Lightweight power Internet of Things secure communication method, system and device, and storage medium

Abstract

The invention discloses a lightweight power Internet of Things secure communication method, system and device and a storage medium, and the method comprises the steps: carrying out the authentication of the identity of a first access entity through employing an SPA mechanism, carrying out the legal authorization of an access request if the authentication is passed, and forbidding the access request if the authentication is not passed; a BIC algorithm is introduced into the authorized access request, and credibility evaluation is performed on network nodes based on the BIC algorithm and a Bayesian network; determining the access authority of the network node according to the evaluation result; and continuously monitoring and recording the behaviors of the network node, determining the credibility of the current network node according to the recorded historical data and behavior mode of the network node and the credibility evaluation result, and dynamically adjusting the access permission of the network node according to the credibility. The method can provide more comprehensive and powerful security assurance, monitor and quickly respond to security events in real time, and reduce the security risk of the electric power Internet of Things to the greatest extent.

Description

Technical Field

[0001] The present application relates to the field of secure communication technology for electric power Internet of Things, and in particular to a lightweight secure communication method, system, device and storage medium for electric power Internet of Things. Background Art

[0002] The extensiveness of power IoT data poses a severe challenge to the security of communication. In particular, when the traditional LwM2M protocol is applied to power equipment, its security layer design often fails to fully meet the high security requirements in two-way communication, which may lead to data leakage. In order to meet this challenge, the LwM2M protocol introduces the DTLS protocol on the security layer, attempting to reduce the risk by enhancing the security of the communication process. As a secure transport layer protocol on top of the UDP protocol, the DTLS protocol draws on the core mechanisms of the TLS protocol, including the handshake process, data encryption, integrity verification and identity authentication, thereby providing key security attributes such as confidentiality, integrity and source verification for user data. However, when DTLS is directly applied to the LwM2M environment, some new problems and challenges are also exposed. First, although the DTLS protocol is similar to TLS in terms of security mechanism, its transmission characteristics based on UDP may cause data packet loss or disorder when network conditions are unstable, which increases the unreliability of the protocol itself.

[0003] In the context of the power Internet of Things, the reliability and real-time performance of data transmission are crucial. With the rapid development of the power Internet of Things, new security threats and challenges continue to emerge. For example, authentication, access control, and key management of large-scale distributed systems require more lightweight and flexible security mechanisms to ensure security. However, traditional security protocols such as DTLS are difficult to fully meet all new security requirements. Summary of the invention

[0004] Based on this, it is necessary to propose a lightweight power Internet of Things secure communication method, system, device and storage medium to address the above problems.

[0005] The embodiment of the present application provides a lightweight power Internet of Things security communication method, which is applied to the lightweight power Internet of Things security communication system, and the lightweight power Internet of Things security communication system is constructed based on the LwM2M protocol and the SDP logic component, and the method includes:

[0006] The SPA mechanism is used to authenticate the identity of the entity accessing the service for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0007] Introducing the BIC algorithm for legally authorized access requests, and performing trust evaluation on network nodes based on the BIC algorithm and Bayesian network;

[0008] Determining access rights of the network node according to the trust evaluation result;

[0009] Continuously monitoring and recording the behavior of the network node, and determining the trustworthiness of the current network node according to the recorded historical data and behavior pattern of the network node and the trustworthiness evaluation result;

[0010] The access rights of the network node are dynamically adjusted according to the trustworthiness of the current network node.

[0011] In some embodiments, the method further comprises:

[0012] Identifying security threats to data packets entering and leaving the network node;

[0013] Issue corresponding security response instructions based on the identified security threats.

[0014] In some implementations, the BIC algorithm is introduced into the access request for legal authorization, and the trustworthiness of the network nodes is evaluated based on the BIC algorithm and the Bayesian network, including:

[0015] Defining the trust level and trust factors of the network nodes, wherein the trust level is used to indicate the degree of trust of the network nodes, and the trust factors are key factors affecting the degree of trust;

[0016] Collect relevant data affecting the trust in the network nodes and perform preprocessing;

[0017] Based on the defined trust level and trust factors of network nodes and the collected relevant data affecting trust, the network node trust evaluation model is determined by combining the BIC algorithm and the Bayesian network model;

[0018] The network node performs trust evaluation according to the network node trust evaluation model.

[0019] In some embodiments, the network node trust evaluation model is determined based on the defined trust level of the network node, the trust factor, and the collected relevant data affecting the trust, in combination with the BIC algorithm and the Bayesian network model, including:

[0020] Constructing a Bayesian network model, including establishing a mapping relationship between the trust factor and the trust level based on Bayesian reasoning, and setting a priori probability and conditional probability;

[0021] When there are multiple data affecting the trust, weighting the collected data affecting the trust according to their importance in the trust evaluation;

[0022] The BIC algorithm is used to learn parameters, evaluate the degree of fit of different Bayesian network models, select the optimal Bayesian network model parameters, and obtain the corresponding network node trust evaluation model;

[0023] The network node trust evaluation model combines the prior probability and the conditional probability to calculate the trust of the network node under the currently recorded relevant data affecting the trust.

[0024] In some implementations, the LwM2M protocol is based on the REST framework, uses CoAP to transfer messages, and defines a model with resources as the basic unit.

[0025] In some implementations, the LwM2M protocol supports multiple security protocols of DTLS, and the protocol specifies multiple interfaces between various entities, including a boot interface, a client registration interface, a device management, a service implementation interface, and an information reporting interface.

[0026] The embodiment of the present application also provides a lightweight power Internet of Things security communication system, the lightweight power Internet of Things security communication system comprising:

[0027] The access control module is used to use the SPA mechanism to authenticate the identity of the entity that accesses the site for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0028] A BIC trust evaluation module, used to introduce the BIC algorithm into the access request for legal authorization, and to evaluate the trust of the network nodes based on the BIC algorithm and the Bayesian network;

[0029] The BIC trust evaluation module is further used to determine the access rights of the network node according to the trust evaluation result;

[0030] A rights management module, used to continuously monitor and record the behavior of the network node, and determine the trustworthiness of the current network node based on the recorded historical data and behavior patterns of the network node and the trustworthiness evaluation result;

[0031] The authority management module is further used to dynamically adjust the access authority of the network node according to the trustworthiness of the current network node.

[0032] In some embodiments, the lightweight electric power Internet of Things secure communication system further includes a data packet analysis and response module, and the data packet analysis and response module is used to:

[0033] Conducting in-depth analysis on the incoming and outgoing data packets of the network node to obtain analysis results;

[0034] identifying security threats based on the analysis results;

[0035] Issue corresponding security response instructions based on the identified security threats.

[0036] The embodiment of the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the following steps:

[0037] The SPA mechanism is used to authenticate the identity of the entity accessing the service for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0038] Introducing the BIC algorithm for legally authorized access requests, and evaluating the trustworthiness of network nodes based on the BIC algorithm and the Bayesian network;

[0039] Determining access rights of the network node according to the trust evaluation result;

[0040] Continuously monitoring and recording the behavior of the network node, and determining the trustworthiness of the current network node according to the recorded historical data and behavior pattern of the network node and the trustworthiness evaluation result;

[0041] The access rights of the network node are dynamically adjusted according to the trustworthiness of the current network node.

[0042] The embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the following steps:

[0043] The SPA mechanism is used to authenticate the identity of the entity accessing the service for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0044] Introducing the BIC algorithm for legally authorized access requests, and evaluating the trustworthiness of network nodes based on the BIC algorithm and the Bayesian network;

[0045] Determining access rights of the network node according to the trust evaluation result;

[0046] Continuously monitoring and recording the behavior of the network node, and determining the trustworthiness of the current network node according to the recorded historical data and behavior pattern of the network node and the trustworthiness evaluation result;

[0047] The access rights of the network node are dynamically adjusted according to the trustworthiness of the current network node.

[0048] The embodiments of the present application have the following beneficial effects:

[0049] In the lightweight power Internet of Things security communication method provided in the embodiment of the present application, in view of the security issues faced by the LwM2M protocol in the power Internet of Things environment, the present invention proposes a lightweight power Internet of Things security communication method by integrating the SDP concept, the LwM2M protocol and the BIC algorithm. The core idea of ​​this method is to transform network access control from the traditional network boundary-based model to identity-based fine-grained access control. Under the SDP framework, only authenticated and authorized devices or services can establish a connection, and this connection is established dynamically and only exists when needed, thereby greatly reducing the potential attack surface. By introducing the BIC algorithm for trust evaluation, dynamic evaluation and precise control of the trust of network nodes are achieved, effectively improving the security of communication between devices and servers in the power Internet of Things environment and the robustness of two-way interaction between power equipment and edge servers. In the future, with the continuous development and improvement of technology, this method and system are expected to be more widely used and promoted in the field of power Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] in:

[0052] Figure 1 A schematic diagram of a flow chart of a lightweight power Internet of Things secure communication method in one embodiment;

[0053] Figure 2 A structural diagram of a lightweight power Internet of Things security communication device in one embodiment;

[0054] Figure 3 is a schematic diagram of the structure of a computer device in one embodiment;

[0055] Figure 4 Schematic diagram of the structure of a computer-readable storage medium in one embodiment. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0057] In the embodiment of the present application, a lightweight power Internet of Things secure communication method is provided. Figure 1 , Figure 1 It is a flow chart of a lightweight power Internet of Things security communication method in an embodiment; the lightweight power Internet of Things security communication method includes steps S1 to S5.

[0058] Step S1, using the SPA mechanism to authenticate the identity of the first-time access entity. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0059] Specifically, step S1 can ensure that the identity of each access entity is verified immediately and strictly at the time of first communication to prevent unauthorized access.

[0060] In some embodiments, when an entity (user or device) attempts to access a server for the first time, it sends a request data packet containing authentication information, which may include a username, a hash value of a password, a digital signature, or other forms of authentication credentials; after receiving the request data packet, the server first uses the SPA mechanism to verify the integrity and authenticity of the data packet. If the SPA verification fails (i.e., the data packet has been tampered with or is not from a known legitimate entity), the server immediately rejects the access request and may record a security event. If the SPA verification passes, the server will then extract the authentication information in the request data packet, and the server uses the stored legitimate user identity information to verify the authentication information in the request. If the authentication information matches (for example, the hash value of the username and password matches), the authentication is successful; otherwise, the authentication fails; if the authentication passes, the server will legally authorize the access request according to the user's permissions and policies, and the server may generate a session token (session A server sends a token or establishes a secure session to identify the user and maintain the session state in subsequent interactions. Once the user passes the identity authentication and obtains legal authorization, the server will allow the user to access the requested resources or services. During the entire session, the server may continue to use the SPA mechanism to verify the authenticity and integrity of subsequent data packets. If the identity authentication fails (whether the SPA verification fails or the identity authentication information does not match), the server will reject the access request. The server may record a failed attempt and take further actions according to the security policy (such as locking the account, sending an alarm, etc.).

[0061] It should be noted that for subsequent access requests, the server may use session tokens or secure sessions to identify the user and omit the authentication step (but SPA verification will still be performed). If the session expires or is invalid, the server will require the user to re-authenticate.

[0062] Step S2, introducing the BIC algorithm into the legally authorized access request, and performing a trust evaluation on the network nodes based on the BIC algorithm and the Bayesian network;

[0063] Specifically, a network node is a part of an entity, which specifically refers to an entity that is connected to a network and communicates.

[0064] In some implementations, the BIC algorithm is introduced into the access request for legal authorization, and the trustworthiness of the network nodes is evaluated based on the BIC algorithm and the Bayesian network, including steps S21 to S24.

[0065] Step S21, defining the trust level and trust factors of the network node, wherein the trust level is used to indicate the degree of trust of the network node, and the trust factor is a key factor affecting the degree of trust;

[0066] Specifically, the trust levels are clearly divided into high trust (T1), medium trust (T2), and low trust (T3), which are used to indicate the degree of trust in network nodes. The key factors affecting trust are defined as follows: behavioral data (F1), which indicates the communication behavior of the node, such as communication frequency, data integrity, etc.; historical records (F2), which indicate the past behavior records of the node, such as whether there have been any violations or security incidents; and security vulnerabilities (F3), which indicate the current security vulnerabilities of the node, such as unpatched software, known vulnerabilities, etc.

[0067] Step S22, collecting relevant data affecting the trust in the network nodes and performing pre-processing;

[0068] Specifically, relevant data of network nodes are collected from the power Internet of Things system, including behavioral data, historical records, security vulnerabilities, etc.; the data is further preprocessed, including data cleaning (removing noise and outliers), data conversion (such as discretization and standardization), data integration, etc., for subsequent calculations.

[0069] Step S23, based on the defined trust level and trust factors of the network nodes and the collected relevant data affecting the trust, a network node trust evaluation model is determined in combination with the BIC algorithm and the Bayesian network model;

[0070] In some embodiments, the network node trust evaluation model is determined based on the defined trust level of the network node, the trust factor, and the collected relevant data affecting the trust, in combination with the BIC algorithm and the Bayesian network model, including:

[0071] Historical data collection: Deploy monitoring tools on the target network node to capture all network activities of the node in real time, including but not limited to inbound and outbound traffic, protocol usage, connection frequency, destination IP address, etc., and generate historical data sets;

[0072] Behavior pattern analysis, including combing through historical data, recording event logs related to nodes, such as error messages, warning prompts, etc., and preliminarily classifying network activities on nodes into regular behaviors and abnormal behaviors;

[0073] Constructing a Bayesian network model, including establishing a mapping relationship between the trust factor and the trust level based on Bayesian reasoning, and setting a priori probability and conditional probability;

[0074] When there are multiple data affecting the trust, weighting the collected data affecting the trust according to their importance in the trust evaluation;

[0075] The BIC algorithm is used to learn parameters, evaluate the degree of fit of different Bayesian network models, select the optimal Bayesian network model parameters, and obtain the corresponding network node trust evaluation model;

[0076] Specifically, we can construct multiple Bayesian network models with different complexities and use BIC to evaluate their pros and cons. By comparing the BIC values ​​of different models, we can select a model that can not only fit the observed data well but also has a high generalization ability, so as to be used for subsequent trust assessment tasks. After selecting the Bayesian network model, the accuracy and reliability of the model are verified using a test data set. The performance of the model can be evaluated by comparing the consistency between the model prediction results and the actual observation results, and the model can be adjusted and optimized based on the verification results. For example, the settings of the prior probability and conditional probability can be adjusted, or the structure of the Bayesian network can be improved until the model meets expectations. At this time, the model is the network node trust assessment model.

[0077] The network node trust evaluation model combines the prior probability and the conditional probability to calculate the trust of the network node under the currently recorded relevant data affecting the trust.

[0078] Specifically, please refer to the following links:

[0079] 1) Set the prior probability. (Assume that most nodes are initially at a medium trust level, while high trust and low trust nodes account for a small proportion)

[0080] Trust Level Prior probability T1 0.2 T2 0.5 T3 0.3

[0081] 2): Set conditional probabilities. (Set different conditional probabilities for different trust factors)

[0082] The behavior data (F1) is set to have three levels: good (G), average (M), and poor (P).

[0083] Then: |F1| conditional probability P(T|F1)|

[0084] |G|P(T1|F1=G)=0.8, P(T2|F1=G)=0.2, P(T3|F1=G)=0|

[0085] |M|P(T1|F1=M)=0.4, P(T2|F1=M)=0.5, P(T3|F1=M)=0.1|

[0086] |P|P(T1|F1=P)=0, P(T2|F1=P)=0.3, P(T3|F1=P)=0.7|

[0087] There are three levels of setting history (F2): clean (C), minor violation (S), and serious violation (V).

[0088] Then: |F2| conditional probability P(T|F2)|

[0089] |C|P(T1|F2=C)=0.7, P(T2|F2=C)=0.3, P(T3|F2=C)=0|

[0090] |S|P(T1|F2=S)=0.3, P(T2|F2=S)=0.5, P(T3|F2=S)=0.2|

[0091] |V|P(T1|F2=V)=0, P(T2|F2=V)=0.2, P(T3|F2=V)=0.8|

[0092] There are three levels of security vulnerability settings: no vulnerability (N), minor vulnerability (L), and severe vulnerability (H).

[0093] Then: |F3| conditional probability P(T|F3)

[0094] |N|P(T1|F3=N)=0.9, P(T2|F3=N)=0.1, P(T3|F3=N)=0|

[0095] |L|P(T1|F3=L)=0.5, P(T2|F3=L)=0.4, P(T3|F3=L)=0.1|

[0096] |H|P(T1|F3=H)=0, P(T2|F3=H)=0.3, P(T3|F3=H)=0.7|

[0097] 3): Calculate the trust. Using the BIC algorithm, combined with the prior probability and conditional probability, calculate the trust (posterior probability) of the network node under the current collected data, and introduce weighted processing as needed to reflect the importance of the collected data that affects the trust in the trust assessment.

[0098] Calculate the trust (posterior probability) of the network node under the current observation data, P(A|B) = \frac{P(B|A)\times P(A)}{P(B)}\]. Where A represents the trust level and B represents the collected data that affects the trust level.

[0099] It should be noted that when there are multiple trust data that affect the trust assessment at the same time, it is necessary to weight the data affecting the trust of each observation to reflect its importance in the trust assessment. These weights can be considered in the subsequent calculation of conditional probability or update of posterior probability.

[0100] For example, P(A|B_1,B_2,...,B_n)=\frac{P(A)\times\prod_{i=1}^{n}P(B_i|A)^{w_i}}{\sum_{A'\in\text{TrustLevels}}P(A')\times\prod_{i=1}^{n}P(B_i|A')^{w_i}}\]where B_1,B_2,...,B_n represent multiple collected observations, and w_i represents the weight of the i-th observation.

[0101] The network node trust evaluation model outputs the calculated trust as a trust evaluation result, which is used to feed back to the authority management module later so that it can take corresponding security measures, such as strengthening monitoring, restricting access rights, etc.

[0102] Step S24: the network node performs a trust evaluation according to the network node trust evaluation model.

[0103] Specifically, a trust evaluation process for secure communication has been completed. In practical applications, the algorithm may need to be adjusted and optimized according to specific circumstances to improve the accuracy and efficiency of the evaluation.

[0104] Step S3, determining the access rights of the network node according to the trust evaluation result;

[0105] Specifically, multiple levels of access rights are pre-set based on business needs and security requirements. These levels may include read-only access, read-write access, management access, etc., each of which corresponds to a different scope of operations and permission level. A mapping relationship between trust and access rights is established. This is usually a threshold or range that is used to determine the level of access rights corresponding to different trust scores. For example, if the trust score of a node is very high, it is granted the highest level of access rights; if the trust score is low, it may only be granted limited access rights.

[0106] Step S4, continuously monitoring and recording the behavior of the network node, and determining the trust of the current network node according to the recorded historical data and behavior pattern of the network node and the trust evaluation result;

[0107] The behavior of network nodes needs to be continuously monitored, including but not limited to the communication activities, data processing, access requests, etc. of the nodes. Through monitoring, the behavior data of the nodes can be captured in real time and recorded for subsequent analysis. The historical behavior data of network nodes is collected and stored, including but not limited to the access records, communication logs, data processing results, etc. of the nodes. By analyzing the historical data, the behavior patterns of the nodes can be identified, such as the activity frequency, access habits, communication patterns, etc. of the nodes. The historical data can be analyzed and mined using machine learning, data mining and other technologies to identify the behavior patterns of the nodes. These behavior patterns can be used to predict the future behavior of the nodes and serve as one of the bases for trust evaluation.

[0108] Based on the recorded historical data and behavior patterns, as well as the previous trust evaluation results, a trust evaluation algorithm (such as the BIC algorithm combined with the Bayesian network) is used to calculate the trust of the current network node. The trust evaluation algorithm will comprehensively consider the node's historical behavior, behavior patterns, trust evaluation results, and possible risk factors to give a quantitative trust score. As time goes by and the node's behavior continues to change, the node's trust score is updated regularly or in real time. The update of trust will be based on new behavior data and behavior pattern analysis, as well as possible algorithm adjustments and optimizations.

[0109] Step S5: dynamically adjust the access rights of the network node according to the trustworthiness of the current network node.

[0110] Specifically, if the trust level of a node is high, it will be granted more access rights and a higher security level. If the trust level of a node is reduced or there is abnormal behavior, the system will restrict its access rights accordingly or even mark it as a potential security threat. This dynamic adjustment mechanism helps ensure the security and stability of the system while improving its flexibility and adaptability.

[0111] In summary, continuously monitoring and recording the behavior of network nodes, and determining the trust of current network nodes based on the recorded historical data and behavior patterns and previous trust evaluation results, is an indispensable security mechanism in the lightweight power Internet of Things secure communication system. It helps to timely discover and respond to potential security threats, ensuring the normal operation of lightweight power Internet of Things secure communication and the secure transmission of data.

[0112] In some implementations, the lightweight power Internet of Things secure communication method further includes:

[0113] Identifying security threats to data packets entering and leaving the network node;

[0114] Issue corresponding security response instructions based on the identified security threats.

[0115] Specifically, the controller works with the gateway to conduct in-depth analysis of incoming and outgoing data packets, which may contain various types of information, such as sensor data, control instructions, status updates, etc. Through data packet monitoring, advanced threat identification algorithms can be used to conduct in-depth analysis and detection of data packets. These algorithms may include pattern matching, anomaly detection, behavioral analysis, etc., which are used to identify security threats such as malicious code, unauthorized access attempts, data leakage, etc. that may exist in data packets, detect abnormal or suspicious data transmission behaviors in a timely manner, identify potential security threats, and take immediate security response measures.

[0116] In some implementations, in order to improve the accuracy and timeliness of threat identification, the system will regularly update the threat library to include the latest information on security vulnerabilities, attack methods, etc. This helps the system better cope with the ever-changing security threat environment.

[0117] In some implementations, the LwM2M protocol is based on a REST framework, uses CoAP to transfer messages, and defines a model with resources as the basic unit.

[0118] Specifically, the LwM2M protocol is based on the REST framework, uses CoAP to transmit messages, and defines a model with resources as the basic unit. The data architecture is a three-level architecture of "object-instance-resource", which provides a good foundation for secure and efficient communication between power IoT devices. Among them, the REST framework is used to design the communication interface, making the interaction between the client and the server more concise, efficient and scalable. CoAP is a lightweight network protocol used for communication between resource-constrained IoT devices. It is based on the UDP protocol and has the advantages of low overhead, low power consumption and easy implementation. It is very suitable for communication between power IoT devices. The LwM2M protocol abstracts data into resources and organizes and manages them with resources as the basic unit. Each resource has a unique identifier and can contain data, execution methods or sub-resources. This resource model makes data organization and access more flexible and convenient.

[0119] In some implementations, the LwM2M protocol supports multiple security protocols of DTLS, and the protocol specifies multiple interfaces between various entities, including a boot interface, a client registration interface, a device management, a service implementation interface, and an information reporting interface.

[0120] Specifically, DTLS is a secure transport layer protocol based on the UDP protocol, which provides functions such as data encryption, integrity verification and identity authentication. The LwM2M protocol supports the DTLS protocol, which can ensure the security of communication between devices and prevent data leakage and tampering. In addition to DTLS, the LwM2M protocol may also support other security protocols, such as TLS (Transport Layer Security), etc. This allows the LwM2M protocol to select appropriate protocols according to different security requirements. For example, TLS is more suitable for environments with good network conditions. These interfaces define standard ways for devices to interact, making communication between devices more standardized and reliable. Through these interfaces, the server can effectively manage devices and provide various services. The client can obtain device information, control devices, and report events through these interfaces.

[0121] The technical solution of this embodiment is integrated with the concept of software-defined boundaries (SDP) in the zero-trust architecture and the LwM2M protocol, and the BIC algorithm is used to perform trust evaluation on network nodes. First, a single packet authorization (SPA) mechanism is adopted to ensure that the identity of each access entity is verified immediately and strictly; then, by deploying the BIC trust evaluation algorithm, the system can realize dynamic evaluation and precise control of the trust of network nodes, and flexibly adjust relevant access rights accordingly; finally, the controller and the gateway work together to conduct in-depth analysis of incoming and outgoing data packets, and make immediate security responses to effectively resist potential security threats. In this way, the security protection method and system proposed in the present invention can not only enhance the security barrier of communication between devices and servers, but also improve the security of two-way interaction between power equipment and edge servers in the power Internet of Things environment, providing a solid guarantee for the safe and stable operation of the power Internet of Things.

[0122] In the embodiment of the present application, a lightweight power Internet of Things secure communication system is provided. Figure 2 , Figure 2 A lightweight power Internet of Things security communication system in an embodiment is constructed based on the LwM2M protocol and SDP logic components. The lightweight power Internet of Things security communication system includes: an access control module 201, a BIC trust evaluation module 202 and a permission management module 203.

[0123] The access control module 201 is configured to use the SPA mechanism to authenticate the identity of the entity accessing for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0124] A BIC trust evaluation module 202 is configured to introduce a BIC algorithm into a legally authorized access request, and to perform a trust evaluation on a network node based on the BIC algorithm and a Bayesian network;

[0125] The BIC trust evaluation module 202 is further configured to determine the access rights of the network node according to the trust evaluation result;

[0126] The authority management module 203 is configured to continuously monitor and record the behavior of the network node, and determine the trust of the current network node according to the recorded historical data and behavior pattern of the network node and the trust evaluation result;

[0127] The authority management module 203 is further configured to dynamically adjust the access authority of the network node according to the trustworthiness of the current network node.

[0128] In some embodiments, the lightweight electric power Internet of Things secure communication system further includes a data packet analysis and response module 204, and the data packet analysis and response module 201 is configured to:

[0129] Conducting in-depth analysis on the incoming and outgoing data packets of the network node to obtain analysis results;

[0130] identifying security threats based on the analysis results;

[0131] Issue corresponding security response instructions based on the identified security threats.

[0132] In some embodiments, the BIC trust evaluation module 202 is further configured to define a trust level and a trust factor of a network node, wherein the trust level is used to indicate the degree of trust of the network node, and the trust factor is a key factor affecting the degree of trust;

[0133] Collect relevant data affecting the trust in the network nodes and perform preprocessing;

[0134] Based on the defined trust level and trust factors of network nodes and the collected relevant data affecting trust, the network node trust evaluation model is determined by combining the BIC algorithm and the Bayesian network model;

[0135] The network node performs trust evaluation according to the network node trust evaluation model.

[0136] In some embodiments, the BIC trust evaluation module 202 is further configured to construct a Bayesian network model, including establishing a mapping relationship between the trust factor and the trust level based on Bayesian reasoning, and setting a priori probability and conditional probability;

[0137] When there are multiple data affecting the trust, weighting the collected data affecting the trust according to their importance in the trust evaluation;

[0138] The BIC algorithm is used to learn parameters, evaluate the degree of fit of different Bayesian network models, select the optimal Bayesian network model parameters, and obtain the corresponding network node trust evaluation model;

[0139] The network node trust evaluation model combines the prior probability and the conditional probability to calculate the trust of the network node under the currently recorded relevant data affecting the trust.

[0140] For other details on how each module in the lightweight power Internet of Things secure communication system implements the above-mentioned technical solution, please refer to the description of the lightweight power Internet of Things secure communication method provided above, which will not be repeated here.

[0141] In an embodiment of the present application, a computer device is provided. Figure 3 , Figure 3 3 is a schematic diagram of the structure of a computer device in an embodiment. The device includes a memory 301 and a processor 302. The memory 301 stores a computer program. When the computer program is executed by the processor 302, the processor 302 performs the following steps:

[0142] The SPA mechanism is used to authenticate the identity of the entity accessing the service for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0143] Introducing the BIC algorithm for legally authorized access requests, and evaluating the trustworthiness of network nodes based on the BIC algorithm and the Bayesian network;

[0144] Determining access rights of the network node according to the trust evaluation result;

[0145] Continuously monitoring and recording the behavior of the network node, and determining the trustworthiness of the current network node according to the recorded historical data and behavior pattern of the network node and the trustworthiness evaluation result;

[0146] The access rights of the network node are dynamically adjusted according to the trustworthiness of the current network node.

[0147] Among them, the processor 302 can also be called a CPU (Central Processing Unit), and the processor 302 may be an integrated circuit chip with signal processing capabilities; the processor 302 can also be a general-purpose processor, DSP (Digital Signal Process), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, among which the general-purpose processor can be a microprocessor or the processor 302 can also be any conventional processor, etc.

[0148] In an embodiment of the present application, a computer readable storage medium is provided. Figure 4 , Figure 4 The structure diagram of a computer-readable storage medium in an embodiment is a schematic diagram, on which a readable computer program 401 is stored; wherein the computer program 401 may be stored in the above storage medium in the form of a software product, and includes a number of instructions for causing a computer device (which may be a personal computer, a server machine, or a network device, etc.) or a processor to perform the following steps:

[0149] The SPA mechanism is used to authenticate the identity of the entity accessing the service for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited.

[0150] Introducing the BIC algorithm for legally authorized access requests, and performing trust evaluation on network nodes based on the BIC algorithm and Bayesian network;

[0151] Determining access rights of the network node according to the trust evaluation result;

[0152] Continuously monitoring and recording the behavior of the network node, and determining the trustworthiness of the current network node according to the recorded historical data and behavior pattern of the network node and the trustworthiness evaluation result;

[0153] The access rights of the network node are dynamically adjusted according to the trustworthiness of the current network node.

[0154] The aforementioned storage media include: U disk, mobile hard disk, magnetic disk or CD, ROM (Read-Only Memory), RAM (Random Access Memory) and other media that can store program code, or terminal devices such as computers, service machines, mobile phones, and tablets.

[0155] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0156] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0157] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A lightweight power Internet of Things secure communication method, characterized in that: The lightweight power Internet of Things security communication method is applied to the lightweight power Internet of Things security communication system, and the lightweight power Internet of Things security communication system is constructed based on the LwM2M protocol and the SDP logic component. The method includes: The SPA mechanism is used to authenticate the identity of the entity accessing the service for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited. Introducing the BIC algorithm for legally authorized access requests, and evaluating the trustworthiness of network nodes based on the BIC algorithm and the Bayesian network; Determining access rights of the network node according to the trust evaluation result; Continuously monitoring and recording the behavior of the network node, and determining the trustworthiness of the current network node according to the recorded historical data and behavior pattern of the network node and the trustworthiness evaluation result; The access rights of the network node are dynamically adjusted according to the trustworthiness of the current network node.

2. The lightweight power Internet of Things secure communication method according to claim 1 is characterized in that: The method further comprises: Identifying security threats to data packets entering and leaving the network node; Issue corresponding security response instructions based on the identified security threats.

3. The lightweight power Internet of Things secure communication method according to claim 2 is characterized in that: The BIC algorithm is introduced into the access request for legal authorization, and the trustworthiness of the network nodes is evaluated based on the BIC algorithm and the Bayesian network, including: Defining the trust level and trust factors of the network nodes, wherein the trust level is used to indicate the degree of trust of the network nodes, and the trust factors are key factors affecting the degree of trust; Collect relevant data affecting the trust in the network nodes and perform preprocessing; Based on the defined trust level and trust factors of network nodes and the collected relevant data affecting trust, the network node trust evaluation model is determined by combining the BIC algorithm and the Bayesian network model; The network node performs trust evaluation according to the network node trust evaluation model.

4. According to claim 3, the lightweight power Internet of Things secure communication method is characterized in that: The trust level and trust factors of the defined network nodes, the collected relevant data affecting the trust, and the BIC algorithm and the Bayesian network model are combined to determine the network node trust evaluation model, including: Constructing a Bayesian network model, including establishing a mapping relationship between the trust factor and the trust level based on Bayesian reasoning, and setting a priori probability and conditional probability; When there are multiple data affecting the trust, weighting the collected data affecting the trust according to their importance in the trust evaluation; The BIC algorithm is used to learn parameters, evaluate the degree of fit of different Bayesian network models, select the optimal Bayesian network model parameters, and obtain the corresponding network node trust evaluation model; The network node trust evaluation model combines the prior probability and the conditional probability to calculate the trust of the network node under the currently recorded relevant data affecting the trust.

5. The lightweight power Internet of Things secure communication method according to claim 4 is characterized in that: The LwM2M protocol is based on the REST framework, uses CoAP to transfer messages, and defines a model with resources as the basic unit.

6. The lightweight power Internet of Things secure communication method according to claim 5 is characterized in that: The LwM2M protocol supports multiple security protocols of DTLS, and the protocol specifies multiple interfaces between various entities, including a boot interface, a client registration interface, a device management, a service implementation interface, and an information reporting interface.

7. A lightweight power Internet of Things security communication system, characterized in that: The lightweight power Internet of Things security communication system is constructed based on the LwM2M protocol and the SDP logic component. The lightweight power Internet of Things security communication system includes: The access control module is used to use the SPA mechanism to authenticate the identity of the entity that accesses the site for the first time. If the authentication is successful, the access request is legally authorized. If the authentication is not successful, the access request is prohibited. A BIC trust evaluation module, used to introduce the BIC algorithm into the access request for legal authorization, and to evaluate the trust of the network nodes based on the BIC algorithm and the Bayesian network; The BIC trust evaluation module is further used to determine the access rights of the network node according to the trust evaluation result; A rights management module, used to continuously monitor and record the behavior of the network node, and determine the trustworthiness of the current network node based on the recorded historical data and behavior patterns of the network node and the trustworthiness evaluation result; The authority management module is further used to dynamically adjust the access authority of the network node according to the trustworthiness of the current network node.

8. The lightweight power Internet of Things security communication system according to claim 7 is characterized in that: The lightweight power Internet of Things secure communication system further includes a data packet analysis and response module, which is used to: Conducting in-depth analysis on the incoming and outgoing data packets of the network node to obtain analysis results; identifying security threats based on the analysis results; Issue corresponding security response instructions based on the identified security threats.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 7.

Images