A network security management method and system for the power Internet of Things

Abstract

This invention relates to the field of power grid interconnection technology, specifically disclosing a network security management method and system for the power Internet of Things. To achieve the goals of reducing network congestion, improving the efficiency of intrusion detection algorithm deployment, and reducing data transmission threats, security management research is conducted from three levels: application layer user data secure transmission, network layer intrusion detection algorithm, and perception layer terminal access authentication. At the application layer, a dynamic key-based data encryption transmission scheme is adopted to ensure data integrity and transmission efficiency. At the network layer, an intrusion detection algorithm based on particle swarm optimization extreme learning machine (PSO-ELM) is used to achieve high detection rate and accuracy. At the perception layer, a challenge-response-based terminal access authentication scheme is used to resist various attack methods while improving network security and reliability.

Description

Technical Field

[0001] This invention relates to the field of power grid networking technology, and in particular to a network security management method and system for the power Internet of Things. Background Technology

[0002] With the popularization of the power Internet of Things (IoT) and the continuous development of computer networks, the application of the power IoT in social production and daily life is becoming increasingly widespread. However, its network security management has also attracted widespread attention. In stark contrast to its important position, its network and information security measures have many shortcomings, lacking mechanisms such as authentication protection, encryption protection, and integrity protection. This paper proposes a targeted security management framework for the network security management of the power IoT oriented towards 5G, based on its hierarchical architecture, logical characteristics, and security management principles. The framework divides the network into a perception layer, a network layer, and an application layer, aiming to improve network security performance. For the perception layer, due to the limitations of some perception layer terminals in terms of terminal computing and storage resources, network congestion can occur when a large number of terminals simultaneously access and authenticate. For the network layer, an intrusion detection system (IDS) needs to be deployed to protect the security of data transmission. The core intrusion detection algorithm needs to meet the needs of different scenarios based on the varying demands of computing and storage resources. Regarding the application layer, the requirement for secure data transmission must be met by the virtual network resources provided by the 5G network. Due to the complexity of the network, problems such as user data leakage, misuse, and tampering exist. Summary of the Invention

[0003] This invention provides a network security management method and system for the power Internet of Things, addressing the technical problem of how to improve network security performance.

[0004] To address the above technical problems, this invention provides a network security management method for the power Internet of Things, comprising the following steps:

[0005] A. At the application layer, a shared key is used for data encryption and decryption transmission between the base station and the terminal; specifically, the steps include:

[0006] A1. The base station and the terminal each generate a consistent dynamic key; specifically, the steps include:

[0007] A11. The terminal uses the current shared key to encrypt and send the first random number string to the base station;

[0008] A12. The base station uses the current shared key to decrypt and obtain the first random number string, temporarily stores the first random number string, and then sends the first response message to the terminal;

[0009] A13. After receiving the first response message, the terminal updates its own random number sequence and increments the count value. It then uses the current shared key to encrypt and send the second random number string to the base station.

[0010] A14. The base station uses the current shared key to decrypt and obtain the second random number string. It compares the second random number string with the temporarily stored first random number string. If they are the same, it returns to step A11. If they are not the same, it sends a corresponding response message to the terminal and proceeds to step A15.

[0011] A15. After receiving the second response message, the terminal updates its own random number sequence and increments the count value. It then uses the current shared key to encrypt and send a third random number string to the base station.

[0012] A16. Repeat steps A14 and A15 until the count value equals N, then exit the loop. The base station calculates the hash value of its own random number sequence at this time as the base station's dynamic key, and the terminal calculates the hash value of its own random number sequence at this time as the terminal's dynamic key.

[0013] A2. The base station and the terminal update the current shared key based on their respective generated dynamic keys;

[0014] A3. The base station and the terminal use the current shared key for data encryption and decryption transmission.

[0015] Further, step A2 specifically includes:

[0016] The terminal is based on its current shared key SK cn_t-1 and the generated dynamic key DS cn_t Generate a new shared key This represents the XOR operation;

[0017] The base station is based on its current shared key SK sn_t-1 and the generated dynamic key DS sn_t Generate a new shared key

[0018] Furthermore, the network security management measures also include steps or steps:

[0019] B. At the network layer, an extreme learning machine based on particle swarm optimization is used to classify the data received from the terminal, determine whether there is any intrusion behavior, and identify the specific attack type.

[0020] Furthermore, in step B, generating the particle swarm optimization-based extreme learning machine specifically includes the following steps:

[0021] B1. Initialize the extreme learning machine, determine the number of hidden layer nodes l, and randomly generate the input layer weights and hidden layer thresholds of the network;

[0022] B2. Initialize the state information of the particle swarm, including random position and velocity, and set the particle dimension to D = l(n+1), where n is the number of input layer nodes;

[0023] B3. Calculate the fitness of each particle and evaluate the fitness. A higher fitness value indicates that the solution is closer to the optimal solution, while a lower fitness value indicates that the solution is worse.

[0024] B4. Based on the evaluation of the fitness of each particle, the solution with the best fitness value for a single particle is taken as the individual optimal solution pbest for that particle; compare the individual optimal solutions of multiple particles, and take the individual optimal solution with the best fitness value as the global optimal solution gbest.

[0025] B5. Update the position and velocity of all particles based on the individual optimal solutions of multiple particles and the global optimal solution gbest for all particles;

[0026] B6. Determine whether the iteration termination condition is met. If it is met, output the global optimal solution gbest. Otherwise, repeat steps B3 to B5 until the iteration termination condition is met.

[0027] B7. Using the population's optimal position, i.e., the global optimal solution gbest, as the input layer weights and hidden layer thresholds of the extreme learning machine, train the extreme learning machine with the training dataset, and then test the extreme learning machine with the test dataset. After the test is completed, the extreme learning machine based on particle swarm optimization is obtained.

[0028] Furthermore, this network security management method also includes steps or comprises the following steps:

[0029] C. At the perception layer, the base station determines the legitimacy of the terminal's identity based on challenge response.

[0030] Furthermore, step C specifically includes the following steps:

[0031] C1. Initialize the base station and terminal; specifically including:

[0032] Configure the base station's authentication list as follows The initial shared key storage list for the base station is as follows: <ID j ,K ij >, ID j Represents the terminal's identity identifier ID, hash(ID) j ) represents ID j The hash value represents the anonymous identity identifier of the terminal. Indicates terminal ID j The communication IP address, K ij Indicates the initial shared key;

[0033] When the base station obtains hash(ID)j When this happens, scan its initial shared key list to find the corresponding shared key;

[0034] When the terminal's identity ID and communication IP address are not bound, the base station uses hash(ID) to... j The router performs addressing based on the hash(ID). j Returns the corresponding communication IP address;

[0035] The base station and the terminal will each generate a random number N. i With N j ;

[0036] Base station storage includes hash(ID) j ), N i and N j List information <hash(ID j ),N i N j > This is used to resist replay attacks, that is, to determine whether the received random number pair is a recently used random number pair; the terminal also stores the corresponding list information;

[0037] C2. The base station authenticates the identity of the terminal based on the challenge response.

[0038] Furthermore, step C2 specifically includes the following steps:

[0039] C21. The base station sends an anonymous identity identifier (hash(ID)) to the terminal. i ) and encrypted information E(N) i ,K ij The authentication request {hash(ID)} i ),E(N i ,K ij Encrypted information E(N) i ,K ij ) by using shared key K ij Random number N for base station i Generated through encryption;

[0040] C22. The terminal receives an authentication request {hash(ID)} i ),E(N i ,K ij After that, based on the anonymous identity identifier of the base station, hash(ID) i Scan its own storage list to obtain the shared key K. ij And using the shared key K ij For E(N) i ,K ij Decrypt the data and obtain the base station's random number N. iThen, based on hash(ID) i ), K ij N i N j and the anonymous identity identifier hash (ID) of the terminal j Generate a message verification code (MAC); then the terminal generates its own random number N. j and hash(ID) i ), N i MAC uses shared key K ij Encryption is performed to obtain encrypted information E({hash(ID)} i ),N i N j ,MAC},K ij Then, the encrypted information E({hash(ID)) is encrypted. i ),N i N j ,MAC},K ij ) and hash(ID) j Generate a message together {hash(ID)} j ),E({hash(ID i ),N i N j ,MAC},K ij Send it to the base station;

[0041] C23, The base station receives {hash(ID)} j ),E({hash(ID i ),N i N j ,MAC},K ij After that, perform data integrity verification. If it passes, then use hash(ID) to perform the verification. j Scan list <hash(ID j ),K ij >, then the shared key K can be obtained ij Then use K ij E({hash(ID) i ),N i N j ,MAC},K ij Decrypt the result to obtain a random number N. j and hash(ID) j If the anonymous identity identifier hash(ID) is obtained j ) and the anonymous identity identifier hash (ID) of the terminal j The same and random number N j If it is valid, proceed to the next step; otherwise, reject terminal access.

[0042] C24. The base station hashes its anonymous identity identifier (ID). i ) and encrypted information EMAC i Send the base station's anonymous identity identifier hash(ID) to the terminal. i The random number N generated by the base station and the terminal i N j After ORing, the hash function is used to obtain hash({hash(ID)). i )||N i ||N j}), using shared key K ij The hash value is hash({hash(ID) i )||N i ||N j}), base station IP address, terminal IP address, and MAC address generated by the base station. i Encryption is performed to obtain encrypted information Then hash({hash(ID)} i )||N i ||N j}) with base station IP address, terminal IP address and shared key K ij The base station's message verification code is obtained by performing a hash operation after ORing the two signals.

[0043] C25, Terminal receives EMAC i and hash(ID) i After that, use hash(ID) i Obtain the shared key K ij and EMAC i To decrypt, first use <hash(ID i ),N i N j > Calculate hash for list { hash(ID) i )||N i ||N j The system then checks if the random number pair used is valid; if valid, it further checks if the IP address is a valid address; if invalid, it rejects the terminal access; if the IP address is valid, it continues to use EMAC. i and MAC i The integrity of the sent message is verified. If it is invalid, the terminal access is rejected. If the verification is correct, the terminal sends an acknowledgment response and proceeds to the next step. If the verification fails, the terminal access is rejected.

[0044] C26. The terminal hashes its anonymous identity identifier (ID). j ) and encrypted information EMAC jSend it to the base station, and hash(ID) the terminal's anonymous identity identifier. j The random number N generated by the base station and the terminal i N j After ORing, the hash function is used to obtain hash({hash(ID)). j )||N i ||N j}), using shared key K ij The hash value is hash({hash(ID) j )||N i ||N j}), base station IP address, terminal IP address, and MAC address generated by the terminal. j Encryption is performed to obtain encrypted information hash({hash(ID) j )||N i ||N j}) with base station IP address, terminal IP address and shared key K ij The terminal's message verification code is obtained by performing a hash operation after ORing the two.

[0045] C27, The base station receives hash(ID) j ) and EMAC j Then, using hash(ID) j Obtain the shared key K ij and EMAC j Decryption, utilization <hash(ID j ),N i N j > Calculate hash for list { hash(ID) j )||N i ||N j The system then checks if the random number pair used is valid; if valid, it further checks if the IP address is a valid address; if invalid, it rejects the terminal access; if the IP address is valid, it continues to use EMAC. j and MAC j The integrity of the sent message is verified. If it is invalid, the terminal access is rejected. If the verification is correct, the base station sends a confirmation response to the terminal. If the verification fails, the terminal access is rejected.

[0046] Furthermore, in step C22, through the shared key K ij Each base station identity identifier hash(ID) i The random number N generated by the base station i and the random number N generated by the terminal j Encryption yields E(hash(ID)) j),K ij ), E(N i ,K ij ) and E(N j ,K ij Then, the anonymous identity identifier of the base station is hashed (ID). i ), E(hash(ID) j ),K ij ), E(N i ,K ij ) and E(N j ,K ij The message verification code (MAC) is obtained by performing a hash operation after ORing the two values: MAC = hash(ID) i )||E(hash(ID j ),K ij )||E(N i ,K ij )||E(N j ,K ij )).

[0047] The present invention also provides a network security management system for the power Internet of Things, the key feature of which is that it includes base stations and terminals, and the base stations and terminals are managed at the application layer, network layer and perception layer according to the network security management method for the power Internet of Things.

[0048] This invention provides a network security management method and system for the power Internet of Things (IoT). Based on a three-layer network architecture, it employs a dynamic key-based data encryption transmission scheme, a particle swarm optimization-based extreme learning machine (PSO-ELM) intrusion detection algorithm, and a challenge-response-based terminal access authentication scheme at the application layer, network layer, and perception layer, respectively. The core of the dynamic key-based data encryption transmission scheme lies in maintaining the freshness of the dynamic and shared keys, thereby achieving the security and self-healing capabilities of the communication system, ensuring data integrity, and improving data transmission efficiency. The PSO-ELM intrusion detection algorithm optimizes the ELM algorithm using the PSO algorithm, finding the optimal initial input weights and hidden layer thresholds. Then, the PSO-ELM algorithm is used to classify the data received from terminal nodes, determine the presence of intrusion behavior, and identify the specific attack type to take appropriate response measures. Thus, based on the analysis of the characteristics of neural networks, it meets the accuracy requirements of the power IoT intrusion detection system. The perception layer terminal access authentication, namely the challenge-response based terminal access authentication scheme, uses symmetric encryption and hash functions with low communication overhead. The authentication of the access terminal is completed through the exchange of random numbers and further terminal identity verification. By utilizing the identity identifier that can protect power equipment and verifying the integrity of sent messages, it effectively resists attack methods such as replay attacks and man-in-the-middle attacks while ensuring data confidentiality and integrity.

[0049] To achieve the goals of reducing network congestion, improving the efficiency of intrusion detection algorithms, and mitigating data transmission threats, this invention conducts security management research from three levels: application layer user data secure transmission, network layer intrusion detection algorithms, and perception layer terminal access authentication. At the application layer, a dynamic key-based data encryption transmission scheme is employed to ensure data integrity and transmission efficiency. At the network layer, an intrusion detection algorithm based on Particle Swarm Optimization Extreme Learning Machine (PSO-ELM) achieves high detection rates and accuracy. At the perception layer, a challenge-response-based terminal access authentication scheme is used to resist various attack methods while improving network security and reliability. Attached Figure Description

[0050] Figure 1 This is an overall block diagram of a network security management method for the power Internet of Things provided in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the data encryption transmission scheme based on dynamic keys provided in the embodiments of the present invention;

[0052] Figure 3This is a flowchart of generating a dynamic key provided in an embodiment of the present invention;

[0053] Figure 4 This is a flowchart of the intrusion detection algorithm based on particle swarm optimization-based extreme learning machine (PSO-ELM) provided in an embodiment of the present invention;

[0054] Figure 5 This is a flowchart of a challenge-response-based terminal access authentication method provided in an embodiment of the present invention. Detailed Implementation

[0055] The embodiments of the present invention are described in detail below with reference to the accompanying drawings. The embodiments are given for illustrative purposes only and should not be construed as limiting the present invention. The accompanying drawings are for reference and illustration only and do not constitute a limitation on the scope of patent protection of the present invention, because many changes can be made to the present invention without departing from the spirit and scope of the present invention.

[0056] Application Layer Security: The primary function of the application layer is to provide reliable services to users and fully meet their needs for secure data transmission. Therefore, in the 5G network architecture, application layer security management should focus on the security of user data transmission to ensure the privacy and integrity of the power Internet of Things.

[0057] Network Layer Security: The network layer involves the transmission, routing, and processing of network data. Therefore, it is necessary to deploy Intrusion Detection Systems (IDS) at the network layer to monitor malicious network traffic and strengthen security protection. The core of IDS is the intrusion detection algorithm. Therefore, the choice of algorithm plays a crucial role in the effectiveness of network layer security protection. To ensure that the network layer provides reliable data transmission services and provides early warning of malicious network attacks, intrusion detection algorithms with high detection rates and accuracy should be selected.

[0058] Perception Layer Security: Due to limited terminal resources and large deployment volume, it is impossible to set up high-security protection measures for a single node. Therefore, terminal access authentication is both important and feasible. Good identity authentication security management can ensure the efficient deployment of resource-constrained terminals, defend against potential malicious attacks, and reduce network communication load.

[0059] Therefore, embodiments of the present invention provide a network security management method for the power Internet of Things, such as... Figure 1 As shown, the steps include:

[0060] A. At the application layer, a shared key is used for data encryption and decryption transmission between the base station and the terminal; that is, a data encryption transmission scheme based on dynamic keys is adopted.

[0061] B. At the network layer, the data received from the terminal is classified using Particle Swarm Optimization-based Extreme Learning Machine (PSO-ELM) to determine whether there is any intrusion behavior and to identify the specific attack type; that is, an intrusion detection algorithm based on Particle Swarm Optimization-based Extreme Learning Machine (PSO-ELM) is used.

[0062] C. At the perception layer, the base station judges the legitimacy of the terminal's identity based on challenge-response; that is, it adopts a terminal access authentication scheme based on challenge-response.

[0063] There is no restriction on the execution order of the three steps; each step plays its role at its respective level.

[0064] (1) Application Layer – Data Encryption Transmission Scheme Based on Dynamic Keys

[0065] like Figure 2 Schematic diagram and Figure 3 As shown in the flowchart, step A specifically includes the following steps:

[0066] A1. The base station and the terminal each generate a consistent dynamic key;

[0067] A2. The base station and the terminal update the current shared key based on their respective generated dynamic keys;

[0068] A3. The base station and the terminal use the current shared key for data encryption and decryption transmission.

[0069] Step A1 (the base station and the terminal each generate a consistent dynamic key) specifically includes the following steps:

[0070] A11. The terminal uses the current shared key K SC The first random number string rand_num1 is encrypted and sent to the base station. The message sent is ciphertext E(rand_num1, K). SC );

[0071] A12. The base station uses the current shared key to decrypt and obtain the first random number string rand_num1, and temporarily stores the first random number string rand_num1, and then sends the first response message to the terminal;

[0072] A13. After receiving the first response message, the terminal updates its own random number sequence CN_DS_keyset and increments the counter value, using the current shared key K. SC The encrypted message sent to the base station is a second random number string rand_num2, and the message sent is ciphertext E(rand_num2, K). SC );

[0073] A14. The base station uses the current shared key K. SCDecrypt to obtain the second random number string rand_num2. Compare the second random number string rand_num2 with the temporarily stored first random number string rand_num1. If they are the same, return to step A11. If they are not the same, send the corresponding response message to the terminal and proceed to step A15.

[0074] A15. After receiving the second response message, the terminal updates its own random number sequence CN_DS_keyset and increments the counter value, using the current shared key K. SC The third random number string is sent to the base station in encrypted form.

[0075] A16. Repeat steps A14 and A15 until the counter value equals N, then exit the loop. The base station calculates the hash value of its own random number sequence SN_DS_keyset at this point as the base station's dynamic key DS. sn =H(SN_DS_keyset), the terminal calculates the hash value of its own random number sequence CN_DS_keyset at this time as the terminal's dynamic key DS. cn =H(CN_DS_keyset).

[0076] Step A2 (the base station and the terminal update the current shared key based on their respective generated dynamic keys) is as follows:

[0077] The terminal is based on its current shared key SK cn_t-1 and the generated dynamic key DS cn_t Generate a new shared key This represents an XOR operation; the base station uses its current shared key SK. sn_t-1 and the generated dynamic key DS sn_t Generate a new shared key Note: K SC To avoid emphasizing the time t of the shared key, it represents a substantially identical key shared by the base station and the terminal; SK cn_t-1 and SK sn_t-1 To emphasize the key stored in the terminal and base station at the previous time (t-1), SK cn_t-1 and SK sn_t-1 The content is essentially the same; similarly, the dynamic key DS cn_t and DS sn_t To emphasize the keys generated by the terminal and base station at time (t), DS cn_t and DS sn_t The content is essentially the same; while the shared key SK cn_t and SK sn_t To emphasize the keys generated by the terminal and base station at time (t), SK cn_tand SK sn_t The content is essentially the same.

[0078] In step A3 (data encryption and decryption transmission between the base station and the terminal using the current shared key):

[0079] Shared key and message initialization vector count i After addition, it is compared with the plaintext PT. i (ciphertext CT) i Perform an XOR operation to generate the encrypted CT. i (Plain text PT) i ).

[0080] The encryption / decryption module uses a CTR counter mode to convert the cipher block into a stream cipher, generating a continuous key stream by adding an incrementing counter; the value of the "counter" used in the encryption / decryption process is count. i It can be pre-configured to enable parallel computation of encrypting and decrypting packets in any order.

[0081] During the generation of dynamic keys, attackers cannot maintain error-free monitoring of all data transmissions in a wireless communication environment. Therefore, they cannot obtain the sequence of random numbers transmitted within a dynamic key generation cycle, and consequently, cannot obtain the generated dynamic key and shared key. Even if an attacker misses only one communication, they cannot obtain the lost random numbers and thus cannot deduce the subsequent series of dynamic keys. Although the shared key update always lags behind the dynamic key generation, this does not affect the accuracy and consistency of the key generation and updates between the two parties.

[0082] Thus, the data encryption transmission scheme based on dynamic keys in this invention generates dynamic keys by monitoring application layer data. During data communication, the hash value of the additional transmitted random number sequence is used as the dynamic key to further update the shared key, thereby achieving data encryption with low communication overhead.

[0083] (2) Network layer – Intrusion detection algorithm based on Particle Swarm Optimization Extreme Learning Machine (PSO-ELM)

[0084] An intrusion detection algorithm based on Particle Swarm Optimization Extreme Learning Machine (PSO-ELM) is proposed. Based on an analysis of the characteristics of neural networks, it meets the accuracy requirements of intrusion detection systems in the power Internet of Things (IoT). Its implementation process is described in reference [link to relevant documentation]. Figure 4The PSO algorithm is used to optimize the ELM algorithm, finding the optimal initial input weights and hidden layer thresholds. Then, the PSO-ELM algorithm is used to classify the data received from the terminal node, determine whether there is any intrusion behavior, and identify the specific attack type in order to take appropriate response measures.

[0085] like Figure 4 As shown, the specific execution steps of the PSO-ELM algorithm are as follows:

[0086] B1. Initialize the extreme learning machine, determine the number of hidden layer nodes l, and randomly generate the input layer weights and hidden layer thresholds of the network;

[0087] B2. Initialize the state information of the particle swarm, including random position and velocity, and set the particle dimension to D = l(n+1), where n is the number of input layer nodes;

[0088] B3. Calculate the fitness of each particle and evaluate the fitness. A higher fitness value indicates that the solution is closer to the optimal solution, while a lower fitness value indicates that the solution is worse.

[0089] B4. Based on the evaluation of the fitness of each particle, the solution with the best fitness value for a single particle is taken as the individual optimal solution pbest for that particle; compare the individual optimal solutions of multiple particles, and take the individual optimal solution with the best fitness value as the global optimal solution gbest.

[0090] B5. Update the position and velocity of all particles based on the individual optimal solutions of multiple particles and the global optimal solution gbest for all particles;

[0091] B6. Determine whether the iteration termination condition is met. If it is met, output the global optimal solution gbest. Otherwise, repeat steps B3 to B5 until the iteration termination condition is met.

[0092] B7. Using the population's optimal position, i.e., the global optimal solution gbest, as the input layer weights and hidden layer thresholds of the extreme learning machine, train the extreme learning machine with the training dataset, and then test the extreme learning machine with the test dataset. After the test is completed, the extreme learning machine based on particle swarm optimization is obtained.

[0093] The training and test datasets consist of multiple samples containing sensor data and communication information from power IoT terminal nodes. The training dataset is used as input to train the ELM, and the output is a label indicating whether a sample constitutes an intrusion behavior and the corresponding confidence level of the intrusion behavior. The test dataset is then used to test the ELM, and predictions are made using the trained ELM. The output nodes of the ELM will provide the confidence level of the corresponding intrusion behavior type. Based on the output results, intrusion behavior is detected. If intrusion behavior is found, appropriate response measures are taken, such as alarm notification and isolation of malicious terminal nodes.

[0094] Based on the analysis of artificial neural networks and combined with the characteristics of power private grids, an intrusion detection algorithm based on PSO-ELM is proposed. This intrusion detection algorithm combines the advantages of extreme learning machine and particle swarm optimization algorithm, ensuring the real-time performance of the intrusion detection system while meeting the requirements of high detection rate and accuracy.

[0095] (3) Perception Layer – Terminal Access Authentication Scheme Based on Challenge-Response

[0096] The challenge-response-based terminal access authentication scheme uses symmetric encryption and hash functions with low communication overhead as much as possible. The authentication of the access terminal is completed through the exchange of random numbers and further terminal identity verification, and the legitimacy of its identity is judged.

[0097] Specifically, step C includes the following steps:

[0098] C1. Initialize the base station and terminal;

[0099] C2. The base station authenticates the identity of the terminal based on the challenge response.

[0100] Step C1 (initializing the base station and terminal) specifically includes:

[0101] Configure the base station's authentication list as follows The initial shared key storage list for the base station is as follows: <ID j ,K ij >, ID j Represents the terminal's identity identifier ID, hash(ID) j ) represents ID j The hash value represents the anonymous identity identifier of the terminal. Indicates terminal ID j The communication IP address, K ij Indicates the initial shared key;

[0102] When the base station obtains hash(ID) j When this happens, scan its initial shared key list to find the corresponding shared key;

[0103] When the terminal's identity ID and communication IP address are not bound, the base station uses hash(ID) to... j The router performs addressing based on the hash(ID). j Returns the corresponding communication IP address;

[0104] The base station and the terminal will each generate a random number N. i With N j ;

[0105] Base station storage includes hash(ID) j ), N i and N j List information <hash(ID j ),N i N j > This is used to resist replay attacks, that is, to determine whether the received random number pair is a recently used random number pair; the terminal also stores the corresponding list information.

[0106] like Figure 5 As shown, step C2 specifically includes the following steps:

[0107] C21. The base station sends an anonymous identity identifier (hash(ID)) to the terminal. i ) and encrypted information E(N) i ,K ij The authentication request {hash(ID)} i ),E(N i ,K ij Encrypted information E(N) i ,K ij ) by using shared key K ij Random number N for base station i Generated through encryption;

[0108] C22. The terminal receives an authentication request {hash(ID)} i ),E(N i ,K ij After that, based on the anonymous identity identifier of the base station, hash(ID) i Scan its own storage list to obtain the shared key K. ij And using the shared key K ij For E(N) i ,K ij Decrypt the data and obtain the base station's random number N. i Then, based on hash(ID) i ), K ij N i N jand the anonymous identity identifier hash (ID) of the terminal j Generate a message verification code (MAC); then the terminal generates its own random number N. j and hash(ID) i ), N i MAC uses shared key K ij Encryption is performed to obtain encrypted information E({hash(ID)} i ),N i N j ,MAC},K ij Then, the encrypted information E({hash(ID)) is encrypted. i ),N i N j ,MAC},K ij ) and hash(ID) j Generate a message together {hash(ID)} j ),E({hash(ID i ),N i N j ,MAC},K ij Send it to the base station;

[0109] C23, The base station receives {hash(ID)} j ),E({hash(ID i ),N i N j ,MAC},K ij After that, perform data integrity verification. If it passes, then use hash(ID) to perform the verification. j Scan list <hash(ID j ),K ij >, then the shared key K can be obtained ij Then use K ij E({hash(ID) i ),N i N j ,MAC},K ij Decrypt the result to obtain a random number N. j and hash(ID) j If the anonymous identity identifier hash(ID) is obtained j ) and the anonymous identity identifier hash (ID) of the terminal j The same and random number N j If it is valid, proceed to the next step; otherwise, reject terminal access.

[0110] C24. The base station hashes its anonymous identity identifier (ID). i ) and encrypted information EMAC iSend the base station's anonymous identity identifier hash(ID) to the terminal. i The random number N generated by the base station and the terminal i N j After ORing, the hash function is used to obtain hash({hash(ID)). i )||N i ||N j}), using shared key K ij The hash value is hash({hash(ID) i )||N i ||N j}), base station IP address, terminal IP address, and MAC address generated by the base station. i Encryption is performed to obtain encrypted information Then hash({hash(ID)} i )||N i ||N j}) with base station IP address, terminal IP address and shared key K ij The base station's message verification code is obtained by performing a hash operation after ORing the two signals.

[0111] C25, Terminal receives EMAC i and hash(ID) i After that, use hash(ID) i Obtain the shared key K ij and EMAC i To decrypt, first use <hash(ID i ),N i N j > Calculate hash for list { hash(ID) i )||N i ||N j The system then checks if the random number pair used is valid; if valid, it further checks if the IP address is a valid address; if invalid, it rejects the terminal access; if the IP address is valid, it continues to use EMAC. i and MAC i The integrity of the sent message is verified. If it is invalid, the terminal access is rejected. If the verification is correct, the terminal sends an acknowledgment response and proceeds to the next step. If the verification fails, the terminal access is rejected.

[0112] C26. The terminal hashes its anonymous identity identifier (ID). j ) and encrypted information EMAC j Send to the base station.

[0113] Hash(ID) the anonymous identity identifier of the terminal. jThe random number N generated by the base station and the terminal i N j After ORing, the hash function is used to obtain hash({hash(ID)). j )||N i ||N j}), using shared key K ij The hash value is hash({hash(ID) j )||N i ||N j}), base station IP address, terminal IP address, and MAC address generated by the terminal. j Encryption is performed to obtain encrypted information hash({hash(ID) j )||N i ||N j}) with base station IP address, terminal IP address and shared key K ij The terminal's message verification code is obtained by performing a hash operation after ORing the two.

[0114] C27, The base station receives hash(ID) j ) and EMAC j Then, using hash(ID) j Obtain the shared key K ij and EMAC j Decryption, utilization <hash(ID j ),N i N j > Calculate hash for list { hash(ID) j )||N i ||N j The system then checks if the random number pair used is valid; if valid, it further checks if the IP address is a valid address; if invalid, it rejects the terminal access; if the IP address is valid, it continues to use EMAC. j and MAC j The integrity of the sent message is verified. If it is invalid, the terminal access is rejected. If the verification is correct, the base station sends a confirmation response to the terminal. If the verification fails, the terminal access is rejected.

[0115] In step C22, through the shared key K ij The base station identity identifier hash(ID) is processed separately. i The random number N generated by the base station i and the random number N generated by the terminal j Encryption yields E(hash(ID)) j ),K ij ), E(N i ,Kij ) and E(N j ,K ij Then, the anonymous identity identifier of the base station is hashed (ID). i ), E(hash(ID) j ),K ij ), E(N i ,K ij ) and E(N j ,K ij The message verification code (MAC) is obtained by performing a hash operation after ORing the two values: MAC = hash(ID) i )||E(hash(ID j ),K ij )||E(N i ,K ij )||E(N j ,K ij )).

[0116] The challenge-response based two-way authentication scheme, combined with the network architecture of the power Internet of Things, utilizes the identification of power equipment and performs integrity authentication on sent messages to effectively resist replay attacks and man-in-the-middle attacks while ensuring data confidentiality and integrity.

[0117] This invention also provides a network security management system for the power Internet of Things, including base stations and terminals, which are managed at the application layer, network layer and perception layer according to a network security management method for the power Internet of Things.

[0118] In summary, the network security management method and system for the power Internet of Things provided by this invention aims to reduce network congestion, improve the efficiency of intrusion detection algorithm deployment, and reduce data transmission threats. It conducts security management research from three levels: application layer user data secure transmission, network layer intrusion detection algorithm, and perception layer terminal access authentication. At the application layer, a dynamic key-based data encryption transmission scheme is adopted to ensure data integrity and transmission efficiency. At the network layer, an intrusion detection algorithm based on particle swarm optimization extreme learning machine (PSO-ELM) achieves high detection rate and accuracy. At the perception layer, a challenge-response-based terminal access authentication scheme is used to resist various attack methods while improving network security and reliability.

[0119] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A network security management method for power Internet of Things, characterized in that, The method comprises the following steps: A. In the application layer, shared keys are used for data encryption and decryption transmission between the base station and the terminal; specifically comprising the following steps: A1. The base station and the terminal each generate a consistent dynamic key; specifically comprising the following steps: A11. The terminal sends a first random number string to the base station using the current shared key for encryption; A12. The base station decrypts the first random number string using the current shared key and temporarily stores the first random number string, and then sends a first response message to the terminal; A13. After receiving the first response message, the terminal updates its own random number sequence and increments the count value, and sends a second random number string to the base station using the current shared key for encryption; A14. The base station decrypts the second random number string using the current shared key, compares the second random number string with the temporarily stored first random number string, and if they are the same, returns to step A11, and if they are not the same, the base station updates its own random number sequence and increments the count value, and then sends a second response message to the terminal and enters step A15; A15. After receiving the second response message, the terminal updates its own random number sequence and increments the count value, and sends a third random number string to the base station using the current shared key for encryption; A16. According to steps A14 and A15, the cycle is repeated until the count value of the terminal is equal to N, at which time the base station calculates the hash value of its own random number sequence as the dynamic key of the base station, and the terminal calculates the hash value of its own random number sequence as the dynamic key of the terminal; A2. The base station and the terminal update the current shared key based on the respective generated dynamic key; A3. The base station and the terminal use the current shared key for data encryption and decryption transmission; B. In the network layer, a particle swarm optimization-based extreme learning machine is used to classify the data received from the terminal, determine whether there is an intrusion behavior, and identify the specific attack type; C. In the perception layer, the base station judges the identity legitimacy of the terminal based on challenge and response. 2.The network security management method for power Internet of Things according to claim 1, wherein, The step A2 specifically comprises: The terminal generates a new shared key based on its current shared key and the generated dynamic key generates a new shared key , denotes an exclusive OR operation; The base station generates a new shared key based on its current shared key and the generated dynamic key generates a new shared key . 3.The network security management method for power Internet of Things of claim 1, wherein, In step B, generating a particle swarm optimization-based extreme learning machine specifically comprises the following steps: B1, initialize the extreme learning machine, determine the number of hidden layer nodes , randomly generate the input layer weight and hidden layer threshold of the network; B2, initialize the state information of the particle swarm, including random position and speed, set the dimension of the particle to , is the number of input layer nodes; B3. Calculate the fitness of each particle, perform fitness evaluation, and a higher fitness value indicates that the solution is closer to the optimal solution, and a lower fitness value indicates that the solution is poorer; B4. based on the evaluation of the fitness of each particle, the solution with the optimal fitness value of the individual particle is taken as the individual optimal solution of the particle ; compare the individual optimal solutions of multiple particles, and take the individual optimal solution with the optimal fitness value as the global optimal solution ; B5. updating the position and velocity of all particles according to the individual optimal solution of the plurality of particles and the global optimal solution of all particles updating the position and velocity of all particles; B6, judging whether the iteration termination condition is satisfied, and outputting the global optimal solution if the iteration termination condition is satisfied ; otherwise, repeating steps B3 to B5 until the iteration termination condition is satisfied; B7、the best position of the population, i.e. the global optimal solution As the input layer weight and hidden layer threshold of the extreme learning machine, the extreme learning machine is trained by using the training data set, and then the extreme learning machine is tested by using the test data set. After the test is completed, the extreme learning machine based on particle swarm optimization is obtained.

4. The network security management method for power Internet of Things according to claim 1, characterized in that, Step C specifically comprises the following steps: C1. Initialize the base station and the terminal; specifically comprising: The authentication list of the base station is set as , and the initial shared key storage list of the base station is , represents an identity ID of the terminal, represents a hash value of the terminal, which represents an anonymous identity of the terminal, represents a communication IP address of the terminal , and represents an initial shared key; When the base station has obtained the initial shared key list, it scans the initial shared key list for a corresponding shared key; When the identity of the terminal and the communication address are not bound, the base station addresses by the identity of the terminal, and the router returns the corresponding communication address according to the identity of the terminal; the base station addresses by the communication address, and the router returns the corresponding identity of the terminal. The base station and the terminal generate random numbers, respectively With ; The base station stores list information including , and to resist replay attacks, i.e., to determine whether a received pair of random numbers is a pair of random numbers that has been used recently; the terminal also stores corresponding list information;​ C2. The base station authenticates the identity of the terminal based on challenge and response.

5. The network security management method for power Internet of Things according to claim 4, characterized in that, Step C2 specifically comprises the following steps: C21. The base station transmits to the terminal an authentication request including an anonymous identity of the base station and encryption information The encryption information is generated by encrypting a random number of the base station with a shared key ​​​ C22, the terminal receives the authentication request After that, according to the anonymous identity of the base station Scan the storage list of itself, obtain the shared key , and use the shared key To Decryption, obtain the random number of the base station ; then according to , , , And the anonymous identity of the terminal Generate message authentication code ; then the terminal encrypts the random number and , , MAC using the shared key Obtain encrypted information ; then send the encrypted information and Together generate a message Send to the base station; C23, the base station received Next, perform data integrity verification. If it passes, then proceed according to... Scan list You can then obtain the shared key. Then utilize Will Decrypt to obtain a random number. and If the anonymous identity identifier is obtained Anonymous identity identifier of the terminal Same and random number If it is valid, proceed to the next step; otherwise, reject terminal access. C24. The base station identifies its own anonymous identity. and encrypted information Send to the terminal, including the base station's anonymous identity identifier. Random numbers generated by the same base station and terminal , After ORing, the hash function is used to obtain the result. Using shared keys hash value Base station IP address, terminal IP address, and verification code generated by the base station. Encryption is performed to obtain encrypted information Then With base station IP address, terminal IP address and shared key The base station's message verification code is obtained by performing a hash operation after ORing the two signals. , || represents the OR operator; C25, Terminal received and Then, using Obtain the shared key and to To decrypt, first use List calculations It then checks whether the random number pair used is valid; if valid, it further checks whether the IP address is a valid address; if invalid, it rejects terminal access. If the IP address is legal, continue to use and Check the integrity of the sent message, and if not legal, reject terminal access; If the verification is correct, the terminal sends a confirmation response and enters the next step, and if the verification fails, the terminal access is rejected; C26, the terminal sends the anonymous identity of itself and the encrypted information to the base station, and sends the anonymous identity of the terminal to the base station, and the random number generated by the base station and the terminal , or the hash value obtained by hashing the random number , using the shared key encrypts the hash value , the IP address of the base station, the IP address of the terminal, and the message authentication code generated by the terminal to obtain the encrypted information ; hashes the , the IP address of the base station, the IP address of the terminal, and the shared key to obtain the message authentication code of the terminal ; C27, the base station receives and then, using obtains the shared key and decrypts using calculates and judges whether the pair of random numbers used is valid; if valid, further judges whether the IP address is a legal address, and if invalid, rejects the terminal access; If the IP address is valid, continue with and Check the integrity of the sent message and reject the terminal access if it is not valid. If the verification is correct, the base station sends a confirmation response to the terminal, and if the verification fails, the terminal access is rejected.

6. The network security management method for power Internet of Things according to claim 5, characterized in that: In step C22, the random number generated by the base station is encrypted by the shared key , and the random number generated by the terminal , , and , and then the anonymous identity of the base station , , and is hashed to obtain the message authentication code .

7. A network security management system for power internet of things, characterized in that: The base station and the terminal apply the network security management method for power Internet of Things according to any one of claims 1-6 to manage the application layer, the network layer, and the perception layer.

Images