Device identity authentication method and system

Abstract

The present application discloses a device identity authentication method and system, the method comprising: obtaining the current business scenario of the power system, the dynamic capability information of the device to be authenticated, and the first static capability information of the device to be authenticated; confirming the device type of the device to be authenticated according to the first static capability information; obtaining the authentication strategy according to the current business scenario, the dynamic capability information, and the device type; the authentication strategy at least includes a proof algorithm and proof algorithm parameters; and authenticating the device to be authenticated through the authentication strategy. The use of the embodiments of the present application can improve the efficiency of the authentication process, thereby improving the applicability and scalability of the authentication method, and effectively ensuring the overall safety of the power system.

Description

Technical Field

[0001] The present application relates to the field of authentication technology, and in particular to a device identity authentication method and system. Background Art

[0002] There are many types of terminal devices in the power system, and their computing power, storage capacity, communication bandwidth and other information vary greatly. The traditional terminal device identity authentication method uses a unified proof algorithm, which is difficult to take into account the characteristics of different devices, resulting in inefficient authentication process. Summary of the invention

[0003] The present application provides a device identity authentication method and system to solve the problem in the prior art that it is difficult to take into account the characteristics of different devices, resulting in low efficiency of the authentication process and affecting the applicability and scalability of the authentication method.

[0004] To achieve the above purpose, the present application provides a device identity authentication method, including:

[0005] Acquire the current business scenario of the power system, dynamic capability information of the device to be authenticated, and first static capability information of the device to be authenticated;

[0006] Confirming the device type of the device to be authenticated according to the first static capability information;

[0007] Acquire an authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a certification algorithm and certification algorithm parameters;

[0008] The identity of the device to be authenticated is authenticated using the authentication strategy.

[0009] As an improvement of the above solution, the confirming the certification algorithm and the certification algorithm parameters according to the current business scenario, the dynamic capability information and the device type includes:

[0010] According to the current business scenario, obtaining the security requirements of the current business scenario;

[0011] Selecting the authentication algorithm from a preset algorithm library according to the security requirements and the device type;

[0012] The certification algorithm parameters are selected from a preset parameter library according to the dynamic capability information and the certification algorithm.

[0013] As an improvement of the above solution, confirming the device type of the device to be authenticated according to the first static capability information includes:

[0014] Vectorizing the first static capability information to obtain a first static capability vector;

[0015] Performing similarity matching between the first static capability vector and each capability feature vector in a preset capability library to obtain a target capability feature vector;

[0016] The device type is determined according to the target capability feature vector.

[0017] As an improvement to the above solution, the capability library is constructed by the following steps:

[0018] Obtaining second static capability information of a plurality of test devices;

[0019] Vectorizing the plurality of second static capability information to obtain a plurality of second static capability vectors;

[0020] Performing cluster analysis on a number of the second static capability vectors to obtain a number of clustering results;

[0021] The capability feature vector of each clustering result is calculated to form the capability library.

[0022] As an improvement of the above solution, the step of performing identity authentication on the device to be authenticated by using the authentication strategy includes:

[0023] Obtaining an identity token sent by the device to be authenticated, where the identity token is generated by the authentication policy;

[0024] The identity of the device to be authenticated is performed according to the identity token.

[0025] As an improvement of the above solution, the identity token is generated by the device to be authenticated through the following steps:

[0026] Obtaining identity information of the device to be authenticated;

[0027] Associating the first static capability information with the identity information;

[0028] The authentication strategy is adopted to encrypt the associated first static capability information and identity information to obtain the identity token.

[0029] As an improvement of the above solution, the identity authentication of the device to be authenticated according to the identity token includes:

[0030] The identity token is matched with each token in the preset token library. If the same token is matched, the identity authentication is passed.

[0031] As an improvement of the above solution, the device identity authentication method further includes:

[0032] After the identity authentication is passed, obtaining the security status information of the device to be authenticated;

[0033] The access policy of the device to be authenticated is adjusted according to the security status information of the device to be authenticated.

[0034] As an improvement of the above solution, the device identity authentication method further includes:

[0035] After the identity authentication is passed, obtaining the security status information of the device to be authenticated;

[0036] Determining whether the device to be authenticated is in a safe state according to the security state information of the device to be authenticated;

[0037] If it is determined that the device to be authenticated is not in a safe state, a security control instruction is sent to the device to be authenticated.

[0038] To achieve the above object, an embodiment of the present application further provides a device identity authentication system, including a controller, wherein the controller is configured to:

[0039] Acquire the current business scenario of the power system, dynamic capability information of the device to be authenticated, and first static capability information of the device to be authenticated;

[0040] Acquire an authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a certification algorithm and certification algorithm parameters;

[0041] The identity of the device to be authenticated is authenticated using the authentication strategy.

[0042] Compared with the prior art, the device identity authentication method and system provided in the embodiment of the present application obtains the current business scenario of the power system, the dynamic capability information of the device to be authenticated, and the first static capability information of the device to be authenticated; confirms the device type of the device to be authenticated according to the first static capability information; obtains the authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a proof algorithm and proof algorithm parameters; and authenticates the device to be authenticated through the authentication strategy. It can be seen that the embodiment of the present application not only takes into account the characteristics of different devices, but also takes into account the business scenario, which can improve the efficiency of the authentication process, thereby improving the applicability and scalability of the authentication method, and effectively ensuring the overall safety of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flow chart of a device identity authentication method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] See also Figure 1 , Figure 1 : is a flow chart of a device identity authentication method provided in an embodiment of the present application, the device identity authentication method comprising:

[0046] S1. Acquire the current business scenario of the power system, dynamic capability information of the device to be authenticated, and first static capability information of the device to be authenticated;

[0047] S2. Confirming the device type of the device to be authenticated according to the first static capability information;

[0048] S3. Acquire an authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a certification algorithm and certification algorithm parameters;

[0049] S4. Perform identity authentication on the device to be authenticated using the authentication strategy.

[0050] It is understandable that the dynamic capability information of the device is used to indicate the current capability of the device, for example, including at least one of the current CPU occupancy rate, the current memory usage rate, and the current communication delay. The static capability information of the device (first static capability information, second static capability information) is used to indicate the specifications of the device, that is, the maximum capability that can be achieved, for example, including at least one of computing power, storage capacity, and communication bandwidth. Through the dynamic capability information and static capability information of the device, the characteristics of the device are fully demonstrated, so that the authentication process takes into account the characteristics of different devices.

[0051] The embodiment of the present application can be pre-set with an authentication policy library, which includes the current business scenario, dynamic capability information, and the corresponding relationship between the device type and the authentication policy, so that the authentication policy library can obtain an authentication policy that meets the current situation, which not only takes into account the characteristics of different devices, but also takes into account the business scenario, and can improve the efficiency of the authentication process, thereby improving the applicability and scalability of the authentication method, and effectively ensuring the overall safety of the power system. Among them, the authentication policy library can be tested in advance. Specifically, various authentication strategies are used for various situations to perform authentication tests, and the best authentication strategy is selected for various situations according to the authentication time obtained each time to form a corresponding relationship.

[0052] In an optional embodiment, the confirming the certification algorithm and the certification algorithm parameters according to the current business scenario, the dynamic capability information and the device type includes:

[0053] According to the current business scenario, obtaining the security requirements of the current business scenario;

[0054] Selecting the authentication algorithm from a preset algorithm library according to the security requirements and the device type;

[0055] The certification algorithm parameters are selected from a preset parameter library according to the dynamic capability information and the certification algorithm.

[0056] In an embodiment of the present application, the current business scenario can be analyzed by a machine learning algorithm to obtain the security requirements of the current business scenario, such as whether the security requirements are high, medium, or low. In combination with the security requirements and the device type, the proof algorithm is selected from a preset algorithm library, which includes the correspondence between security requirements, device types, and proof algorithms. By dynamically adjusting the proof algorithm, the changes in the requirements for the device type in the scenario are met. Finally, based on the dynamic capability information and the proof algorithm, the proof algorithm parameters are selected from a preset parameter library, which includes the correspondence between dynamic capability information, proof algorithms, and proof algorithm parameters. By dynamically adjusting the proof algorithm parameters, changes in device capabilities are adapted.

[0057] For example, in the scenario of electricity consumption information collection in the smart grid, for the LXSK-2000 electric energy meter, a proof algorithm with a "high" security requirement is selected from the preset algorithm library, including elliptic curve cryptography algorithm, hash algorithm, zero-knowledge proof algorithm, etc. According to the dynamic capability information and the selected proof algorithm, the proof algorithm parameters are selected from the preset parameter library. The proof algorithm and the proof algorithm parameters construct an authentication process for efficient authentication of the LXSK-2000 electric meter. For example, if the dynamic capability information is that the current CPU occupancy rate of the electric meter exceeds 80%, the proof algorithm parameters of the elliptic curve cryptography algorithm are adjusted from ECC-256 to ECC-224 to reduce the computational load of the electric meter. If the dynamic capability information is that the current communication delay exceeds 500 ms, the number of interaction rounds in the proof algorithm is reduced from 3 rounds to 2 rounds to adapt to changes in network conditions. In addition, the system also monitors in real time the changes in the security requirements of the electricity consumption information collection scenario, from "high" to "medium", and accordingly switches the hash algorithm SM3 to the hash algorithm SHA-256, further improving the authentication efficiency while meeting the security requirements.

[0058] In an optional embodiment, confirming the device type of the device to be authenticated according to the first static capability information includes:

[0059] Vectorizing the first static capability information to obtain a first static capability vector;

[0060] Performing similarity matching between the first static capability vector and each capability feature vector in a preset capability library to obtain a target capability feature vector;

[0061] The device type is determined according to the target capability feature vector.

[0062] In the embodiment of the present application, the first static capability information of the device to be authenticated is vectorized to obtain a first static capability vector; the first static capability vector is matched with each capability feature vector in a preset capability library for similarity, and the capability feature vector with the greatest similarity is used as the target capability feature vector, and the device type is confirmed according to the target capability feature vector. The capability library includes the corresponding relationship between the capability feature vector and the device type.

[0063] For example, if the identity token is "0x3a5c", the first static capability information of the device queried based on "0x3a5c" is "computing power is 5 GFLOPS, storage capacity is 128 GB, and communication bandwidth is 100 Mbps". The quantified value of computing power is 5, the quantified value of storage capacity is 128, and the quantified value of communication bandwidth is 100, then the first static capability vector is [5,128,100]. Calculate the similarity between [5,128,100] and each capability feature vector, and use the capability feature vector with the greatest similarity as the target capability feature vector. The device type corresponding to the target capability feature vector is the device type of the device to be authenticated.

[0064] In an optional embodiment, the capability library is constructed by the following steps:

[0065] Obtaining second static capability information of a plurality of test devices;

[0066] Vectorizing the plurality of second static capability information to obtain a plurality of second static capability vectors;

[0067] Performing cluster analysis on a number of the second static capability vectors to obtain a number of clustering results;

[0068] The capability feature vector of each clustering result is calculated to form the capability library.

[0069] In the embodiment of the present application, by vectorizing the second static capability information of a plurality of test devices, a plurality of second static capability vectors are obtained, by clustering the plurality of second static capability vectors, a plurality of clustering results are obtained, and the capability feature vector of each clustering result is calculated, and these capability feature vectors form the capability library. The capability library includes the correspondence between the capability feature vector and the device type.

[0070] Exemplarily, the second static capability vector of the test device is [5, 128, 100]. The K-means clustering algorithm is used to analyze the capability matrix. By calculating the Euclidean distance between devices, devices with similar distances are divided into the same category to form a clustering result, i.e., a device classification result. For example, devices with computing power between 0 and 100 GFLOPS, storage capacity between 100 and 200 GB, and communication bandwidth between 50 and 150 Mbps are divided into one category. For each device category, the average value, maximum value, minimum value and other statistical characteristics of all devices in the category in each capability dimension are counted to obtain the capability feature vector of the device category. For example, the capability feature vector of a certain category is [5, 150, 100, 100, 200, 150], which respectively represent the average computing power, average storage capacity, average communication bandwidth, maximum computing power, maximum storage capacity and maximum communication bandwidth of the devices in this category. The capability library includes a correspondence between device types and capability feature vectors. For example, in the capability library, the device type whose capability feature vector is [5, 150, 100, 100, 200, 150] is the first device type.

[0071] In an optional embodiment, the performing identity authentication on the device to be authenticated by using the authentication policy includes:

[0072] Obtaining an identity token sent by the device to be authenticated, where the identity token is generated by the authentication policy;

[0073] The identity of the device to be authenticated is performed according to the identity token.

[0074] In the embodiment of the present application, the device to be authenticated generates an identity token through the authentication strategy and sends it to the power system for identity authentication. If the identity authentication is successful, it means that the device to be authenticated is a legal device, and the device to be authenticated is allowed to access the power system to access the power system and ensure the overall security of the power system. If the identity authentication fails, it means that the device to be authenticated is an illegal device, and the device to be authenticated is denied access to the power system.

[0075] In an optional embodiment, the identity token is generated by the device to be authenticated through the following steps:

[0076] Obtaining identity information of the device to be authenticated;

[0077] Associating the first static capability information with the identity information;

[0078] The authentication strategy is adopted to encrypt the associated first static capability information and identity information to obtain the identity token.

[0079] In an embodiment of the present application, the identity token of the device is obtained by combining the first static capability information and identity information of the device, thereby improving the accuracy of authentication.

[0080] Exemplarily, the first static capability information of the device to be authenticated is obtained, such as "computing power: 5 GFLOPS, storage capacity: 128 GB, communication bandwidth: 100 Mbps"; the identity information of the device to be authenticated is obtained, such as the device identification is "A001", the hardware information is "CPU: 4 GHz, memory: 8 GB", and the software information is "operating system: Android 10". "Computing power: 5GFLOPS, storage capacity: 128 GB, communication bandwidth: 100 Mbps" is associated with "A001, CPU: 4 GHz, memory: 8 GB", operating system: Android 10", and the associated "A001, CPU: 4 GHz, memory: 8 GB", operating system: Android10, computing power: 5 GFLOPS, storage capacity: 128 GB, communication bandwidth: 100 Mbps" is encrypted to obtain the identity token, for example, using the SHA-256 (secure hash) algorithm for hash operation to obtain the hash value "0x3a5c" as the identity token. In addition, a mapping relationship between the device identification "A001" and the identity token "0x3a5c" may be established, so that the device identification may be queried according to the identity token, and then the first static capability information of the device may be queried according to the device identification.

[0081] In an optional embodiment, performing identity authentication on the device to be authenticated according to the identity token includes:

[0082] The identity token is matched with each token in the preset token library. If the same token is matched, the identity authentication is passed.

[0083] In an embodiment of the present application, the power system is preset with a token library, which stores a number of tokens. When the identity token of the device to be authenticated can be queried in the token library, it means that the identity authentication of the device to be authenticated is passed.

[0084] In an optional embodiment, the device identity authentication method further includes:

[0085] After the identity authentication is passed, obtaining the security status information of the device to be authenticated;

[0086] The access policy of the device to be authenticated is adjusted according to the security status information of the device to be authenticated.

[0087] In the embodiment of the present application, the security status information of the device to be authenticated can be analyzed by a machine learning algorithm, and the access policy of the device to be authenticated can be adjusted in time to achieve continuous control of the device, so as to avoid abnormal behavior of the device affecting the safety of the power system. Optionally, the security status information includes operation logs and security events.

[0088] Exemplarily, the power system queries the 5,000 operation logs and 200 security events of the meter in the past year. If it is determined based on these data that the meter is currently in a safe state, the system adjusts the access policy of the meter to the first access policy, such as allowing the meter to upload electricity data once every 5 minutes and synchronize billing information once a day. If it is determined based on these data that the meter is currently in an abnormal state, such as more than 3 abnormalities within 1 hour, the system adjusts the access policy of the meter to the second access policy to limit the meter function and ensure the overall safety of the power system. If it is determined based on these data that the meter is currently in a dangerous state, the system adjusts the access policy of the meter to the third access policy, such as denying access to the meter, to ensure the overall safety of the power system.

[0089] In an optional embodiment, the device identity authentication method further includes:

[0090] After the identity authentication is passed, obtaining the security status information of the device to be authenticated;

[0091] Determining whether the device to be authenticated is in a safe state according to the security state information of the device to be authenticated;

[0092] If it is determined that the device to be authenticated is not in a safe state, a security control instruction is sent to the device to be authenticated.

[0093] In an embodiment of the present application, by analyzing the security status information of the device to be authenticated and sending a security control instruction to the device to be authenticated to limit or shut down the operation of the device to be authenticated, the security risk of the device can be discovered in time and the security of the device can be improved.

[0094] Exemplarily, the system obtains the operation log and security events of the device every 5 minutes as security status information, analyzes these security statuses, and determines whether the device is in a safe state. For example, if an unknown process appears or a suspicious connection is initiated to the outside, the device is judged to be in an abnormal state, that is, the device is not in a safe state, otherwise it is in a safe state. For devices that are not in a safe state, security control instructions are sent to the device to be authenticated, such as virus detection instructions, high-risk port closing instructions, operation restriction instructions, etc. Specifically, according to the security status information of the device to be authenticated, the abnormal description information of the device to be authenticated is obtained, and then the security control instructions to be sent are determined according to the abnormal description information.

[0095] In addition, an embodiment of the present application further provides a device identity authentication system, the device identity authentication system comprising a controller, the controller being configured as follows:

[0096] Acquire the current business scenario of the power system, dynamic capability information of the device to be authenticated, and first static capability information of the device to be authenticated;

[0097] Confirming the device type of the device to be authenticated according to the first static capability information;

[0098] Acquire an authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a certification algorithm and certification algorithm parameters;

[0099] The identity of the device to be authenticated is authenticated using the authentication strategy.

[0100] Optionally, the confirming the certification algorithm and certification algorithm parameters according to the current business scenario, the dynamic capability information, and the device type includes:

[0101] According to the current business scenario, obtaining the security requirements of the current business scenario;

[0102] Selecting the authentication algorithm from a preset algorithm library according to the security requirements and the device type;

[0103] The certification algorithm parameters are selected from a preset parameter library according to the dynamic capability information and the certification algorithm.

[0104] Optionally, confirming the device type of the device to be authenticated according to the first static capability information includes:

[0105] Vectorizing the first static capability information to obtain a first static capability vector;

[0106] Performing similarity matching between the first static capability vector and each capability feature vector in a preset capability library to obtain a target capability feature vector;

[0107] The device type is determined according to the target capability feature vector.

[0108] Optionally, the capability library is constructed by the following steps:

[0109] Obtaining second static capability information of a plurality of test devices;

[0110] Vectorizing the plurality of second static capability information to obtain a plurality of second static capability vectors;

[0111] Performing cluster analysis on a number of the second static capability vectors to obtain a number of clustering results;

[0112] The capability feature vector of each clustering result is calculated to form the capability library.

[0113] Optionally, the performing identity authentication on the device to be authenticated by using the authentication policy includes:

[0114] Obtaining an identity token sent by the device to be authenticated, where the identity token is generated by the authentication policy;

[0115] The identity of the device to be authenticated is performed according to the identity token.

[0116] Optionally, the identity token is generated by the device to be authenticated through the following steps:

[0117] Obtaining identity information of the device to be authenticated;

[0118] Associating the first static capability information with the identity information;

[0119] The authentication strategy is adopted to encrypt the associated first static capability information and identity information to obtain the identity token.

[0120] Optionally, performing identity authentication on the device to be authenticated according to the identity token includes:

[0121] The identity token is matched with each token in the preset token library. If the same token is matched, the identity authentication is passed.

[0122] Optionally, the controller is further configured to:

[0123] After the identity authentication is passed, obtaining the security status information of the device to be authenticated;

[0124] The access policy of the device to be authenticated is adjusted according to the security status information of the device to be authenticated.

[0125] Optionally, the controller is further configured to:

[0126] After the identity authentication is passed, obtaining the security status information of the device to be authenticated;

[0127] Determining whether the device to be authenticated is in a safe state according to the security state information of the device to be authenticated;

[0128] If it is determined that the device to be authenticated is not in a safe state, a security control instruction is sent to the device to be authenticated.

[0129] It is worth noting that the working process of the device identity authentication system described in the embodiment of the present application can refer to the working process of the device identity authentication method described in the above embodiment, which will not be repeated here.

[0130] The embodiment of the present application provides a device identity authentication system, which obtains the current business scenario of the power system, the dynamic capability information of the device to be authenticated, and the first static capability information of the device to be authenticated; confirms the device type of the device to be authenticated according to the first static capability information; obtains the authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a proof algorithm and proof algorithm parameters; and authenticates the device to be authenticated through the authentication strategy. It can be seen that the embodiment of the present application not only takes into account the characteristics of different devices, but also takes into account the business scenario, which can improve the efficiency of the authentication process, thereby improving the applicability and scalability of the authentication method, and effectively ensuring the overall safety of the power system.

[0131] In addition, an embodiment of the present application further provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the device identity authentication method as described in any of the above embodiments.

[0132] In addition, an embodiment of the present application further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the device identity authentication method as described in any of the above embodiments.

[0133] In addition, an embodiment of the present application further provides an authentication device, the authentication device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps in the above-mentioned device identity authentication method embodiment are implemented. Alternatively, when the processor executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0134] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the authentication device.

[0135] The authentication device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the schematic diagram is merely an example of an authentication device and does not constitute a limitation on the authentication device. The authentication device may include more or fewer components than shown in the diagram, or may combine certain components, or different components. For example, the authentication device may also include an input / output device, a network access device, a bus, etc.

[0136] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the authentication device, and uses various interfaces and lines to connect various parts of the entire authentication device.

[0137] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the authentication device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0138] Wherein, if the module / unit integrated in the authentication device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0139] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A device identity authentication method, characterized in that: include: Acquire the current business scenario of the power system, dynamic capability information of the device to be authenticated, and first static capability information of the device to be authenticated; Confirming the device type of the device to be authenticated according to the first static capability information; Acquire an authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a certification algorithm and certification algorithm parameters; Performing identity authentication on the device to be authenticated using the authentication strategy; The confirming of the certification algorithm and the certification algorithm parameters according to the current business scenario, the dynamic capability information and the device type includes: According to the current business scenario, obtaining the security requirements of the current business scenario; Selecting the authentication algorithm from a preset algorithm library according to the security requirements and the device type; The certification algorithm parameters are selected from a preset parameter library according to the dynamic capability information and the certification algorithm.

2. The device identity authentication method according to claim 1, characterized in that: The confirming, according to the first static capability information, the device type of the device to be authenticated includes: Vectorizing the first static capability information to obtain a first static capability vector; Performing similarity matching between the first static capability vector and each capability feature vector in a preset capability library to obtain a target capability feature vector; The device type is determined according to the target capability feature vector.

3. The device identity authentication method according to claim 2, characterized in that: The capability library is constructed by following the steps below: Obtaining second static capability information of a plurality of test devices; Vectorizing the plurality of second static capability information to obtain a plurality of second static capability vectors; Performing cluster analysis on a number of the second static capability vectors to obtain a number of clustering results; The capability feature vector of each clustering result is calculated to form the capability library.

4. The device identity authentication method according to claim 1, characterized in that: The performing identity authentication on the device to be authenticated by using the authentication strategy includes: Obtaining an identity token sent by the device to be authenticated, where the identity token is generated by the authentication policy; The identity of the device to be authenticated is performed according to the identity token.

5. The device identity authentication method according to claim 4, characterized in that: The identity token is generated by the device to be authenticated through the following steps: Obtaining identity information of the device to be authenticated; Associating the first static capability information with the identity information; The authentication strategy is adopted to encrypt the associated first static capability information and identity information to obtain the identity token.

6. The device identity authentication method according to claim 4, characterized in that: The step of performing identity authentication on the device to be authenticated according to the identity token includes: The identity token is matched with each token in the preset token library. If the same token is matched, the identity authentication is passed.

7. The device identity authentication method according to claim 1, characterized in that: The device identity authentication method further includes: After the identity authentication is passed, obtaining the security status information of the device to be authenticated; The access policy of the device to be authenticated is adjusted according to the security status information of the device to be authenticated.

8. The device identity authentication method according to claim 1, characterized in that: The device identity authentication method further includes: After the identity authentication is passed, obtaining the security status information of the device to be authenticated; Determining whether the device to be authenticated is in a safe state according to the security state information of the device to be authenticated; If it is determined that the device to be authenticated is not in a safe state, a security control instruction is sent to the device to be authenticated.

9. A device identity authentication system, characterized in that: comprising a controller configured to: Acquire the current business scenario of the power system, dynamic capability information of the device to be authenticated, and first static capability information of the device to be authenticated; Confirming the device type of the device to be authenticated according to the first static capability information; Acquire an authentication strategy according to the current business scenario, the dynamic capability information and the device type; the authentication strategy at least includes a certification algorithm and certification algorithm parameters; Performing identity authentication on the device to be authenticated using the authentication strategy; The confirming of the certification algorithm and the certification algorithm parameters according to the current business scenario, the dynamic capability information and the device type includes: According to the current business scenario, obtaining the security requirements of the current business scenario; Selecting the authentication algorithm from a preset algorithm library according to the security requirements and the device type; The certification algorithm parameters are selected from a preset parameter library according to the dynamic capability information and the certification algorithm.

Images