IoT systems based on PLC communication and their device network access methods

Abstract

This invention relates to the field of PLC communication security technology, and provides an IoT system based on PLC communication and a method for device network access. In this method, the server obtains STA device information and transmits it encrypted to the PLC gateway. By securely encrypting and transmitting the device information, it ensures that user-provided information is not easily tampered with or stolen. Furthermore, the CCO (Controlled Access Center) includes the STA device information in a whitelist, enabling designated STA devices to securely access the network and exchange data. This effectively avoids network security risks that may arise from disabling the whitelist mechanism. Through an automated network access method, STA device authentication, key exchange, and network access are completed, providing a secure, convenient, and effective network access method. The introduction of data encryption and authentication for STA devices during network configuration enhances the overall network security, effectively prevents potential network attacks, and reduces the risk of unauthorized STA devices entering the network by ensuring the legitimacy of the STA devices.

Description

Technical Field

[0001] This invention relates to the field of PLC communication security technology, specifically to an Internet of Things (IoT) system based on PLC communication and a method for connecting its devices to the network. Background Technology

[0002] Currently, more and more Chinese companies are investing in the smart home ecosystem. Most PLC technologies used in smart home appliances and interconnection in China use mid-frequency band PLCs. Among them, PLC-IoT (Power Line Communication Internet of Things) based on IEEE 1901.1 is a mid-frequency band power line carrier communication technology for IoT scenarios. It can be used in IoT scenarios such as smart homes and smart streetlights for real-time control. However, since PLC signal transmission is on power lines, some potential safety hazards may affect data privacy and security.

[0003] The existing methods for allowing PLC-IoT-based devices to join the network have cybersecurity vulnerabilities related to whitelist management. The existing solutions for whitelist management have the following problems:

[0004] Disabling whitelist verification allows unknown STAs to access the network or obtain network information, which poses a security risk. Furthermore, the lack of security verification and identity verification for devices during automatic network configuration may lead to unauthorized devices entering the network, increasing potential security risks and privacy leaks. For example, the automatic network configuration method for a PLC network communication system and its communication equipment disclosed in patent CN116614353A discloses such a solution.

[0005] Alternatively, in the network access method, after the CCO automatically generates a whitelist upon power-on, unknown STAs can access the network, obtain network information, and launch network attacks. It is necessary to delete STAs that have been mistakenly added to the whitelist. In a multi-network environment, users need to delete a large number of unknown STAs from the whitelist. For example, a PLC-IoT device networking method and device disclosed in patent CN112867102A discloses such a solution. Summary of the Invention

[0006] The primary objective of this invention is to provide a method for device network access based on PLC communication, aiming to improve the problems of cumbersome, inefficient, and insecure device network access processes.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A method for connecting a device to a network based on PLC communication includes:

[0009] S1. Encryption: The server encrypts the acquired STA device information using a private key and sends the ciphertext to the PLC gateway;

[0010] S2. Decryption: The PLC gateway decrypts the ciphertext using a pre-set public key to obtain the STA device information, and then sends the STA device information to the CCO;

[0011] S3. Input: The CCO adds the STA device information to the whitelist and waits for the STA device to join the network;

[0012] S4. Network Access: The user triggers the STA device network access method through interactive means, and the STA device joins the network;

[0013] S5. Query: The CCO reports the information of the STA devices that have joined the network to the PLC gateway. The PLC gateway sends a query message to the CCO, which then sends it to the STA device through the PLC.

[0014] S6. Feedback: The STA device receives the query message and replies with STA device information via power line carrier communication. The CCO forwards the STA device information to the PLC gateway.

[0015] S7. Verification: The PLC gateway verifies the STA device information. If the verification is successful, the PLC gateway reports to the server that the STA device has successfully joined the network. If the verification fails, the PLC gateway sends a kick-out command to the CCO.

[0016] Furthermore, it also includes:

[0017] S8. Key Exchange: After successful verification, the PLC gateway periodically exchanges keys with the STA device and uses the keys to encrypt communication.

[0018] Furthermore, the server and the PLC gateway communicate using an asymmetric encryption algorithm, which includes one or more of RSA, DSA, SM2, and ECC; the STA device and the PLC gateway communicate using a symmetric encryption algorithm, which includes one or more of AES, DES, SM1, SM4, and Diffie-Hellman.

[0019] Furthermore, it also includes:

[0020] S9. Reporting: The PLC gateway reports the verification result of the STA device to the server, and the server sends the corresponding verification result message to the user.

[0021] Furthermore, the STA device information includes one or more of the following: device product ID, device model, device type ID, device version number, and device MAC address.

[0022] The second objective of this invention is to provide a device network access system based on PLC communication, which aims to improve the problems of cumbersome, inefficient, and insecure device network access processes.

[0023] An Internet of Things (IoT) system based on PLC communication, the system including a CCO, a PLC gateway, a STA device, and a server, the system being used to execute the device network access method described above.

[0024] Furthermore, the system is created based on the IEEE 1901.1 protocol, and the STA device information is the device MAC address.

[0025] Further, the CCO includes:

[0026] The whitelist control unit is used to generate a whitelist of the STA devices and keep it enabled or to delete the STA device information from the whitelist.

[0027] The transceiver unit is used to send and receive messages and device information between the PLC gateway and the STA device.

[0028] Furthermore, the PLC gateway includes:

[0029] The decryption unit is used to receive the ciphertext sent by the server, decrypt it to obtain the relevant information of the STA device, and send the relevant information to the CCO;

[0030] The query unit is used to send a query message to the CCO and obtain relevant information about the STA device after the STA device successfully joins the network.

[0031] The verification unit is used to verify the information of the STA device that has been connected to the network. If the verification is successful, it reports to the server that the network access is successful. If the verification fails, it sends a kick-out command to the CCO.

[0032] A key exchange unit is used to periodically exchange the key with the STA device and encrypt communication using the key.

[0033] Furthermore, the server includes:

[0034] The acquisition module is used to acquire information about the STA device.

[0035] The encryption module is used to encrypt the STA device information using a private key and send the ciphertext to the PLC gateway.

[0036] By adopting the above technical solution, the present invention has the following advantages compared with the prior art:

[0037] 1. The server obtains STA device information and transmits it to the PLC gateway in encryption. By securely encrypting and transmitting the device information, it ensures that the information provided by the user is not easily tampered with or stolen. Then, the PLC gateway completes the authentication, key exchange and network access of the STA device through an automated network access method, providing a safe, convenient and effective network access method.

[0038] 2. The CCO adds STA device information to the whitelist and keeps the whitelist enabled. The whitelist control unit can continuously control the addition and deletion of whitelist items, enabling designated STA devices to securely access the network and exchange data, effectively avoiding network security risks that may be caused by disabling the whitelist.

[0039] 3. Data encryption and authentication of STA devices were introduced during the network configuration process, which enhanced the overall security of the network, effectively prevented potential network attacks, and reduced the risk of unauthorized STA devices entering the network by ensuring the legitimacy of STA devices.

[0040] 4. For STA devices already connected to the network, encryption of communication is achieved through the periodic exchange of communication keys between the PLC gateway and the STA device. This measure not only effectively protects the user's data privacy, but also enhances the overall security of network communication. Through encrypted communication, the system can prevent potential data leakage and unauthorized access threats, providing users with more reliable IoT services. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the device network access method described in this invention;

[0042] Figure 2 This is a schematic diagram of the topology of the Internet of Things system described in this invention.

[0043] Explanation of reference numerals in the attached figures:

[0044] 1. CCO; 2. PLC Gateway; 3. Server; 4. STA Device;

[0045] 11. Whitelist control unit; 12. Transceiver unit;

[0046] 21. Decryption unit; 22. Query unit; 23. Verification unit; 24. Key exchange unit;

[0047] 31. Data Acquisition Module; 32. Encryption Module. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0049] Example 1

[0050] Before discussing this invention, to facilitate understanding, the abbreviations and key terms involved in this invention are defined, wherein PLC stands for Power Line Communication; CCO stands for Central Coordinator; STA stands for Station; and MAC stands for Media Access Control Address.

[0051] Please refer to Figure 1 , Figure 2 As shown, this embodiment provides a method for device network access based on PLC communication, which includes:

[0052] S1. Encryption: Server 3 encrypts the obtained STA device 4 information with a private key and sends the ciphertext to PLC gateway 2. Specifically, in this embodiment, STA device 4 can be one or more. Server 3 obtains STA device 4 information from the information of STA device 4 that needs to be connected to the network provided by the user to the server through a communication device. The communication device includes, but is not limited to, mobile phones, tablets, computers, etc.

[0053] S2. Decryption: PLC gateway 2 decrypts the ciphertext using a pre-set public key to obtain the STA device 4 information, and sends the STA device 4 information to CCO1;

[0054] S3. Entry: CCO1 adds the information of STA device 4 to the whitelist and waits for STA device 4 to join the network; the whitelist mechanism remains enabled during the process of STA device 4 joining the network.

[0055] S4. Network Access: The user triggers the network access method of STA device 4 through interactive means, and STA device 4 joins the network. In this embodiment, the user interaction means include but are not limited to button, voice, wireless communication, etc.

[0056] S5. Query: CCO1 reports the information of the network-connected STA device 4 to PLC gateway 2. PLC gateway 2 sends a query message to CCO1, which then sends the message to STA device 4 via PLC.

[0057] S6. Feedback: STA device 4 receives the query message and replies with STA device 4 information via power line carrier communication. CCO1 forwards the STA device 4 information to PLC gateway 2.

[0058] S7. Verification: PLC gateway 2 verifies the information of STA device 4. If the verification is successful, PLC gateway 2 reports to server 3 that STA device 4 has successfully joined the network. If the verification fails, PLC gateway 2 sends a command to CCO1 to remove the device from the whitelist.

[0059] Specifically, users use communication terminals to provide the network access information of STA device 4 to server 3 by scanning a code, entering device information, or using other convenient methods. Server 3 encrypts the STA device 4 information and sends it to PLC gateway 2. PLC gateway 2 decrypts the STA device 4 information and sends it to CCO1. CCO1 adds the STA device 4 information to the whitelist. Through the secure encryption and transmission of STA device 4 information, it is ensured that the information provided by the user is not easily tampered with or stolen. This enhanced security lays a solid foundation for the entire network access process.

[0060] Meanwhile, after STA device 4 joins the network, CCO1 reports the joining device information to PLC gateway 2. PLC gateway 2 sends a query message, which is then sent by CCO1 to the joined STA device 4 via the PLC. The joined STA device 4 receives the query message and replies with device information via the PLC, which is then received and forwarded by CCO1 to PLC gateway 2. PLC gateway 2 continuously verifies the information of the joined STA device 4 and notifies CCO1 to remove STA device 4 with inconsistent information. This effectively simplifies the device joining and network configuration process, eliminating the need for users to perform complex operations and settings, improving network configuration efficiency. At the same time, it avoids the potential danger of unknown STA device 4 launching network attacks, improves the overall security of network communication, and facilitates the management and use of the devices.

[0061] Furthermore, during the continuous network access process of different STA devices 4, the whitelist mechanism remains enabled. CCO1 allows the acquisition of STA device 4 information to be continuously added to the whitelist or removes STA devices 4 that fail verification from the whitelist, causing the STA devices 4 that fail verification to disconnect, effectively preventing the intrusion of unauthorized STA devices 4, thereby ensuring network security. CCO1 is responsible for maintaining the whitelist, ensuring that only STA devices 4 provided through legitimate channels can successfully access the network. The introduction of the whitelist control mechanism greatly improves the network access security of STA devices 4 in the entire PLC system. The device security verification and identity verification mechanism introduced during the network distribution process provides strong support for the system to prevent potential network attacks.

[0062] like Figure 1 and Figure 2 As shown, the methods for device network access also include:

[0063] S8. Key Exchange: After successful verification, PLC Gateway 2 periodically exchanges keys with STA Device 4 and uses these keys to encrypt communication. For devices already connected to the network, the gateway and STA Device 4 periodically exchange communication keys, effectively protecting user data privacy and improving the overall security of network communication, preventing potential data leaks and unauthorized access threats.

[0064] Furthermore, server 3 and PLC gateway 2 communicate using asymmetric encryption algorithms, including one or more of RSA (Rivest–Shamir–Adleman, an asymmetric algorithm), DSA (Digital Signature Algorithm), SM2 (Chinese national cryptographic algorithm standard), and ECC (Elliptic Curve Cryptography). STA device 4 and PLC gateway 2 communicate using symmetric encryption algorithms, including one or more of AES (Advanced Encryption Standard), DES (Data Encryption Standard), SM4 (Chinese national cryptographic block cipher algorithm standard), SM1 (symmetric cryptography), and Diffie-Hellman (Diffie-Hellman key exchange protocol). While asymmetric encryption algorithms require higher computing power and time compared to symmetric encryption algorithms, making real-time communication less convenient, they offer higher security.

[0065] Furthermore, methods for device network access also include:

[0066] S9. Reporting: PLC gateway 2 reports the verification result of STA device 4 to server 3. Server 3 sends the corresponding verification result message to the user, which lowers the user threshold and improves user experience and distribution efficiency.

[0067] Furthermore, the STA device 4 information includes one or more of the following: device production serial number, device product ID, device type ID, device manufacturer ID, device MAC address, device model, device protocol version, device firmware version, device hardware version, and device software version. In this embodiment, when using the IEEE 1901.1 protocol, the STA device 4 information is the MAC address.

[0068] Example 2

[0069] Please refer to Figure 1 , Figure 2 As shown, this embodiment provides an Internet of Things (IoT) system based on PLC communication. The system is created based on PLC-IoT and used to execute the device network access method described in Embodiment 1. The system includes CCO1, PLC gateway 2, STA device 4, and server 3.

[0070] Furthermore, the system is created based on the IEEE 1901.1 protocol, and the STA device 4 information is the device MAC address.

[0071] Specifically, the system in this embodiment adopts PLC-IoT based on the IEEE protocol. PLC-IoT is a mid-frequency power line carrier communication technology for Internet of Things scenarios. Its operating frequency range is 0.7-12MHz. PLC-IoT adopts time-frequency diversity technology, and data can be backed up in both the time domain and the frequency domain to prevent interference or loss of information in a certain period or frequency. It is used to cope with the strong time-varying interference of power lines and the frequency-selective attenuation, thereby improving the anti-attenuation and anti-noise capabilities.

[0072] Furthermore, CCO1 includes:

[0073] The whitelist control unit 11 is used to generate a whitelist of STA devices 4 and keep it enabled or delete the information of STA devices 4 from the whitelist, ensuring that only devices provided through legitimate channels can successfully access the network, thereby effectively preventing the intrusion of unauthorized STA devices 4 and ensuring network security.

[0074] The transceiver unit 12 is used to send and receive messages and device information between the PLC gateway 2 and the STA device 4. For example, it can receive device information from the STA device 4 from the PLC gateway via power line carrier communication. Or, the PLC gateway can send a query message to CCO1, and CCO1 can send it to the STA device 4 via power line carrier communication. After receiving the query message, the STA device 4 can reply with device information via power line carrier communication, which is then forwarded to the PLC gateway by CCO1.

[0075] Meanwhile, PLC gateway 2 includes:

[0076] The decryption unit 21 is used to receive the ciphertext sent by the server 3 and decrypt it to obtain the relevant information of the STA device 4, and send the relevant information to CCO1;

[0077] The query unit 22 is used to send a query message to CCO1 and obtain relevant information about STA device 4 after STA device 4 successfully joins the network;

[0078] Verification unit 23 is used to verify the information of the STA device 4 that has joined the network. If the verification is successful, it reports to server 3 that the network access is successful. If the verification fails, it sends a kick-out command to CCO1. During the network access process, verification unit 23 continuously verifies the information of the STA device 4 and notifies CCO to kick out STA devices 4 with inconsistent information. This prevents a large number of STA devices 4 that need to be deleted from the whitelist from increasing the workload of the process. It effectively simplifies the network access and configuration process, so that users do not need to perform complicated operations and settings, thus improving the efficiency of network configuration. At the same time, it avoids the potential danger of unknown STA devices 4 launching network attacks, improves the overall security of network communication, and facilitates the management and use of devices.

[0079] The key exchange unit 24 is used to periodically exchange keys with the STA device 4 and encrypt communication through the keys, effectively protecting the user's data privacy, improving the overall security of network communication, and preventing potential data leakage and unauthorized access threats.

[0080] The key is a private key encrypted using a symmetric encryption algorithm, which includes one or more of AES (Advanced Encryption Standard), DES (Data Encryption Standard), SM4 (Chinese Block Cryptography Standard), SM1 (Symmetric Cryptography), and Diffie-Hellman (Diffie-Hellman Key Exchange Protocol).

[0081] In addition, server 3 includes:

[0082] Acquisition module 31 is used to acquire information from STA device 4;

[0083] The encryption module 32 is used to encrypt the information of STA device 4 using a private key and send the ciphertext to PLC gateway 2. Specifically, the key here is a key encrypted using an asymmetric encryption algorithm, including one or more of RSA (Rivest–Shamir–Adleman, an asymmetric algorithm), DSA (digital signature algorithm), SM2 (Chinese national cryptographic algorithm standard) and ECC (elliptic curve cryptography).

[0084] Specifically, the acquisition module 31 acquires the MAC address of the STA device, the encryption module 32 encrypts the information of the STA device 4 and sends it to the PLC gateway 2, the decryption unit 21 decrypts the information of the STA device 4 and the PLC gateway 2 sends the information to the CCO1, and the whitelist control unit 11 in the CCO1 adds the information of the STA device 4 to the whitelist. In this way, by securely encrypting and transmitting the information of the STA device 4, it is ensured that the information provided by the user is not easily tampered with or stolen. This improvement in security lays a solid foundation for the entire network access process.

[0085] Meanwhile, after STA device 4 joins the network, the transceiver unit 12 in CCO1 reports the information of STA device 4 to PLC gateway 2. The query unit 22 in PLC gateway 2 sends a query message, which is then sent by the transceiver unit 12 to the STA device 4 already joined in the network via PLC. The STA device 4 receives the query message and replies with device information via PLC. The transceiver unit 12 then receives and forwards the message to PLC gateway 2. The verification unit 23 continuously verifies the information of STA device 4 and notifies the whitelist control unit 11 in CCO1 to remove STA devices 4 whose information does not match. This effectively simplifies the device joining and network configuration process, eliminating the need for complex operations and settings by users, improving network configuration efficiency. At the same time, it avoids the potential danger of unknown STA device 4 launching network attacks, improves the overall security of network communication, and facilitates the management and use of the device.

[0086] During the continuous network access process of different STA devices 4, the whitelist control unit 11 remains in the active state. The whitelist control unit 11 continuously adds the obtained STA device 4 information to the whitelist or removes STA devices 4 that fail verification from the whitelist, causing the STA devices 4 that fail verification to disconnect, effectively preventing the intrusion of unauthorized STA devices 4, thereby ensuring network security. CCO1 is responsible for maintaining the whitelist, ensuring that only STA devices 4 provided through legitimate channels can successfully access the network. The introduction of the whitelist control mechanism greatly improves the network access security of STA devices 4 in the entire PLC system. The device security verification and identity verification mechanism introduced during the network distribution process provides strong support for the system to prevent potential network attacks.

[0087] Furthermore, after successful verification by verification unit 23, PLC gateway 2 periodically exchanges keys with STA device 4 through key exchange unit 24 and encrypts communication using these keys. For devices already connected to the network, the gateway and STA device 4 periodically exchange communication keys, effectively protecting user data privacy and improving the overall security of network communication, preventing potential data leaks and unauthorized access threats.

[0088] It should be understood that all encryption algorithms and communication protocols involved can be adjusted and updated according to actual needs and security standards. The message format and protocol specifications during the communication process should comply with relevant standards to ensure effective communication between devices.

[0089] Furthermore, it should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0090] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0091] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0092] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A PLC communication-based device commissioning method, characterized by, include: S1. Encryption: The server encrypts the acquired STA device information using a private key and sends the ciphertext to the PLC gateway; S2. Decryption: The PLC gateway decrypts the ciphertext using a pre-set public key to obtain the STA device information, and then sends the STA device information to the CCO; S3. Input: The CCO adds the STA device information to the whitelist and waits for the STA device to join the network; S4. Network Access: The user triggers the STA device network access method through interactive means, and the STA device joins the network; S5. Query: The CCO reports the information of the STA devices that have joined the network to the PLC gateway. The PLC gateway sends a query message to the CCO, which then sends it to the STA device through the PLC. S6. Feedback: The STA device receives the query message and replies with STA device information via power line carrier communication. The CCO forwards the STA device information to the PLC gateway. S7. Verification: The PLC gateway verifies the STA device information. If the verification is successful, the PLC gateway reports to the server that the STA device has successfully joined the network. If the verification fails, the PLC gateway sends a kick-out command to the CCO.

2. The method for connecting devices to the network based on PLC communication according to claim 1, characterized in that, Also includes: S8. Key Exchange: After successful verification, the PLC gateway periodically exchanges keys with the STA device and uses the keys to encrypt communication.

3. The method for connecting devices to the network based on PLC communication according to claim 2, characterized in that, The server and the PLC gateway communicate using an asymmetric encryption algorithm, which includes one or more of RSA, DSA, SM2, and ECC. The STA device and the PLC gateway communicate using a symmetric encryption algorithm, which includes one or more of AES, DES, SM4, SM1, and Diffie-Hellman.

4. The method for connecting devices to the network based on PLC communication according to claim 1, characterized in that, Also includes: S9. Reporting: The PLC gateway reports the verification result of the STA device to the server, and the server sends the corresponding verification result message to the user.

5. The method for connecting devices to the network based on PLC communication according to claim 1, characterized in that, The STA device information includes one or more of the following: device production serial number, device product ID, device type ID, device manufacturer ID, device MAC address, device model, device protocol version, device firmware version, device hardware version, and device software version.

6. An Internet of Things (IoT) system based on PLC communication, characterized in that: The system includes a CCO, a PLC gateway, a STA device, and a server, and is used to execute the device network access method as described in any one of claims 1-5.

7. The IoT system based on PLC communication according to claim 6, characterized in that: The system is created based on the IEEE 1901.1 protocol, and the STA device information is the device MAC address.

8. The IoT system based on PLC communication according to claim 6, characterized in that, The CCO includes: The whitelist control unit is used to generate a whitelist of the STA devices and keep it enabled or to delete the STA device information from the whitelist. The transceiver unit is used to send and receive messages and device information between the PLC gateway and the STA device.

9. The IoT system based on PLC communication according to claim 6, characterized in that, The PLC gateway includes: The decryption unit is used to receive the ciphertext sent by the server, decrypt it to obtain the relevant information of the STA device, and send the relevant information to the CCO; The query unit is used to send a query message to the CCO and obtain relevant information about the STA device after the STA device successfully joins the network. The verification unit is used to verify the information of the STA device that has been connected to the network. If the verification is successful, it reports to the server that the network access is successful. If the verification fails, it sends a kick-out command to the CCO. A key exchange unit is used to periodically exchange the key with the STA device and encrypt communication using the key.

10. The IoT system based on PLC communication according to claim 6, characterized in that, The server includes: The acquisition module is used to acquire information about the STA device; The encryption module is used to encrypt the STA device information using a private key and send the ciphertext to the PLC gateway.

Images