Terminal security access method for edge computing nodes of power satellite Internet of Things

Abstract

The present invention discloses a terminal security access method for an edge computing node of an electric satellite Internet of Things, comprising: S1. registering a terminal device, and generating and distributing an identification key of the terminal device by the edge computing node; S2. performing access authentication on the terminal device accessing the edge computing node; S3. establishing a virtual security channel between the terminal device allowed to access and the edge computing node. The present invention can ensure the security of terminal access at the perception layer of the Internet of Things, prevent illegal and counterfeit terminal access, and effectively ensure the reliable operation of the electric satellite network.

Description

Technical Field

[0001] The present invention relates to the field of information security of Internet of Things, and in particular to a terminal security access method for an edge computing node of an electric satellite Internet of Things. Background Art

[0002] The power satellite Internet of Things is a power Internet of Things infrastructure built by power grid companies based on satellite channels to achieve communication of power facilities in areas without network coverage. It is a new type of power Internet of Things application based on satellite communications. Different from traditional power satellite emergency communications, the power satellite Internet of Things has more communication nodes and requires more satellite communication channel support. At the same time, there are a large number of sensor terminal devices accessed in the perception layer of the power satellite Internet of Things, which puts pressure on the access control of satellite communication terminals.

[0003] The sensor terminal devices in the perception layer of the power satellite Internet of Things are deployed in power equipment or facilities in environments with extremely weak network signals, sparse population, and remote locations. Due to the harsh environment and long manual operation and maintenance cycle, the perception layer terminal devices have certain security risks. The commercial use of satellites has turned satellite communications into a public network. Attackers can impersonate or replace sensor devices connected to the satellite network, which will pose a risk to the authenticity of the power data collected and transmitted back by the sensor devices, and have a serious impact on the safety and stability of power production; at the same time, attackers can also use these unattended sensor devices to attack the power satellite Internet of Things, which may even cause the paralysis of the power satellite Internet of Things and directly block the safe production application of electricity.

[0004] Therefore, a terminal security access method for edge computing nodes of power satellite Internet of Things is needed to solve the above problems. Summary of the invention

[0005] In view of this, the purpose of the present invention is to overcome the defects in the prior art and provide a terminal security access method for the edge computing node of the power satellite Internet of Things, which can ensure the security of terminal access at the Internet of Things perception layer, prevent illegal and counterfeit terminal access, and effectively ensure the reliable operation of the power satellite network.

[0006] The terminal security access method of the power satellite Internet of Things edge computing node of the present invention comprises the following steps:

[0007] S1. Register the terminal device, and the edge computing node generates and distributes the identification key of the terminal device;

[0008] S2. Perform access authentication on the terminal device accessing the edge computing node;

[0009] S3. Establish a virtual secure channel between the terminal device allowed to access and the edge computing node.

[0010] Further, the step S1 specifically includes:

[0011] Step 1: The terminal device sends the device's MAC, serial number SN, category, and model to the edge computing node;

[0012] Step 2: The edge computing node queries the device registration information and reviews the information of the terminal device that has applied for access. If the review is passed, the device registration is completed, and the edge computing node identifier and node public key GPK are sent to the terminal device.

[0013] Step 3: The terminal device generates a random number in the security chip as the session key skey;

[0014] Step 4: Use the edge computing node public key GPK to perform SM2 encryption on the session key skey in the security chip to generate the ciphertext C1;

[0015] Step 5: Randomly generate an SM2 key pair (usk, UPK) in the security chip, encrypt and cache the private key usk in the chip key area, output the terminal's custom public key UPK, and send the ciphertext C1 and public key UPK generated by the terminal to the edge computing node;

[0016] Step 6: After receiving the ciphertext C1, the edge computing node decrypts it with the private key gsk to obtain the session key skey; the edge computing node inputs the MAC, serial number SN and skey of the terminal device into the key generation module of the edge computing node;

[0017] Step 7: The key generation module randomly generates an SM2 key pair (hsk, HPK) as the hidden key, calculates the accompanying public key APK = UPK + HPK, and then calculates the SM3 value with the accompanying public key and the terminal identifier to generate the key coefficient σ, and calculates the distribution private key dsk corresponding to the terminal device T =σ·gsk+hsk, where gsk is the private key of the edge computing node; and encrypted with the session key skey to obtain the ciphertext csk T , and returns it to the terminal device;

[0018] Step 8: The terminal device will csk T Enter the security chip and decrypt csk with the cached session key skey T , get dsk T , and then compound it with the cached custom private key factor to get the terminal private key tsk T =dsk T +usk, and then use the device encryption key to encrypt the terminal private key tsk T And stored in the key area of ​​the security chip, thus completing the registration of the terminal device and the application and distribution of the key.

[0019] Furthermore, the access authentication of the terminal device to the edge computing node includes:

[0020] Step 1: The terminal device accesses the edge computing node and sends an access request to the edge computing node;

[0021] Step 2: The edge computing node queries the device whitelist to confirm whether the terminal applying for access is a legitimate device. If it is a legitimate device, a 32-byte random number is generated as the session ID and the session ID is returned to the terminal device; if it is not a legitimate device, access is denied;

[0022] Step 3: The terminal device uses the private key stored in the device security chip to perform SM2 signature on the current time and session ID, and sends the signature value sig, current time Time, accompanying public key APK and device identity to the edge computing node as authentication data for the access application;

[0023] Step 4: After receiving the access application authentication data from the terminal, the edge computing node calculates the terminal's public key TPK in the key generation module through the device identifier, the accompanying public key APK and the public key GPK of the edge computing node, and then uses the terminal public key TPK, the signature value sig and the signature time to verify the signature using the SM2 signature verification protocol. If the verification is successful, it can be confirmed that the device identifier applying for access is authentic;

[0024] Step 5: The edge computing node verifies the difference between the signature time of the application and the current time. If it is within the allowed time range, access is allowed; otherwise, the access application is rejected.

[0025] Furthermore, a virtual secure channel is established between the terminal device allowed to access and the edge computing node, specifically including:

[0026] Step 1: After the terminal device and the edge computing node complete access authentication, the terminal device generates a 32-byte random number R1 in the security chip and encrypts it with the public key GPK of the edge computing node through SM2 to obtain the ciphertext C2, and sends C2 to the edge computing node;

[0027] Step 2: The edge computing node receives the data packet, uses the node's private key gsk to decrypt C2 to obtain the random number R1, and generates a 16-byte random number R2. It then uses the terminal device's identification public key SM2 to encrypt the ciphertext C3 and returns it to the terminal device.

[0028] Step 3: The edge computing node uses the high 16 bytes of the random number R1 as the initial vector and the low 16 bytes as the key, and encrypts the random number R2 in CBC mode using the SM4 cryptographic algorithm to obtain a 16-byte ciphertext, which is the session key between the two and is cached in the node's security key area as the symmetric key for communication data between the two.

[0029] Step 4: The terminal device receives the ciphertext C3 and inputs it into the security chip. It uses the terminal device's identification private key tsk to decrypt C3 to obtain the random number R2. The random numbers R1 and R2 are encrypted in the same way as in the third step to obtain a 16-byte session key, which is cached in the key area and used as the key for data encryption and decryption when communicating with the edge computing node. At this point, the establishment of the virtual security channel is completed.

[0030] Furthermore, it also includes: performing access authentication on the source data of the terminal device to collect data, specifically including:

[0031] Step 1: The terminal device adds a timestamp to the collected data and uses the national secret SM3 cryptographic algorithm to calculate the hash value of the data as the data fingerprint of the collected data;

[0032] In the second step, the terminal device inputs the data fingerprint into the device's security chip, and the chip uses the identification private key to sign the data fingerprint with the national secret SM2 cryptographic algorithm;

[0033] In the third step, the terminal device packages the source data, signature value, timestamp, accompanying public key, and device identification and encrypts them through a secure channel to send them to the edge computing node;

[0034] In the fourth step, the edge computing node decrypts and disassembles the received data packet, calculates the device identification, accompanying public key APK and edge node public key GPK in the key generation module to obtain the terminal device identification public key, and uses the identification public key and the national secret SM2 signature verification protocol to verify the source data signature. If it passes, the source data is authentic and has not been tampered with, and then verifies the timestamp to determine the freshness of the data;

[0035] Step 5: If all verifications are passed, the source data authentication is passed; otherwise, the source data is fake or tampered with, and the data is discarded or an alarm message is sent to the cloud center.

[0036] The beneficial effects of the present invention are as follows: the present invention discloses a terminal security access method for an edge computing node of an electric satellite Internet of Things, in which the edge computing node of the electric satellite Internet of Things implements access authentication for a perception layer electric sensor terminal to ensure the safety and reliability of the data transmission source device; the data uploaded by the sensor device is required to be signed by the data acquisition device including a timestamp to ensure the authenticity and integrity of the data sent by the device and prevent data replay and copy attacks; and data that fails the verification is prohibited from entering the electric satellite Internet of Things, thereby reducing the transmission pressure on the electric satellite network, preventing attacks on the electric satellite Internet of Things network through the perception layer terminal sensor network, and effectively ensuring the reliable operation of the electric satellite network. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0038] Figure 1 A schematic diagram of the terminal access identification key generation and distribution process of the present invention;

[0039] Figure 2 This is a schematic diagram of the terminal access authentication process of the present invention;

[0040] Figure 3 A schematic diagram of a virtual secure channel establishment process of the present invention;

[0041] Figure 4 It is a schematic diagram of the source data authentication process of the present invention. DETAILED DESCRIPTION

[0042] The present invention is further described below in conjunction with the accompanying drawings, as shown in the drawings:

[0043] The terminal security access method of the power satellite Internet of Things edge computing node of the present invention comprises the following steps:

[0044] S1. Register the terminal device, and the edge computing node generates and distributes the identification key of the terminal device; in this embodiment, the terminal device is a sensor terminal device;

[0045] S2. Perform access authentication on the terminal device accessing the edge computing node;

[0046] S3. Establish a virtual secure channel between the terminal device allowed to access and the edge computing node.

[0047] It should be noted that the edge computing node of the power satellite Internet of Things uses the edge IoT proxy gateway as the on-site information communication hub to collect data from each monitoring module, and upload the data to the main station backend after completing the calculation according to the strategy and algorithm. The edge IoT proxy gateway can realize the access, forwarding, intelligent analysis and processing of narrowband data such as sensors and broadband data such as pictures. The edge IoT proxy consists of a central processing unit, CPU, memory, Ethernet interface, RS-485 interface, small wireless module (433, WiFi, 4G, LoRa), etc., and can support expansion.

[0048] The edge IoT proxy gateway builds the edge computing node of the power satellite IoT, and connects to various power sensor terminals such as channel monitoring unit, main monitoring unit, micro-meteorological unit, tower tilt unit, conductor temperature measurement unit, dancing monitoring unit, sag monitoring unit, wind deviation monitoring unit, and ice monitoring unit through the edge computing node. The data collected by the sensor terminal is aggregated and integrated at the edge computing node, reducing the scattered transmission of various sensor terminals and realizing the aggregation, upload and intelligent calculation of data at the edge computing node. Therefore, the security of the edge computing node is the key to the security system of the power satellite IoT, and the terminal access security is the core of the edge computing node security.

[0049] In this embodiment, in step S1, the sensor device needs to register with the edge computing node when it first accesses the power satellite Internet of Things edge computing node, and the edge computing node generates and distributes the identification key of the sensor terminal device for it; Figure 1 As shown, specifically including:

[0050] Step 1: The terminal device sends the device's MAC, serial number SN, category, and model to the edge computing node;

[0051] Step 2: The edge computing node queries the device registration information and reviews the information of the terminal device that has applied for access. If the review is passed, the device registration is completed, and the edge computing node identifier and node public key GPK are sent to the terminal device.

[0052] Step 3: The terminal device generates a random number in the security chip as the session key skey;

[0053] Step 4: Use the edge computing node public key GPK to perform SM2 encryption on the session key skey in the security chip to generate the ciphertext C1;

[0054] Step 5: Randomly generate an SM2 key pair (usk, UPK) in the security chip, encrypt and cache the private key usk in the chip key area, output the terminal's custom public key UPK, and send the ciphertext C1 and public key UPK generated by the terminal to the edge computing node;

[0055] Step 6: After receiving the ciphertext C1, the edge computing node decrypts it with the private key gsk to obtain the session key skey; the edge computing node inputs the MAC, serial number SN and skey of the terminal device into the key generation module of the edge computing node; wherein, the key generation module can use an existing PCI-E cryptographic card;

[0056] Step 7: The key generation module randomly generates an SM2 key pair (hsk, HPK) as a hidden key, calculates the accompanying public key APK = UPK + HPK, and then calculates the SM3 value with the accompanying public key and the terminal identifier (MAC address + device serial number SN), generates the key coefficient σ, and calculates the distribution private key dsk corresponding to the terminal device T =σ·gsk+hsk, where gsk is the private key of the edge computing node; and encrypted with the session key skey to obtain the ciphertext csk T , and returns it to the terminal device;

[0057] Step 8: The terminal device will csk T Enter the security chip and decrypt csk with the cached session key skey T , get dsk T, and then compound it with the cached custom private key factor to get the terminal private key tsk T =dsk T +usk, and then use the device encryption key to encrypt the terminal private key tsk T And stored in the key area of ​​the security chip, thus completing the registration of the terminal device and the application and distribution of the key.

[0058] In this embodiment, in step S2, when the sensor terminal device accesses the edge computing network node, the node needs to authenticate the legitimacy of the accessed device to ensure that only legitimate and authorized devices are allowed to access. The authentication protocol combining the certificateless public key system based on identification and the national secret SM2 cryptographic algorithm is used to authenticate the access of the terminal device to the edge computing node, such as Figure 2 As shown, specifically including:

[0059] Step 1: The terminal device accesses the edge computing node and sends an access request to the edge computing node. The request includes but is not limited to the device's MAC address and serial number SN.

[0060] Step 2: The edge computing node queries the device whitelist to confirm whether the terminal applying for access is a legitimate device. If it is a legitimate device, a 32-byte random number is generated as the session ID and the session ID is returned to the terminal device; if it is not a legitimate device, access is denied;

[0061] Step 3: The terminal device uses the private key stored in the device security chip to perform SM2 signature on the current time and session ID, and sends the signature value sig, the current time Time, the accompanying public key APK and the device identifier (MAC address + device serial number SN) to the edge computing node as authentication data for the access application;

[0062] Step 4: After the edge computing node receives the access application authentication data from the terminal, it calculates the terminal's public key TPK in the key generation module through the device identifier, the accompanying public key APK and the public key GPK of the edge computing node, and then uses the terminal public key TPK, the signature value sig and the signature time to verify the signature using the SM2 signature verification protocol. If the verification is successful, it can be confirmed that the sensor device identifier (MAC+SN) applying for access is authentic and not fake;

[0063] Step 5: The edge computing node verifies the difference between the signature time of the application and the current time. If it is within the allowed time range, access is allowed. Otherwise, it may be a legitimate application copied by an attacker and the access application is rejected.

[0064] In this embodiment, in step S3, after the sensor terminal device completes the access authentication, it needs to negotiate the session key with the edge computing node to establish a virtual secure channel, and encrypt the data transmitted between the two using the national secret SM4 cryptographic algorithm. The establishment of the secure channel is also a key negotiation protocol based on the combination of the certificateless public key system based on identification and the national secret SM2 cryptographic algorithm. A virtual secure channel is established between the terminal device allowed to access and the edge computing node, such as Figure 3 As shown, specifically including:

[0065] Step 1: After the terminal device and the edge computing node complete access authentication, the terminal device generates a 32-byte random number R1 in the security chip and encrypts it with the public key GPK of the edge computing node through SM2 to obtain the ciphertext C2, and sends C2 to the edge computing node;

[0066] Step 2: The edge computing node receives the data packet, uses the node's private key gsk to decrypt C2 to obtain the random number R1, and generates a 16-byte random number R2, and then uses the terminal device's identification public key to encrypt SM2 to obtain the ciphertext C3, and returns it to the terminal device; wherein the identification public key is implemented based on the certificateless identification public key system;

[0067] Step 3: The edge computing node uses the high 16 bytes of the random number R1 as the initial vector and the low 16 bytes as the key, and encrypts the random number R2 in CBC mode using the SM4 cryptographic algorithm to obtain a 16-byte ciphertext, which is the session key between the two and is cached in the node's security key area as the symmetric key for communication data between the two.

[0068] Step 4: The terminal device receives the ciphertext C3 and inputs it into the security chip. It uses the terminal device's identification private key tsk to decrypt C3 to obtain the random number R2. The random numbers R1 and R2 are encrypted in the same way as in the third step to obtain a 16-byte session key, which is cached in the key area and used as the key for data encryption and decryption when communicating with the edge computing node. At this point, the establishment of the virtual security channel is completed.

[0069] In this embodiment, in addition to device access authentication, the present invention also performs access authentication on the source data of the sensor terminal device, that is, the data uploaded by the acquisition terminal needs to be timestamped and SM2 signed by the acquisition device to ensure the authenticity, integrity and timeliness of the source data, and prevent data counterfeiting, data tampering and copying of historical data for attack. Figure 4 As shown, specifically including:

[0070] Step 1: The terminal device adds a timestamp to the collected data and uses the national secret SM3 cryptographic algorithm to calculate the hash value of the data as the data fingerprint of the collected data;

[0071] In the second step, the terminal device inputs the data fingerprint into the device's security chip, and the chip uses the identification private key to sign the data fingerprint with the national secret SM2 cryptographic algorithm;

[0072] In the third step, the terminal device packages the source data, signature value, timestamp, accompanying public key, and device identification (MAC+SN), encrypts them through a secure channel, and sends them to the edge computing node;

[0073] In the fourth step, the edge computing node decrypts and disassembles the received data packet, calculates the device identification, accompanying public key APK and edge node public key GPK in the key generation module to obtain the terminal device identification public key, and uses the identification public key and the national secret SM2 signature verification protocol to verify the source data signature. If it passes, the source data is authentic and has not been tampered with, and then verifies the timestamp to determine the freshness of the data;

[0074] In the fifth step, if all the verifications are passed, the source data authentication is passed. Otherwise, the source data is fake or tampered with, and the data is discarded or an alarm message is sent to the cloud center. Finally, the verified source data is cleaned and compressed at the edge computing gateway, and the processed data is uploaded to the cloud data center through the power satellite Internet of Things.

[0075] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A terminal security access method for an edge computing node of an electric satellite Internet of Things, characterized in that: The steps include: S1. Register the terminal device, and the edge computing node generates and distributes the identification key of the terminal device; the step S1 specifically includes: Step 1: The terminal device sends the device's MAC, serial number SN, category, and model to the edge computing node; Step 2: The edge computing node queries the device registration information and reviews the information of the terminal device that has applied for access. If the review is passed, the device registration is completed, and the edge computing node identifier and node public key GPK are sent to the terminal device. Step 3: The terminal device generates a random number in the security chip as the session key skey; Step 4: Use the edge computing node public key GPK to perform SM2 encryption on the session key skey in the security chip to generate the ciphertext C1; Step 5: Randomly generate an SM2 key pair (usk, UPK) in the security chip, encrypt and cache the private key usk in the chip key area, output the terminal's custom public key UPK, and send the ciphertext C1 and public key UPK generated by the terminal to the edge computing node; Step 6: After receiving the ciphertext C1, the edge computing node decrypts it with the private key gsk to obtain the session key skey; the edge computing node inputs the MAC, serial number SN and skey of the terminal device into the key generation module of the edge computing node; Step 7: The key generation module randomly generates an SM2 key pair (hsk, HPK) as the hidden key, calculates the accompanying public key APK = UPK + HPK, and then calculates the SM3 value with the accompanying public key and the terminal identifier to generate the key coefficient σ, and calculates the distribution private key dsk corresponding to the terminal device T =σ·gsk+hsk, where gsk is the private key of the edge computing node; and encrypted with the session key skey to obtain the ciphertext csk T , and returns it to the terminal device; Step 8: The terminal device will csk T Enter the security chip and decrypt csk with the cached session key skey T , get dsk T , and then compound it with the cached custom private key factor to get the terminal private key tsk T =dsk T +usk, and then use the device encryption key to encrypt the terminal private key tsk T And stored in the key area of ​​the security chip, thus completing the registration of the terminal device and the application and distribution of the key; S2. Perform access authentication on the terminal device accessing the edge computing node; S3. Establish a virtual secure channel between the terminal device allowed to access and the edge computing node.

2. The terminal security access method of the power satellite Internet of Things edge computing node according to claim 1 is characterized in that: Perform access authentication for terminal devices accessing edge computing nodes, including: Step 1: The terminal device accesses the edge computing node and sends an access request to the edge computing node; Step 2: The edge computing node queries the device whitelist to confirm whether the terminal applying for access is a legitimate device. If it is a legitimate device, a 32-byte random number is generated as the session ID and the session ID is returned to the terminal device; if it is not a legitimate device, access is denied; Step 3: The terminal device uses the private key stored in the device security chip to perform SM2 signature on the current time and session ID, and sends the signature value sig, current time Time, accompanying public key APK and device identity to the edge computing node as authentication data for the access application; Step 4: After receiving the access application authentication data from the terminal, the edge computing node calculates the terminal's public key TPK in the key generation module through the device identifier, the accompanying public key APK and the public key GPK of the edge computing node, and then uses the terminal public key TPK, the signature value sig and the signature time to verify the signature using the SM2 signature verification protocol. If the verification is successful, it can be confirmed that the device identifier applying for access is authentic; Step 5: The edge computing node verifies the difference between the signature time of the application and the current time. If it is within the allowed time range, access is allowed; otherwise, the access application is rejected.

3. The terminal security access method of the power satellite Internet of Things edge computing node according to claim 1 is characterized in that: A virtual secure channel is established between the terminal device allowed to access and the edge computing node, including: Step 1: After the terminal device and the edge computing node complete access authentication, the terminal device generates a 32-byte random number R1 in the security chip and encrypts it with the public key GPK of the edge computing node through SM2 to obtain the ciphertext C2, and sends C2 to the edge computing node; Step 2: The edge computing node receives the data packet, uses the node's private key gsk to decrypt C2 to obtain the random number R1, and generates a 16-byte random number R2. It then uses the terminal device's identification public key SM2 to encrypt the ciphertext C3 and returns it to the terminal device. Step 3: The edge computing node uses the high 16 bytes of the random number R1 as the initial vector and the low 16 bytes as the key, and encrypts the random number R2 in CBC mode using the SM4 cryptographic algorithm to obtain a 16-byte ciphertext, which is the session key between the two and is cached in the node's security key area as the symmetric key for communication data between the two. Step 4: The terminal device receives the ciphertext C3 and inputs it into the security chip. It uses the terminal device's identification private key tsk to decrypt C3 to obtain the random number R2. The random numbers R1 and R2 are encrypted in the same way as in the third step to obtain a 16-byte session key, which is cached in the key area and used as the key for data encryption and decryption when communicating with the edge computing node. At this point, the establishment of the virtual security channel is completed.

4. The terminal security access method of the power satellite Internet of Things edge computing node according to claim 1 is characterized in that: Also includes: Perform access authentication on the source data collected by the terminal device, including: Step 1: The terminal device adds a timestamp to the collected data and uses the national secret SM3 cryptographic algorithm to calculate the hash value of the data as the data fingerprint of the collected data; In the second step, the terminal device inputs the data fingerprint into the device's security chip, and the chip uses the identification private key to sign the data fingerprint with the national secret SM2 cryptographic algorithm; In the third step, the terminal device packages the source data, signature value, timestamp, accompanying public key, and device identification and encrypts them through a secure channel to send them to the edge computing node; In the fourth step, the edge computing node decrypts and disassembles the received data packet, calculates the device identification, accompanying public key APK and edge node public key GPK in the key generation module to obtain the terminal device identification public key, and uses the identification public key and the national secret SM2 signature verification protocol to verify the source data signature. If it passes, the source data is authentic and has not been tampered with, and then verifies the timestamp to determine the freshness of the data; Step 5: If all verifications are passed, the source data authentication is passed; otherwise, the source data is fake or tampered with, and the data is discarded or an alarm message is sent to the cloud center.

Images