Safety prevention and control method based on edge computing device, cloud platform and edge computing device

Abstract

The invention relates to the technical field of edge computing, and discloses a safety prevention and control method based on edge computing equipment, a cloud platform and the edge computing equipment, and the method comprises the steps: recognizing the type of a request interaction instruction when the cloud platform and the edge computing equipment carry out data interaction; implementing different security authentication strategies on the edge computing device according to the type of the request interaction instruction; and performing data interaction under the condition that the edge computing device passes the security authentication. Besides, authentication of different levels is carried out on the edge computing device, and data interaction can be carried out only on the premise that the authentication is passed, so that on one hand, the security of data acquisition of the edge computing device and the security of a data source connected with the engine device are greatly improved, and on the other hand, resources can be effectively saved.

Description

Technical Field

[0001] The present invention relates to the field of edge computing technology, and in particular to a security control method based on edge computing devices, a cloud platform and an edge computing device. Background Art

[0002] With the development of edge technology and the intelligent digital transformation of the entire IoT industry, security issues are receiving more and more attention from all parties. The security authentication of existing edge computing engines is only managed through role authorization. As long as you can log in to the cloud system or the management interface of the edge computing engine, you can fully control the device. In addition, there is basically no data cleaning from data collection to data upload on the platform side, and PLC (programmable logic controller) devices are not attacked by tampering.

[0003] This situation will allow the outside world to easily obtain and analyze the data structure through means such as packet capture and disguise, and then perform identity simulation and data simulation to attack edge computing devices and edge-side devices that collect and analyze data. Summary of the invention

[0004] In response to the above technical problems, the present invention proposes a security control method, a cloud platform and an edge computing device based on edge computing devices. In this method, the platform side performs different levels of authentication on the edge computing device according to the type of data interaction between it and the edge computing device. Data interaction can only be carried out after the authentication is passed. On the one hand, the security of data collected by the edge computing device and the security of the data source connected to the engine device are greatly increased. On the other hand, resources can be effectively saved.

[0005] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0006] A first aspect of the present invention provides a security control method based on an edge computing device, which is used in a cloud platform and includes:

[0007] S1. When the cloud platform interacts with the edge computing device, identifying the type of the requested interaction instruction;

[0008] S2. Implement different security authentication strategies on the edge computing device according to the type of requested interaction instruction, specifically including:

[0009] S21. When the request interaction instruction is an upload data instruction or a down-control operation instruction, verify the identity of the edge computing device through a predefined identity authentication mechanism;

[0010] S22. When the edge computing device passes identity authentication, decrypt the ciphertext uploaded by the edge computing device to obtain the interaction data and the serial number information of the edge computing device;

[0011] S23, determining whether the serial number information matches the serial number of the edge computing device;

[0012] S24. When the serial number information matches the serial number of the edge computing device, receiving the interaction data; otherwise, not receiving the interaction data;

[0013] S3. Performing data interaction when the edge computing device passes security authentication;

[0014] Wherein, in step S22, the ciphertext uploaded by the edge computing device is decrypted to obtain identity authentication and serial number information of the edge computing device, including:

[0015] S221. Decrypt the ciphertext using the RSA private key to obtain a Base64-encoded string.

[0016] S222, decoding the Base64-encoded string to obtain obfuscated binary data;

[0017] S223: De-obfuscate the obfuscated binary data to obtain the interaction data and serial number information of the edge computing device.

[0018] Furthermore, in step S3, when the edge computing device passes security authentication, before data interaction, it also includes: when the edge computing device passes identity authentication, verifying whether the edge computing device has access rights by querying an access control list of sensitive data.

[0019] Furthermore, the identity verification includes verifying an account / password mechanism, a dynamic token or a digital certificate.

[0020] HMAC-SHA-1 means using SHA-1 for HMAC. Truncate is a function used to intercept the encrypted string and take which fields of the encrypted string to form a new key.

[0021] Furthermore, the method further comprises:

[0022] When an abnormal alarm is received from an edge computing device, the edge computing device is abnormally controlled so that the edge computing device can recover data through a preset emergency strategy.

[0023] A second aspect of the present invention provides a security control method based on an edge computing device, comprising:

[0024] S4. When the edge computing device interacts with the cloud platform, it sends a request for interaction data to the cloud platform, encrypts the interaction data using an obfuscation encryption algorithm, and waits for the cloud platform to perform security authentication on it.

[0025] S5. After the security authentication is passed, data interaction is performed;

[0026] Wherein, in step S4, uploading the interactive data to the cloud platform and encrypting the interactive data using an obfuscation encryption algorithm includes:

[0027] S41, encrypting the interaction data using an RSA public key;

[0028] S42: Determine the serial number information of the edge computing device, and combine the serial number information and the encrypted data into a binary string;

[0029] S43, performing Base64 encoding on the combined binary string;

[0030] S44. Obfuscate the encoded string and transmit it to the cloud platform.

[0031] Furthermore, the method further includes: in the step S4, the specific algorithm for encrypting the interactive data using the obfuscation encryption algorithm is:

[0032] n = p × q;

[0033]

[0034] m^e mod n = m;

[0035] c^d mod n=m;

[0036] Among them, p and q are set values, p and q are prime numbers, n represents the modulus, e represents the public key exponent, and e must satisfy And e and Mutually prime, m represents the interaction data, c represents the ciphertext, and d represents the private key exponent.

[0037] Furthermore, the method also includes: in S5, when the security authentication is passed, before data interaction, it also includes: when the edge computing device passes the security authentication, verifying whether the edge computing device has access rights by querying the access control list of sensitive data.

[0038] Furthermore, the edge computing device is connected to an edge-side terminal device, and the method further includes:

[0039] S6. Monitor the working data of the edge-side terminal device to determine whether the working data is within a preset behavior threshold range;

[0040] S7. If the judgment result is no, an abnormal alarm is sent to the cloud platform, and data repair is performed according to the emergency strategy provided by the cloud platform.

[0041] The third aspect of the present invention provides a cloud platform, comprising: a memory for storing computer instructions; a controller for calling and executing the computer instructions stored in the memory to implement any one of the security control methods provided in the first aspect.

[0042] The fourth aspect of the present invention provides an edge computing device, comprising: a memory for storing computer instructions; a controller for calling and executing the computer instructions stored in the memory to implement any one of the security control methods provided in the second aspect.

[0043] According to the method provided by the present invention, the platform side can perform different levels of authentication on the edge computing device according to the type of data interaction between it and the edge computing device. Data interaction can only be carried out after the authentication is passed. On the one hand, the security of data collected by the edge computing device and the security of the data source connected to the engine device are greatly increased, and on the other hand, resources can be effectively saved. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0045] Figure 1 One of the flow diagrams of the security control method provided in some embodiments of the present application is shown;

[0046] Figure 2 The second flowchart of the security control method provided by some embodiments of the present application is shown;

[0047] Figure 3 The third flowchart of the security control method provided by some embodiments of the present application is shown;

[0048] Figure 4 A fourth flowchart of the security control method provided in some embodiments of the present application is shown;

[0049] Figure 5 A schematic diagram showing an encryption demonstration of a security control method provided by some embodiments of the present application is shown;

[0050] Figure 6 A data recovery and alarm diagram of the security control method provided in some embodiments of the present application is shown. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0052] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0053] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0054] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0055] The first embodiment of the present invention provides a security control method based on edge computing devices for a cloud platform, combined with Figure 1 , the method includes S1 to S3, wherein:

[0056] S1, when the cloud platform interacts with the edge computing device, identify the type of requested interaction instruction;

[0057] S2, implement different security authentication strategies for edge computing devices according to the requested interaction instruction type;

[0058] S3, data interaction is carried out when the edge computing device passes security authentication.

[0059] The security control method based on edge computing devices ensures the security and reliability of data transmission when the cloud platform interacts with the edge computing device. This method identifies the type of request interaction instructions, implements differentiated security authentication strategies, and safely interacts with data after authentication. The cloud platform first receives the interaction request from the edge computing engine device, parses the instruction content in the request, and identifies the specific interaction instruction type. These types may include data upload, command execution, configuration update, status query, etc. According to the instruction type, the request is classified so that different security authentication strategies can be implemented later.

[0060] In one embodiment of the present invention, Figure 2 , S2 includes S21~S24, among which:

[0061] S21, when the requested interaction instruction is an upload data instruction or a down-control operation instruction, the identity of the edge computing device is verified through a predefined identity authentication mechanism.

[0062] Different security authentication strategies are formulated for different types of interactive instructions. For example, stricter encryption and authentication may be required for data upload instructions, while only basic authentication may be required for status query instructions. The identity of the edge computing engine device is verified through predefined authentication mechanisms (such as username / password, token, digital certificate, etc.).

[0063] S22, when the edge computing device passes the identity authentication, the ciphertext uploaded by the edge computing device is decrypted to obtain the original data and the serial number information of the edge computing device. The original data can be sensitive data (such as monitoring data) or down-controlled data.

[0064] S23, determine whether the serial number information matches the serial number of the edge computing device.

[0065] S24, when the serial number information matches the serial number of the edge computing device, the original data is received; otherwise, the original data is not received.

[0066] Each edge computing device has a unique SN serial number, which can be used as the device's identity. By reading and verifying the device's SN serial number, the legitimacy and uniqueness of the device can be ensured. During the encryption process, the unique SN serial number of the device is read as part of the encryption (for example, the first 7 digits of the serial number are used as part of the encryption, that is, the serial number information. When the decrypted serial number information is consistent with the first 7 digits of the serial number, it is considered a match. When the serial number information is the serial number itself, it is considered a match when the two are consistent), ensuring that only devices with the correct SN serial number can decrypt and receive data. This mechanism prevents unauthorized devices from accessing or tampering with data.

[0067] In one embodiment of the present invention, Figure 3 , S22 includes S221 to S223, wherein:

[0068] S221, decrypt the ciphertext using the RSA private key to obtain a Base64-encoded string; Base64 is a method of representing arbitrary binary data using 64 characters.

[0069] S222, decode the Base64-encoded string to obtain the obfuscated binary data; in this process, Base64 decoding is to convert the Base64-encoded string that may be obtained after RSA decryption back to the original binary data.

[0070] S223, de-obfuscate the obfuscated binary data to obtain the original data and the serial number information of the edge computing device. This step is to remove the obfuscation added during the transmission or storage process to restore the original sensitive data. This process ensures the security and integrity of sensitive data during transmission and storage, and also prevents unauthorized access and understanding through the de-obfuscation step.

[0071] In one embodiment of the present invention, in step S3, before data interaction, when the edge computing device passes security authentication, it also includes: when the edge computing device passes identity authentication, verifying whether the edge computing device has access rights by querying the access control list of the sensitive data.

[0072] Verify whether the device has the permission to execute this type of instruction. This can be achieved by querying the device's permission list or role assignment. Assign different access rights based on the user's role to ensure that only authorized users can access sensitive data. At the same time, limit the access control list: set an access control list for each resource to clarify which users or roles can access the resource. Map the minimum permission set to specific tables, columns, and operations in the database. Ensure that each user or application can only access and operate the tables, columns, and operations corresponding to its minimum permission set, and regularly review and update user permissions to ensure that permissions are consistent with actual needs.

[0073] In this embodiment, the present invention can ensure the protection security between the edge computing device and the cloud platform through double verification, thereby greatly improving the stability of the overall system. It can be understood that the access rights of the edge computing device can be controlled based on the result of verifying whether the edge computing device has access rights.

[0074] In one embodiment, the identity authentication includes verifying an account / password mechanism, a dynamic token, or a digital certificate.

[0075] In one embodiment of the present invention, the formula for generating a dynamic token in dynamic token authentication is OTP(K,C)=Truncate(HMAC-SHA-1(K,C)),

[0076] Where K represents the serial number of the edge computing device, C represents the data of the downstream control, and OTP represents a one-time password.

[0077] HMAC-SHA-1 means using SHA-1 for HMAC. Truncate is a function that intercepts the encrypted string and takes the fields of the encrypted string to form a new key.

[0078] Specifically, K in the formula represents the secret key. The SN unique ID value of the edge computing device currently used is, for example, (3641963c68739803cfc1625b). This value platform can obtain through the interface. C represents the data of the downstream control (for example, 34), which is related to the data points collected by industrial equipment (such as heat meters), that is, sensitive data that needs to be encrypted. The sensitive data is encrypted using the HMAC-SHA-1 hash algorithm with SN and downstream control data as parameters (according to the above two data, BA125444A962EDA3DB7FE247ED372A853EFBB08F), and the obfuscation of the encrypted data is completed through the Truncate function. (For example: BA521449A462ADE3DF7BE742ED372A853EFBBF80), thus completing the token of the down-control data. After the device side receives the data (BA521449A462ADE3DF7BE742ED372A853EFBBF80), it first uses the Truncatede function to obtain (BA125444A962EDA3DB7FE247ED372A853EFBB08F), and then decrypts it through HMAC-SHA-1 and SN (3641963c68739803cfc1625b) to obtain the down-control value (34) and write it to the collected device side to complete the down-control.

[0079] The second aspect of the present invention provides a security control method based on an edge computing device, which is used in conjunction with the method provided in the first aspect of the present invention. Figure 4 , the method includes S4 to S5, wherein:

[0080] S4. When the edge computing device interacts with the cloud platform, it sends a request for interaction data to the cloud platform, encrypts the interaction data using an obfuscation encryption algorithm, and waits for the cloud platform to perform security authentication on it.

[0081] S5. After the security authentication is passed, data interaction is performed.

[0082] In one embodiment of the present invention, sending a request for interaction instruction to the cloud platform in S4 includes: when transmitting interaction data to the cloud platform, encrypting the interaction data using an obfuscated encryption algorithm; combining Figure 5 , using the obfuscation encryption algorithm to encrypt the interactive data includes S41 to S44, wherein:

[0083] S41, encrypting the interaction data using an RSA public key;

[0084] S42: Determine the serial number information of the edge computing device, and combine the serial number information and the encrypted data into a binary string;

[0085] S43, performing Base64 encoding on the combined binary string;

[0086] S44. Obfuscate the encoded string and transmit it to the cloud platform.

[0087] In one embodiment, in step S4, the specific algorithm for encrypting the interactive data using the obfuscation encryption algorithm is:

[0088] n=p×q

[0089]

[0090] m^e mod n=m

[0091] c^d mod n=m

[0092] Among them, p and q are set values, p and q are prime numbers, n represents the modulus, e represents the public key exponent, and e must satisfy And e and Mutually prime, m represents the interaction instruction, c represents the ciphertext, d represents the private key exponent, and ^ represents the power.

[0093] Specifically, the algorithm of this formula is used to transmit the monitoring data of industrial equipment collected by the edge computing device. Among them, p and q will be changed regularly. If p = 7q = 11, then n = 77 corresponds to the binary number 100 1101, a total of 7 bits. Then take the first 7 bits of the SN of the edge computing device as the base64 string reference (3641963), and use the Euler function pass Get e=7, according to m^e mod n=m, it represents the data m (for example, 2) to be encrypted, 2^3=8, the data is combined with 3641963 (the first 7 bits of SN) and base64 encoded (MzY0MTk2Mzg=), and after obfuscation (MzM0YTkzM2g=), it is transmitted to the platform side. After receiving it, the platform side first restores it to (MzY0MTk2Mzg=), and then performs base64 decoding to obtain (36419638). According to the agreed p and q values, the data bits of SN are obtained and compared to obtain the transmitted data 8. According to the above formula (8=m^e mod n), the data collected by the industrial equipment is m=2 and then displayed.

[0094] In one embodiment, in S5, when security authentication is passed, before data interaction is performed, it also includes: when the edge computing device passes security authentication, verifying whether the edge computing device has access rights by querying an access control list of sensitive data.

[0095] In this embodiment, the present invention can ensure the protection security between the edge computing device and the cloud platform through double verification, thereby greatly improving the stability of the overall system. It can be understood that the access rights of the edge computing device can be controlled based on the result of verifying whether the edge computing device has access rights.

[0096] In one embodiment of the present invention, the edge computing device is connected to an edge side device (such as a power collection device, a temperature collection device, etc.), and the method further includes S6 to S7, wherein:

[0097] S6, monitoring the working data of the edge terminal device to determine whether the working data is within a preset behavior threshold range;

[0098] S7, if the judgment result is no, an abnormal alarm is sent to the cloud platform, and data repair is performed according to the emergency strategy provided by the cloud platform.

[0099] Another embodiment of the present invention provides a cloud platform, including: a memory for storing computer instructions; a controller for calling and executing the computer instructions stored in the memory to implement the method as described in the above embodiment.

[0100] Another embodiment of the present invention provides an edge computing device, including: a memory for storing computer instructions; and a controller for calling and executing the computer instructions stored in the memory to implement the method of the above embodiment.

[0101] Edge computing devices are important carriers for data processing and analysis, and their security is directly related to the security and reliability of data. Since edge computing devices are at the edge of the network, they are more vulnerable to attacks and damage. In addition, due to the limited processing and storage capabilities of edge computing devices, more efficient and reliable security control measures are needed to ensure the security and reliability of data. Traditional cloud systems mainly focus on the secure backup and recovery of the platform side, which is also mainly aimed at the platform side. Edge computing device security control generally only has one identity authentication process or even no identity authentication, which results in many attacks on devices that are simple but deadly. Simple disguises can control devices to perform various operations, settings, and even deactivate them. Moreover, the hardware and software environments of the devices are different, making unified security control more difficult. Due to the limited processing and storage capabilities of edge computing devices, more efficient and reliable security control measures are needed to ensure the security and reliability of data and the stability of device operation.

[0102] The method provided in this embodiment is mainly aimed at the access authorization management of the edge computing engine, the encryption management of sensitive data, the multiple authentication processing of the down-control operation, and the data backup and automatic repair. It also reports abnormal operations and data changes to the platform and operation and maintenance management personnel in a timely manner through the alarm strategy to facilitate their necessary human intervention, ensure the integrity and availability of the edge computing equipment and the entire system, and reduce the impact of abnormal events on the overall business. This embodiment proposes a set of security prevention and control methods, systems, and engine devices based on edge computing devices, which provide prevention and control measures for the entire data security from the cloud to the edge side. In general, the present invention can achieve the following technical effects:

[0103] 1. Encryption management of sensitive data

[0104] A strong encryption algorithm with obfuscation (WEIENCP algorithm) is used to encrypt sensitive data to ensure the security of data during transmission and storage.

[0105] The strong encryption algorithm with obfuscation first obfuscates the sensitive data in sequence, then converts it into a base64 string, and then transmits it after the following formula (^ is a power).

[0106] n = p × q;

[0107]

[0108] m^e mod n = m;

[0109] c^d mod n=m;

[0110] After receiving the sensitive data, the platform first decrypts it using the secret key (m = c^d mod n), where Then it is decrypted using base64, and finally the (C1^(-1))^(-r)×C2^s anti-obfuscation process is performed to obtain the original sensitive data.

[0111] In addition, keys are replaced regularly and old keys are destroyed.

[0112] 2. Multiple authentication processing for down-control operations: In order to prevent misoperation, hackers or criminals from causing irreversible data disasters to terminal devices, multi-factor authentication is adopted for special down-control points: username and password, dynamic token, obfuscation encryption, etc., which increases the complexity of authentication and ensures the security of engine equipment. The formula for generating dynamic tokens is OTP(K,C)=Truncate(HMAC-SHA-1(K,C)), where K represents the secret key string, C is a number representing a random number, and OTP represents a one-time password. HMAC-SHA-1 means using SHA-1 for HMAC. Truncate is a function that intercepts the encrypted string and takes which fields of the encrypted string to form a new secret key. The obfuscation encryption algorithm is the same as that for sensitive data, but it uses different public keys and obfuscation algorithms of the WEIENCP algorithm.

[0113] 3. Access authorization management

[0114] Role-based access control: Assign different access rights according to the user's role to ensure that only authorized users can access sensitive data. At the same time, limit the access control list: set an access control list for each resource to clarify which users or roles can access the resource. Map the minimum permission set to specific tables, columns, and operations in the database. Ensure that each user or application can only access and operate the tables, columns, and operations corresponding to its minimum permission set, and regularly review and update user permissions to ensure that permissions are consistent with actual needs.

[0115] 4. Data backup and automatic repair: Back up important data regularly to ensure that data can be restored in the event of a failure or disaster. Data recovery: When data is lost or damaged, restore it through backup data to ensure business continuity. Backup strategy selection: Select an appropriate backup strategy based on business needs and data importance, such as full backup once a week and incremental backup once a day. Perform recovery tests on backup data every month to ensure the availability and integrity of backup data. Data recovery process formulation: Develop a detailed data recovery process, clarify the recovery steps and responsible persons, and respond after double password authentication to ensure that data can be restored in a timely and safe manner.

[0116] The algorithm proposed in this embodiment is mainly aimed at strong encryption management with obfuscation for sensitive data, access authorization management for edge computing devices, multiple authentication processing for lower-control operations, as well as data backup and automatic repair. It also reports abnormal operations and data changes in a timely manner through alarm strategies, controls a series of devices in a diverse and unified manner, and can prevent and control external illegal data tampering and attacks. Authentication and authorization of edge computing devices are basic measures to ensure device security. Through device authentication, the identity and legitimacy of the device can be confirmed; through authorization, the access rights and operating scope of the device can be controlled. The encryption and decryption technology of the WEIENCP algorithm with obfuscation is an important means to ensure data security. In edge computing devices, the WEIENCP algorithm encryption and decryption algorithm is also used to protect the confidentiality and integrity of data.

[0117] The intrusion detection and defense technology used in the present invention can help timely discover and prevent malicious attacks: in edge computing devices, detection based on device SN features, abnormal detection and behavior detection are used to detect and defend against attacks. For example, the unique SN serial number of the device is used for authentication and WEIENCP algorithm obfuscation encryption and decryption. When encrypting, the unique SN serial number of the device is read for encryption, and the data interaction of each group of devices is to verify this SN. If it does not match the SN used by the secret key, no reception and control processing will be performed, which effectively prevents malicious attacks by disguised devices; abnormal detection refers to the abnormal operation status of the edge acquisition device, and a standardized behavior threshold is set for sensitive data. If the device acquisition data is not within the threshold range, it will be reported through the alarm system, and the platform side will evaluate whether human intervention is required or whether the device repair operation needs to be started; abnormal behavior is to control abnormal operation, confirm the legitimacy of the control operation, and record the time when the behavior occurs and the operator, etc., and do a good job of backing up the relevant equipment to prevent recovery confusion after errors. At the same time, an equipment safety management system is set up, including safety management of equipment procurement, use, maintenance, scrapping and other links. At the same time, strengthen the training and education of employees to improve their safety awareness and operating skills.

Claims

1. A security control method based on edge computing devices, used in cloud platforms, characterized in that: The method comprises: S1. When the cloud platform interacts with the edge computing device, identifying the type of the requested interaction instruction; S2. Implement different security authentication strategies on the edge computing device according to the type of requested interaction instruction, specifically including: S21. When the request interaction instruction is an upload data instruction or a down-control operation instruction, verify the identity of the edge computing device through a predefined identity authentication mechanism; S22. When the edge computing device passes identity authentication, decrypt the ciphertext uploaded by the edge computing device to obtain the interaction data and the serial number information of the edge computing device; S23, determining whether the serial number information matches the serial number of the edge computing device; S24. When the serial number information matches the serial number of the edge computing device, receiving the interaction data; otherwise, not receiving the interaction data; S3. Performing data interaction when the edge computing device passes security authentication; Wherein, in step S22, the ciphertext uploaded by the edge computing device is decrypted to obtain identity authentication and serial number information of the edge computing device, including: S221. Decrypt the ciphertext using the RSA private key to obtain a Base64-encoded string. S222, decoding the Base64-encoded string to obtain obfuscated binary data; S223: De-obfuscate the obfuscated binary data to obtain the interaction data and serial number information of the edge computing device.

2. The method according to claim 1, characterized in that In step S3, when the edge computing device passes the security authentication, before data interaction, it also includes: When the edge computing device passes the identity authentication, whether the edge computing device has the access rights is verified by querying the access control list of sensitive data.

3. The method according to claim 2, characterized in that The identity authentication includes verification of an account / password mechanism, a dynamic token or a digital certificate.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: When an abnormal alarm of the edge computing device is received, the edge computing device is abnormally controlled so that the edge computing device performs data recovery through a preset emergency strategy.

5. A security control method based on edge computing equipment, characterized in that: The method comprises: S4. When the edge computing device interacts with the cloud platform, it sends a request for interaction data to the cloud platform, encrypts the interaction data using an obfuscation encryption algorithm, and waits for the cloud platform to perform security authentication on the encrypted interaction data; S5. After the security authentication is passed, data interaction is performed; Wherein, in step S4, uploading the interactive data to the cloud platform and encrypting the interactive data using an obfuscation encryption algorithm includes: S41, encrypting the interaction data using an RSA public key; S42: Determine the serial number information of the edge computing device, and combine the serial number information and the encrypted data into a binary string; S43, performing Base64 encoding on the combined binary string; S44. Obfuscate the encoded string and transmit it to the cloud platform.

6. The method according to claim 5, characterized in that In step S4, the specific algorithm for encrypting the interactive data using the obfuscation encryption algorithm is: n = p × q; m^e mod n = m; c^d mod n=m; Among them, p and q are set values, p and q are prime numbers, n represents the modulus, e represents the public key exponent, and e must satisfy And e and Mutually prime, m represents the interaction data, c represents the ciphertext, and d represents the private key exponent.

7. The method according to claim 6, characterized in that In S5, after the security authentication is passed, before data interaction is performed, the following steps are also included: When the edge computing device passes the security authentication, whether the edge computing device has access rights is verified by querying the access control list of sensitive data.

8. The method according to any one of claims 5 to 7, characterized in that: The edge computing device is connected to the edge side terminal device, and the method further includes: S6. Monitor the working data of the edge-side terminal device to determine whether the working data is within a preset behavior threshold range; S7. If the judgment result is no, an abnormal alarm is sent to the cloud platform, and data repair is performed according to the emergency strategy provided by the cloud platform.

9. A cloud platform, characterized in that: include: Memory, for storing computer instructions; A controller, configured to call and execute computer instructions stored in the memory to implement the method according to any one of claims 1 to 4.

10. An edge computing device, characterized in that: include: Memory, for storing computer instructions; A controller, configured to call and execute computer instructions stored in the memory to implement the method according to any one of claims 5 to 7.

Images