immutable nature of the blockchain;

[0067] S5.3: Regularly audit the logs and transactions on the chain to ensure the compliance of data storage and access, deploy a security information and event management system to continuously monitor the identity authentication and data on-chain process, and combine side chain and sharding technology to improve blockchain performance and processing capabilities.

[0068] A blockchain-based power Internet of Things terminal security access system includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the blockchain-based power Internet of Things terminal security access method as described above.

[0069] The present invention has the following beneficial effects:

[0070] 1. The present invention not only improves the efficiency and security of terminal access, but also realizes comprehensive protection and flexible management of networks and data through blockchain and SDN technology;

[0071] 2. The present invention can realize VLAN logical isolation based on function and data type, protect sensitive information, ensure the security of key equipment, ensure efficient use of network resources through dynamic adjustment, and flexibly and dynamically manage network traffic through SDN, optimize bandwidth utilization, and improve network security and response speed through intelligent traffic path adjustment. It can dynamically adjust to adapt to load changes, optimize bandwidth utilization and latency, and ensure that network performance is improved while maintaining service quality;

[0072] 3. The present invention uses blockchain and smart contracts for decentralized identity management, which can effectively improve the efficiency and security of device access, ensure the transparency and non-tamperability of identity authentication between devices, thereby enhancing the security architecture and operational capabilities of the overall network, and using blockchain to efficiently and decentralizedly manage device identities, thereby enhancing the access security of IoT devices. The application of smart contracts in this process ensures the automation and rapid responsiveness of device access, while improving the transparency and trust of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 is a flow chart of the method of the present invention;

[0074] Figure 2 This is a schematic diagram of the process of managing and controlling network traffic by an SDN controller in one embodiment of the present invention;

[0075] Figure 3 Schematic diagram of identity authentication in one embodiment of the present invention. DETAILED DESCRIPTION

[0076] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0077] refer to Figure 1 In this embodiment, a method for secure access to a power Internet of Things terminal based on blockchain is provided, which is characterized by comprising the following steps:

[0078] S1: Divide virtual local area networks (VLANs) based on device functions, data types or security levels to achieve logical isolation within the physical network, ensure traffic isolation between critical devices and ordinary devices, and reduce potential security risks;

[0079] S2: Deploy SDN controllers (such as OpenDaylight) to manage and control network traffic, dynamically define and adjust traffic paths, so as to quickly respond to changes in network conditions and improve bandwidth utilization and network security;

[0080] S3: Use blockchain for decentralized identity recognition, register device IDs, distribute and verify digital certificates, and use smart contracts to execute automated identity authentication processes to ensure fast and secure device access.

[0081] S4: Perform preliminary identity authentication based on certificates (such as X.509), and perform secondary authentication based on the biometrics and location information of the IoT device;

[0082] S5: Select the most important data based on their criticality and upload them to the blockchain, such as status changes, device public keys, and important transaction records. Use hash functions to generate unique fingerprints of the data and store them in the blockchain to ensure data integrity and prevent tampering.

[0083] S6: Apply strong encryption algorithms (such as AES-256) in the transmission layer and data storage process to ensure data security and implement homomorphic encryption technology so that data operations are performed in an encrypted state to protect privacy.

[0084] In this embodiment, virtual local area networks (VLANs) are divided based on device functions, data types, or security levels to achieve logical isolation within the physical network, as follows:

[0085] Classify all devices in the network and identify them based on device function (such as sensor, control device, management terminal), data type (such as real-time data, batch data) and security level (such as high, medium, low); assign unique VLAN IDs to different types of devices;

[0086] Configure VLANs on network devices such as switches and routers to ensure that various devices communicate only with designated VLANs; use the IEEE 802.1Q protocol to transmit VLAN-tagged packets between network devices.

[0087] Use routing policies to control traffic between different VLANs to ensure traffic isolation between VLANs; only allow necessary cross-VLAN communication;

[0088] For cross-VLAN traffic control, the following conditions are used to refer to the state:

[0089]

[0090] T1 and T2 represent different VLANs, and AllowTraffic is a high-level policy that allows communication between VLANs under certain conditions, such as management commands.

[0091] Use policy-based network management tools to dynamically manage VLANs, allocate and adjust VLANs through device authentication, implement role-aware mechanisms, and automatically adjust the VLAN affiliation of devices in the network;

[0092] Dynamically adjust VLAN policies based on device ID, user role or data type to ensure dynamic attribution management of users and devices. It can achieve VLAN logical isolation based on function and data type, protect sensitive information, ensure the security of key equipment, and ensure efficient use of network resources through dynamic adjustment)

[0093] In this embodiment, a policy-based network management tool is used to dynamically manage VLANs, allocate and adjust VLANs through device authentication, implement a role-aware mechanism, and automatically adjust the VLAN affiliation of devices in the network, as follows:

[0094] Configure AAA (Authentication, Authorization, Accounting) server information on network devices (switches, wireless controllers) and point it to the network management tool Cisco ISE;

[0095] When a device accesses the network, it performs identity authentication through RADIUS / TACACS+ to confirm the legitimacy of the device and user;

[0096] Define policies in Cisco ISE based on device type, user role, and device ID; use identification information to assign devices to the appropriate role category to assist in subsequent VLAN assignment;

[0097] Create a policy set in Cisco ISE and define policy rules based on different roles and identification information, including device ID, user role, and device type. Each policy rule determines how a certain role is mapped to a specific VLAN.

[0098] Through the RADIUS attribute, Tunnel-Private-Group-ID is used in this embodiment to tell the network device to allocate the device to the indicated VLAN. After the device passes the verification, it automatically joins the corresponding VLAN according to the policy.

[0099] refer to Figure 2 In this embodiment, S2 is specifically:

[0100] S2.1: Select OpenDaylight and install it, ensure that the controller is compatible with the network equipment, configure the communication interface between the controller and the network equipment, and use the OpenFlow protocol for control and management.

[0101] S2.2: Enable OpenFlow on network devices and register them with the OpenDaylight controller; ensure that network devices can report traffic status and topology changes in real time; the network devices include switches and routers;

[0102] S2.3: Use OpenDaylight's topology module to discover the network architecture and visualize the status of network devices and links; record and continuously update the current global view of the network to support path optimization and adjustment;

[0103] S2.4: Use the OpenDaylight controller to monitor network traffic and analyze performance, identify network bottlenecks, congestion points, and abnormal traffic, and assist in the formulation of dynamic adjustment strategies;

[0104] S2.5: The controller calculates the optimal traffic path and uses Dijkstra to optimize path selection. It also uses real-time network data to dynamically adjust the traffic path to adapt to changes in network conditions and strengthen the management of bandwidth and latency.

[0105] S2.6: In traffic path adjustment, the OpenDaylight controller sends new flow table rules to network devices based on the calculation results;

[0106] S2.7: Integrate security policies into SDN controllers to automatically adjust network attack detection and defense responses.

[0107] S2.8: Use traffic anomaly detection algorithms and intrusion detection system (IDS) information to update flow tables in real time to defend against security threats; formulate north-south and east-west traffic policies, filter and isolate traffic at the network edge, dynamically configure virtual LANs (VLANs), and separate traffic according to different security requirements.

[0108] In this embodiment, S2.5 is specifically:

[0109] S2.5.1: Consider the network as a graph model G = (V, E), where V is a set of nodes, including routers and switches; E is a set of edges, i.e., links; each edge e∈E is assigned a weight, indicating bandwidth consumption;

[0110] S2.5.2: Use Dijkstra algorithm to calculate the shortest path from the source node to the destination node, optimize based on the path weight, and select the path with sufficient bandwidth and low delay;

[0111] S2.5.3: Monitor the status of the current path. If a bottleneck or network congestion is found, trigger path recalculation and dynamically update the path selection weight using real-time data;

[0112] S2.5.4: Recalculate the optimal path on the controller, send updated flow table rules through OpenFlow, and redirect traffic;

[0113] S2.5.5: Add bandwidth utilization as an optimization goal in path selection, improve overall network performance through traffic engineering technology, and ensure optimal bandwidth allocation based on the solution of the maximum flow-minimum cost problem;

[0114] S2.5.6: Reduce path delay through network monitoring and add delay weight to the path selection model.

[0115] In this embodiment, S2.5.5 is as follows:

[0116] Assign weight w(e) to each edge e∈E, including bandwidth weight w bw(e), reflects the inverse of the available bandwidth; delay weight w latency (e) is to use the delay value directly; total weight:

[0117] w(e)=α·w bw (e)+β·w latency (e);

[0118] Among them, α and β are adjustment coefficients;

[0119] The maximum flow-minimum cost optimization objective function is:

[0120]

[0121] Among them, f ij is the flow from node i to node j, c ij is the unit flow cost from node i to node j;

[0122] When selecting a path to meet the maximum flow, ensure that the transmission cost (bandwidth and delay cost) is minimized. A linear programming algorithm is used to solve the maximum flow-minimum cost optimization problem to ensure that the reallocated path can optimize bandwidth utilization and control delay.

[0123] In this embodiment, S3 is specifically:

[0124] Deploy blockchain network nodes, including power companies, equipment manufacturers, and third-party security agencies, configure nodes to participate in consensus, and ensure data is uploaded and verified on the blockchain;

[0125] Each power IoT device generates a unique device ID and public key pair; the device ID is its unique identifier on the blockchain; transactions are used to write the device ID and public key information into the blockchain to ensure that it cannot be tampered with and is traceable;

[0126] The device digital certificate is issued by a third-party security organization and distributed and stored on the blockchain. The stored certificate information includes the device ID, device public key and certificate validity period metadata;

[0127] Create smart contracts to manage the authentication process, including device registration functions, authentication request processing functions, and status update functions, to automate the authentication process; when the device is connected, submit the ID and public key to request access. The smart contract verifies the submitted data: check whether the device ID is recorded on the blockchain; verify whether the public key matches the certificate; if the verification passes, update the device status to authenticated; if the verification fails, deny device access and record the exception;

[0128] The core data of the identity (such as device ID and public key hash) is put on the chain. For large-capacity certificates, a distributed file system (such as IPFS) is used for off-chain storage. The blockchain only stores file fingerprints and links.

[0129] refer to Figure 3 In this embodiment, S4 is specifically:

[0130] S4.1: Issue an X.509 digital certificate to each IoT device, which contains the device ID, public key, and CA (certificate authority) signature; when the device attempts to connect to the network, it is required to provide the X.509 certificate;

[0131] S4.2: The system verifies the signature of the certificate and confirms its validity by checking the CA chain and validity period in the certificate. After the verification is passed, the device is authorized to enter the network for the first time.

[0132] S4.3: The device has built-in biometric sensors (such as fingerprint and voice recognition) to collect unique biometric data, implement encrypted matching of biometrics on the network or on the device, and process them locally on the device or at the edge computing node;

[0133] S4.4: Use GPS to obtain the physical location of the device and verify whether the device location matches the registered information or is within a predefined geo-fence as an additional security layer.

[0134] S4.5: Adopt a multi-factor authentication (MFA) strategy that combines certificates, biometrics, and location information to achieve strong identity authentication.

[0135] In this embodiment, S5 is specifically:

[0136] S5.1: According to business needs and security levels, select key information (device registration records, status changes, device public keys) and upload them to the chain, and use a secure hash algorithm (such as SHA-256) to generate a unique fingerprint for the selected data;

[0137] S5.2: Store the generated hash value and related index information on the blockchain, and ensure the integrity and tamper-proofness of the on-chain data through the immutable nature of the blockchain;

[0138] S5.3: Regularly audit the logs and transactions on the chain to ensure the compliance of data storage and access, deploy a security information and event management system (SIEM) to continuously monitor the identity authentication and data on-chain process, and combine side chain and sharding technology to improve blockchain performance and processing capabilities.

[0139] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0141] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0142] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0143] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A blockchain-based power Internet of Things terminal security access method, characterized in that: The following steps are involved: S1: Divide virtual LANs based on device functions, data types or security levels to achieve logical isolation within the physical network; S2: Deploy SDN controllers to manage and control network traffic, dynamically define and adjust traffic paths; S3: Use blockchain for decentralized identity recognition, register device IDs, distribute and verify digital certificates, and use smart contracts to perform automated identity authentication processes to ensure fast and secure device access; S4: Perform initial identity authentication based on certificates, and perform secondary authentication based on the biometrics and location information of the IoT device; S5: Select data to be uploaded to the blockchain based on its criticality, use a hash function to generate a unique fingerprint of the data and store it in the blockchain; S6: Apply strong encryption algorithms in the transmission layer and data storage process to ensure data security, and based on homomorphic encryption technology, enable data operations to be performed in an encrypted state to protect privacy.

2. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 1 is characterized in that: The virtual local area network (VLAN) is divided based on device function, data type or security level to achieve logical isolation within the physical network, as follows: Classify all devices within the network and identify them based on device function, data type, and security level; assign unique VLAN IDs to different types of devices; Use routing policies to control traffic between different VLANs to ensure traffic isolation between VLANs; only allow necessary cross-VLAN communication; For cross-VLAN traffic control, the following conditions are used to refer to the state: T1 and T2 represent different VLANs, and AllowTraffic is a high-level policy that allows communication between VLANs under specific conditions. Use policy-based network management tools to dynamically manage VLANs, allocate and adjust VLANs through device authentication, implement role-aware mechanisms, and automatically adjust the VLAN affiliation of devices in the network; Dynamically adjust VLAN policies based on device ID, user role or data type to ensure dynamic attribution management of users and devices.

3. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 2 is characterized in that: The policy-based network management tool is used to dynamically manage VLANs, allocate and adjust VLANs through device authentication, implement a role-aware mechanism, and automatically adjust the VLAN affiliation of devices in the network, as follows: Configure AAA server information on network devices and point it to the network management tool Cisco ISE; When a device accesses the network, it performs identity authentication through RADIUS / TACACS+ to confirm the legitimacy of the device and user; Define policies in Cisco ISE based on device type, user role, and device ID; use identification information to assign devices to the appropriate role category to assist in subsequent VLAN assignment; Create a policy set in Cisco ISE and define policy rules based on different roles and identification information; each policy rule determines how a certain role is mapped to a specific VLAN; The RADIUS attributes are used to tell the network device to assign the device to the indicated VLAN. After the device passes the authentication, it is automatically added to the corresponding VLAN according to the policy.

4. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 1 is characterized in that: The S2 is specifically: S2.1: Select OpenDaylight and install it, ensure that the controller is compatible with the network equipment, configure the communication interface between the controller and the network equipment, and use the OpenFlow protocol for control and management; S2.2: Enable OpenFlow on network devices and register them with the OpenDaylight controller; ensure that network devices can report traffic status and topology changes in real time; the network devices include switches and routers; S2.3: Use OpenDaylight's topology module to discover the network architecture and visualize the status of network devices and links; record and continuously update the current global view of the network to support path optimization and adjustment; S2.4: Use the OpenDaylight controller to monitor network traffic and analyze performance, identify network bottlenecks, congestion points, and abnormal traffic, and assist in the formulation of dynamic adjustment strategies; S2.5: The controller calculates the optimal traffic path and uses Dijkstra to optimize path selection. It also uses real-time network data to dynamically adjust the traffic path to adapt to changes in network conditions and strengthen the management of bandwidth and latency. S2.6: In traffic path adjustment, the OpenDaylight controller sends new flow table rules to network devices based on the calculation results; S2.7: Integrate security policies into SDN controllers to automatically adjust network attack detection and defense responses; S2.8: Use traffic anomaly detection algorithms and intrusion detection system information to update flow tables in real time to defend against security threats; formulate north-south and east-west traffic strategies, filter and isolate traffic at the network edge, dynamically configure virtual LAN VLANs, and separate traffic according to different security requirements.

5. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 4 is characterized in that: The S2.5 is specifically: S2.5.1: Consider the network as a graph model G = (V, E), where V is a set of nodes, including routers and switches; E is a set of edges, i.e., links; each edge e∈E is assigned a weight, which represents bandwidth consumption; S2.5.2: Use Dijkstra algorithm to calculate the shortest path from the source node to the destination node, optimize based on the path weight, and select the path with sufficient bandwidth and low delay; S2.5.3: Monitor the status of the current path. If a bottleneck or network congestion is found, trigger path recalculation and dynamically update the path selection weight using real-time data; S2.5.4: Recalculate the optimal path on the controller, send updated flow table rules through OpenFlow, and redirect traffic; S2.5.5: Add bandwidth utilization as an optimization goal in path selection, improve overall network performance through traffic engineering technology, and ensure optimal bandwidth allocation based on the solution of the maximum flow-minimum cost problem; S2.5.6: Reduce path delay through network monitoring and add delay weight to the path selection model.

6. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 5 is characterized in that: The S2.5.5 is as follows: Assign weight w(e) to each edge e∈E, including bandwidth weight w bw (e), reflects the inverse of the available bandwidth; delay weight w latency (e) is to use the delay value directly; total weight: w(e)=α·w bw (e)+β·w latency (e); Among them, α and β are adjustment coefficients; The maximum flow-minimum cost optimization objective function is: Among them, f ij is the flow from node i to node j, c ij is the unit flow cost from node i to node j; when selecting a path to meet the maximum flow, ensure that the transmission cost is the lowest, A linear programming algorithm is used to solve the maximum flow-minimum cost optimization problem to ensure that the reallocated paths can both optimize bandwidth utilization and control latency.

7. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 1 is characterized in that: The S3 is specifically: Deploy blockchain network nodes, including power companies, equipment manufacturers, and third-party security agencies, configure nodes to participate in consensus, and ensure data is uploaded and verified on the blockchain; Each power IoT device generates a unique device ID and public key pair; the device ID is its unique identifier on the blockchain; Use transactions to write device ID and public key information into the blockchain to ensure that it is tamper-proof and traceable; The device digital certificate is issued by a third-party security organization and distributed and stored on the blockchain. The stored certificate information includes the device ID, device public key and certificate validity period metadata; Create smart contracts to manage the authentication process, including device registration functions, authentication request processing functions, and status update functions to automate the authentication process; When a device is connected, it submits its ID and public key to request access. The smart contract verifies the submitted data: checks whether the device ID is recorded on the blockchain; verifies whether the public key matches the certificate; if the verification passes, updates the device status to authenticated; If verification fails, device access is denied and the exception is recorded; The core data of the identity is put on the chain. For large-capacity certificates, a distributed file system is used for off-chain storage. The blockchain only stores file fingerprints and links.

8. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 1 is characterized in that: The S4 is specifically: S4.1: Issue an X.509 digital certificate to each IoT device, which contains the device ID, public key, and CA signature; when the device attempts to connect to the network, it is required to provide the X.509 certificate; S4.2: The system verifies the signature of the certificate and confirms its validity by checking the CA chain and validity period in the certificate. After the verification is passed, the device is authorized to enter the network for the first time. S4.3: The device has a built-in biometric sensor to collect unique biometric data, implement encrypted matching of biometrics on the network or on the device, and process it locally on the device or through edge computing nodes; S4.4: Use GPS to obtain the physical location of the device and verify whether the device location matches the registered information or is within a predefined geo-fence as an additional security layer; S4.5: Use a multi-factor authentication strategy that combines certificates, biometrics, and location information to achieve strong identity authentication.

9. The method for secure access to a power Internet of Things terminal based on blockchain according to claim 1 is characterized in that: The S5 is specifically: S5.1: According to business needs and security levels, select key information and upload it to the chain, and use a secure hash algorithm to generate a unique fingerprint for the selected data; S5.2: Store the generated hash value and related index information on the blockchain, and ensure the integrity and tamper-proofness of the on-chain data through the immutable nature of the blockchain; S5.3: Regularly audit the logs and transactions on the chain to ensure the compliance of data storage and access, deploy a security information and event management system to continuously monitor the identity authentication and data on-chain process, and combine side chain and sharding technology to improve blockchain performance and processing capabilities.

10. A blockchain-based power Internet of Things terminal security access system, characterized in that: It includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the blockchain-based power Internet of Things terminal security access method as described in any one of claims 1 to 9.

Images