Safe and credible access technology of electric red-hong Internet of Things operating system

Abstract

The invention relates to a safe and credible access technology for an electric Hongyu Internet of Things operating system, which is characterized in that adaptive construction is carried out in a power transformation system based on OpenHarmony, and the safety and the credibility of Internet of Things equipment when the equipment accesses the electric Hongyu Internet of Things operating system are ensured by means of equipment authentication, safe communication, data encryption and the like, so that the safety and the stability of the power transformation system are improved.

Description

Technical Field

[0001] The present application belongs to the technical field of power systems, and more specifically, to a secure and trusted access technology for the Dianhong IoT operating system. Background Art

[0002] With the rapid development of Internet of Things technology, substation systems are gradually becoming intelligent. However, there are many security risks in the access and management of IoT devices, such as device identity forgery and data leakage. Therefore, developing a secure and reliable access technology is crucial to ensure the security of substation systems. Summary of the invention

[0003] The present invention provides a secure and reliable access technology for the Dianhong IoT operating system, aiming to solve the security problems existing in the prior art when IoT devices are connected to a substation system.

[0004] A secure and trusted access technology for the Dianhong IoT operating system, comprising: 1. Equipment Authentication Before the device is connected to the Dianhong IoT operating system, the system sends an authentication request to the device, which contains the system's authentication key and random number.

[0005] After receiving the authentication request, the device uses the preset authentication key to encrypt the random number and returns the encrypted result to the system.

[0006] The system uses its own authentication key to decrypt the received encryption result and compare it with the original random number. If the comparison results are consistent, the authentication is successful and the device obtains access permission; otherwise, the authentication fails and the device is denied access.

[0007] 2. Secure communication After the device is authenticated, the Dianhong IoT operating system establishes a secure communication channel with the device. This channel uses encryption technology to ensure data security during the communication process.

[0008] The communication data between the system and the device is encrypted and decrypted using a symmetric encryption algorithm to ensure the confidentiality and integrity of the data.

[0009] During the communication process, the system periodically sends heartbeat packets to the device to detect the device's online status. If the device does not respond to the heartbeat packet for a long time, the system considers the device offline and disconnects from the device.

[0010] 3. Data Encryption For device data stored in the Dianhong IoT operating system, the system uses an asymmetric encryption algorithm to encrypt data to ensure data security.

[0011] When access to device data is required, the system uses the private key to decrypt the data for use.

[0012] 4. Data transmission encryption During data transmission, the system uses encryption technology to ensure the confidentiality and integrity of data. Specifically, the system encrypts the transmitted data and decrypts and verifies the integrity of the data at the receiving end to prevent the data from being leaked or tampered with during transmission.

[0013] Through the above implementation methods, the present invention realizes the secure and reliable access of the Dianhong IoT operating system to the IoT devices, thereby improving the security and stability of the substation system. DETAILED DESCRIPTION

[0014] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present application more clearly understood, the present application is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0015] The present invention provides a secure and reliable access technology for the Dianhong IoT operating system, aiming to solve the security problems existing in the prior art when IoT devices are connected to a substation system.

[0016] The present invention is described in detail below based on embodiments: 1. Equipment Authentication Before the device is connected to the Dianhong IoT operating system, the system sends an authentication request to the device, which contains the system's authentication key and random number.

[0017] After receiving the authentication request, the device uses the preset authentication key to encrypt the random number and returns the encrypted result to the system.

[0018] The system uses its own authentication key to decrypt the received encryption result and compare it with the original random number. If the comparison results are consistent, the authentication is successful and the device obtains access permission; otherwise, the authentication fails and the device is denied access.

[0019] Specifically, the following is an extended description of device authentication: Key management: The management of authentication keys is a key step in the device authentication process. To ensure the security of keys, the system uses a key distribution center (KDC) or hardware security module (HSM) to generate, store and distribute keys. These measures can effectively prevent the leakage or illegal acquisition of keys.

[0020] Multi-factor authentication: In addition to key-based authentication, the system can also combine other authentication methods, such as biometrics (fingerprint, facial recognition, etc.) or dynamic tokens (such as mobile phone verification codes) to achieve multi-factor authentication and further improve the security of device access.

[0021] Blacklist mechanism: For devices that fail authentication or have abnormal behavior, the system will add them to the blacklist and deny their access requests for a certain period of time. This helps prevent malicious devices from repeatedly trying to access the system.

[0022] 2. Secure communication After the device is authenticated, the Dianhong IoT operating system establishes a secure communication channel with the device. This channel uses encryption technology to ensure data security during the communication process.

[0023] The communication data between the system and the device is encrypted and decrypted using a symmetric encryption algorithm to ensure the confidentiality and integrity of the data.

[0024] During the communication process, the system periodically sends heartbeat packets to the device to detect the device's online status. If the device does not respond to the heartbeat packet for a long time, the system considers the device offline and disconnects from the device.

[0025] Specifically, the following is an expanded description of secure communications: Choice of communication protocol: To ensure the security of communication, the system can choose mature and widely verified communication protocols, such as TLS (Transport Layer Security) or DTLS (Datagram Transport Layer Security). These protocols provide strong encryption and authentication capabilities.

[0026] End-to-end encryption: In addition to encrypting communication data, the system can also achieve end-to-end encryption, that is, the data remains encrypted from the sender to the receiver, and even if a node in the network is intercepted, the data content cannot be decrypted.

[0027] Anomaly detection and response: The system should monitor abnormal situations in the communication process in real time, such as packet loss, disorder or abnormal delay, etc. Once an abnormality is detected, the system should immediately take corresponding measures, such as disconnecting, logging or sending an alarm.

[0028] 3. Data Encryption For device data stored in the Dianhong IoT operating system, the system uses an asymmetric encryption algorithm to encrypt data to ensure data security.

[0029] When access to device data is required, the system uses the private key to decrypt the data for use.

[0030] During data transmission, the system uses encryption technology to ensure the confidentiality and integrity of data and prevent data leakage and tampering.

[0031] Specifically, the following is an extended description of data encryption: Selection of encryption algorithms: For data encryption, the system can choose efficient and widely verified encryption algorithms, such as AES (Advanced Encryption Standard) or RSA (asymmetric encryption algorithm). These algorithms can minimize the impact of encryption and decryption processes on system performance while ensuring security.

[0032] Hierarchical encryption of data: The system can encrypt data at different levels according to the sensitivity of the data and the access requirements. For highly sensitive data, a higher level of encryption algorithm and stricter access control are used; for general data, a relatively lower level of encryption measures can be used.

[0033] Data backup and recovery: While encrypting data, the system should also consider data backup and recovery. The integrity and security of the backup data should be ensured so that the data can be quickly restored when needed.

[0034] 4. Data transmission encryption Data transmission encryption mainly involves encrypting the data stream in transit to ensure the confidentiality and integrity of the data. This usually includes the following key steps: Selection of encryption algorithm: Select an appropriate encryption algorithm based on the sensitivity of the data and the security requirements of the transmission environment. Common encryption algorithms include symmetric encryption algorithms (such as AES) and asymmetric encryption algorithms (such as RSA).

[0035] Key management and distribution: Keys are the key to encryption and decryption, so key management and distribution are crucial. It is necessary to ensure the secure storage and transmission of keys to prevent illegal access.

[0036] Transmission of encrypted data: Use the selected encryption algorithm and key to encrypt the data to be transmitted, and then transmit the encrypted data over the network.

[0037] Decryption and verification: After receiving the encrypted data, the receiver uses the corresponding key and algorithm to decrypt and verify the integrity of the data. If the data is tampered with during transmission, the decryption and verification process will fail.

[0038] In short, data transmission encryption is one of the important technologies in the field of network security. By selecting appropriate encryption algorithms and key management schemes, the confidentiality and integrity of data can be effectively protected. In practical applications, it is necessary to flexibly apply and adjust according to specific scenarios and needs.

[0039] The following is a supplementary explanation with specific examples: The following is a specific example to supplement the above overall process: 1. Device authentication example: Assume that a smart meter device needs to be connected to the Dianhong IoT operating system. First, the system sends an authentication request to the smart meter, which contains the system's authentication key and a generated random number, such as "random number 123456".

[0040] After receiving the request, the smart meter uses its preset authentication key to encrypt the "random number 123456" to generate the encryption result "encryption code ABCDEF". Then, the smart meter returns the "encryption code ABCDEF" to the system.

[0041] After receiving the encryption result, the system uses its own authentication key to decrypt the "encryption code ABCDEF" and obtains the decrypted random number. If the decrypted random number is consistent with the original random number sent (that is, the "decrypted random number 123456" is the same as the "random number 123456"), the system determines that the smart meter device is trustworthy and grants it access permission.

[0042] If the decrypted random number is inconsistent with the original random number, the system determines that the authentication has failed and rejects the access request of the smart meter device.

[0043] 2. Secure communication example: After the smart meter device is successfully authenticated and connected to the system, the Dianhong IoT operating system establishes a secure communication channel with it. The system uses a symmetric encryption algorithm (such as AES) to encrypt and decrypt communication data.

[0044] For example, when the system needs to send a control instruction to the smart meter, it first encrypts the instruction using the AES key to generate encrypted instruction data. Then, the system sends the encrypted instruction data to the smart meter.

[0045] After receiving the encrypted data, the smart meter uses the same AES key to decrypt it, obtains the original control instruction, and performs the corresponding operation.

[0046] During the communication process, the system periodically sends heartbeat packets to the smart meter to detect its online status. If the smart meter does not respond to the heartbeat packet for a long time, the system considers it offline and automatically disconnects it to ensure the timeliness and security of communication.

[0047] 3. Data encryption example: For the smart meter data stored in the Dianhong IoT operating system, the system uses an asymmetric encryption algorithm (such as RSA) for encryption processing.

[0048] When the system needs to store the data of the smart meter, it first encrypts the data using the RSA public key to generate an encrypted data block. The system then stores the encrypted data block in the database.

[0049] When the data needs to be accessed, the system uses the corresponding RSA private key to decrypt the data and obtain the original data content. In this way, even if the database is illegally accessed, the attacker cannot obtain the original data information, ensuring the security of the data.

[0050] In addition, during data transmission, the system also uses similar encryption technology to ensure the confidentiality and integrity of data during transmission.

[0051] Data transmission encryption example The administrator initiates a query request: The administrator initiates a query request through the operation management system and enters information such as the query device / data, query scope, and query conditions.

[0052] Data encryption: The operation management system uses an encryption algorithm (such as AES) and a key to encrypt the query response data and generate an encrypted data packet.

[0053] Data transmission: The encrypted data packets are transmitted to the administrator through the network. In this process, the data packets exist in ciphertext form, and even if they are intercepted, they cannot be directly read.

[0054] Server decryption and verification: After receiving the encrypted data packet, the administrator uses the corresponding key and algorithm to decrypt and verify the integrity of the data. If the verification passes, the query data is displayed.

[0055] Through this process, it can be ensured that the administrator's query request data will not be illegally obtained or tampered with during transmission, thereby ensuring the security of information data.

[0056] In summary, by expanding measures in terms of device authentication, secure communication and data encryption, the present invention can further improve the secure and trusted access capability of the Dianhong IoT operating system to IoT devices, thereby ensuring the security and stability of the substation system.

[0057] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0058] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0059] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0060] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0061] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0062] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0063] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0064] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0065] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0066] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0067] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A secure and trusted access technology for the Dianhong IoT operating system, characterized in that: The following steps are involved: a. Device authentication: Before the device is connected to the Dianhong IoT operating system, the system sends an authentication request containing a random number generated by the system and the system authentication public key to the device; after receiving the authentication request, the device uses the preset authentication private key to sign the random number and returns the signature result to the system; the system uses the authentication public key to verify the signature result. If the verification is successful, the device obtains the right to access the system; b. Establishment of secure communication channel: After the device is authenticated, a secure communication channel using a symmetric encryption algorithm is established between the Dianhong IoT operating system and the device for data encryption and decryption. At the same time, the system uses a heartbeat packet mechanism to periodically send heartbeat packets to the device to detect the device's online status; c. Data encryption: The Dianhong IoT operating system uses an asymmetric encryption algorithm to encrypt the device data stored in it. The data encryption and decryption process is automatically completed by the system; d. Data transmission encryption: During the data transmission process, the Dianhong IoT operating system encrypts the transmitted data and decrypts and verifies the integrity of the data at the receiving end.

2. According to claim 1, the secure and trusted access technology of the Dianhong IoT operating system, The device authentication step also includes exchanging session keys with the system after the device obtains access to the system for subsequent secure communications.

3. The secure and trusted access technology for the Dianhong IoT operating system according to claim 1 or 2, wherein: The symmetric encryption algorithm in the secure communication channel establishment step adopts the AES encryption algorithm.

4. The secure and trusted access technology for the Dianhong IoT operating system according to claim 1, wherein: The asymmetric encryption algorithm in the data encryption step adopts the RSA encryption algorithm.

5. The secure and trusted access technology for the Dianhong IoT operating system according to claim 1, wherein: The steps for data transmission encryption include: a. The sender encrypts the transmitted data and generates an encrypted data packet; b. The sender sends the encrypted data packet to the receiver; c. The receiving end decrypts the encrypted data packet and restores the original data; d. The receiving end performs integrity check on the decrypted data to ensure that the data has not been tampered with during transmission.

6. The secure and trusted access technology for the Dianhong IoT operating system according to claim 5, wherein: The data transmission encryption step also includes signing the transmitted data using digital signature technology to ensure the integrity of the data and the authenticity of the source.

7. A Dianhong IoT operating system, characterized in that: The system implements the secure and trusted access technology of the Dianhong IoT operating system according to any of the above claims.

8. A secure access device for a Dianhong IoT operating system, characterized in that: The device includes hardware and / or software modules for executing each step of the secure and trusted access technology for the Dianhong IoT operating system according to any of the above claims.

9. A method for implementing a secure and trusted access technology for a Dianhong IoT operating system, characterized in that: The following steps are involved: a. Integrate secure and trusted access technology modules into the Dianhong IoT operating system; b. When the device is accessed, performing the device authentication step according to any of the preceding claims; c. After the device is authenticated, a secure communication channel is established; d. Encrypt device data stored in the system; e. During data transmission, the transmitted data is encrypted and integrity checked.

10. The method for implementing the secure and trusted access technology of the Dianhong IoT operating system according to claim 9, wherein: The method also includes regular testing and evaluation of the system's security performance to ensure the effectiveness and reliability of secure and trusted access technology.