A SDP-based access authentication method and system for power Internet of Things

Abstract

The present application relates to an access authentication method and system for an SDP-based electric power Internet of Things, the system comprising an initiating host, an SDP controller, an SDP Internet gateway, an identity management system, a certificate management system, and a receiving host; wherein the initiating host is connected to the SDP controller, the SDP controller is connected to the SDP Internet gateway, the certificate management system, and the identity management system, and the receiving host is connected to the SDP controller. The present invention realizes rapid authentication and communication of various types of devices (intelligent devices and customized devices) by studying the identity recognition technology of terminal devices and lightweight encryption methods for communication, provides a method for rapid and secure terminal access for various scenarios of the electric power Internet of Things, and realizes high-level, fine-grained access control. If the protocol recognition of NGFW is integrated on the gateway, access control at the application layer can be achieved. If the analysis and filtering of the application protocol content are added, access control at the application content level can be achieved.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things access authentication, and in particular to an SDP-based access authentication method and system for electric power Internet of Things. Background Art

[0002] At present: the traditional network boundary protection mode performs security reinforcement on each endpoint or front-end host, and then accesses through VPN or traditional authentication mode. The reinforcement cost is high, some terminals (customized systems or dumb devices) cannot be reinforced, and the access is unstable and has long latency. It will not be applicable in the scenario of power Internet of Things. A large number of smart charging piles, smart meters, sensors and other equipment and various management platforms are connected to the power network environment, which makes the traditional network boundary gradually disappear. The computing power of the traditional center side is partially transferred to the endpoint. There are or are potential large numbers of uncontrollable endpoint devices with certain computing power at the front end.

[0003] Due to the large number of devices connected to the Internet of Things, many of which do not have authentication functions, access to the Internet of Things may bring security risks. Since the existing network uses secure access platforms, VPNs and other methods for external access, the existing technology can only achieve the integration of SDP and the power Internet of Things by changing the existing model.

[0004] Through the above analysis, the problems and defects of the prior art are as follows:

[0005] (1) Existing technologies cannot perform trusted authentication on access devices.

[0006] (2) Existing technologies cannot realize the integration of SDP and the power Internet of Things without changing the existing access mode. Summary of the invention

[0007] The purpose of the embodiments of the present application is to provide an access authentication method and system for the power Internet of Things based on SDP, which realizes rapid authentication and communication of various devices (smart devices and customized devices) by studying the identity recognition technology of terminal devices and the lightweight encryption method of communication, and provides a method for rapid and secure terminal access for various scenarios of the power Internet of Things, thereby realizing high-level and fine-grained access control.

[0008] To achieve the above objectives, this application provides the following technical solutions:

[0009] In a first aspect, an embodiment of the present application provides an access authentication method for an electric power Internet of Things based on SDP, comprising the following steps:

[0010] S1: The initiating host requests authorization from the SDP controller;

[0011] S2: Under the control of the SDP controller, the SDP Internet gateway and the identity management system initiate a two-way authentication between the host and the SDP Internet gateway and the identity management system;

[0012] S3: If the SDP Internet gateway authentication and identity authentication pass the initiating host, the SDP controller obtains the correct authorization access authentication message from the certificate management system and sends it to the receiving host, and notifies the receiving host that it can access the service;

[0013] S4: The SDP controller sends a message to the initiating host to tell it which receiving host it can connect to, and also sends a message to tell the receiving host who can connect to it;

[0014] S5: Accept host access service.

[0015] After all authentications, the SDP controller determines who can access what service or application, where, and when according to the configured policies, thereby implementing centralized access policy control. The SDP controller also performs more fine-grained access control.

[0016] The SDP Internet gateway performs continuous analysis and risk assessment audits on the access of the receiving host through multi-source data, and acts as an agent to respond to the initiating host request based on the results.

[0017] The SDP Internet Gateway needs to be authenticated by the SDP controller, and can only provide services or access services after passing the authentication.

[0018] After receiving the request message from the SDP controller, the SDP Internet gateway opens the corresponding port to accept the connection of the specified IP. For an attacker who has unauthenticated and illegally accessed the network, the entire network is black, and no IP will respond to the message it sends. For an attacker who can monitor the message, all he sees are the IP addresses of each SDP Internet gateway communicating with encrypted traffic, and he cannot know the real IP address and port of the initiating host and the receiving host.

[0019] The SDP controller sends a message to the initiating host to tell it the receiving host that can connect, and also sends a message to tell the receiving host who can connect to it.

[0020] The SDP controller, SDP Internet gateway, identity management system and certificate management system jointly and automatically complete the establishment and allocation of dynamic rules.

[0021] The identity management system realizes the identity recognition of the receiving host and lightweight encryption of communications.

[0022] In a second aspect, an embodiment of the present application provides an access authentication system for an electric power Internet of Things based on SDP, including an initiating host, an SDP controller, an SDP Internet gateway, an identity management system, a certificate management system, and a receiving host;

[0023] The initiating host is connected to the SDP controller, the SDP controller is connected to the SDP Internet gateway, the certificate management system, and the identity management system, and the receiving host is connected to the SDP controller.

[0024] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a program code. When the program code is executed by a processor, the steps of the access authentication method of the SDP-based power Internet of Things as described above are implemented.

[0025] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention realizes rapid authentication and communication of various types of devices (intelligent devices and customized devices) by studying the identity recognition technology of terminal devices and the lightweight encryption method of communication, and provides a method for rapid and secure terminal access for various scenarios of the power Internet of Things, realizing high-level, fine-grained access control, and at least port-level access control by default, because each receiving host and initiating host has a Host, which can control the access control at the level of which ports of each initiating host and server. If the protocol recognition of NGFW is integrated on the gateway, access control at the application layer can be achieved. If the application protocol content is parsed and filtered, access control at the application content level can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 It is a schematic diagram of the structure of an access authentication method for the power Internet of Things based on SDP provided by an embodiment of the present invention;

[0028] Figure 2 It is a schematic diagram of a centralized two-way authentication process of an access authentication method for an electric power Internet of Things based on SDP provided by an embodiment of the present invention;

[0029] Figure 3 It is a method flow chart of an SDP-based access authentication method for electric power Internet of Things provided in an embodiment of the present invention.

[0030] In the figure: 1. Initiating host; 2. SDP controller; 3. SDP Internet gateway; 4. Identity management system; 5. Certificate management system; 6. Receiving host. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0032] The terms "comprises," "comprising," or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0033] like Figure 1 The present invention provides an access authentication system for an electric power Internet of Things based on SDP, and the access authentication method for an electric power Internet of Things based on SDP includes an initiating host 1, an SDP controller 2, an SDP Internet gateway 3, an identity management system 4, a certificate management system 5, and a receiving host 6;

[0034] The initiating host 1 is connected to the SDP controller 2 , the SDP controller 2 is connected to the SDP Internet gateway 3 , the certificate management system 5 , and the identity management system 4 , and the receiving host 6 is connected to the identity management system 4 .

[0035] After all gateways are authenticated, the SDP controller 2 determines who can access what service or application, where and when according to the configured policies, thereby realizing centralized access policy control.

[0036] The SDP controller 2 can call other information to perform more fine-grained access control.

[0037] The SDP Internet gateway 3 performs continuous analysis and risk assessment audits on the access of the receiving host through multi-source data, and acts as an agent to respond to the initiating host request based on the results.

[0038] The SDP Internet gateways 3 all need to be authenticated by the SDP controller 2, and can only provide services or access services after passing the authentication.

[0039] The SDP Internet gateway 3 will only open the corresponding port for a short time to accept the connection of the specified IP after receiving the request message from the SDP controller 2. For an attacker who has unauthenticated and illegally accessed the network, the entire network is black, and no IP will respond to the message it sends. For an attacker who can monitor the message, all he sees are the IP addresses of each SDP Internet gateway 3 communicating with encrypted traffic, and he cannot know the real IP address and port of the initiating host and the receiving host.

[0040] The SDP controller 2 sends a message to the initiating host 1 to tell it the receiving host 6 that can connect, and at the same time sends a message to tell the receiving host 6 who can connect to it.

[0041] The SDP controller 2, SDP Internet gateway 3, identity management system 4 and certificate management system 5 jointly and automatically complete the establishment and allocation of dynamic rules.

[0042] The identity management system 4 implements the identity recognition technology of the receiving host 6 and lightweight encryption of communications.

[0043] like Figure 2 and Figure 3 The present invention provides an access authentication method for the power Internet of Things based on SDP, comprising the following steps:

[0044] S1: The initiating host requests authorization from the SDP controller;

[0045] S2: Under the control of the SDP controller, the SDP Internet gateway and the identity management system initiate a two-way authentication between the host and the SDP Internet gateway and the identity management system;

[0046] S3: If the SDP Internet gateway authentication and identity authentication pass the initiating host, the SDP controller obtains the correct authorization access authentication message from the certificate management system and sends it to the receiving host, and notifies the receiving host that it can access the service;

[0047] S4: The SDP controller sends a message to the initiating host to tell it which receiving host it can connect to, and also sends a message to tell the receiving host who can connect to it;

[0048] S5: Accept host access service.

[0049] The present application also provides a computer-readable storage medium, which stores a program code. When the program code is executed by a processor, the steps of the access authentication method of the power Internet of Things based on SDP as described above are implemented.

[0050] In order to make the technical means, creative features, objectives and effects achieved by the present invention easier to understand, the present invention is further described below in conjunction with embodiments.

[0051] Embodiment 1:

[0052] refer to Figure 2 , 3 , the WIFI device requests to access the power Internet of Things, the SDP controller turns on the WIFI network, the WIFI device sends a request for authorization to the SDP controller, the SDP controller sends an authentication request to the SDP Internet Gateway Identity Management System, the SDP Internet Gateway Identity Management System sends identity authentication and Internet gateway authentication to the SDP controller, the SDP controller transmits the identity authentication and Internet gateway authentication to the WIFI device, the WIFI device responds to the authentication, and transmits the authentication information required for identity authentication and Internet gateway authentication to the SDP controller, the SDP controller transmits the response information to the SDP Internet Gateway Identity Management System, which performs authentication, and returns the authentication result to the SDP controller after the authentication is completed. The SDP controller obtains the correct authorization access authentication message from the certificate management system and sends it to the WIFI device, and notifies the WIFI device that it can access the service. The SDP controller sends a message to the WIFI device to tell it to connect to the receiving host, and at the same time sends a message to tell the receiving host who can connect to the WIFI device and accept the access service of the WIFI device.

[0053] Embodiment 2:

[0054] refer to Figure 2 , 3 , the Bluetooth device requests to access the power Internet of Things, the SDP controller turns on Bluetooth and enters the corresponding Bluetooth matching code. After the connection is successful, the Bluetooth device sends a request for authorization to the SDP controller, and the SDP controller sends an authentication request to the SDP Internet Gateway Identity Management System. The SDP Internet Gateway Identity Management System sends identity authentication and Internet gateway authentication to the SDP controller. The SDP controller transmits the identity authentication and Internet gateway authentication to the Bluetooth device. The Bluetooth device responds to the authentication and transmits the authentication information required for identity authentication and Internet gateway authentication to the SDP controller. The SDP controller transmits the response information to the SDP Internet Gateway Identity Management System, which is authenticated by the SDP Internet Gateway Identity Management System. After the authentication is completed, the authentication result is returned to the SDP controller. The SDP controller obtains the correct authorization access authentication message from the certificate management system and sends it to the Bluetooth device, and notifies the Bluetooth device that it can access the service. The SDP controller sends a message to the Bluetooth device to tell it to connect to the receiving host, and at the same time sends a message to tell the receiving host who can connect to the Bluetooth device and accept the access service of the Bluetooth device.

[0055] The present invention realizes rapid authentication and communication of various devices (intelligent devices and customized devices) by studying the identity recognition technology of terminal devices and the lightweight encryption method of communication, and provides a method for rapid and secure terminal access for various scenarios of the power Internet of Things, realizing high-level, fine-grained access control, and at least port-level access control by default, because each receiving host and initiating host has Host, which can control the access control of which ports of each initiating host and server. If the protocol recognition of NGFW is integrated on the gateway, access control at the application layer can be achieved. If the application protocol content is parsed and filtered, access control at the application content level can be achieved.

[0056] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0057] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0060] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0061] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0062] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0063] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An access authentication method for power Internet of Things based on SDP, characterized in that: The steps include: S1: The initiating host requests authorization from the SDP controller; S2: Under the control of the SDP controller, the SDP Internet gateway and the identity management system initiate a two-way authentication between the host and the SDP Internet gateway and the identity management system; S3: If the SDP Internet gateway authentication and identity authentication pass the initiating host, the SDP controller obtains the correct authorization access authentication message from the certificate management system and sends it to the receiving host, and notifies the receiving host that it can access the service; S4: The SDP controller sends a message to the initiating host to tell it which receiving host it can connect to, and also sends a message to tell the receiving host who can connect to it; S5: accept host access service; After all authentications, the SDP controller decides who can access what service or application, where and when, based on the configured policies, thus achieving centralized access policy control. The SDP controller also performs more fine-grained access control; The SDP Internet gateway continuously analyzes and conducts risk assessment audits on the access of the receiving host through multi-source data, and acts as an agent to respond to the initiating host request based on the results; The SDP Internet Gateway needs to be authenticated by the SDP controller before it can provide services or access services; After receiving the request message from the SDP controller, the SDP Internet gateway opens the corresponding port to accept the connection of the specified IP. For the attacker who has unauthenticated and illegally accessed the network, the entire network is black, and no IP will respond to the message it sends. For the attacker who can monitor the message, all he sees is the IP address of each SDP Internet gateway communicating with encrypted traffic, and he cannot know the real IP address and port of the initiating host and the receiving host. The SDP controller sends a message to the initiating host to tell it which receiving host it can connect to, and also sends a message to tell the receiving host who can connect to it; The SDP controller, SDP Internet gateway, identity management system, and certificate management system jointly and automatically complete the establishment and allocation of dynamic rules; The identity management system realizes the identity recognition of the receiving host and lightweight encryption of communications.

2. An access authentication system for power Internet of Things based on SDP, characterized in that: Includes initiating host, SDP controller, SDP Internet gateway, identity management system, certificate management system, and receiving host; The initiating host is connected to the SDP controller, the SDP controller is connected to the SDP Internet gateway, the certificate management system, and the identity management system, and the receiving host is connected to the SDP controller.

3. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, and when the program code is executed by the processor, the steps of the access authentication method of the power Internet of Things based on SDP as claimed in claim 1 are implemented.

Images