Zero-trust-based operation and maintenance processing method and device for electric power Internet of Things equipment

Abstract

The invention discloses a zero-trust-based operation and maintenance processing method and device for power Internet of Things equipment. The method comprises the following steps: acquiring an operation and maintenance task authorization code issued by operation and maintenance terminal equipment; verifying a first equipment serial number corresponding to the operation and maintenance task authorization code and a second equipment serial number stored in the operation and maintenance task authorization code to obtain a verification result; under the condition that the verification result shows that the first equipment serial number is consistent with the second equipment serial number, verifying operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result; after the verification result shows that the operation and maintenance task information passes verification, generating a starting instruction; and after determining that the operation and maintenance channel is opened based on the starting instruction, receiving an operation and maintenance instruction sent by the operation and maintenance terminal equipment based on the operation and maintenance task, and forwarding the operation and maintenance instruction to the power distribution terminal. According to the invention, the technical problem that the electric power Internet of Things equipment has large potential safety hazards due to no safety protection in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of power Internet of Things equipment operation and maintenance technology, and in particular to a zero-trust based power Internet of Things equipment operation and maintenance processing method and device. Background Art

[0002] The power Internet of Things devices (such as distribution terminals, FTUs, fault recording devices, online monitoring devices, etc.) are widely used in the power industry. These power Internet of Things devices often need to be installed on poles or overhead lines, which are a certain distance from the ground. This makes the operation and maintenance configuration of these devices difficult (such as setting value modification, equipment status inspection, etc.).

[0003] Due to the needs of these operation and maintenance services, current power Internet of Things devices have proximal wireless configuration interfaces (such as through zigbee or Bluetooth) to achieve interconnection and interoperability of power Internet of Things devices on overhead lines through ground computers.

[0004] However, these near-field operation and maintenance methods have great security risks due to the lack of security protection. Hackers can invade the power grid monitoring system by attacking these exposed wireless interfaces.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method and device for operation and maintenance of power Internet of Things equipment based on zero trust, so as to at least solve the technical problem in the related technology that power Internet of Things equipment has great potential safety hazards due to the lack of security protection.

[0007] According to one aspect of an embodiment of the present invention, a method for operation and maintenance processing of power Internet of Things equipment based on zero trust is provided, comprising: obtaining an operation and maintenance task authorization code issued by an operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by an operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system; verifying a first device serial number corresponding to the operation and maintenance task authorization code with a second device serial number stored in itself to obtain a verification result; when the verification result indicates that the first device serial number is consistent with the second device serial number, verifying the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, wherein the operation and maintenance task information at least includes: an operation and maintenance object, an operation and maintenance time, and identity information of an operation and maintenance personnel; after the verification result indicates that the operation and maintenance task information are all verified, generating a startup instruction; after determining that the operation and maintenance channel is opened based on the startup instruction, receiving the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and forwarding the operation and maintenance instruction to the distribution terminal, wherein the distribution terminal is a device that needs to be operated and maintained.

[0008] Optionally, the first device serial number corresponding to the operation and maintenance task authorization code is verified with the second device serial number stored in itself to obtain a verification result, including: parsing the operation and maintenance task authorization code to obtain the first device serial number; comparing the first device serial number with the second device serial number to obtain a comparison result; and obtaining the verification result based on the comparison result.

[0009] Optionally, when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, including: obtaining its own private key to decrypt the first ciphertext to obtain a first plaintext corresponding to the first ciphertext, wherein the first ciphertext is a ciphertext generated using the second ciphertext, and the second ciphertext is a ciphertext obtained by encrypting the task authorization code and digital signature information, and the digital signature information is information obtained by digitally signing the task authorization code using the private key of the operation and maintenance background system; using the first ciphertext to decrypt the first plaintext to obtain a second plaintext of the second ciphertext; using its own public key to verify the task code in the second plaintext to obtain a verification result; after the verification result indicates that the public key has passed the verification of the task code, obtaining the operation and maintenance task information; verifying the operation and maintenance task information to obtain the verification result.

[0010] Optionally, when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, including: obtaining its own current clock data, and judging whether the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, to obtain a first judgment result; obtaining its own first device identification, and judging whether the first device identification appears in the authorized device identification list, to obtain a second judgment result, wherein the authorized device identification list is used to save the second device identification of the operation and maintenance terminal device corresponding to the operation and maintenance task; obtaining the operation and maintenance personnel identity information of the operation and maintenance personnel, and identifying the operation and maintenance personnel identity information to obtain an identification result; obtaining the verification result according to the first judgment result, the second judgment result and the identification result.

[0011] Optionally, the operation and maintenance personnel identity information of the operation and maintenance personnel is obtained, and the operation and maintenance personnel identity information is identified to obtain an identification result, including: generating an identity challenge code for the operation and maintenance personnel, and sending the identity challenge code to the operation and maintenance terminal device, so that the operation and maintenance personnel encrypts the identity challenge code using a predetermined password on the operation and maintenance terminal device to obtain a third ciphertext; obtaining the third ciphertext and the identity code of the operation and maintenance personnel; using the identity code to encrypt a predetermined random number to obtain a fourth ciphertext; comparing the third ciphertext with the fourth ciphertext to obtain the identification result.

[0012] Optionally, after the verification result indicates that the operation and maintenance task information has been verified, a start instruction is generated, including: when the verification result indicates that the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, the first device identifier appears in the authorized device identifier list and the third ciphertext is consistent with the fourth ciphertext, it is determined that the operation and maintenance task information has been verified, and the start instruction is generated.

[0013] Optionally, after determining that the operation and maintenance channel is opened based on the startup instruction, receiving the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and before forwarding the operation and maintenance instruction to the distribution terminal, the zero-trust-based power Internet of Things equipment operation and maintenance processing method also includes: starting a timed channel closing task, wherein the timed channel closing task includes the closing time of the operation and maintenance channel; when the closing time arrives, closing the operation and maintenance channel according to the timed channel closing task.

[0014] According to another aspect of an embodiment of the present invention, there is also provided an operation and maintenance processing device for power Internet of Things equipment based on zero trust, including: an acquisition module, used to obtain an operation and maintenance task authorization code issued by an operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by an operation and maintenance background system for an operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system; a verification module, used to verify the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself, and obtain a verification result; a verification module, used to verify the verification result table When it is indicated that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, wherein the operation and maintenance task information at least includes: the operation and maintenance object, the operation and maintenance time, and the identity information of the operation and maintenance personnel; a generation module is used to generate a start instruction after the verification result indicates that the operation and maintenance task information has been verified; a processing module is used to receive the operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task after determining that the operation and maintenance channel is opened based on the start instruction, and forward the operation and maintenance instructions to the distribution terminal, wherein the distribution terminal is the equipment that needs to be operated and maintained.

[0015] Optionally, the verification module includes: a parsing unit, used to parse the operation and maintenance task authorization code to obtain the first device serial number; a comparison unit, used to compare the first device serial number with the second device serial number to obtain a comparison result; and a first acquisition unit, used to obtain the verification result based on the comparison result.

[0016] Optionally, the verification module includes: a first processing unit, used to obtain its own private key to decrypt a first ciphertext to obtain a first plaintext corresponding to the first ciphertext, wherein the first ciphertext is a ciphertext generated using a second ciphertext, and the second ciphertext is a ciphertext obtained by encrypting the task authorization code and digital signature information, and the digital signature information is information obtained by digitally signing the task authorization code using the private key of the operation and maintenance background system; a decryption unit, used to decrypt the first plaintext using the first ciphertext to obtain a second plaintext of the second ciphertext; a signature verification unit, used to verify the task code in the second plaintext using its own public key to obtain a signature verification result; a second acquisition unit, used to obtain the operation and maintenance task information after the signature verification result indicates that the public key has passed the signature verification of the task code; a verification unit, used to verify the operation and maintenance task information to obtain the verification result.

[0017] Optionally, the verification module also includes: a second processing unit, used to obtain its own current clock data, and determine whether the current clock data is within the authorized start and end time of the task corresponding to the operation and maintenance time, to obtain a first judgment result; a third processing unit, used to obtain its own first device identification, and determine whether the first device identification appears in the authorized device identification list, to obtain a second judgment result, wherein the authorized device identification list is used to save the second device identification of the operation and maintenance terminal device corresponding to the operation and maintenance task; a fourth processing unit, used to obtain the operation and maintenance personnel identity information of the operation and maintenance personnel, and identify the operation and maintenance personnel identity information to obtain an identification result; a third acquisition unit, used to obtain the verification result based on the first judgment result, the second judgment result and the identification result.

[0018] Optionally, the fourth processing unit includes: a first processing subunit, used to generate an identity challenge code for the operation and maintenance personnel, and send the identity challenge code to the operation and maintenance terminal device, so that the operation and maintenance personnel use a predetermined password to encrypt the identity challenge code on the operation and maintenance terminal device to obtain a third ciphertext; a first acquisition subunit, used to obtain the third ciphertext and the identity code of the operation and maintenance personnel; an encryption subunit, used to encrypt a predetermined random number using the identity code to obtain a fourth ciphertext; and a comparison subunit, used to compare the third ciphertext with the fourth ciphertext to obtain the identification result.

[0019] Optionally, the generation module includes: a fifth processing unit, used to determine that the operation and maintenance task information has been verified and generate the start instruction when the verification result indicates that the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, the first device identifier appears in the authorized device identifier list, and the third ciphertext is consistent with the fourth ciphertext.

[0020] Optionally, the zero-trust based power IoT equipment operation and maintenance processing device also includes: a starting module, used to start a scheduled channel closing task, wherein the scheduled channel closing task includes the closing time of the operation and maintenance channel; a closing module, used to close the operation and maintenance channel according to the scheduled channel closing task when the closing time arrives.

[0021] According to another aspect of an embodiment of the present invention, a zero-trust-based power Internet of Things device operation and maintenance processing system is also provided, and the zero-trust-based power Internet of Things device operation and maintenance processing system uses any of the zero-trust-based power Internet of Things device operation and maintenance processing methods described above.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned zero-trust-based power Internet of Things equipment operation and maintenance processing methods.

[0023] According to another aspect of an embodiment of the present invention, a processor is further provided, wherein the processor is used to run a program, wherein when the program is running, any one of the above-mentioned zero-trust-based power Internet of Things equipment operation and maintenance processing methods is executed.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned zero-trust-based power Internet of Things equipment operation and maintenance processing methods.

[0025] In an embodiment of the present invention, an operation and maintenance task authorization code issued by an operation and maintenance terminal device is obtained, wherein the operation and maintenance task authorization code is an authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system; a first device serial number corresponding to the operation and maintenance task authorization code and a second device serial number stored in the operation and maintenance task are verified to obtain a verification result; when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, wherein the operation and maintenance task information at least includes: an operation and maintenance object, an operation and maintenance time, and identity information of the operation and maintenance personnel; when the verification result indicates that the operation and maintenance task information has been verified, a startup instruction is generated; after determining that the operation and maintenance channel is opened based on the startup instruction, the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task is received, and the operation and maintenance instruction is forwarded to the power distribution terminal, wherein the power distribution terminal is a device that needs to be operated and maintained. Through the technical solution provided by the present invention, it is achieved that an operation and maintenance task authorization code is generated each time an operation and maintenance task is received, and after the operation and maintenance task authorization code is successfully verified, multi-layer verification is performed on multi-dimensional information related to operation and maintenance. Only after the multi-layer verification is successful, the purpose of the operation and maintenance channel is opened, thereby achieving the integration and fool-proof design of operation and maintenance from business to process to IT, so that the operation of operation and maintenance has the technical effect of the basis of management and control, improves the efficiency and safety of operation and maintenance, and further solves the technical problem in the related technology that the power Internet of Things equipment has a large safety hazard due to the lack of safety protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1 It is a hardware structure block diagram of a mobile terminal of a zero-trust-based power IoT device operation and maintenance processing method according to an embodiment of the present invention;

[0028] Figure 2 It is a flowchart of a method for operating and maintaining a power IoT device based on zero trust according to an embodiment of the present invention;

[0029] Figure 3 is a flowchart of an optional zero-trust-based power IoT device operation and maintenance processing method according to an embodiment of the present invention;

[0030] Figure 4 is a schematic diagram of an operation and maintenance task authorization code according to an embodiment of the present invention;

[0031] Figure 5 is a flow chart of verification by authorized operation and maintenance personnel according to an embodiment of the present invention;

[0032] Figure 6 is a flow chart of optional authorized operation and maintenance personnel verification according to an embodiment of the present invention;

[0033] Figure 7 is another optional flowchart of authorized operation and maintenance personnel verification according to an embodiment of the present invention;

[0034] Figure 8 is a flowchart of an optional zero-trust-based power IoT device operation and maintenance processing method according to an embodiment of the present invention;

[0035] Fig. 9 2 is a schematic diagram of a zero-trust-based power Internet of Things equipment operation and maintenance processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] As introduced in the background technology, the power Internet of Things devices in the related technology have great security risks due to the lack of security protection. In view of the above defects, in the embodiments of the present invention, a method and device for operating and maintaining power Internet of Things devices based on zero trust, a system for operating and maintaining power Internet of Things devices based on zero trust, a computer program product, a computer-readable storage medium and a processor are provided.

[0039] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0040] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of a zero-trust-based power IoT device operation and maintenance processing method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0041] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the zero-trust-based power IoT device operation and maintenance processing method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific network examples may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0042] According to an embodiment of the present invention, a method embodiment of zero-trust based operation and maintenance processing of power Internet of Things equipment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] Figure 2 is a flowchart of a method for operating and maintaining a power IoT device based on zero trust according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0044] Step S202, obtaining the operation and maintenance task authorization code issued by the operation and maintenance terminal device, wherein the operation and maintenance task authorization code is the authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system.

[0045] In this embodiment, the operation and maintenance task authorization code can be obtained through the operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved. It should be noted that the authorization code is a temporary authorization code generated for each operation and maintenance task.

[0046] Optionally, the authorization code (ie, the operation and maintenance task authorization code) may include: equipment serial number, digital envelope and other information.

[0047] It should be noted that the above-mentioned device serial number, that is, the device unique ID (identifier), is used to identify the near-field communication zero-trust module; the digital envelope, that is, the ciphertext 1 (that is, the second ciphertext in the context) and the ciphertext 2 (that is, the first ciphertext in the context), is a digitally encrypted and protected information transmission method consisting of two parts, wherein ciphertext 1 is composed of the encrypted operation and maintenance task code and the system signature, and ciphertext 2 is obtained by encrypting the temporary key of ciphertext 1 with the device public key corresponding to the device serial number.

[0048] Among them, the above-mentioned operation and maintenance terminal equipment is equipment specially designed for operation and maintenance work, that is, the PC (personal computer) of the operation and maintenance personnel is portable. Through this device, the operation and maintenance personnel can apply to the operation and maintenance background for operation and maintenance of designated line equipment, and is used to access the operation and maintenance background system of the operation and maintenance team; the operation and maintenance background system refers to the IT infrastructure and service system deployed in the operation and maintenance team, which can register and manage zero-trust module equipment, apply / approve operation and maintenance tasks, and download operation and maintenance task authorization codes, to achieve remote monitoring, fault diagnosis and maintenance of equipment, improve equipment operation efficiency and reliability, and reduce operation and maintenance costs and risks.

[0049] Figure 3 is a flowchart of an optional zero-trust-based power IoT device operation and maintenance processing method according to an embodiment of the present invention, such as Figure 3 As shown in the figure, the operation and maintenance team includes the operation and maintenance background and operation and maintenance personnel, and the equipment site includes the power distribution terminal and the near-field communication zero-trust module. For the operation and maintenance personnel, they can first apply for operation and maintenance permissions from the operation and maintenance background, and the operation and maintenance background will generate a temporary authorization code (i.e., the operation and maintenance task authorization code) through task authorization management.

[0050] Among them, the operation and maintenance personnel access the operation and maintenance background system of the operation and maintenance team through a PC portable computer, log in with their account password, and then fill in the operation and maintenance task information, submit an application to the operation and maintenance background, and initiate approval; the operation and maintenance task issuance will give an approval opinion of approval or rejection after evaluation after receiving the application. After approval, the operation and maintenance background system (i.e., the operation and maintenance background) generates an authorization code for the operation and maintenance task and issues it to the operation and maintenance personnel.

[0051] It should be noted that in the embodiment of the present invention, the operation and maintenance background system mainly performs task authorization management and can generate temporary authorization codes for operation and maintenance tasks, that is, one authorization for each task and one key for each time, so as to ensure the safety of power equipment.

[0052] Then, if Figure 3As shown in the figure, the operation and maintenance personnel knock on the door based on the temporary authorization code and establish a controlled near-field operation and maintenance channel. For the near-field communication zero-trust module, by default, all requests are rejected. Only when multiple layers of verification are passed will the operation and maintenance channel be opened to operate and maintain the power distribution terminal.

[0053] From the above, we can see that the operation and maintenance backend system deployed in the operation and maintenance team can manage the registration of zero-trust module equipment, apply for / approve operation and maintenance tasks, and download operation and maintenance task authorization codes.

[0054] Optionally, the above-mentioned operation and maintenance task information includes: the name of the operation and maintenance task, the location of the operation and maintenance task, the selection of the near-field zero-trust module involved in the task operation and maintenance, the start and end time of the operation and maintenance task, the operation and maintenance task participants and the task leader and other information.

[0055] Step S204: Verify the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself to obtain a verification result.

[0056] In this embodiment, the first device serial number corresponding to the operation and maintenance task authorization code can be verified with the second device serial number stored in itself to obtain a verification result, which is used to ensure the matching of the authorization code and the device serial number, thereby increasing the security and reliability of the system and preventing unauthorized devices or users from performing operation and maintenance tasks, thereby protecting the security of the system and data.

[0057] Step S206, when the verification result indicates that the first device serial number is consistent with the second device serial number, verify the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, wherein the operation and maintenance task information at least includes: operation and maintenance object, operation and maintenance time, and identity information of the operation and maintenance personnel.

[0058] In this embodiment, the operation and maintenance task information corresponding to the operation and maintenance task can be verified to obtain a verification result, which is used to confirm the identity and qualifications of the task executors, ensure the accuracy and completeness of the execution of the operation and maintenance tasks, effectively supervise and manage the operation and maintenance process, discover and solve problems in a timely manner, and improve the efficiency and quality of operation and maintenance.

[0059] Step S208: after the verification result indicates that the operation and maintenance task information has been verified, a start instruction is generated.

[0060] In this embodiment, by generating a start instruction after the verification result indicates that the operation and maintenance task information has been verified, it can be ensured that the operation and maintenance task is performed according to the set plan and process.

[0061] Step S210, after determining that the operation and maintenance channel is opened based on the start-up instruction, receive the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and forward the operation and maintenance instruction to the power distribution terminal, wherein the power distribution terminal is the equipment that needs to be operated and maintained.

[0062] In this embodiment, after determining that the operation and maintenance channel is opened based on the startup instruction, the operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task can be received, the operation and maintenance instructions can be remotely forwarded and the operation and maintenance operations can be recorded, so as to realize remote operation and maintenance management and control of the power distribution terminal equipment, improve operation and maintenance efficiency and reduce operation and maintenance costs.

[0063] Among them, the above-mentioned distribution terminals refer to equipment used for branching, conversion, control, metering and protection functions in the power system, and are equipment that requires operation and maintenance.

[0064] As can be seen from the above, in the embodiment of the present invention, an operation and maintenance task authorization code issued by the operation and maintenance terminal device is obtained, wherein the operation and maintenance task authorization code is an authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system; the first device serial number corresponding to the operation and maintenance task authorization code is verified with the second device serial number stored in itself to obtain a verification result; when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, wherein the operation and maintenance task information at least includes: operation and maintenance object, operation and maintenance time, and identity information of the operation and maintenance personnel; when the verification result indicates that the operation and maintenance task is consistent, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result. After the maintenance task information is verified, a startup instruction is generated; after determining that the operation and maintenance channel is opened based on the startup instruction, the operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task are received, and the operation and maintenance instructions are forwarded to the distribution terminal, where the distribution terminal is a device that requires operation and maintenance, and an operation and maintenance task authorization code is generated every time an operation and maintenance task is received, and after the operation and maintenance task authorization code is successfully verified, multi-layer verification is performed on the multi-dimensional information related to operation and maintenance. Only after the multi-layer verification is successful, the operation and maintenance channel will be opened, achieving the integration and fool-proof design of operation and maintenance from business to process to IT, so that the operation of operation and maintenance has the technical effect of the basis of management and control, improves the efficiency and safety of operation and maintenance, and also improves the safety of power Internet of Things equipment.

[0065] The technical solution provided by the embodiment of the present invention solves the technical problem in the related art that the power Internet of Things equipment has great potential safety hazards due to the lack of safety protection.

[0066] According to the above embodiment of the present invention, the first device serial number corresponding to the operation and maintenance task authorization code is verified with the second device serial number stored in itself to obtain a verification result, including: parsing the operation and maintenance task authorization code to obtain the first device serial number; comparing the first device serial number with the second device serial number to obtain a comparison result; and obtaining a verification result based on the comparison result.

[0067] In this embodiment, the operation and maintenance personnel will download the authorization code to a PC computer, then go to the operation and maintenance site, and then send the authorization code to the near-field communication zero-trust module deployed at the device site. The near-field zero-trust module will verify whether the device serial number of the authorization code is consistent with the zero-trust module's own device ID.

[0068] It should be noted that the near-field communication zero-trust module is used to control the on and off of the distribution terminal operation and maintenance channel, such as Figure 3 As shown, the distribution terminal operation and maintenance channel controlled by this module is closed by default. After receiving the authorization code sent by the operation and maintenance PC, it verifies whether the device serial number of the authorization code is consistent with the device ID of the zero-trust module itself.

[0069] According to the above embodiment of the present invention, when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, including: obtaining its own private key to decrypt the first ciphertext to obtain a first plaintext corresponding to the first ciphertext, wherein the first ciphertext is a ciphertext generated using the second ciphertext, and the second ciphertext is a ciphertext obtained by encrypting the task authorization code and the digital signature information, and the digital signature information is information obtained by digitally signing the task authorization code using the private key of the operation and maintenance background system; using the first ciphertext to decrypt the first plaintext to obtain a second plaintext of the second ciphertext; using its own public key to verify the task code in the second plaintext to obtain a verification result; after the verification result indicates that the public key has passed the verification of the task code, the operation and maintenance task information is obtained; the operation and maintenance task information is verified to obtain a verification result.

[0070] In this embodiment, the private key of the zero-trust module itself can be used to decrypt the ciphertext 2 in the digital envelope to obtain the plaintext 2 corresponding to the ciphertext 2 (i.e., the first plaintext), and the ciphertext 1 can be decrypted using the plaintext 2 to obtain the plaintext 1 of the ciphertext 1 (i.e., the second plaintext); then the public key of the operation and maintenance background system preset by the near-field communication zero-trust module is used to verify the signature of the task code in the plaintext 2. After the signature verification is passed, the operation and maintenance task information is obtained; the operation and maintenance task information is subjected to three-layer verification to obtain the verification result.

[0071] It should be noted that the above operation and maintenance task information includes: task authorization start and end dates, authorized operation and maintenance personnel, authorized device ID, and the identity code of the operation and maintenance personnel.

[0072] Figure 4 is a schematic diagram of an operation and maintenance task authorization code according to an embodiment of the present invention, such as Figure 4As shown, the operation and maintenance task authorization code mainly includes two parts: the device serial number and the digital envelope. Among them, the digital envelope consists of two parts: ciphertext 1 and ciphertext 2: ciphertext 1 is composed of two parts of information, the operation and maintenance task code and the system signature. Among them, the encrypted key is a temporarily generated symmetric encryption algorithm key (preferably using AES256-GCM or SM4 algorithm). Among them. The system signature refers to the plain text of the task code, which is signed using the private key of the background management system itself (preferably ECC or SM2 algorithm), where the task code includes four parts: the start and end dates of the task authorization, the authorized operation and maintenance personnel, the authorized device ID, and the identity code of the operation and maintenance personnel. Among them, the identity code of the operation and maintenance personnel is the encrypted output of the operation and maintenance personnel password as the identity code; ciphertext 2 is obtained by encrypting the temporary key of ciphertext 1 with the device public key corresponding to the device serial number.

[0073] According to the above embodiment of the present invention, when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, including: obtaining its own current clock data, and judging whether the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, to obtain a first judgment result; obtaining its own first device identification, and judging whether the first device identification appears in the authorized device identification list, to obtain a second judgment result, wherein the authorized device identification list is used to save the second device identification of the operation and maintenance terminal device corresponding to the operation and maintenance task; obtaining the operation and maintenance personnel identity information of the operation and maintenance personnel, and identifying the operation and maintenance personnel identity information to obtain an identification result; obtaining a verification result based on the first judgment result, the second judgment result and the identification result.

[0074] In this embodiment, the current clock data of the device can be obtained, and it can be determined whether the current clock of the near-field zero-trust module is within the authorized start and end dates of the task; the first device identification of the device can be obtained, and it can be determined whether the ID of the near-field zero-trust module appears in the authorized device ID, that is, the authorized device ID is the corresponding device ID set in an operation and maintenance task. Multiple devices can be authorized at the same time for an operation and maintenance task to obtain a second judgment result; the operation and maintenance personnel identity information of the operation and maintenance personnel is obtained, and the operation and maintenance personnel identity information is identified, that is, the authorized operation and maintenance personnel are verified to obtain an identification result.

[0075] According to the above embodiment of the present invention, the operation and maintenance personnel identity information of the operation and maintenance personnel is obtained, and the operation and maintenance personnel identity information is identified to obtain an identification result, including: generating an identity challenge code for the operation and maintenance personnel, and sending the identity challenge code to the operation and maintenance terminal device, so that the operation and maintenance personnel encrypts the identity challenge code using a predetermined password on the operation and maintenance terminal device to obtain a third ciphertext; obtaining the third ciphertext and the identity code of the operation and maintenance personnel; using the identity code to encrypt a predetermined random number to obtain a fourth ciphertext; comparing the third ciphertext and the fourth ciphertext to obtain an identification result.

[0076] Figure 5 is a flow chart of verification by authorized operation and maintenance personnel according to an embodiment of the present invention, such as Figure 5 As shown, the operation and maintenance personnel interact with the near-field zero-trust module through a PC; first, the operation and maintenance personnel can scan the serial number through the PC and send the authorization code to the near-field zero-trust module; the near-field zero-trust module verifies the authorization code based on the received information.

[0077] Figure 6 is a flowchart of optional authorized operation and maintenance personnel verification according to an embodiment of the present invention, such as Figure 5 and 6 As shown, the near-field zero-trust module generates a random number 1 as the identity challenge code of the operation and maintenance personnel, and sends it to the operation and maintenance personnel PC. Then the operation and maintenance personnel needs to use their own password (i.e., the predetermined password) to encrypt the identity challenge code to obtain ciphertext 3 (i.e., the third ciphertext). Then ciphertext 3 is sent back to the near-field zero-trust module. At the same time, the near-field zero-trust module uses the identity code of the above-mentioned operation and maintenance personnel to encrypt the random number to obtain ciphertext 4 (the fourth ciphertext), and then compares whether ciphertext 3 is consistent with ciphertext 4.

[0078] According to the above embodiment of the present invention, after the verification result indicates that the operation and maintenance task information has been verified, a start instruction is generated, including: when the verification result indicates that the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, the first device identifier appears in the authorized device identifier list and the third ciphertext is consistent with the fourth ciphertext, it is determined that the operation and maintenance task information has been verified and a start instruction is generated.

[0079] In this embodiment, after the verification is passed, the near-field zero-trust module opens the operation and maintenance channel, the operation and maintenance personnel PC can send operation and maintenance instructions, and then the near-field zero-trust module forwards the operation and maintenance instructions and records the operation and maintenance operation. Figure 5 As shown, after the identity authentication is passed, the near-field zero-trust module responds to the channel result and opens the operation and maintenance channel. Then the operation and maintenance personnel PC sends an operation and maintenance instruction, that is, generates a start instruction, otherwise the operation and maintenance channel will not be opened.

[0080] According to the above embodiment of the present invention, after determining that the operation and maintenance channel is opened based on the startup instruction, receiving the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and before forwarding the operation and maintenance instruction to the distribution terminal, the zero-trust-based power Internet of Things equipment operation and maintenance processing method also includes: starting a timed channel closing task, wherein the timed channel closing task includes the closing time of the operation and maintenance channel; when the closing time arrives, closing the operation and maintenance channel according to the timed channel closing task.

[0081] In this embodiment, a timed channel closing task can be started. When the closing time arrives, the operation and maintenance channel is closed according to the timed channel closing task. That is, the operation and maintenance channel is started for a maximum of N hours and is automatically closed after N hours. The maintenance personnel need to resend the authorization code and reopen the operation and maintenance channel after verification by the near-field zero-trust module.

[0082] It should be noted that if Figure 5 As shown, the near-field zero-trust module starts the timed channel closing task. At the same time, while the operation and maintenance channel is open, the near-field zero-trust module will forward the operation and maintenance instructions sent by the operation and maintenance personnel PC to the power distribution terminal.

[0083] Above Figure 6 The example shown is a situation where there is only one authorization code for a zero-trust module in an operation and maintenance task. Figure 7 is another optional flowchart of authorized operation and maintenance personnel verification according to an embodiment of the present invention, such as Figure 7 As shown, it is mainly aimed at the situation where there are only multiple zero-trust module authorization codes in an operation and maintenance task. Figure 8 is a flowchart of an optional zero-trust-based power IoT device operation and maintenance processing method according to an embodiment of the present invention, such as Figure 6 , 7 As shown in Figure 8, the method mainly includes the following steps: Step 1: The operation and maintenance personnel access the operation and maintenance background system of the operation and maintenance team through a PC portable computer and log in using their account password. Step 2: The operation and maintenance personnel fill in the operation and maintenance task information. Including the name of the operation and maintenance task, the location of the operation and maintenance task, check the near-field zero-trust module involved in the task operation and maintenance, the start and end time of the operation and maintenance task, the operation and maintenance task participants and the task leader. Then initiate the approval. Step 3: Operation and maintenance task issuance After receiving the operation and maintenance task application filled out by the operation and maintenance personnel in step 2, give an approval opinion of approval or rejection after evaluation. After approval, the operation and maintenance background system generates an operation and maintenance task authorization code for the operation and maintenance task in step 1.

[0084] The task authorization code format is as follows: Task authorization start and end dates: Authorized operation and maintenance personnel: Authorized device ID (list): Operation and maintenance personnel identity code. The details are as follows:

[0085] 24010208,240103012-13800138000-a0b1c2d3e4f5,12345678-d4944bf97e416e3a91e19f5aed24294f7d153302c; where “-“ is the separator of data items and “,” is the separator within a data item.

[0086] In the above example, 24010208:240103012 means the start time of the authorization task is 24010208 and the end time is 240103012. Among them, 24 is year, 01 is month, 02 is day, and 08 is hour.

[0087] In the above example, 13800138000 represents the ID of the operation and maintenance personnel, which is 13800138000;

[0088] In the above example, a0b1c2d3e4f5,12345678 means that there are two near-field zero-trust modules in this task, one of which has an ID of a0b1c2d3e4f5 and the other has an ID of 12345678;

[0089] In the above example, d4944bf97e416e3a91e19f5aed24294f7d153302c is the ciphertext of the password of the operation and maintenance personnel 13800138000.

[0090] In addition, the ciphertext calculation formula is as follows: Identity code = PBDF2 (operation and maintenance personnel ID, operation and maintenance personnel password, 10000). Then use the private key of the operation and maintenance background system to digitally sign the above task authorization code, preferably the ECC or SM2 algorithm. Then generate a temporary random number 1. Encrypt the above task authorization code and digital signature with random number 1 to obtain ciphertext 1. Then use ciphertext 1 to generate ciphertext 2 for each near-field zero-trust module. The final operation and maintenance authorization code is formed. Ciphertext 2 is generated by encrypting the key of ciphertext 1 (that is, the above random number 1) with the public key of the near-field zero-trust module, and then marking it with the device ID of the zero-trust module.

[0091] Step 4: The operation and maintenance personnel download the authorization code to the PC and then go to the operation and maintenance site.

[0092] Step 5: The operation and maintenance personnel send the authorization code to the near-field zero-trust module.

[0093] Step 6: For the near-field zero-trust module, first verify whether the device serial number of the authorization code is consistent with the device ID of the zero-trust module itself.

[0094] If they are consistent, the zero-trust module's own private key is used to decrypt ciphertext 2 in the digital envelope to obtain plaintext 2 corresponding to ciphertext 2. The plaintext 2 of ciphertext 2 is used to decrypt ciphertext 1 to obtain plaintext 1 of ciphertext 1.

[0095] Then use the public key of the operation and maintenance background system preset in the near-field communication zero-trust module to verify the task code in plain text 1. After the verification passes.

[0096] Four pieces of information are extracted: the start and end dates of task authorization, the authorized operation and maintenance personnel, the authorized device ID, and the identity code of the operation and maintenance personnel. Then the following three levels of verification are carried out: Verification 1: Whether the current clock of the near-field zero-trust module is within the start and end dates of task authorization; Verification 2: Whether the ID of the near-field zero-trust module appears in the authorized device ID. That is, the authorized device ID is the set of device IDs corresponding to an operation and maintenance task, and multiple devices can be authorized at the same time for an operation and maintenance task; Verification 3: Authorized operation and maintenance personnel verification. The specific verification method is as follows:

[0097] The near-field zero-trust module generates a random number 1 as the identity challenge code of the operation and maintenance personnel and sends it to the operation and maintenance personnel's PC. The operation and maintenance personnel then needs to use their own password to encrypt the identity challenge code to obtain the ciphertext 3.

[0098] Then, ciphertext 3 is sent back to the near-field zero-trust module. At the same time, the near-field zero-trust module uses the identity code of the above-mentioned operation and maintenance personnel to encrypt the random number to obtain ciphertext 4, and then compares ciphertext 3 to ciphertext 4 to see if they are consistent.

[0099] Step 7: If the zero-trust module passes the identity authentication of the object of the operation and maintenance task, the operation and maintenance time, and the operation and maintenance personnel in step 6, the near-field zero-trust module opens the operation and maintenance channel. Otherwise, the operation and maintenance channel will not be opened.

[0100] Step 8: If the operation and maintenance channel in step 7 is open, the near-field zero-trust module starts the scheduled channel closing task and automatically closes the operation and maintenance channel after N hours. At the same time, while the operation and maintenance channel is open, the near-field zero-trust module will forward the operation and maintenance instructions sent by the operation and maintenance personnel PC to the power distribution terminal.

[0101] In addition, if Figure 8 As shown, in an embodiment of the present invention, the operation and maintenance method mainly includes three stages: before operation and maintenance, during operation and maintenance, and after operation and maintenance; it mainly involves equipment managers, operation and maintenance task leaders, operation and maintenance task issuers, business managers, audit managers and IT personnel.

[0102] Among them, the equipment administrator can perform equipment registration and task application operations in advance of operation and maintenance. For example, he can register the equipment information / register it with the business administrator for equipment registration confirmation.

[0103] like Figure 8 As shown, before operation and maintenance, the main operations include equipment registration, task application, and task authorization; during operation and maintenance, the main operations include near-field operation and maintenance and task closing; after operation and maintenance, the main operation and maintenance audit operation can be performed.

[0104] The person in charge of the operation and maintenance task can apply for the operation and maintenance task and send the application information to the issuer of the operation and maintenance task for approval. After the approval, the person in charge of the operation and maintenance task can download the operation and maintenance task and perform zero-trust access to the equipment to be operated and maintained; after the operation and maintenance of the equipment to be operated and maintained is completed, the operation and maintenance task is closed.

[0105] In the embodiment of the present invention, the operation and maintenance tasks of the operation and maintenance personnel are applied for and approved through the IT system, and the start and end time of the operation and maintenance tasks, the operation and maintenance task personnel, and the operation and maintenance task objects are deeply bound. By using cryptographic technology, only the correct operation and maintenance time, the correct operation and maintenance objects, and the normal operation and maintenance personnel can operate and maintain the operation and maintenance objects. This avoids problems such as personnel misoperation, untrustworthy personnel, account borrowing, and uncontrollable operation and maintenance operations during the operation and maintenance management and implementation process.

[0106] Through the technical solution provided by the above embodiment of the present invention, first obtain the operation and maintenance task authorization code issued by the operation and maintenance terminal device; then verify the first device serial number corresponding to the operation and maintenance task authorization code and the second device serial number stored in itself to obtain the verification result; when the verification result indicates that the first device serial number is consistent with the second device serial number, verify the operation and maintenance task information corresponding to the operation and maintenance task to obtain the verification result; after the verification result indicates that the operation and maintenance task information has been verified, generate a start instruction; after determining that the operation and maintenance channel is opened based on the start instruction, receive the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and forward the operation and maintenance instruction to the power distribution terminal. Taking into account various factors such as safety hazards and operation and maintenance management efficiency, comprehensive control of operation and maintenance tasks is achieved through the IT system, avoiding erroneous operations and safety hazards caused by human factors, and ensuring the smooth progress of operation and maintenance tasks and stable operation of the system.

[0107] That is, the above-mentioned technical solution provided by the embodiment of the present invention can effectively solve the safety issues of these near-field operation and maintenance of power Internet of Things devices without reducing the complexity of equipment operation and maintenance and reducing work efficiency. It can effectively improve the efficiency and reliability of operation and maintenance management, and provide more reliable protection for the enterprise's information system operation and maintenance work.

[0108] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0109] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0110] According to an embodiment of the present invention, there is also provided a zero-trust-based power IoT device operation and maintenance processing device for implementing the above-mentioned zero-trust-based power IoT device operation and maintenance processing method. Fig. 9 is a schematic diagram of a zero-trust-based power IoT device operation and maintenance processing device according to an embodiment of the present invention, such as Fig. 9 As shown, the device includes: an acquisition module 901, a verification module 903, a verification module 905, a generation module 907 and a processing module 909. The zero-trust-based power IoT equipment operation and maintenance processing device is described below.

[0111] The acquisition module 901 is used to acquire the operation and maintenance task authorization code issued by the operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system;

[0112] Verification module 903, used to verify the first device serial number corresponding to the operation and maintenance task authorization code and the second device serial number stored in itself to obtain a verification result;

[0113] Verification module 905, used to verify the operation and maintenance task information corresponding to the operation and maintenance task when the verification result indicates that the first device serial number is consistent with the second device serial number, and obtain a verification result, wherein the operation and maintenance task information at least includes: operation and maintenance object, operation and maintenance time, and identity information of the operation and maintenance personnel;

[0114] A generating module 907, configured to generate a start instruction after the verification result indicates that the operation and maintenance task information has been verified;

[0115] Processing module 909 is used to receive operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task after determining that the operation and maintenance channel is opened based on the startup instruction, and forward the operation and maintenance instructions to the distribution terminal, wherein the distribution terminal is the equipment that needs operation and maintenance.

[0116] It should be noted here that the above-mentioned acquisition module 901, verification module 903, verification module 905, generation module 907 and processing module 909 correspond to steps S202 to S210 in the above-mentioned embodiments, and the five modules are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0117] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, the acquisition module can first be used to acquire the operation and maintenance task authorization code issued by the operation and maintenance terminal device, wherein the operation and maintenance task authorization code is the authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system; then the verification module can be used to verify the first device serial number corresponding to the operation and maintenance task authorization code and the second device serial number stored in itself to obtain a verification result; then the verification module can be used to verify the operation and maintenance task information corresponding to the operation and maintenance task when the verification result indicates that the first device serial number is consistent with the second device serial number to obtain a verification result, wherein the operation and maintenance task information at least includes: operation and maintenance object, operation and maintenance time, operation and maintenance task information ... The identity information of the maintenance personnel; secondly, the generation module can be used to generate a startup instruction after the verification result indicates that the operation and maintenance task information has been verified; finally, the processing module can be used to receive the operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task after determining that the operation and maintenance channel is opened based on the startup instruction, and forward the operation and maintenance instructions to the distribution terminal, wherein the distribution terminal is a device that needs to be operated and maintained, and an operation and maintenance task authorization code is generated every time an operation and maintenance task is received, and after the operation and maintenance task authorization code is successfully verified, multi-layer verification is performed on the multi-dimensional information related to operation and maintenance. Only after the multi-layer verification is successful, the operation and maintenance channel will be opened, achieving the integration and fool-proof design of operation and maintenance from business to process to IT, so that the operation of operation and maintenance has the technical effect of the basis of management and control, and improves the efficiency and safety of operation and maintenance.

[0118] The technical solution provided by the embodiment of the present invention solves the technical problem in the related art that the power Internet of Things equipment has great potential safety hazards due to the lack of safety protection.

[0119] In an optional embodiment, the verification module includes: a parsing unit, used to parse the operation and maintenance task authorization code to obtain a first device serial number; a comparison unit, used to compare the first device serial number with the second device serial number to obtain a comparison result; and a first acquisition unit, used to obtain a verification result based on the comparison result.

[0120] In an optional embodiment, the verification module includes: a first processing unit, used to obtain its own private key to decrypt the first ciphertext to obtain a first plaintext corresponding to the first ciphertext, wherein the first ciphertext is a ciphertext generated using the second ciphertext, and the second ciphertext is a ciphertext obtained by encrypting the task authorization code and the digital signature information, and the digital signature information is information obtained by digitally signing the task authorization code using the private key of the operation and maintenance background system; a decryption unit, used to use the first ciphertext to decrypt the first plaintext to obtain a second plaintext of the second ciphertext; a signature verification unit, used to use its own public key to verify the task code in the second plaintext to obtain a verification result; a second acquisition unit, used to obtain the operation and maintenance task information after the verification result indicates that the public key has passed the verification of the task code; a verification unit, used to verify the operation and maintenance task information to obtain a verification result.

[0121] In an optional embodiment, the verification module also includes: a second processing unit, used to obtain its own current clock data, and determine whether the current clock data is within the authorized start and end time of the task corresponding to the operation and maintenance time, to obtain a first judgment result; a third processing unit, used to obtain its own first device identification, and determine whether the first device identification appears in the authorized device identification list, to obtain a second judgment result, wherein the authorized device identification list is used to save the second device identification of the operation and maintenance terminal device corresponding to the operation and maintenance task; a fourth processing unit, used to obtain the operation and maintenance personnel identity information of the operation and maintenance personnel, and identify the operation and maintenance personnel identity information to obtain an identification result; a third acquisition unit, used to obtain a verification result based on the first judgment result, the second judgment result and the identification result.

[0122] In an optional embodiment, the fourth processing unit includes: a first processing subunit, used to generate an identity challenge code for the operation and maintenance personnel, and send the identity challenge code to the operation and maintenance terminal device, so that the operation and maintenance personnel use a predetermined password to encrypt the identity challenge code on the operation and maintenance terminal device to obtain a third ciphertext; a first acquisition subunit, used to obtain the third ciphertext and the identity code of the operation and maintenance personnel; an encryption subunit, used to encrypt a predetermined random number using the identity code to obtain a fourth ciphertext; and a comparison subunit, used to compare the third ciphertext with the fourth ciphertext to obtain an identification result.

[0123] In an optional embodiment, the generation module includes: a fifth processing unit, which is used to determine that the operation and maintenance task information has been verified and generate a start instruction when the verification result indicates that the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, the first device identifier appears in the authorized device identifier list, and the third ciphertext is consistent with the fourth ciphertext.

[0124] In an optional embodiment, the zero-trust-based power Internet of Things equipment operation and maintenance processing device also includes: a starting module, used to start a scheduled channel closing task, wherein the scheduled channel closing task includes the closing time of the operation and maintenance channel; a closing module, used to close the operation and maintenance channel according to the scheduled channel closing task when the closing time arrives.

[0125] According to another aspect of an embodiment of the present invention, a zero-trust-based power Internet of Things device operation and maintenance processing system is also provided. The zero-trust-based power Internet of Things device operation and maintenance processing system uses any of the above-mentioned zero-trust-based power Internet of Things device operation and maintenance processing methods.

[0126] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is running, any one of the above-mentioned zero-trust-based power Internet of Things equipment operation and maintenance processing methods is executed.

[0127] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned zero-trust-based power Internet of Things equipment operation and maintenance processing methods.

[0128] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the above-mentioned zero-trust-based power Internet of Things equipment operation and maintenance processing methods.

[0129] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0130] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: obtaining an operation and maintenance task authorization code issued by an operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by the operation and maintenance background system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance background system; verifying the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself to obtain a verification result; when the verification result indicates that the first device serial number is consistent with the second device serial number, verifying the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, wherein the operation and maintenance task information includes at least: operation and maintenance object, operation and maintenance time, and identity information of the operation and maintenance personnel; after the verification result indicates that the operation and maintenance task information has been verified, generating a startup instruction; after determining that the operation and maintenance channel is opened based on the startup instruction, receiving the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and forwarding the operation and maintenance instruction to the distribution terminal, wherein the distribution terminal is a device that needs to be operated and maintained.

[0131] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: verifying the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself to obtain a verification result, including: parsing the operation and maintenance task authorization code to obtain the first device serial number; comparing the first device serial number with the second device serial number to obtain a comparison result; and obtaining a verification result based on the comparison result.

[0132] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: when the verification result indicates that the first device serial number is consistent with the second device serial number, verifying the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, including: obtaining its own private key to decrypt the first ciphertext to obtain a first plaintext corresponding to the first ciphertext, wherein the first ciphertext is a ciphertext generated using the second ciphertext, and the second ciphertext is a ciphertext obtained by encrypting the task authorization code and digital signature information, and the digital signature information is information obtained by digitally signing the task authorization code using the private key of the operation and maintenance background system; using the first ciphertext to decrypt the first plaintext to obtain a second plaintext of the second ciphertext; using its own public key to verify the task code in the second plaintext to obtain a verification result; after the verification result indicates that the public key has passed the verification of the task code, obtaining the operation and maintenance task information; verifying the operation and maintenance task information to obtain a verification result.

[0133] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: when the verification result indicates that the first device serial number is consistent with the second device serial number, the operation and maintenance task information corresponding to the operation and maintenance task is verified to obtain a verification result, including: obtaining its own current clock data, and judging whether the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, to obtain a first judgment result; obtaining its own first device identification, and judging whether the first device identification appears in the authorized device identification list, to obtain a second judgment result, wherein the authorized device identification list is used to save the second device identification of the operation and maintenance terminal device corresponding to the operation and maintenance task; obtaining the operation and maintenance personnel identity information of the operation and maintenance personnel, and identifying the operation and maintenance personnel identity information to obtain an identification result; obtaining a verification result based on the first judgment result, the second judgment result and the identification result.

[0134] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: obtaining the operation and maintenance personnel identity information of the operation and maintenance personnel, and identifying the operation and maintenance personnel identity information to obtain an identification result, including: generating an identity challenge code for the operation and maintenance personnel, and sending the identity challenge code to the operation and maintenance terminal device, so that the operation and maintenance personnel encrypts the identity challenge code using a predetermined password on the operation and maintenance terminal device to obtain a third ciphertext; obtaining the third ciphertext and the identity code of the operation and maintenance personnel; using the identity code to encrypt a predetermined random number to obtain a fourth ciphertext; comparing the third ciphertext and the fourth ciphertext to obtain an identification result.

[0135] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: after the verification result indicates that the operation and maintenance task information has been verified, a start instruction is generated, including: when the verification result indicates that the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, the first device identifier appears in the authorized device identifier list and the third ciphertext is consistent with the fourth ciphertext, it is determined that the operation and maintenance task information has been verified and a start instruction is generated.

[0136] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: after determining that the operation and maintenance channel is opened based on the startup instruction, receiving the operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task, and before forwarding the operation and maintenance instructions to the distribution terminal, the zero-trust-based power Internet of Things equipment operation and maintenance processing method also includes: starting a timed channel closing task, wherein the timed channel closing task includes the closing time of the operation and maintenance channel; when the closing time arrives, closing the operation and maintenance channel according to the timed channel closing task.

[0137] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0138] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0140] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0141] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0142] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0143] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A zero-trust-based power IoT equipment operation and maintenance processing method, characterized in that: include: Obtaining an operation and maintenance task authorization code issued by an operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by an operation and maintenance backend system for the operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance backend system; Verify the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself to obtain a verification result; When the verification result indicates that the first device serial number is consistent with the second device serial number, verify the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, wherein the operation and maintenance task information at least includes: an operation and maintenance object, an operation and maintenance time, and identity information of an operation and maintenance personnel; After the verification result indicates that the operation and maintenance task information has been verified, a start instruction is generated; After determining that the operation and maintenance channel is opened based on the startup instruction, the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task is received, and the operation and maintenance instruction is forwarded to the power distribution terminal, wherein the power distribution terminal is the equipment that needs to be operated and maintained.

2. The zero-trust-based power IoT device operation and maintenance processing method according to claim 1 is characterized in that: Verify the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself to obtain a verification result, including: Parsing the operation and maintenance task authorization code to obtain the first device serial number; Compare the first device serial number with the second device serial number to obtain a comparison result; The verification result is obtained according to the comparison result.

3. The zero-trust-based power IoT device operation and maintenance processing method according to claim 1 is characterized in that: If the verification result indicates that the first device serial number is consistent with the second device serial number, Verify the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, including: Obtain its own private key to decrypt the first ciphertext to obtain a first plaintext corresponding to the first ciphertext, wherein the first ciphertext is a ciphertext generated by using the second ciphertext, the second ciphertext is a ciphertext obtained by encrypting the task authorization code and digital signature information, and the digital signature information is information obtained by digitally signing the task authorization code using the private key of the operation and maintenance background system; Decrypting the first plaintext using the first ciphertext to obtain a second plaintext of the second ciphertext; Use its own public key to verify the signature of the task code in the second plaintext to obtain the signature verification result; After the signature verification result indicates that the signature verification of the task code by the public key is passed, obtaining the operation and maintenance task information; The operation and maintenance task information is verified to obtain the verification result.

4. The zero-trust-based power IoT device operation and maintenance processing method according to claim 1 is characterized in that: If the verification result indicates that the first device serial number is consistent with the second device serial number, Verify the operation and maintenance task information corresponding to the operation and maintenance task to obtain a verification result, including: Acquire its own current clock data, and determine whether the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, to obtain a first determination result; Obtaining its own first device identification, and determining whether the first device identification appears in an authorized device identification list, to obtain a second determination result, wherein the authorized device identification list is used to store the second device identification of the operation and maintenance terminal device corresponding to the operation and maintenance task; Obtaining the operation and maintenance personnel identity information of the operation and maintenance personnel, and identifying the operation and maintenance personnel identity information to obtain an identification result; The verification result is obtained according to the first judgment result, the second judgment result and the recognition result.

5. The zero-trust-based power IoT device operation and maintenance processing method according to claim 4 is characterized in that: Obtaining the operation and maintenance personnel identity information of the operation and maintenance personnel, and identifying the operation and maintenance personnel identity information to obtain an identification result, including: generating an identity challenge code for the operation and maintenance personnel, and sending the identity challenge code to the operation and maintenance terminal device, so that the operation and maintenance personnel encrypts the identity challenge code using a predetermined password on the operation and maintenance terminal device to obtain a third ciphertext; Obtaining the third ciphertext and the identity code of the operation and maintenance personnel; Encrypting a predetermined random number using the identity code to obtain a fourth ciphertext; The third ciphertext and the fourth ciphertext are compared to obtain the recognition result.

6. The zero-trust-based power IoT equipment operation and maintenance processing method according to claim 5 is characterized in that: After the verification result indicates that the operation and maintenance task information has been verified, a start instruction is generated, including: When the verification result indicates that the current clock data is within the task authorization start and end time corresponding to the operation and maintenance time, the first device identifier appears in the authorized device identifier list, and the third ciphertext is consistent with the fourth ciphertext, it is determined that the operation and maintenance task information has been verified and the start instruction is generated.

7. The zero-trust-based power IoT equipment operation and maintenance processing method according to any one of claims 1 to 6, characterized in that: After determining that the operation and maintenance channel is opened based on the startup instruction, before receiving the operation and maintenance instruction sent by the operation and maintenance terminal device based on the operation and maintenance task, and forwarding the operation and maintenance instruction to the power distribution terminal, the method further includes: Initiate a scheduled channel closing task, wherein the scheduled channel closing task includes the closing time of the operation and maintenance channel; When the closing time arrives, the operation and maintenance channel is closed according to the scheduled channel closing task.

8. A zero-trust-based power IoT equipment operation and maintenance processing device, characterized in that: include: An acquisition module is used to acquire an operation and maintenance task authorization code issued by an operation and maintenance terminal device, wherein the operation and maintenance task authorization code is an authorization code generated by an operation and maintenance backend system for an operation and maintenance task corresponding to the operation and maintenance task application after the operation and maintenance task application is approved, and the operation and maintenance terminal device is used to access the operation and maintenance backend system; A verification module, used to verify the first device serial number corresponding to the operation and maintenance task authorization code with the second device serial number stored in itself to obtain a verification result; a verification module, configured to verify the operation and maintenance task information corresponding to the operation and maintenance task when the verification result indicates that the first device serial number is consistent with the second device serial number, and obtain a verification result, wherein the operation and maintenance task information at least includes: an operation and maintenance object, an operation and maintenance time, and identity information of an operation and maintenance personnel; A generation module, configured to generate a start instruction after the verification result indicates that all operation and maintenance task information has been verified; A processing module is used to receive the operation and maintenance instructions sent by the operation and maintenance terminal device based on the operation and maintenance task after determining that the operation and maintenance channel is opened based on the startup instruction, and forward the operation and maintenance instructions to the distribution terminal, wherein the distribution terminal is a device that needs to be operated and maintained.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the zero-trust-based power Internet of Things equipment operation and maintenance processing method as described in any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by the processor, the zero-trust-based power Internet of Things equipment operation and maintenance processing method described in any one of claims 1 to 7 is executed.

Images