Trusted measurement identification method and system for WAPI network terminal of power transmission line

Abstract

The invention relates to a power transmission line WAPI network terminal trusted measurement identification method and system. The system comprises a plurality of WAPI terminals arranged on a plurality of iron towers in a power transmission line in a one-to-one correspondence mode. Wherein the target WAPI terminal comprises a wireless communication module and an identification module; the authentication module has an edge computing capability and is used for executing an identity authentication function of an authentication server AS of the WAPI when the plurality of WAPI terminals are networked so as to complete successful networking of the plurality of WAPI terminals; the wireless communication module is used for remotely transmitting power transmission line monitoring data to a power management center after the plurality of WAPI terminals are successfully networked; the target WAPI terminal is any one of the plurality of WAPI terminals.

Description

Technical Field

[0001] The disclosed embodiments relate to the technical field of power grid monitoring, and in particular to a method and system for identifying a trusted metric of a transmission line WAPI network terminal. Background Art

[0002] Currently, traditional wireless communications are used in transmission line monitoring, and data transmission relies more on the operator's communication base stations. However, transmission lines are generally located in remote areas in the wild, and there may be no base stations near their power towers or their number is limited, making it difficult to fully cover and effectively monitor and transmit data. If new base stations are added specifically for transmission lines, too much unnecessary equipment cost will be added, and traditional wireless communications that transmit data through the operator's network are difficult to ensure the security of power monitoring data.

[0003] A new solution is proposed in the related art, which is to set up multiple WAPI terminals on multiple towers in the power transmission line in the area where the communication base station is difficult to effectively cover to form a WAPI (Wireless LAN Authentication and Privacy Infrastructure) network, and to monitor data transmission based on the set WAPI terminal networking, so as to avoid the problem of being completely dependent on the operator's communication base station and being difficult to fully cover effective monitoring. At the same time, there is no need to add new base stations to increase unnecessary base station equipment costs, and it can ensure the security of power monitoring data transmission. WAPI technology usually adopts a ternary peer-to-peer security architecture, and its network identity authentication requires the participation of the authentication server AS (Authentication Server). AS is an important component of WAPI, which is an independent server. At present, AS is usually set in the intranet, such as the computer room of the power supply bureau. From the computer room where AS is located to the WAPI network corresponding to multiple WAPI terminals set up on multiple towers in the field, it is unrealistic to pull the fiber-optic private network back to the computer room in actual scenarios, and there is no such practice at present.

[0004] In the related technology, an operator communication module can be configured on a WAPI terminal in the WAPI network (i.e., the external network) to transmit the aggregated data back based on the network of the nearest operator, such as the 5G network. When transmitting back, 5G is a public network after all, and the power system has very strict protection for its network, so the data sent back from the public network must pass through a set security isolation zone, and the security isolation zone increases the non-real-time nature of the returned data. That is, when a WAPI terminal device wants to access the network, it must find an AS to authenticate its identity, and this AS is located in the intranet, such as a power supply bureau at a remote end, with a long transmission distance, and the data related to the returned network must pass through a security isolation zone (such as an isolation gateway, an isolation firewall, etc.) for detection. In this case, the networking of the WAPI terminal has a serious lag effect, and the real-time nature of the networking is extremely poor. The power system also has very strict requirements for the real-time nature of the monitoring data return. Therefore, it is difficult for the current technology to quickly complete the networking of the transmission line WAPI terminal to transmit the monitoring data in real time while ensuring safety. Summary of the invention

[0005] In order to solve the above technical problem or at least partially solve the above technical problem, the embodiments of the present disclosure provide a method and system for authenticating a trustworthy metric of a power line WAPI network terminal.

[0006] In a first aspect, an embodiment of the present disclosure provides a transmission line WAPI network terminal trust metric identification system, the system comprising a plurality of WAPI terminals arranged one-to-one on a plurality of towers in a transmission line;

[0007] Among them, the target WAPI terminal includes a wireless communication module and an identification module; the identification module has edge computing capabilities, and is used to execute the identity authentication function of the WAPI authentication server AS when the multiple WAPI terminals are networked, so as to complete the successful networking of the multiple WAPI terminals; the wireless communication module is used to remotely transmit the transmission line monitoring data to the power management center after the multiple WAPI terminals are successfully networked; the target WAPI terminal is any one of the multiple WAPI terminals.

[0008] In one embodiment, the target WAPI terminal further includes a trust metric module, which is used to determine a trust metric value of the authentication module, and when the trust metric value meets a preset condition, prohibit starting the authentication module or stop the operation of the authentication module.

[0009] In one embodiment, the authentication module includes an authentication chip, and the authentication chip includes a built-in authentication code;

[0010] The trust metric module is used to obtain the hardware information of the authentication chip, the static information of the authentication code and the dynamic information during the code running process; and determine the trust metric value based on one or more of the hardware information, the static information and the dynamic information.

[0011] In one embodiment, the authentication code includes at least one target component, each of which is a code component whose component importance weight is greater than a preset weight when the authentication code performs the identity authentication function;

[0012] The trust metric module is used to determine a trust metric value based on component static information of the at least one target component and component dynamic information during the operation of the at least one target component.

[0013] In one embodiment, the component static information includes the core code of at least one target component; the component dynamic information includes result information output during the operation of at least one target component, and the result information includes at least signature information.

[0014] In one embodiment, the wireless communication module includes a 4G or 5G communication module; and / or the trust metric module is a chip module.

[0015] In a second aspect, an embodiment of the present disclosure provides a transmission line WAPI network terminal trust metric identification method, which is applied to a networking process of multiple WAPI terminals arranged one-to-one on multiple towers in a transmission line; wherein the target WAPI terminal includes a wireless communication module and an identification module, and the identification module has edge computing capabilities; the target WAPI terminal is any one of the multiple WAPI terminals; the method includes:

[0016] When the multiple WAPI terminals are networked, the authentication module is started to perform an identity authentication function of the WAPI authentication server AS to complete the successful networking of the multiple WAPI terminals;

[0017] After the multiple WAPI terminals are successfully networked based on the wireless communication module, the transmission line monitoring data is remotely transmitted to the power management center.

[0018] In one embodiment, the target WAPI terminal further includes a trust metric module; the method further includes:

[0019] Determining a trustworthiness metric value of the authentication module based on the trustworthiness metric module;

[0020] When the credibility metric value meets a preset condition, starting the authentication module is prohibited or the operation of the authentication module is stopped.

[0021] In one embodiment, the authentication module includes an authentication chip, and the authentication chip includes a built-in authentication code;

[0022] The determining the trustworthiness metric value of the authentication module based on the trustworthiness metric module comprises:

[0023] Acquire the hardware information of the authentication chip, the static information of the authentication code, and the dynamic information during the code running process;

[0024] A trust metric value is determined based on one or more of the hardware information, the static information, and the dynamic information.

[0025] In one embodiment, the authentication code includes at least one target component, each of which is a code component whose component importance weight is greater than a preset weight when the authentication code performs the identity authentication function;

[0026] The determining of the trustworthiness metric value based on the static information and the dynamic information includes:

[0027] A trust metric value is determined based on component static information of the at least one target component and component dynamic information during the operation of the at least one target component.

[0028] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0029] The disclosed embodiment provides a transmission line WAPI network terminal trust metric identification method and system, the system includes a plurality of WAPI terminals arranged one by one on a plurality of towers in a transmission line, wherein the target WAPI terminal includes a wireless communication module and an identification module, the identification module has edge computing capability, and is used to perform the identity authentication function of the WAPI authentication server AS when the plurality of WAPI terminals are networked, so as to complete the successful networking of the plurality of WAPI terminals; the wireless communication module is used to remotely transmit the transmission line monitoring data to the power management center after the plurality of WAPI terminals are successfully networked; the target WAPI terminal is any one of the plurality of WAPI terminals. In this way, an embedded AS can be implemented on the target WAPI terminal of the transmission line WAPI network, that is, the terminal used for remote data return, that is, the AS is configured in the gateway device on the transmission line side, and a lightweight AS is made to complete the identity authentication of the terminal when the WAPI is networked locally, instead of returning the networking data to the remote AS to realize identity authentication in the related technology, which is equivalent to changing the identity authentication system architecture of the WAPI, so as to avoid the disadvantages brought by the related technology, and quickly complete the networking of the transmission line WAPI terminal to transmit the power monitoring data in real time under the premise of ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0032] Figure 1 This is a schematic diagram of a trusted metric identification system for a WAPI network terminal on a power line according to an embodiment of the present disclosure;

[0033] Figure 2 This is a schematic diagram of a trusted metric identification system for a power line WAPI network terminal according to another embodiment of the present disclosure;

[0034] Figure 3 This is a flow chart of a method for identifying a trusted metric of a power line WAPI network terminal according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0036] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0037] It should be understood that, in the following, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0038] Figure 1The schematic diagram of the transmission line WAPI network terminal trust metric identification system of the embodiment of the present disclosure may include multiple WAPI terminals arranged one by one on multiple towers in the transmission line. The above-mentioned multiple towers (not shown) are towers in local areas on the entire transmission line, and there are no operator base stations or a small number of base stations near the local area. Among them, the target WAPI terminal may include a wireless communication module and an identification module. In one embodiment, the wireless communication module may include but is not limited to a 4G or 5G communication module. The target WAPI terminal is any one of the multiple WAPI terminals.

[0039] Exemplarily, the identification module has edge computing capabilities, that is, it provides edge computing services on the edge side of the transmission line. It can be specifically used to execute the identity authentication function of the WAPI authentication server AS when the multiple WAPI terminals are networked, so as to complete the successful networking of the multiple WAPI terminals.

[0040] It is understandable that WAPI uses certificate authentication and / or pre-shared key authentication to authenticate the legitimacy of the client identity, and can use unicast key negotiation and multicast key notification to protect the unicast / multicast data exchanged between the client and the AC. Certificate authentication is based on the certificates of the client, AC and AS installed on the wireless client such as the WAPI terminal. Before authentication, the wireless client and AC can have their own certificates in advance, and then the identities of both parties are authenticated separately through the AS, and the base key BK (BaseKey) is generated based on the temporary public key and temporary private key generated by both parties, and preparations are made for subsequent unicast key negotiation and multicast key notification. The wireless LAN authentication infrastructure WAI (WLAN Authentication Infrastructure) protocol message between the AC and the AS will be transmitted via ordinary UDP, and the certificate authentication will be finally completed. The specific certificate authentication process of the WAPI technology can be understood by referring to the existing technology, and will not be repeated here.

[0041] In this embodiment, the identity authentication function related to the authentication server AS is transferred to the target WAPI terminal on the edge side of the transmission line, which can be implemented by an authentication module with edge computing capabilities. The authentication module starts executing the identity authentication function of the authentication server AS when the multiple WAPI terminals are networked, and completes the successful networking of multiple WAPI terminals after the authentication is legal.

[0042] The wireless communication module, such as the 5G communication module, is used to remotely transmit the transmission line monitoring data to the power management center after the multiple WAPI terminals are successfully networked.

[0043] Exemplarily, after multiple WAPI terminals are successfully networked, a WAPI network is formed. Each WAPI terminal in the network can obtain the monitoring data collected by the monitoring equipment on the tower where it is located. The remaining WAPI terminals except the target WAPI terminal can relay the monitoring data to the target WAPI terminal, that is, the WAPI terminal having both a wireless communication module and an identification module, through the WAPI network. The target WAPI terminal transmits the aggregated monitoring data of all towers or the monitoring data of a certain tower back to the power management center. Among them, the monitoring equipment on each tower may include, for example, temperature and humidity sensors, current or voltage detection sensors, cameras, etc. The wireless communication module and the power management center may also include an isolation gateway, an isolation firewall, etc. These can be understood with reference to the prior art and will not be repeated here.

[0044] In some other embodiments, the above-mentioned multiple towers are towers without operator base stations nearby, and the multiple towers are arranged in sequence. The topological relationship of the WAPI network can be a relationship in which the multiple WAPI terminals are sequentially communicated and linked. Any WAPI terminal at the head and tail of the WAPI network can be used as the above-mentioned target WAPI terminal, and the target WAPI terminal can communicate with the communication equipment on the towers with operator base stations in other surrounding areas, such as 4G or 5G communication links, so as to realize that the monitoring data on the WAPI network is sent by the target WAPI terminal, and then transmitted back to the power management center through the communication equipment through the relay transmission.

[0045] The above-mentioned scheme of the disclosed embodiment can implement an embedded AS on the target WAPI terminal local to the transmission line WAPI network, i.e., the terminal used for remote data backhaul. That is, the AS is configured in the gateway device on the transmission line side to make a lightweight AS with edge computing capability, which is used to complete the terminal identity authentication during WAPI networking locally, i.e., on the edge side, instead of backhauling the networking data to the remote AS to implement identity authentication in the related technology. This can avoid the disadvantages brought by the related technology, and quickly complete the networking of the transmission line WAPI terminal to transmit power monitoring data in real time while ensuring security.

[0046] Since the AS is sunk to the WAPI network side of the transmission line, the target WAPI terminal therein can transmit data back through the operator's communication network such as 4G or 5G. However, the 4G or 5G network is a public network and is vulnerable to network attacks, especially the target WAPI terminal that is sunk to implement the AS is most vulnerable to attacks, and the security of power data is poor. On the transmission line side, it is impossible to set up security protection equipment such as firewalls and network gates. Therefore, while quickly completing the networking of the transmission line WAPI terminal to transmit power monitoring data in real time, in order to further improve the security of power monitoring data, the following technical solution is proposed in this embodiment.

[0047] Specifically, based on the above embodiments, in one embodiment, Figure 2 As shown, the target WAPI terminal may further include a trust metric module for determining a trust metric value of the authentication module, and when the trust metric value meets a preset condition, prohibiting the authentication module from being started or stopping the operation of the authentication module.

[0048] Exemplarily, the trust measurement module may be a chip module, such as an encryption chip module. The trust measurement module may perform trust measurement on the authentication module based on the trusted root measurement method to determine whether it is safe, such as whether it has been tampered with by malicious attacks to give an erroneous result of identity authentication. As an example, for example, the identity authentication is clearly illegal, but after the attack and tampering, the AS can give a legal authentication result.

[0049] In one example, the trust measurement module may perform trust measurement on the authentication module at regular intervals when the target WAPI terminal is powered on or working after startup, at an appropriate time, such as during the startup process or while continuously working after startup.

[0050] Specifically, the trust metric module can calculate and determine the trust metric value of the identification module, and when the trust metric value meets the preset condition, such as the trust metric value is inconsistent with the preset value, the identification module is prohibited from being started or the operation of the identification module is stopped, and when the trust metric value is consistent with the preset value, no specific operation is responded. The preset value can be set in advance according to the needs, and there is no limitation on this.

[0051] The above scheme in this embodiment can quickly complete the networking of the transmission line WAPI terminal to transmit power monitoring data in real time, while performing trust measurement on the identification module that implements AS identity authentication, and determine whether to execute the authentication process of the identification module based on the trust measurement result, thereby improving the security of the identity authentication process and further improving the security of the power monitoring data.

[0052] Based on the above embodiment, in one embodiment, the identification module may include an identification chip, and the identification chip includes a built-in identification code. The trust metric module is used to obtain hardware information of the identification chip, static information of the identification code, and dynamic information during code operation; and determine a trust metric value based on one or more of the hardware information, the static information, and the dynamic information.

[0053] Exemplarily, the hardware information may be the unique identification information of the authentication chip, hardware parameters, etc. Static information may be the text of the authentication code, such as the original code text, and dynamic information may include dynamic information during the code running process, such as the signature information of the certificate, secret key, etc. As an example, the text of the authentication code, i.e., the static information, may be hashed in advance to obtain a hash value such as 12345678 as a preset value. Subsequently, the trusted measurement module performs a hash calculation on the authentication code each time the trusted measurement is checked. If the hash value obtained is not the pre-calculated hash value such as 12345678 one day, it means that the authentication module implementing the AS must have been attacked and tampered with. In terms of the security of the device itself, the authentication module can be directly prohibited from starting and running. If it is an authentication module that is running, its operation is stopped because it is no longer trustworthy.

[0054] It is understandable that in other embodiments, the data of hash calculation can also be dynamic information in the code running process, such as signature information of the certificate, secret key, etc. The above specific trust measurement process based on hash calculation is only an example and is not limited to the hash calculation method.

[0055] In addition, in some embodiments, after the trusted metric module determines two trusted metric values ​​such as hash values ​​based on, for example, static information and dynamic information, respectively, when it is determined that both trusted metric values ​​do not meet preset conditions, such as both hash values ​​are inconsistent with preset values, the authentication module is prohibited from being started or the operation of the authentication module is stopped.

[0056] The solution of this embodiment can more accurately determine whether the authentication module implementing the AS has been attacked and tampered with, so as to accurately control the start and stop of the authentication module, thereby quickly completing the networking of the transmission line WAPI terminal to transmit power monitoring data in real time, and further improving the security of the power monitoring data, for example, avoiding the return of tampered erroneous data to improve the security of the power monitoring data.

[0057] On the basis of the above embodiments, in one embodiment, the identification code includes at least one target component, and each of the target components is a code component in which the component importance weight is greater than the preset weight when the identification code performs the identity authentication function. Exemplarily, the preset weight can be set in advance. The component importance weight represents the importance of the identity authentication-related components when the identification code performs the identity authentication function. Exemplarily, the target components may include but are not limited to kernel code components, code components that generate signatures and / or keys, etc., that is, some key components related to identity authentication.

[0058] The trust metric module is used to determine a trust metric value based on component static information of the at least one target component and component dynamic information during the operation of the at least one target component.

[0059] Exemplarily, in one embodiment, the component static information may include the core code of at least one target component. The component dynamic information may include result information output during the operation of at least one target component, and the result information may include at least signature information such as certificate signature information.

[0060] In one example, the trusted measurement module can perform trusted measurement on component static information and component dynamic information of one or more target components, i.e., key components, such as calculating and determining a trusted measurement value such as a hash value, and determining whether an authentication module implementing the AS has been attacked and tampered with based on a comparison between the trusted measurement value and a preset value, thereby determining whether to start running the authentication module.

[0061] The solution of this embodiment can more accurately determine whether the authentication module implementing the AS has been attacked and tampered with, and at the same time, only the information of the target component, i.e., the key component, such as the signature, is subjected to a trust measurement operation, rather than all components, i.e., the entire code. This can save computing resources to increase the speed of identity authentication, that is, while quickly completing the networking of the transmission line WAPI terminal to transmit the power monitoring data in real time, it can further improve the security of the power monitoring data, for example, avoiding the return of tampered erroneous data to improve the security of the power monitoring data.

[0062] like Figure 3 As shown, the embodiment of the present disclosure provides a transmission line WAPI network terminal trust metric identification method, which can be applied to multiple towers in a transmission line that are arranged one by one. Figure 1 or Figure 2 The networking process of multiple WAPI terminals shown in the figure. The target WAPI terminal includes a wireless communication module and an authentication module, and the authentication module has edge computing capabilities; the target WAPI terminal is any one of the multiple WAPI terminals. The method may include the following steps:

[0063] Step S301: when the multiple WAPI terminals are networked, the authentication module is started to perform the identity authentication function of the WAPI authentication server AS to complete the successful networking of the multiple WAPI terminals;

[0064] Step S302: After the multiple WAPI terminals are successfully networked, the transmission line monitoring data is remotely transmitted to the power management center based on the wireless communication module.

[0065] In one embodiment, the target WAPI terminal also includes a trust metric module; the method may also include: determining a trust metric value of the identification module based on the trust metric module; when the trust metric value meets a preset condition, prohibiting the identification module from being started or stopping the operation of the identification module.

[0066] In one embodiment, the identification module includes an identification chip, and the identification chip includes a built-in identification code; determining the trust measurement value of the identification module based on the trust measurement module includes: obtaining hardware information of the identification chip, static information of the identification code, and dynamic information during code operation; determining the trust measurement value based on one or more of the hardware information, the static information, and the dynamic information.

[0067] In one embodiment, the identification code includes at least one target component, each of the target components is a code component whose component importance weight is greater than a preset weight when the identification code performs the identity authentication function; determining the trust metric value based on the static information and the dynamic information includes: determining the trust metric value based on the component static information of the at least one target component and the component dynamic information during the operation of the at least one target component.

[0068] In one embodiment, the component static information includes the core code of at least one target component; the component dynamic information includes result information output during the operation of at least one target component, and the result information includes at least signature information.

[0069] In one embodiment, the wireless communication module includes a 4G or 5G communication module.

[0070] In one embodiment, the trust metric module is a chip module.

[0071] It should be noted that, although the steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution, etc. In addition, it is also easy to understand that these steps may be, for example, executed synchronously or asynchronously in multiple modules / processes / threads.

[0072] Regarding the method in the above embodiment, the specific manner of executing the operation in each step and the corresponding technical effects brought about have been described in detail in the embodiment of the system, and will not be elaborated here.

[0073] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of a module or unit described above can be further divided into multiple modules or units for concretization. The components displayed as modules or units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. Those of ordinary skill in the art can understand and implement it without paying creative work.

[0074] The embodiments of the present disclosure also provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for authenticating a trusted metric of a power line WAPI network terminal described in any one of the embodiments above is implemented.

[0075] Exemplarily, the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0076] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0077] The present disclosure also provides an electronic device such as a WAPI terminal, including a processor, a wireless communication module, an authentication chip, and a memory, wherein the memory is used to store a computer program. The processor is configured to execute the power line WAPI network terminal trust metric authentication method in any of the above embodiments by executing the computer program.

[0078] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0079] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A transmission line WAPI network terminal trust metric identification system, characterized in that: The system includes a plurality of WAPI terminals arranged one by one on a plurality of iron towers in a transmission line; Among them, the target WAPI terminal includes a wireless communication module and an identification module; the identification module has edge computing capabilities, and is used to execute the identity authentication function of the WAPI authentication server AS when the multiple WAPI terminals are networked, so as to complete the successful networking of the multiple WAPI terminals; the wireless communication module is used to remotely transmit the transmission line monitoring data to the power management center after the multiple WAPI terminals are successfully networked; the target WAPI terminal is any one of the multiple WAPI terminals.

2. The system according to claim 1, characterized in that The target WAPI terminal also includes a trust metric module, which is used to determine the trust metric value of the authentication module, and when the trust metric value meets a preset condition, prohibit starting the authentication module or stop the operation of the authentication module.

3. The system according to claim 2, characterized in that The identification module includes an identification chip, and the identification chip includes a built-in identification code; The trust measurement module is used to obtain the hardware information of the authentication chip, the static information of the authentication code and the dynamic information during the code operation; A trust metric value is determined based on one or more of the hardware information, the static information, and the dynamic information.

4. The system according to claim 3, characterized in that The authentication code includes at least one target component, each of which is a code component whose component importance weight is greater than a preset weight when the authentication code performs the identity authentication function; The trust metric module is used to determine a trust metric value based on component static information of the at least one target component and component dynamic information during the operation of the at least one target component.

5. The system according to claim 4, characterized in that The component static information includes the core code of at least one target component; the component dynamic information includes result information output during the operation of at least one target component, and the result information includes at least signature information.

6. The system according to any one of claims 2 to 5, characterized in that: The wireless communication module includes a 4G or 5G communication module; and / or the trust metric module is a chip module.

7. A method for identifying a trusted metric of a transmission line WAPI network terminal, characterized in that: The invention is applied to the networking process of multiple WAPI terminals which are arranged one by one on multiple towers in a power transmission line; wherein the target WAPI terminal comprises a wireless communication module and an identification module, and the identification module has edge computing capability; the target WAPI terminal is any one of the multiple WAPI terminals; the method comprises: When the multiple WAPI terminals are networked, the authentication module is started to perform an identity authentication function of the WAPI authentication server AS to complete the successful networking of the multiple WAPI terminals; After the multiple WAPI terminals are successfully networked based on the wireless communication module, the transmission line monitoring data is remotely transmitted to the power management center.

8. The method according to claim 7, characterized in that The target WAPI terminal also includes a trusted measurement module; the method also includes: Determining a trustworthiness metric value of the authentication module based on the trustworthiness metric module; When the credibility metric value meets a preset condition, starting the authentication module is prohibited or the operation of the authentication module is stopped.

9. The method according to claim 8, characterized in that The identification module includes an identification chip, and the identification chip includes a built-in identification code; The determining the trustworthiness metric value of the authentication module based on the trustworthiness metric module comprises: Acquire the hardware information of the authentication chip, the static information of the authentication code, and the dynamic information during the code running process; A trust metric value is determined based on one or more of the hardware information, the static information, and the dynamic information.

10. The method according to claim 9, characterized in that The authentication code includes at least one target component, each of which is a code component whose component importance weight is greater than a preset weight when the authentication code performs the identity authentication function; The determining of the trustworthiness metric value based on the static information and the dynamic information includes: A trust metric value is determined based on component static information of the at least one target component and component dynamic information during the operation of the at least one target component.

Images