A trusted network security audit method and system for 5G network control services

Abstract

The present invention discloses a network trusted audit method and system for control business network applicable to 5G network, which relates to the field of smart grid security technology. The method includes: obtaining original audit data for encryption and signature processing, generating signed encrypted audit data; transmitting the signed encrypted audit data to each node of the slice network of the management center, and obtaining the audit data transmitted to each node; performing hash calculation on the encrypted audit data in the audit data to obtain a hash value; constructing a Merkle tree based on the obtained hash value; obtaining the hash value in the Merkle tree root and the signature value in the audit data on any node, and performing verification processing. If the verification is passed, the encrypted audit data in the audit data is decrypted to obtain the original audit data and output; if the verification is not passed, the audit error information is output. The present invention can ensure that the network audit data is credible and tamper-proof, and ensure the accuracy and consistency of the data of each node.

Description

Technical Field

[0001] The present invention relates to the field of smart grid security technology, and in particular to a network security trusted audit method and system for control services applicable to 5G networks. Background Art

[0002] Since the characteristics of 5G communication are highly consistent with the needs of power communication, the integration of 5G network and power grid can bring better service provision and economic benefits to the power industry. With the integration of 5G technology and power grid, smart grid begins to transform into 5G+ smart grid. At the same time, 5G also leads to the extension of the power grid boundary, and the network attacks suffered by the power grid network also increase, and the probability of information data in the power grid being changed and leaked increases accordingly.

[0003] Smart grids transmit massive amounts of data, including user electricity privacy data, real-time electricity price data, resource scheduling data, communication data between basic grid equipment, etc. Once these data are transmitted in the network and attacked and exploited by criminals, they will pose a huge threat to the grid or users. Therefore, it is extremely important to ensure the security of 5G+ smart grids.

[0004] Network security protection includes pre-event prediction and post-event tracking. Pre-event prediction is to achieve early warning of security incidents through means such as log auditing, intrusion detection event analysis, and the perception and monitoring of the security status of the network and equipment connected to the power grid; post-event tracking is to track the event and locate the event source through the centralized event audit system and intrusion detection system after the security incident occurs, formulate corresponding security strategies and generate problem reports to prevent such attacks from happening again.

[0005] Blockchain is a data structure that uses blockchain technology to build an information sharing database to achieve secure storage and call of data resources. Blockchain technology has the characteristics of decentralization, trustlessness, transparency, traceability, immutability, anonymity, and reliability, and is gradually being applied to finance, the Internet of Things, entertainment and other fields. At present, in blockchain-based network security audits, when using public and private key encryption and digital certificate certification agencies, there may be problems of lack of credibility and invalid signatures.

[0006] Glossary

[0007] KSI, Keyless Signature Infrastructure, is a signature infrastructure without passwords. This blockchain technology only uses hash function encryption, so that authentication only relies on the security of the hash function and the validity of the public ledger. It can perform large-scale data authentication without relying on centralized trust institutions.

[0008] Merkle tree is a hash binary tree, which is a data structure used to quickly summarize and verify the integrity of large-scale data. The leaves of the Merkle tree are the hash values ​​of data blocks (for example, files or collections of files), and non-leaf nodes are the hashes of the concatenated strings of their corresponding child nodes. Summary of the invention

[0009] The purpose of the present invention is to provide a method and system for 5G network control business network security trust audit, which can ensure the network audit data is trustworthy and tamper-proof, and ensure the accuracy and consistency of the data of each node. The technical solution adopted by the present invention is as follows.

[0010] On the one hand, the present invention provides a network security trustworthy audit method for regulation services applicable to 5G networks, comprising:

[0011] Obtaining original audit data, wherein the original audit data is audit data with the management center slice network as the target transmission direction;

[0012] Encrypt and sign the original audit data to generate signed encrypted audit data;

[0013] Transmit the signed encrypted audit data to each node of the management center slice network, and obtain the data transmitted to each node as the data to be audited;

[0014] Perform hash calculations on the encrypted audit data in the audit data of each node to obtain the hash value corresponding to each audit data;

[0015] Build a Merkle tree based on the obtained hash value;

[0016] Obtain the hash value in the Merkle tree root and the signature value in the data to be audited on any node, perform verification processing, and obtain the verification result;

[0017] According to the verification result: if the verification passes, the encrypted audit data in the audit data is decrypted to obtain the original audit data, and the original audit data is output; if the verification fails, the audit error information is output.

[0018] Optionally, the method further includes encapsulating the data to be audited obtained from each node and the Merkle tree information into a data block with a timestamp, and adding the data block to the blockchain;

[0019] Among them, in each block in the blockchain, the leaf node of the Merkle tree stores the hash value of the encrypted audit data in the data to be audited of each node, and the parent node stores the hash value of the two child nodes. If the number of data points n of the data to be audited does not meet the condition n%4=0, the hash value corresponding to the data to be audited of the last node is repeatedly added to the leaf node until the number of leaf nodes is a multiple of 4; the hash value of the root node of the Merkle tree is stored in the block header of the block.

[0020] The specific contents of the blockchain storage of data blocks can refer to the existing technology. In the above scheme, the root node value recorded by the blockchain cannot be changed, which can facilitate the extraction of information to be verified and the traceability after verification anomalies. It has a deterrent effect on internal personnel and prevents network attacks from within the smart grid. When joining the blockchain, the block file can be named according to the Merkle tree root node value and timestamp information, and the digital signature technology can be used to encrypt and protect the block file and its information data.

[0021] The present invention adopts the Merkle tree technology to avoid excessive redundancy in the verification of a large amount of data, and can efficiently and concisely complete the verification of the audited data transmitted on a large number of nodes.

[0022] Optionally, in the method, the step of obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node is: obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node from the block body of the blockchain. Thus, for the data to be audited recorded in a certain block, the hash value and signature value can be accessed from the blockchain at any time for verification, and the reliability of the data can be guaranteed.

[0023] Optionally, the method further includes, based on the verification result: if the verification fails, obtaining Merkle tree information of the corresponding block from the blockchain, and locating the node with abnormal data based on the Merkle tree information.

[0024] Optionally, the original audit data originates from a slice network where the transmission network or distribution network is located, or a power user network; the original audit data is collected from a border router connected to a slice network of a management center;

[0025] The transmission of the signed encrypted audit data to each node of the slice network of the management center is as follows: the signed encrypted audit data is sent to the border router, and the border router transmits the signed encrypted audit data to each node of the slice network;

[0026] The original audit data includes at least one or more of user power consumption data, real-time power price data and distribution network fault information, but is not limited to the power grid data mentioned above.

[0027] Optionally, encrypting and signing the original audit data to generate signed encrypted audit data includes:

[0028] Generate a key pair and use the public key in it to encrypt the original audit data;

[0029] Calculate the hash value of the original audit data using a preset hash function, send the hash value to the keyless signature system, and receive the digital signature returned by the keyless signature system;

[0030] Generate signed encrypted audit data based on the encryption result of the original audit data and the digital signature;

[0031] In the method, decrypting the encrypted audit data in the audit data to obtain the original audit data is to use the private key in the key pair to decrypt the encrypted audit data.

[0032] Optionally, the original audit data is encrypted using a Paillier encryption algorithm;

[0033] The preset hash function is a salted hash function, and the calculating of the hash value of the original audit data includes:

[0034] Generate an iterative initial hash value A of the original audit data using a preset hash function;

[0035] Based on the iterative initial hash value A, according to the number of data points of the original audit data, using a preset hash function and a preset iteration rule, a final hash value is calculated;

[0036] In the method, the encrypted audit data in the audited data of each node is hashed respectively using the preset hash function.

[0037] Optionally, the iterative calculation formula corresponding to the preset iterative rule is:

[0038]

[0039] In the formula, A m represents the final hash value obtained in the mth iteration, Hash(·) represents the preset hash function, and the number of iterations Where n represents the number of data points in the original audit data.

[0040] In the above technical solution, the salted hash function can use the SHA-521 secure hash algorithm. At the same time, it can be seen that the iterative algorithm of the present invention after calculating the hash value of the original audit data is essentially the same as the algorithm for establishing a binary tree in the Merkle tree algorithm, which can ensure that if the data transmission process is not tampered with, the verification based on the root hash value of the Merkle tree can pass normally, thereby achieving the effect of simultaneously verifying the digital signatures of the audited data of multiple nodes.

[0041] Optionally, obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node, performing verification processing, and obtaining the verification result includes:

[0042] The hash value in the root of the Merkle tree and the signature value in the data to be audited on any node are transmitted to the keyless signature system for verification, and the verification result returned by the keyless signature system is obtained.

[0043] In the above scheme, the signature and verification services are provided by the existing keyless signature system KSI (Keyless Signatures' Infrastructure), which does not require the computing resources of the power grid itself. Compared with the traditional offline method of generating digital signatures, the digital signatures generated by the server of the keyless signature system are not easily affected by key leakage, which can ensure a more accurate audit process.

[0044] In a second aspect, the present invention provides a network security trusted audit device for control services applicable to 5G networks, including:

[0045] An original audit data acquisition module is configured to acquire original audit data, wherein the original audit data is audit data with the management center slice network as the target transmission direction;

[0046] The encryption and signature processing module is configured to encrypt and sign the original audit data to generate signed encrypted audit data;

[0047] The audit data acquisition module is configured to transmit the signed encrypted audit data to each node of the management center slice network, and obtain the data transmitted to each node as the audit data;

[0048] The audit data hash calculation module is configured to perform hash calculations on the encrypted audit data in the audit data of each node to obtain a hash value corresponding to each audit data;

[0049] A Merkle tree construction module, configured to construct a Merkle tree based on the obtained hash value;

[0050] The verification module is configured to obtain the hash value in the Merkle tree root and the signature value in the audited data on any node, perform verification processing, and obtain a verification result;

[0051] And, the audit result output module is configured to: according to the verification result: if the verification passes, decrypt the encrypted audit data in the audit data to obtain the original audit data, and output the original audit data; if the verification fails, output the audit error information.

[0052] Optionally, the network security trusted audit device for the regulation and control service of the 5G network further includes a block generation module, which is configured to:

[0053] The audited data obtained from each node and the Merkle tree information are encapsulated into a data block with a timestamp, and the data block is added to the blockchain.

[0054] In a third aspect, the present invention provides a network security trusted audit system for regulation services applicable to 5G networks, including an audit server, an encryption server, and a block generation server;

[0055] The audit server is configured to obtain original audit data with the management center slice network as the target transmission direction and send it to the encryption server;

[0056] The encryption server is configured to encrypt and sign the original audit data, generate signed encrypted audit data, and return it to the audit server;

[0057] The audit server is also configured to transmit the signed encrypted audit data to each node of the management center slice network, obtain the data transmitted to each node, send it to the block generation server as the data to be audited, and perform hash calculations on the encrypted audit data in the data to be audited of each node, obtain the hash value corresponding to each data to be audited, and transmit it to the block generation server;

[0058] The block generation server is configured to construct a Merkle tree based on the hash value corresponding to each data to be audited, and, in response to receiving the hash value request information from the encryption server, return the hash value in the root of the Merkle tree and the signature value in the data to be audited on any node to the encryption server;

[0059] The encryption server is also configured to perform verification processing based on the hash value in the Merkle tree root and the signature value in the data to be audited on any node, and obtain the verification result and transmit it to the audit server;

[0060] The audit server is configured to: according to the verification result, if the verification is passed, decrypt the encrypted audit data in the audit data to obtain the original audit data, and output the original audit data; if the verification is not passed, output the audit error information.

[0061] Optionally, the network security trusted audit system for regulating and controlling business also includes multiple distributed hosts. The management center slice network exchanges data with the transmission network, distribution network or power user network that generates original audit data through a border router. The distributed hosts are configured to obtain original audit data from the border router and send it to the audit server, receive signed and encrypted audit data from the audit server and send it to the management center slice network, and communicate with each node in the management center slice network to obtain data to be audited and send it to the audit server.

[0062] Optionally, the block generation server is further configured to:

[0063] Encapsulate the audited data corresponding to each node and the Merkle tree information into a data block with a timestamp, and add the data block to the blockchain;

[0064] Get the audit error information output by the audit server and encapsulate it into the corresponding block in the blockchain.

[0065] Optionally, the business regulation network security trusted audit system also includes an audit display terminal, which is used to receive original audit data or audit error information output by the audit server and display the received data information.

[0066] Optionally, the encryption server encrypts and signs the original audit data to generate signed encrypted audit data, including:

[0067] Generate a key pair, use the public key to encrypt the original audit data, and transmit the private key to the audit server;

[0068] Calculate the hash value of the original audit data using a preset hash function, send the hash value to the keyless signature system, and receive the digital signature returned by the keyless signature system;

[0069] Generate signed encrypted audit data based on the encryption result of the original audit data and the digital signature;

[0070] The audit server decrypts the encrypted audit data in the audit data by using the private key in the key pair to decrypt the encrypted audit data.

[0071] Optionally, a virtual firewall is configured on the encryption server, and the externally accessible objects in the access control list of the virtual firewall are only configured with the keyless signature system. That is, in the present invention, the data interaction between the encryption server and the external network is limited to the data interaction with the keyless signature system, which can resist potential network attacks.

[0072] Beneficial Effects

[0073] The present invention combines data encryption and verification technology, obtains, encrypts and verifies the original audit data before entering the management center slice network, obtains the signed encrypted audit data, and transmits it back to the management center slice network, so that the signed encrypted audit data is transmitted to each node in the management center slice network, and then the data on each node is obtained as the audit data for hash value calculation, and the Merkle tree technology is used to simplify the data verification process, and finally the judgment of whether the audit data has been tampered with is realized and the original audit data is obtained. On the one hand, the present invention ensures the privacy and security of audit data through data encryption technology, and on the other hand, a large amount of data can be quickly compared through the Merkle tree to realize rapid data verification, and the tampered data can be easily located. In addition, the present invention introduces a keyless signature authentication system to replace the commonly used private key signature, which saves power grid system resources and does not rely on keys to verify the legitimacy of digital signatures; the application of blockchain technology also enables the audit process data of the present invention to be effectively protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 The figure shows a flow chart of an embodiment of a method for trusted auditing of network security of a regulation service of a 5G network applicable to the present invention;

[0075] Figure 2 Shown is a schematic diagram of a blockchain structure in an embodiment of the present invention;

[0076] Figure 3 The figure shows an architecture diagram of an embodiment of a network security trusted audit system for regulation and control services applicable to 5G networks according to the present invention. DETAILED DESCRIPTION

[0077] The invention is further described below with reference to the accompanying drawings and specific embodiments.

[0078] The technical concept of the present invention is: for the regulation and control business network, especially the power 5G regulation and control business network, in order to avoid data tampering during wireless communication and ensure the accuracy and consistency of 5G network node data, the original audit data is obtained before the power audit data is transmitted to the management center slice network, and encrypted and signed using a keyless signature system. The signed encrypted audit data is then sent to the management center slice network, and then the data transmitted on each network node is obtained, and the Merkle tree algorithm is used to efficiently verify the signature of the data of multiple nodes, and whether the audit data is safe and reliable is judged according to the verification results.

[0079] Example 1

[0080] Based on the above invention concept, this embodiment introduces a network security trustworthy audit method for regulation services applicable to 5G networks, including:

[0081] Obtaining original audit data, wherein the original audit data is audit data with the management center slice network as the target transmission direction;

[0082] Encrypt and sign the original audit data to generate signed encrypted audit data;

[0083] Transmit the signed encrypted audit data to each node of the management center slice network, and obtain the data transmitted to each node as the data to be audited;

[0084] Perform hash calculations on the encrypted audit data in the audit data of each node to obtain the hash value corresponding to each audit data;

[0085] Build a Merkle tree based on the obtained hash value;

[0086] Obtain the hash value in the Merkle tree root and the signature value in the data to be audited on any node, perform verification processing, and obtain the verification result;

[0087] According to the verification result: if the verification passes, the encrypted audit data in the audit data is decrypted to obtain the original audit data, and the original audit data is output; if the verification fails, the audit error information is output.

[0088] Example 2

[0089] Based on the same inventive concept as Example 1, this example makes further improvements on the technical solution of Example 1.

[0090] The method for trusted network security audit of the regulation service of the 5G network in this embodiment also includes: encapsulating the audited data obtained from each node and the Merkle tree information into a data block with a timestamp, and adding the data block to the blockchain;

[0091] In the method, the step of obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node is as follows: obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node from the block body of the blockchain.

[0092] In this method, if the final verification fails, the audit error information is also stored in the corresponding block.

[0093] refer to Figure 1 As shown, this embodiment specifically involves the following contents.

[0094] 1. Acquisition of original audit data

[0095] The management center slice network exchanges data with the transmission network, distribution network or power user network that generates the original audit data through the border router. Therefore, the present invention can obtain the original audit data with the management center slice network as the target transmission direction from the border router.

[0096] The original audit data includes at least one or more of user power consumption data, real-time power price data and distribution network fault information, but is not limited to the power grid data mentioned above.

[0097] 2. Encryption and Signature of Original Audit Data

[0098] The collected original audit data is encrypted. This embodiment adopts the Paillier encryption algorithm. First, a key pair is generated, and then the public key is used to encrypt the original audit data. The private key in the key pair is used to decrypt the encrypted audit data when the subsequent verification is passed.

[0099] When signing encrypted audit data, the present invention introduces the keyless signature system KSI technology, which is a globally distributed system for providing timestamp and server-supported digital signature services. Using the KSI system to implement signature and verification can greatly save the computing resources of the power grid system. The specific signature process includes:

[0100] The preset hash function is used to calculate the iterative initial hash value A of the encrypted audit data. The number of iterations m is determined according to the number of data points n in the original audit data. The final hash value is obtained by iterative calculation according to the following iterative formula:

[0101]

[0102] In the formula, A m Represents the final hash value obtained at the mth iteration, the number of iterations Hash(·) represents a preset hash function, which is a salted hash function, and the SHA-521 secure hash algorithm can be selected. In the present invention, the hash function should have the characteristics of fast forward speed, difficult reverse, input sensitivity, and conflict avoidance. The salted hash function, that is, the hash operation is performed after inserting a specific string at any position of the information. Salting can largely ensure the security of the hash function;

[0103] The calculated final hash value is transmitted to the keyless signature system to obtain the digital signature value returned by the keyless signature system.

[0104] At this point, signed encrypted audit data may be generated based on the encrypted audit data and the digital signature value.

[0105] 3. Acquisition of Data to be Audited

[0106] After obtaining the signed encrypted audit data, this embodiment sends the signed encrypted audit data back to the management center slice network so that the data is transmitted to each node in the network, and then obtains the data transmitted at each node as the data to be audited. If the data has not been tampered with, the data obtained at each node should be consistent and are all signed encrypted audit data.

[0107] 4. Merkle tree construction and signature verification

[0108] In the traditional data verification method, for a large amount of node data, each node data needs to be verified separately, which requires huge computing resources and has extremely low verification efficiency. For the application scenario of the present invention, it is necessary to verify the data obtained on all nodes separately before determining whether there is data tampering in the system. Therefore, this embodiment introduces the Merkle tree technology.

[0109] First, the hash value is calculated for the encrypted audit data in the original audit data of each node. The hash function used here is the same as the hash function used when the encrypted original audit data is hashed. Therefore, if the data has not been tampered with, the hash value calculated here should be A.

[0110] Then, a Merkle tree is constructed. The leaf nodes of the Merkle tree store the hash values ​​of the encrypted audit data in the audited data of each node. The parent node stores the hash values ​​of the two child nodes. If the number of data points n of the audited data does not meet the condition n%4=0, the hash value corresponding to the audited data of the last node is repeatedly added to the leaf node until the number of leaf nodes is a multiple of 4. It can be seen from this that if the original audit data corresponding to each leaf node is consistent and has not been tampered with, the hash value on each leaf node should be A, and the final Merkle tree and hash value should be Am.

[0111] In order to make data storage and transmission more reliable and facilitate subsequent audit and traceability, this embodiment encapsulates the audited data obtained from each node and the Merkle tree information into a data block with a timestamp, and adds the data block to the blockchain; the hash value of the root node of the Merkle tree is stored in the block header of the block. Figure 2 shown.

[0112] When it is necessary to verify the audited data corresponding to any block, the hash value in the Merkle tree root stored in the block and the signature value in the audited data on any node are obtained and sent to the KSI system. The KSI system verifies the hash value based on the signature value. If it is found that the hash value in the Merkle tree root is not Am, it means that the data has changed during the transmission process and there is a possibility of tampering. The KSI system will return a verification failure message, otherwise it will return a verification pass message.

[0113] 5. Audit Results Output

[0114] If the KSI system returns verification information, the private key in the key pair can be used to decrypt the encrypted audit data in the audit data to obtain the original audit data, which can then be output and displayed.

[0115] If the KSI system returns verification failure information, an audit error report can be generated for output. The generated audit error report information can also be stored in the corresponding block of the blockchain.

[0116] Since the hash function has a fast forward operation, the Merkle tree can quickly compare a large amount of data. Therefore, the application of the Merkle tree technology in the present invention greatly simplifies the simultaneous verification process of multi-node data. At the same time, the application of the Merkle tree technology can also facilitate rapid tracing after verification failure. If two Merkle roots are the same, it means that the two sets of data are the same. When the audit data is tampered with, the Merkle tree can quickly locate the modification and locate the changed data node from the root node in a maximum of O(lgn) time according to the tree structure.

[0117] Example 3

[0118] In accordance with the inventive concept based on embodiments 1 and 2, this embodiment introduces a network security trusted audit device for regulation services applicable to 5G networks, including:

[0119] An original audit data acquisition module is configured to acquire original audit data, wherein the original audit data is audit data with the management center slice network as the target transmission direction;

[0120] The encryption and signature processing module is configured to encrypt and sign the original audit data to generate signed encrypted audit data;

[0121] The audit data acquisition module is configured to transmit the signed encrypted audit data to each node of the management center slice network, and obtain the data transmitted to each node as the audit data;

[0122] The audit data hash calculation module is configured to perform hash calculations on the encrypted audit data in the audit data of each node to obtain a hash value corresponding to each audit data;

[0123] A Merkle tree construction module, configured to construct a Merkle tree based on the obtained hash value;

[0124] The verification module is configured to obtain the hash value in the Merkle tree root and the signature value in the audited data on any node, perform verification processing, and obtain a verification result;

[0125] And, the audit result output module is configured to: according to the verification result: if the verification passes, decrypt the encrypted audit data in the audit data to obtain the original audit data, and output the original audit data; if the verification fails, output the audit error information.

[0126] Furthermore, the network security trusted audit device for the regulation and control service of the 5G network in this embodiment also includes a block generation module, which is configured to:

[0127] The audited data obtained from each node and the Merkle tree information are encapsulated into a data block with a timestamp, and the data block is added to the blockchain.

[0128] The specific functional implementation of the above functional modules refers to the relevant steps in the method of Example 1.

[0129] Example 4

[0130] This embodiment introduces a network security trustworthy audit system for control services applicable to 5G networks, including an audit server, an encryption server, and a block generation server. Figure 3 As shown, the system also includes multiple distributed hosts and an audit display terminal. The workflow of the system executing an audit task is as follows.

[0131] The management center slice network exchanges data with the transmission network, distribution network or power user network that generates the original audit data through the border router. The distributed host obtains the original audit data from the border router and sends it to the audit server. The audit server receives the original audit data transmitted by the distributed host with the management center slice network as the target transmission direction and sends it to the encryption server.

[0132] The encryption server generates a key pair, and uses the public key in it to encrypt the received original audit data; and uses a preset hash function to calculate the hash value of the encrypted audit data, and sends the calculated hash value to the keyless signature system KSI for signature processing. The keyless signature system returns a digital signature value to the encryption server, and the encryption server uses the digital signature value and the encrypted audit data to generate signed encrypted audit data and returns it to the audit server. Among them, a virtual firewall is configured on the encryption server, and the externally accessible objects in the access control list of the virtual firewall are only configured with the keyless signature system, so that the data interaction between the encryption server and the external network is limited to the data interaction with the keyless signature system to resist potential network attacks.

[0133] After receiving the signed and encrypted audit data, the audit server sends the data to the management center slice network through the distributed host through the border router, and transmits it to each network node of the slice network. The audit server communicates with each network node of the management center slice network to obtain the data transmitted on the node as the data to be audited.

[0134] The audit server performs hash calculations on the encrypted audit data in the audited data of each node, obtains the hash value corresponding to each audited data, and sends the audited data of each node and the calculated hash value to the block generation server for transmission to the block generation server. The hash function of the hash calculation here is the same as the hash function used by the encryption server to calculate the hash value of the encrypted original audit data, both of which are salted hash functions, such as the SHA-521 secure hash algorithm.

[0135] The block generation server constructs a Merkle tree based on the hash value of each data to be audited, and encapsulates the data to be audited corresponding to each node and the Merkle tree information into a data block with a timestamp, and adds the data block to the blockchain.

[0136] When the audit data of a certain block needs to be verified, the encryption server sends a hash value request message to the block generation server. In response to receiving the hash value request message, the block generation server returns the hash value in the Merkle tree root and the signature value in the audit data on any node to the encryption server;

[0137] The encryption server sends the hash value in the Merkle tree root and the signature value in the audited data on any node to the keyless signature system for verification, obtains the verification result returned by the keyless signature system, and transmits the verification result to the audit server.

[0138] After the audit server receives the verification result, if the verification is successful, it requests the private key from the encryption server, and then uses the private key in the key pair to decrypt the encrypted audit data.

[0139] The encrypted audit data in the audit data is decrypted to obtain the original audit data, and the original audit data is output, which can be displayed through the audit display terminal; if the verification fails, the audit error information is output, and the audit error information can also be displayed on the audit display terminal.

[0140] The audit error information output by the audit server can be encapsulated into the corresponding block in the blockchain.

[0141] In this embodiment, when the encryption server calculates the hash value of the original audit data, it first uses the preset hash function to generate the iterative initial hash value A of the encrypted original audit data; then, based on the iterative initial hash value A, according to the number of data points of the original audit data, the preset hash function and the preset iteration rule are used to calculate the final hash value; the iterative calculation formula corresponding to the preset iteration rule is:

[0142]

[0143] In the formula, A m represents the final hash value obtained in the mth iteration, Hash(·) represents the preset hash function, and the number of iterations Where n represents the number of data points in the original audit data.

[0144] It can be seen that the above iterative algorithm is the same as the algorithm for calculating the root hash value of the Merkle tree. Therefore, during verification, it is only necessary to send the Merkle tree root hash value and the signature value to the keyless signature system for verification and comparison. If the verification fails, it means that the encrypted audit data corresponding to the leaf node of the Merkle tree has been tampered with and is not the original encrypted audit data.

[0145] In summary, the present invention can ensure that network audit data is reliable and tamper-proof, ensure the accuracy and consistency of data at each node, while saving internal network resources and greatly improving the efficiency of verification and auditing.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0150] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

Claims

1. A trusted audit method for network security of control services applicable to 5G networks, characterized in that: include: Obtaining original audit data, wherein the original audit data is audit data with the management center slice network as the target transmission direction; Encrypt and sign the original audit data to generate signed encrypted audit data; Transmit the signed encrypted audit data to each node of the management center slice network, and obtain the data transmitted to each node as the data to be audited; Perform hash calculations on the encrypted audit data in the audit data of each node to obtain the hash value corresponding to each audit data; Build a Merkle tree based on the obtained hash value; Obtain the hash value in the Merkle tree root and the signature value in the data to be audited on any node, perform verification processing, and obtain the verification result; According to the verification result: if the verification passes, the encrypted audit data in the audit data is decrypted to obtain the original audit data, and the original audit data is output; if the verification fails, the audit error information is output.

2. The method according to claim 1, characterized in that: It also includes encapsulating the audited data obtained from each node and the Merkle tree information into a data block with a timestamp, and adding the data block to the blockchain; Among them, in each block in the blockchain, the leaf node of the Merkle tree stores the hash value of the encrypted audit data in the data to be audited of each node, and the parent node stores the hash value of the two child nodes. If the number of data points n of the data to be audited does not meet the condition n%4=0, the hash value corresponding to the data to be audited of the last node is repeatedly added to the leaf node until the number of leaf nodes is a multiple of 4; the hash value of the root node of the Merkle tree is stored in the block header of the block.

3. The method according to claim 2, characterized in that: The obtaining of the hash value in the Merkle tree root and the signature value in the data to be audited on any node is as follows: obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node from the block body of the blockchain.

4. The method according to claim 2, characterized in that: It also includes, according to the verification result: if the verification fails, obtaining the Merkle tree information of the corresponding block from the blockchain, and locating the node with abnormal data according to the Merkle tree information.

5. The method according to claim 1, characterized in that: The original audit data comes from the slice network where the transmission network or distribution network is located, or the power user network; the original audit data is collected from the border router connected to the slice network of the management center; The transmission of the signed encrypted audit data to each node of the slice network of the management center is as follows: the signed encrypted audit data is sent to the border router, and the border router transmits the signed encrypted audit data to each node of the slice network; The original audit data includes at least one or more of user electricity consumption data, real-time electricity price data and distribution network fault information.

6. The method according to claim 1, characterized in that: The encrypting and signing the original audit data to generate signed encrypted audit data includes: Generate a key pair and use the public key in it to encrypt the original audit data; Calculate the hash value of the original audit data using a preset hash function, send the hash value to the keyless signature system, and receive the digital signature returned by the keyless signature system; Generate signed encrypted audit data based on the encryption result of the original audit data and the digital signature; In the method, decrypting the encrypted audit data in the audit data to obtain the original audit data is to use the private key in the key pair to decrypt the encrypted audit data.

7. The method according to claim 6, characterized in that: The original audit data is encrypted using the Paillier encryption algorithm; The preset hash function is a salted hash function, and the calculating of the hash value of the original audit data includes: Generate an iterative initial hash value A of the original audit data using a preset hash function; Based on the iterative initial hash value A, according to the number of data points of the original audit data, using a preset hash function and a preset iteration rule, a final hash value is calculated; In the method, the encrypted audit data in the audited data of each node is hashed respectively using the preset hash function.

8. The method according to claim 7, characterized in that: The iterative calculation formula corresponding to the preset iterative rule is: ， In the formula, represents the final hash value obtained at the mth iteration, Represents the preset hash function, number of iterations ,in Represents the number of data points of the original audit data.

9. The method according to claim 1, characterized in that: The step of obtaining the hash value in the Merkle tree root and the signature value in the data to be audited on any node, performing verification processing, and obtaining the verification result includes: The hash value in the root of the Merkle tree and the signature value in the data to be audited on any node are transmitted to the keyless signature system for verification, and the verification result returned by the keyless signature system is obtained.

10. A network security trusted audit device for control services of 5G networks, characterized in that: include: An original audit data acquisition module is configured to acquire original audit data, wherein the original audit data is audit data with the management center slice network as the target transmission direction; The encryption and signature processing module is configured to encrypt and sign the original audit data to generate signed encrypted audit data; The audit data acquisition module is configured to transmit the signed encrypted audit data to each node of the management center slice network, and obtain the data transmitted to each node as the audit data; The audit data hash calculation module is configured to perform hash calculations on the encrypted audit data in the audit data of each node to obtain a hash value corresponding to each audit data; A Merkle tree construction module, configured to construct a Merkle tree based on the obtained hash value; The verification module is configured to obtain the hash value in the Merkle tree root and the signature value in the audited data on any node, perform verification processing, and obtain a verification result; And, the audit result output module is configured to: according to the verification result: if the verification passes, decrypt the encrypted audit data in the audit data to obtain the original audit data, and output the original audit data; if the verification fails, output the audit error information.

11. The network security trusted audit device for regulating and controlling services of 5G networks according to claim 10 is characterized in that: Also included is a block generation module configured to: The audited data obtained from each node and the Merkle tree information are encapsulated into a data block with a timestamp, and the data block is added to the blockchain.

12. A network security trusted audit system for regulation and control services applicable to 5G networks, characterized in that: Including audit servers, encryption servers and block generation servers; The audit server is configured to obtain original audit data with the management center slice network as the target transmission direction and send it to the encryption server; The encryption server is configured to encrypt and sign the original audit data, generate signed encrypted audit data, and return it to the audit server; The audit server is also configured to transmit the signed encrypted audit data to each node of the management center slice network, obtain the data transmitted to each node, send it to the block generation server as the data to be audited, and perform hash calculations on the encrypted audit data in the data to be audited of each node, obtain the hash value corresponding to each data to be audited, and transmit it to the block generation server; The block generation server is configured to construct a Merkle tree based on the hash value corresponding to each data to be audited, and, in response to receiving the hash value request information from the encryption server, return the hash value in the root of the Merkle tree and the signature value in the data to be audited on any node to the encryption server; The encryption server is also configured to perform verification processing based on the hash value in the Merkle tree root and the signature value in the data to be audited on any node, and obtain the verification result and transmit it to the audit server; The audit server is configured to: according to the verification result, if the verification is passed, decrypt the encrypted audit data in the audit data to obtain the original audit data, and output the original audit data; if the verification is not passed, output the audit error information.

13. The network security trusted audit system for 5G network regulation and control services according to claim 12 is characterized in that: It also includes multiple distributed hosts. The management center slice network exchanges data with the transmission network, distribution network or power user network that generates original audit data through the border router. The distributed host is configured to obtain the original audit data from the border router and send it to the audit server, receive signed and encrypted audit data from the audit server and send it to the management center slice network, and communicate with each node in the management center slice network to obtain the data to be audited and send it to the audit server.

14. The network security trusted audit system for 5G network regulation and control services according to claim 12 is characterized in that: The block generation server is further configured to: Encapsulate the audited data corresponding to each node and the Merkle tree information into a data block with a timestamp, and add the data block to the blockchain; Get the audit error information output by the audit server and encapsulate it into the corresponding block in the blockchain.

15. The network security trusted audit system for 5G network regulation and control services according to claim 12 is characterized in that: It also includes an audit display terminal, which is used to receive original audit data or audit error information output by the audit server and display the received data information.

16. The network security trusted audit system for 5G network regulation and control services according to claim 12 is characterized in that: The encryption server encrypts and signs the original audit data to generate signed encrypted audit data, including: Generate a key pair, use the public key to encrypt the original audit data, and transmit the private key to the audit server; Calculate the hash value of the original audit data using a preset hash function, send the hash value to the keyless signature system, and receive the digital signature returned by the keyless signature system; Generate signed encrypted audit data based on the encryption result of the original audit data and the digital signature; The audit server decrypts the encrypted audit data in the audit data by using the private key in the key pair to decrypt the encrypted audit data.

17. The network security trusted audit system for 5G network regulation and control services according to claim 12 is characterized in that: The encryption server is configured with a virtual firewall, and the externally accessible objects in the access control list of the virtual firewall are only configured with a keyless signature system.

Images