Equipment access authentication system, method and equipment of power internet of things, and medium

Abstract

The invention discloses an equipment access authentication system, method and equipment of an electric power internet of things, and a medium. The system comprises a cloud management platform and electric power side end equipment, the cloud management platform is used for acquiring an access request corresponding to the power side-end equipment, verifying identity information of the power side-end equipment according to the access request, generating an access token corresponding to the power side-end equipment, and issuing the access token to the power side-end equipment; the power side end equipment is used for acquiring the access token issued by the cloud management platform and communicating with the cloud management platform based on the access token; and the cloud management platform and the power side end equipment communicate by adopting a transport layer security protocol. Based on the technical scheme, the request source is ensured to be correct and not tampered by verifying the legality of the equipment identifier and the signature, and after the identity verification of the edge equipment is successful, the cloud generates the access token and performs verification and regular updating in the subsequent request, so that the dynamic property and effectiveness of access control are ensured.

Description

Technical Field

[0001] The present invention relates to the field of electric power technology, and in particular to a device access authentication system, method, device and medium for electric power Internet of Things. Background Art

[0002] In the power IoT cloud-edge system, edge devices include smart meters, sensors, controllers, etc. These devices need to constantly communicate with the cloud to upload data or receive instructions. Since these edge devices are usually in a distributed, unattended environment, they are easy targets for attackers, leading to security threats such as data theft and device hijacking.

[0003] Traditional perimeter defense models often assume that connections to internal networks are trustworthy, but in real-world environments, this assumption is no longer true. Therefore, traditional perimeter defense models cannot ensure strict verification and control of devices and communications under all circumstances. Summary of the invention

[0004] The present invention provides a device access authentication system, method, device and medium for the power Internet of Things to achieve efficient and secure edge device identity authentication and communication encryption, ensuring the technical issues of security and credibility of the power system in a distributed, dynamic and resource-constrained environment.

[0005] According to one aspect of the present invention, a device access authentication system for the power Internet of Things is provided, the system comprising: a cloud management platform and a power edge device; wherein:

[0006] The cloud management platform is used to obtain an access request corresponding to the power edge device, verify the identity information of the power edge device according to the access request, generate an access token corresponding to the power edge device, and send the access token to the power edge device;

[0007] The power edge device is used to obtain the access token issued by the cloud management platform and communicate with the cloud management platform based on the access token; wherein the cloud management platform and the power edge device communicate using the transport layer security protocol.

[0008] According to another aspect of the present invention, a device access authentication method for a power Internet of Things is provided, the method being applied to a device access authentication system for a power Internet of Things, the system comprising: a cloud management platform and a power edge device; wherein the method comprises:

[0009] Obtaining an access request corresponding to the power edge device through the cloud management platform, verifying the identity information of the power edge device according to the access request, generating an access token corresponding to the power edge device, and sending the access token to the power edge device;

[0010] The access token issued by the cloud management platform is obtained through the power edge device, and communication with the cloud management platform is performed based on the access token; wherein the cloud management platform and the power edge device communicate using the transport layer security protocol.

[0011] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0012] at least one processor; and

[0013] a memory communicatively connected to the at least one processor; wherein,

[0014] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the device access authentication method of the power Internet of Things described in any embodiment of the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the device access authentication method of the power Internet of Things described in any embodiment of the present invention when executed.

[0016] The technical solution of the embodiment of the present invention is to obtain an access request corresponding to the power edge device through the cloud management platform, and verify the identity information of the power edge device according to the access request, and generate an access token corresponding to the power edge device, and send the access token to the power edge device, and then obtain the access token issued by the cloud management platform through the power edge device, and communicate with the cloud management platform based on the access token. Based on the above technical solution, by verifying the legitimacy of the device identifier and signature, it is ensured that the source of the request is correct and has not been tampered with. After the identity authentication of the edge device is successful, the cloud generates an access token and verifies and regularly updates it in subsequent requests, ensuring the dynamic and effectiveness of access control, and realizing efficient and secure edge device identity authentication and communication encryption.

[0017] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 This is a structural diagram of a device access authentication system for the power Internet of Things provided by an embodiment of the present invention;

[0020] Figure 2 It is a flow chart of a device access authentication method of a power Internet of Things provided by an embodiment of the present invention;

[0021] Figure 3 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] Embodiment 1

[0025] Figure 1 This is a structural diagram of a device access authentication system for the power Internet of Things provided by an embodiment of the present invention. Figure 1 As shown, the system includes: a cloud management platform and power edge equipment; wherein,

[0026] The cloud management platform is used to obtain an access request corresponding to the power edge device, verify the identity information of the power edge device based on the access request, generate an access token corresponding to the power edge device, and send the access token to the power edge device; the power edge device is used to obtain the access token sent by the cloud management platform, and communicate with the cloud management platform based on the access token.

[0027] Among them, the cloud management platform can be understood as a cloud platform for unified management of edge power equipment. The power edge equipment can be smart meters, sensors, controllers and other power equipment, which can communicate with the cloud management platform wirelessly or wired. The access request can be understood as a request sent by the edge device when accessing data or uploading data. The identity information can be identity information used to determine the access rights of the edge device, for example, it can be the identity information of the edge device determined based on the unique identifier of the device. The access token can be a credential used to prove the identity of the edge device and authorize access to specific resources. The cloud management platform and the power edge device communicate using the transport layer security protocol.

[0028] Specifically, each edge device needs to register when it first accesses the cloud. During the registration process, the edge device provides a unique device identifier; the cloud generates and distributes digital certificates to each registered edge device, and the edge device and the cloud use the TLS protocol to communicate. During the TLS handshake process, the two parties exchange and verify digital certificates based on device identity authentication: each edge device has a device identifier, and when the cloud receives a request from the edge device, it verifies the legitimacy of the device identifier; the edge device uses a private key to sign the request, and the cloud uses the device's public key to verify the validity of the signature. After the identity authentication is successful, the edge device obtains an access token from the cloud, and the device carries the token in subsequent requests, and the cloud system verifies the validity and authority scope of the token; and within a preset time, the cloud system updates the token, and requests a new token before the token required by the edge device expires.

[0029] Furthermore, the use of two-way TLS authentication includes: the edge device sends a ClientHello message to the cloud, which includes a list of encryption algorithms supported by the edge device, random numbers and related TLS protocol parameters; after receiving the ClientHello message, the cloud sends a ServerHello message to the power edge device, which includes an encryption algorithm, random numbers and TLS parameters determined based on the encryption algorithm list; the cloud sends a digital certificate to the power edge device, and the digital certificate includes a digital certificate chain sent to the edge device, and the certificate chain includes the cloud's certificate and the certificate of its issuing authority; the cloud sends a request to the edge device, requesting the edge device to provide its digital certificate: the cloud lists the type list of edge device certificates, the cloud lists the supported signatures and hash algorithms, and the cloud provides a list of trusted CAs; the cloud sends a message indicating that ServerHello is completed, and the edge device sends a digital certificate chain to the cloud, and the certificate chain includes the edge device's certificate and the certificate of its issuing authority; the edge device and the cloud use the trusted CA root certificate to verify the signature of the other party's certificate and check whether the validity period of the other party's certificate is within the current time; check the revocation status of the other party's certificate through the online certificate status protocol or the certificate revocation list; ensure that all certificates in the certificate chain are valid and have not been tampered with.

[0030] It should be noted that two-way TLS authentication also includes session key generation: the edge device generates a 48-byte pre-master key and encrypts the pre-master key using the cloud public key; the edge device and the cloud use the same pre-master key, edge device random number and cloud random number to calculate the master key, where the master key is calculated using a pseudo-random function, and the input of the pseudo-random number includes the pre-master key, the string master secret and the random number of the edge device and the server, and finally outputs a 48-byte master key; the master key is used to derive the session key for encryption and decryption: the session key material is calculated using a pseudo-random function, and the input of the pseudo-random function includes the master key, the string key expansion and the random number of the edge device and the cloud, and outputs a session key with a predetermined key material length; based on the session key, subsequent communication verification between the edge device and the cloud is implemented.

[0031] Based on the above technical solution, the cloud management platform includes: a power edge device registration module; wherein the power edge device registration module is used to obtain a device identifier corresponding to the power edge device when it is detected that the power edge device is connected to the cloud management platform for the first time, and register the device based on the device identifier.

[0032] Specifically, after detecting the device access, the platform will require the device to provide its unique device identifier. This identifier is usually preset in the device and is used to identify the device during the registration process. Based on the acquired device identifier, the cloud management platform will create a new device entry in its device information database. The device entry contains the device's identifier, registration time, status and other information, and after the device is successfully registered, the cloud management platform will generate and distribute a digital certificate to the device. The certificate will contain information such as the device's public key, identifier, and validity period, which will be used in the subsequent two-way TLS authentication process. It should be noted that during the registration process of the power edge device, the cloud management platform will strictly verify the uniqueness of the device identifier to prevent duplicate registration or impersonation. The entire registration process and subsequent communications between the power edge device and the cloud will be carried out in an encrypted manner to ensure that sensitive information (such as device identifiers, digital certificates, etc.) are not stolen or tampered with during transmission.

[0033] Based on the above technical solution, the cloud management platform includes: a digital certificate generation module; wherein the digital certificate generation module is used to obtain the certificate issuance request sent by the power edge device, and generate a digital certificate corresponding to the power edge device according to the certificate issuance request, and the certificate issuance request includes the edge device public key and the edge device identifier.

[0034] Specifically, after receiving the certificate issuance request, the digital certificate generation module will first verify the information in the request, including checking whether the device identifier is consistent with the registration information and whether the public key is valid. After verifying that the request information is correct, the digital certificate generation module will use the private key in the cloud to sign the certificate issuance request and generate a digital certificate containing the device public key, identifier, validity period and other information. The generated digital certificate will be distributed back to the power edge device through a secure channel (such as TLS encrypted communication). After receiving the certificate, the device will store it in the security hardware module for use in subsequent communication processes. It should be noted that when generating a certificate, the digital certificate generation module will use the private key in the cloud to encrypt and sign the certificate issuance request to prevent the certificate from being tampered with or forged during transmission, and the generated digital certificate will contain the public key and sensitive information of the device, so it must be stored in a secure location. In the cloud management platform, certificates will be stored in an encrypted database to prevent unauthorized access.

[0035] Based on the above technical solution, the digital certificate generation module includes: an identity authentication unit and a certificate generation unit; wherein the identity authentication unit is used to parse the certificate issuance request to determine the edge device identifier, and verify the identity information of the power edge device based on the edge device identifier; the certificate generation unit is used to sign the certificate issuance request with a private key when the identity information verification is passed, generate a digital certificate corresponding to the power edge device, and send the digital certificate to the power edge device; the digital certificate includes the edge device public key, the edge device identifier and the certificate validity period.

[0036] Specifically, the edge device generates a certificate issuance request, which includes a device public key and a device identifier. The device private key is stored in a secure hardware module that can be stored in the power edge device. The edge device sends the certificate issuance request to the cloud certificate management service through a secure channel, and then the cloud certificate management service verifies whether the device identifier in the certificate issuance request matches the information at the time of registration. If it matches, it continues, otherwise the request is rejected. After the identity authentication is passed, the cloud certificate management service uses the private key to sign the certificate issuance request and generates a digital certificate for the device. The digital certificate includes the device's public key, identifier and validity period information, and the issued digital certificate is transmitted back to the edge device through a secure channel. It should be noted that when the power edge device completes registration and sends a certificate issuance request, the digital certificate generation module of the cloud management platform will generate a digital certificate containing information such as the device public key and identifier, and the generated digital certificate will be encrypted and stored in the encrypted database of the cloud management platform. The database system will use a preset encryption algorithm and key to encrypt the certificate data.

[0037] Based on the above technical solution, the power edge device includes: a device fingerprint generation module; wherein the device fingerprint generation module is used to collect characteristic information of the power edge device, and generate a device fingerprint corresponding to the power edge device based on the characteristic information, and upload the device fingerprint to the cloud management platform when accessing the cloud management platform for the first time.

[0038] Among them, the device fingerprint can be understood as a device identifier used to record device information. Different from the MAC address of the device, the device fingerprint is the identification information corresponding to the current power edge device determined based on the characteristic information of the power edge device.

[0039] Specifically, the device fingerprint generation module is responsible for collecting the characteristic information of the power edge equipment and generating a unique device fingerprint based on the characteristic information. When the device is connected to the cloud management platform for the first time, the device fingerprint generation module will upload the generated device fingerprint to the cloud for subsequent identity authentication and security management.

[0040] Based on the above technical solution, the device fingerprint generation module includes: a feature information collection unit and a device fingerprint generation unit; wherein the feature information collection unit is used to collect feature information of the power edge device, wherein the feature information includes hardware features, software features and network behavior features; the device fingerprint generation unit is used to hash the feature information, and weight the hashed feature information to generate a device fingerprint of the power edge device.

[0041] Specifically, hardware features are collected, including CPU serial number, MAC address and hard disk serial number; software features are collected, including operating system version and installed software list; network behavior features are collected, including communication port, communication frequency and data packet features, and then the collected hardware features, software features and network behavior features are hashed, and a weighted merging method is used to generate a preliminary device fingerprint. When weighted merging, the weight corresponding to the hardware feature is higher than the weight of the software feature, and the weight of the software feature is higher than the weight of the network behavior feature. It should be noted that the tolerance range of the communication frequency is set to ±10% for the network behavior feature, and it is allowed to increase or decrease up to two commonly used ports.

[0042] The technical solution of the embodiment of the present invention is to obtain an access request corresponding to the power edge device through the cloud management platform, and verify the identity information of the power edge device according to the access request, and generate an access token corresponding to the power edge device, and send the access token to the power edge device, and then obtain the access token issued by the cloud management platform through the power edge device, and communicate with the cloud management platform based on the access token. Based on the above technical solution, by verifying the legitimacy of the device identifier and signature, it is ensured that the source of the request is correct and has not been tampered with. After the identity authentication of the edge device is successful, the cloud generates an access token and verifies and regularly updates it in subsequent requests, ensuring the dynamic and effectiveness of access control, and realizing efficient and secure edge device identity authentication and communication encryption.

[0043] Embodiment 2

[0044] Figure 2 A flow chart of a device access authentication method for a power Internet of Things provided by an embodiment of the present invention. The method is applied to a device access authentication system for a power Internet of Things, the system comprising: a cloud management platform and a power edge device; the method comprising:

[0045] S210, obtaining an access request corresponding to the power edge device through the cloud management platform, verifying the identity information of the power edge device according to the access request, generating an access token corresponding to the power edge device, and sending the access token to the power edge device;

[0046] S220. Obtain the access token issued by the cloud management platform through the power edge device, and communicate with the cloud management platform based on the access token; wherein the cloud management platform and the power edge device communicate using the transport layer security protocol.

[0047] The device access authentication method of the power Internet of Things proposed in the present invention effectively solves the security and credibility issues in distributed, dynamic and resource-constrained environments. First, in the device registration and certificate distribution stage, each edge device is registered when it first accesses the cloud, and obtains a unique device identifier and digital certificate to ensure the uniqueness and credibility of the device. Then, through two-way TLS authentication, a secure communication channel is established between the edge device and the cloud, and the two parties exchange and verify digital certificates to further ensure the security of communication. Next, based on the device identity authentication mechanism, when the cloud receives the request from the edge device, it verifies the legitimacy of the device identifier and signature to ensure that the source of the request is correct and has not been tampered with. Finally, after the token generation mechanism successfully authenticates the identity of the edge device, the cloud generates an access token and verifies and regularly updates it in subsequent requests to ensure the dynamicity and effectiveness of access control. Through these measures, the present invention realizes efficient and secure edge device identity authentication and communication encryption under the zero-trust framework, and improves the security and credibility of the system in a complex environment.

[0048] It should be noted that device identity-based authentication includes constructing a request message: the edge device constructs a Message containing the request content; hashing the request message Message to generate a message digest Digest; generating a digital signature: loading the device's private key SK from the secure hardware module; using SK to sign the message digest Digest to generate a digital signature Signature; sending a request: combining the request message Message, message digest Digest, and digital signature Signature to form a complete request package, and sending the request package to the cloud via TLS; after the cloud receives the request package from the edge device, it unpacks the request message, message digest, and digital signature Signature to obtain the request message, message digest, and digital signature. Message digest Digest and digital signature Signature; Device identifier verification: Extract the device identifier from the request message, check whether the device identifier is registered in the cloud device information database, and ensure the device is legal; Signature authentication: Load the public key PK of the corresponding device from the cloud information database, hash the received request message Message again, and generate the message digest Digest'; Use the public key PK to verify the digital signature Signature to ensure that the signature is indeed generated by the corresponding device private key and the verification content has not been tampered with; If the signature verification passes, the cloud further processes the request information and executes the requested operation; If the previous verification fails, the request is rejected and the security log is recorded.

[0049] The specific steps of token generation include: Requesting a token after successful authentication: After the edge device verifies its identity through the device identifier and digital certificate, it sends a request to the cloud system to obtain an access token. Token generation: After receiving the token request, the cloud system verifies the legitimacy of the request and the identity information of the device. If the verification is successful, the cloud system generates a unique access token. The token contains the device's identity information, permission scope, and validity period. Token distribution: The cloud system returns the generated access token to the edge device. This process is usually carried out through a secure communication channel (such as TLS) to ensure that the token is not intercepted or tampered with during transmission. Token carrying and use: The edge device carries the access token in each subsequent request. When the cloud system receives the request, it extracts the token from the request and verifies it. Token verification: The cloud system verifies the token as follows: Validity verification: Checks whether the token is within the validity period. Permission verification: Checks whether the permissions contained in the token are consistent with the currently requested operation. Integrity verification: Ensures that the token has not been tampered with. Token update: When the token is about to expire, the edge device sends a request to the cloud system to update the token. After verifying the device identity and the legitimacy of the original token, the cloud system generates and distributes a new token.

[0050] The technical solution of the embodiment of the present invention is to obtain an access request corresponding to the power edge device through the cloud management platform, and verify the identity information of the power edge device according to the access request, and generate an access token corresponding to the power edge device, and send the access token to the power edge device, and then obtain the access token issued by the cloud management platform through the power edge device, and communicate with the cloud management platform based on the access token. Based on the above technical solution, by verifying the legitimacy of the device identifier and signature, it is ensured that the source of the request is correct and has not been tampered with. After the identity authentication of the edge device is successful, the cloud generates an access token and verifies and regularly updates it in subsequent requests, ensuring the dynamic and effectiveness of access control, and realizing efficient and secure edge device identity authentication and communication encryption.

[0051] Embodiment 3

[0052] Figure 3 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0053] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0054] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0055] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the device access authentication method of the power Internet of Things.

[0056] In some embodiments, the device access authentication method of the electric power Internet of Things may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the device access authentication method of the electric power Internet of Things described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the device access authentication method of the electric power Internet of Things in any other appropriate manner (e.g., by means of firmware).

[0057] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0058] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0059] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0060] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0061] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0062] The computing system may include a power edge device and a server. The power edge device and the server are generally remote from each other and usually interact through a communication network. The relationship between the power edge device and the server is generated by computer programs running on corresponding computers and having a power edge device-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0063] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0064] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A device access authentication system for power Internet of Things, characterized in that: The system includes: a cloud management platform and power edge equipment; wherein, The cloud management platform is used to obtain an access request corresponding to the power edge device, verify the identity information of the power edge device according to the access request, generate an access token corresponding to the power edge device, and send the access token to the power edge device; The power edge device is used to obtain the access token issued by the cloud management platform and communicate with the cloud management platform based on the access token; wherein the cloud management platform and the power edge device communicate using the transport layer security protocol.

2. The system according to claim 1, characterized in that The cloud management platform includes: a power edge device registration module; wherein, The power edge device registration module is used to obtain a device identifier corresponding to the power edge device when it is detected that the power edge device is connected to the cloud management platform for the first time, and to register the device based on the device identifier.

3. The system according to claim 1, characterized in that The cloud management platform includes: a digital certificate generation module; wherein, The digital certificate generation module is used to obtain the certificate issuance request sent by the power edge device, and generate a digital certificate corresponding to the power edge device according to the certificate issuance request, wherein the certificate issuance request includes the edge device public key and the edge device identifier.

4. The system according to claim 3, characterized in that The digital certificate generation module includes: an identity authentication unit and a certificate generation unit; wherein, The identity authentication unit is used to parse the certificate issuance request to determine the edge device identifier, and verify the identity information of the power edge device based on the edge device identifier; The certificate generation unit is used to sign the certificate issuance request with a private key when the identity information verification is passed, generate a digital certificate corresponding to the power edge device, and send the digital certificate to the power edge device; the digital certificate includes the edge device public key, the edge device identifier and the certificate validity period.

5. The system according to claim 1, characterized in that The power edge device includes: a device fingerprint generation module; wherein, The device fingerprint generation module is used to collect characteristic information of the power edge device, and generate a device fingerprint corresponding to the power edge device based on the characteristic information, and upload the device fingerprint to the cloud management platform when accessing the cloud management platform for the first time.

6. The system according to claim 5, characterized in that The device fingerprint generation module includes: a feature information collection unit and a device fingerprint generation unit; wherein, The characteristic information collection unit is used to collect characteristic information of the power edge device, wherein the characteristic information includes hardware characteristics, software characteristics and network behavior characteristics; The device fingerprint generation unit is used to perform hash processing on the feature information and weight the hashed feature information to generate a device fingerprint of the power edge device.

7. The system according to claim 6, characterized in that The weight corresponding to the hardware feature is higher than the weight of the software feature, and the weight of the software feature is higher than the weight of the network behavior feature.

8. A device access authentication method for power Internet of Things, characterized in that: The method is applied to a device access authentication system of the power Internet of Things, the system comprising: a cloud management platform and a power edge device; wherein the method comprises: Obtaining an access request corresponding to the power edge device through the cloud management platform, verifying the identity information of the power edge device according to the access request, generating an access token corresponding to the power edge device, and sending the access token to the power edge device; The access token issued by the cloud management platform is obtained through the power edge device, and communication with the cloud management platform is performed based on the access token; wherein the cloud management platform and the power edge device communicate using the transport layer security protocol.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the device access authentication method of the electric power Internet of Things described in claim 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the device access authentication method of the power Internet of Things described in claim 8 when executed.

Images