Secure interaction method for cloud side end of power distribution Internet of Things

Abstract

The invention relates to the technical field of cloud side end security, in particular to a power distribution Internet of Things cloud side end security interaction method, which comprises the following steps of: through a device list of a power distribution Internet of Things cloud side end interaction environment, allocating an identification code to each device, carrying out encryption identification on device information, and associating device hardware information with the identification code; and generating an identity recognition record. According to the invention, by distributing the unique identification code for each device and performing encryption identification, the accuracy and security of device identification are significantly improved, and by synchronously updating the communication protocol and setting special encryption and access control rules for different device types, the security requirements of various devices can be effectively adapted, the flexibility and security performance are improved, and the security of the devices is improved. The effectiveness of the interactive verification rule is simulated to enhance the reliability of the strategy, the instant detection and processing of abnormal behaviors are enhanced, the response speed and efficiency are effectively optimized, and the overall operation efficiency and reliability of the power grid are improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud-edge security technology, and in particular to a secure interaction method between a cloud and an edge of a power distribution Internet of Things. Background Art

[0002] The field of cloud-edge security technology involves the research and application of security strategies and technologies in cloud computing and edge computing environments. The core purpose is to protect data stored in the cloud and processed on edge devices from unauthorized access and various network attacks. Cloud computing provides powerful data processing capabilities and resource sharing functions, while edge computing distributes data processing tasks to the edge of the network and processes data from IoT devices at close range, which can reduce latency and improve response speed. In the architecture, ensuring the security of data during transmission and processing requires complex encryption technology, authentication protocols, and data integrity and privacy protection measures.

[0003] Among them, the secure interaction method of the cloud-edge terminal of the power distribution IoT refers to the use of IoT technology in power distribution, and the combination of cloud computing and edge computing to ensure the secure transmission and efficient processing of data. The main purpose is to improve the operating efficiency and reliability of the power grid, while ensuring the security of user and operation data, and preventing data leakage and network attacks. By realizing secure interaction between the cloud, edge and terminal, it is possible to effectively manage and control the allocation of power resources and optimize energy consumption while monitoring the power grid status in real time.

[0004] Although existing cloud-edge security technologies excel in processing power and resource sharing, they are deficient in real-time data processing and immediate security response. Data processing in a cloud computing environment will affect response speed and efficiency due to network latency. Although edge computing can process data at the edge of the network to reduce latency, it lacks a complete set of security strategies to face complex and ever-changing security threats. For example, the handling of unauthorized access and data leakage incidents relies on traditional security protocols, which are not flexible enough or sufficient to deal with advanced persistent threats (APTs) in emerging IoT scenarios. Security measures in existing technologies cannot effectively distinguish and handle security challenges brought by different types of devices, resulting in over-protection of devices while ignoring their security needs, uneven resource allocation, and incomplete security protection. The consequences of these deficiencies include slow processing of security incidents, insufficient response to new attack methods, and inefficient security management in a high-density device environment. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and propose a secure interaction method between the cloud and the edge of the power distribution Internet of Things.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a secure interaction method between a power distribution Internet of Things cloud and an edge terminal, comprising the following steps:

[0007] S1: Through the equipment list of the cloud-edge-end interactive environment of the power distribution Internet of Things, an identification code is assigned to each device, the device information is encrypted and identified, and the device hardware information is associated with the identification code to generate an identity record;

[0008] S2: Based on the identity recognition record, configure the communication key for the power distribution IoT device, synchronously update the device communication protocol, match the device target requirements, and generate a communication protocol adjustment plan;

[0009] S3: adopt the communication protocol adjustment scheme, set encryption and access control rules for differentiated power distribution IoT device types, verify the validity of the rules through simulated interaction, and generate device communication security policies;

[0010] S4: Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored and tracked in real time, the communication behaviors of the power distribution IoT devices are automatically recorded and analyzed, and abnormal behaviors are identified to build a real-time monitoring model;

[0011] S5: According to the real-time monitoring model, an automatic response mechanism is set to handle abnormal communications, including blocking and warning, and the response effect is recorded to optimize the response speed and efficiency, forming an emergency response mechanism;

[0012] S6: Extract key security events from the data collected by the emergency response mechanism, analyze the security events, evaluate the overall security of the distribution Internet of Things cloud edge, and obtain security assessment results.

[0013] As a further solution of the present invention, the identity identification record includes the device type, encryption identifier and identification code, the communication protocol adjustment plan includes key distribution, protocol update content and device requirement matching information, the device communication security policy includes encryption rules, access control lists and simulation interaction results, the real-time monitoring model includes communication behavior logs, abnormal behavior identification and monitoring trigger conditions, the emergency response mechanism includes automatic blocking rules, warning signals and effect records, and the security assessment results include event analysis results, security ratings and optimization plans.

[0014] As a further solution of the present invention, through the device list of the cloud-edge-end interactive environment of the power distribution Internet of Things, an identification code is assigned to each device, the device information is encrypted and identified, and the device hardware information is associated with the identification code. The steps of generating an identity recognition record are specifically as follows:

[0015] S101: Based on the equipment list of the power distribution IoT cloud-edge-end interactive environment, record the model and specification of each equipment, assign an identification code to each equipment, and generate an identification code assignment record by checking the equipment list item by item;

[0016] S102: Encrypting the hardware information and identification code of the power distribution Internet of Things device according to the identification code allocation record, inputting the device hardware information and identification code as key parameters for encryption, checking the security of data during transmission and storage, and performing data integrity verification to generate an encrypted device identifier;

[0017] S103: The encryption device identifier is associated with the hardware information of the device for storage, the matching degree between the encryption identifier and the hardware information is checked, the consistency of the association is verified, the data is stored in a classified manner, and an identity recognition record is generated.

[0018] As a further solution of the present invention, based on the identity recognition record, the communication key is configured for the power distribution Internet of Things device, the device communication protocol is synchronously updated, the device target requirements are matched, and the steps of generating a communication protocol adjustment plan are specifically as follows:

[0019] S201: Based on the identity recognition record, identify the target requirements and security levels of the power distribution Internet of Things device, configure communication keys according to the requirements, match the security requirements of differentiated devices, and generate a device key configuration table;

[0020] S202: Using the device key configuration table, synchronously updating the communication protocol of the power distribution Internet of Things device, adjusting the protocol parameters to match the functions and security standards of the device, adjusting the transmission rate and encryption level, checking the security and efficiency of the communication, and generating a communication protocol update record;

[0021] S203: According to the communication protocol update record, verify and optimize the adjusted protocol, check the practicality and security of the protocol and the consistency with the target requirements of the device, and generate a communication protocol adjustment plan.

[0022] As a further solution of the present invention, the communication protocol adjustment solution is adopted to set encryption and access control rules for differentiated power distribution IoT device types, and the validity of the rules is verified by simulating interactions. The specific steps of generating device communication security policies are as follows:

[0023] S301: adopt the communication protocol adjustment scheme, use symmetric encryption technology, formulate encryption rules for differentiated types of power distribution IoT devices, configure encryption settings according to the functions and security requirements of the devices, select encryption levels and key lengths, and generate a device encryption rule table;

[0024] S302: Based on the device encryption rule table, access control rules are set for each device type, including access control rules for users and devices, and the security of communication is optimized by specifying access rights and conditions, and an access control policy table is generated;

[0025] S303: Perform a simulated interaction test using the access control policy table to verify the validity of the set encryption and access control rules by simulating various network attacks and communication behaviors under normal use, and generate a device communication security policy.

[0026] As a further solution of the present invention, the formula of the symmetric encryption technology is as follows:

[0027]

[0028] Among them, C is the encrypted text, E is the encryption function, k is the encryption key, M is the original message, α is the time sensitivity coefficient, t is the timestamp, β is the sequence number sensitivity coefficient, s is the message sequence number, γ is the load balancing coefficient, and l is the load amount.

[0029] As a further solution of the present invention, based on the device communication security strategy, the communication activities of the power distribution Internet of Things devices are monitored and tracked in real time, the communication behaviors of the power distribution Internet of Things devices are automatically recorded and analyzed, and abnormal behaviors are identified. The steps of building a real-time monitoring model are specifically as follows:

[0030] S401: Based on the device communication security policy, the communication activities of the power distribution Internet of Things devices are monitored in real time, and the communication frequency and data volume threshold are recorded by setting monitoring parameters, and the transmission data is captured to check the coverage of the communication of the cloud-edge devices of the power distribution Internet of Things, and generate a communication activity monitoring record;

[0031] S402: using the communication activity monitoring record, automatically recording and analyzing the communication behavior of the devices in the cloud-edge-end interactive environment of the power distribution Internet of Things, including data packets, transmission rates, and target addresses, and identifying behaviors that deviate from the norm by comparing the collected data with normal behavior patterns, and generating communication behavior analysis results;

[0032] S403: According to the communication behavior analysis results, evaluate and identify abnormal behaviors in communication, analyze potential risks of abnormal behaviors according to preset abnormal behavior indicators, adjust monitoring parameters, optimize abnormal behavior detection efficiency, and build a real-time monitoring model.

[0033] As a further solution of the present invention, according to the real-time monitoring model, an automatic response mechanism is set to handle abnormal communications, including blocking and warning, and recording the response effect to optimize the response speed and efficiency. The steps of forming an emergency response mechanism are specifically as follows:

[0034] S501: Based on the real-time monitoring model, automatically respond, set rules to automatically block communications identified as abnormal and issue security warnings, verify that communication behavior triggers preset conditions according to differentiated blocking conditions and warning levels, and execute responses to generate automatic blocking and warning signals;

[0035] S502: Using the automatic blocking and warning signals, record the information of each response in real time, including the response time, associated equipment and processing results, and generate a response effect record table by timestamping and classifying the response events;

[0036] S503: According to the response effect record table, the speed and efficiency of the response mechanism are evaluated and optimized, and the response strategy is adjusted to avoid false alarms and missed alarms by analyzing the response time data and success rate, so as to generate an emergency response mechanism.

[0037] As a further solution of the present invention, the steps of extracting key security events from the data collected by the emergency response mechanism, analyzing the security events, and evaluating the overall security of the cloud-edge terminal of the power distribution Internet of Things to obtain the security assessment results are specifically as follows:

[0038] S601: Collect response data from the emergency response mechanism, screen according to the severity level and frequency of the event, extract key security events, including unauthorized access and potential data leakage events, and generate key security event records;

[0039] S602: Analyze the security events using data mining technology using the key security event records, including event sources, impact scope, and potential consequences, and identify abnormal patterns and potential security vulnerabilities by comparing security event data with security performance data, thereby generating security event analysis results;

[0040] S603: Based on the security incident analysis results, evaluate the overall security of the distribution Internet of Things cloud edge, refer to the situation of key security incidents and the effectiveness of response measures taken, calculate security performance indicators and design optimization measures, match real-time changing security challenges, and generate security assessment results.

[0041] As a further solution of the present invention, the formula of the data mining technology is as follows:

[0042]

[0043] Among them, R z Score the security risk, w z is the weight of each security event feature, x z is the corresponding security event characteristic value, s z is the number of times the event occurs, t z is the time interval between the event and the last occurrence, nz is the number of security events z.

[0044] Compared with the prior art, the advantages and positive effects of the present invention are:

[0045] In the present invention, a series of security interaction measures are implemented in the cloud-edge environment of the power distribution Internet of Things, including assigning a unique identification code to each device and encrypting the identification, which significantly improves the accuracy and security of device identification. The encrypted identification ensures the privacy protection and security of the device hardware information in the cloud and edge computing process, preventing potential unauthorized access and data leakage. By synchronously updating the communication protocol and setting special encryption and access control rules for different device types, it can effectively adapt to the security needs of various devices and improve flexibility and security performance. The effectiveness of the simulated interaction verification rules not only enhances the reliability of the strategy, but also strengthens the immediate detection and processing of abnormal behaviors through real-time monitoring and automatic response mechanisms. The comprehensive monitoring and response mechanism effectively optimizes the response speed and efficiency, and improves the overall operation efficiency and reliability of the power grid. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the main steps of the present invention;

[0047] Figure 2 It is a schematic diagram of the refinement of S1 of the present invention;

[0048] Figure 3 It is a schematic diagram of the refinement of S2 of the present invention;

[0049] Figure 4 It is a schematic diagram of the refinement of S3 of the present invention;

[0050] Figure 5 It is a schematic diagram of the refinement of S4 of the present invention;

[0051] Figure 6 It is a detailed schematic diagram of S5 of the present invention;

[0052] Figure 7 It is a detailed schematic diagram of S6 of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0054] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0055] See also Figure 1 The present invention provides a technical solution, a secure interaction method for a power distribution Internet of Things cloud-edge terminal, comprising the following steps:

[0056] S1: Through the equipment list of the cloud-edge-end interactive environment of the power distribution Internet of Things, an identification code is assigned to each device, the device information is encrypted and identified, and the device hardware information is associated with the identification code to generate an identity record;

[0057] S2: Based on the identity recognition records, configure the communication key for the power distribution IoT device, synchronously update the device communication protocol, match the device target requirements, optimize the security of data transmission through key management, and generate the communication protocol adjustment plan;

[0058] S3: Adopt the communication protocol adjustment scheme, set encryption and access control rules for differentiated distribution IoT device types, specify access rights and conditions to optimize communication security, verify the validity of the rules through simulated interactions, and generate device communication security policies;

[0059] S4: Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored and tracked in real time, the communication behaviors of the power distribution IoT devices are automatically recorded and analyzed, and abnormal behaviors are identified to build a real-time monitoring model;

[0060] S5: According to the real-time monitoring model, an automatic response mechanism is set to handle abnormal communications, timestamp response events and classify their effects, and record response effects to optimize response speed and efficiency, thus forming an emergency response mechanism;

[0061] S6: Extract key security events from the data collected by the emergency response mechanism, analyze the security events, identify abnormal patterns and potential security vulnerabilities, evaluate the overall security of the distribution IoT cloud-edge, and obtain security assessment results.

[0062] Identity identification records include device type, encryption identifier and identification code; communication protocol adjustment plans include key distribution, protocol update content and device requirement matching information; device communication security policies include encryption rules, access control lists and simulated interaction results; real-time monitoring models include communication behavior logs, abnormal behavior identification and monitoring trigger conditions; emergency response mechanisms include automatic blocking rules, warning signals and effect records; security assessment results include event analysis results, security ratings and optimization plans.

[0063] See also Figure 2 , through the device list of the power distribution IoT cloud-edge interactive environment, an identification code is assigned to each device, the device information is encrypted and identified, and the device hardware information is associated with the identification code. The specific steps for generating an identity record are:

[0064] S101: Based on the equipment list of the cloud-edge-end interactive environment of the power distribution Internet of Things, record the model and specification of each equipment, assign an identification code to each equipment, and generate an identification code assignment record by checking the equipment list item by item. The execution process is as follows;

[0065] Based on the equipment list of the cloud-edge-end interactive environment of the power distribution Internet of Things, including the model and specifications of the equipment, to ensure the integrity and accuracy of the information, a unique identification code will be assigned to each device, which will serve as the identity mark of the device. To ensure the uniqueness and consistency of the identification code, each identification code will be strictly verified before allocation. After the identification code is assigned, the entire list is checked in detail to confirm that the information of each device matches the identification code correctly. To ensure the efficiency of equipment management and the accuracy of subsequent operations, a solid foundation is provided for the tracking, maintenance and management of equipment, and the identification code allocation record is generated using the formula:

[0066]

[0067] Among them, R a Stands for identification code allocation record, ID ia is the identification code of the ath device, M ia For the model, S ia is the specification, n a is the total number of devices, hash represents the hash function, and concat represents the string concatenation function.

[0068] S102: According to the identification code allocation record, encrypt the hardware information and identification code of the power distribution Internet of Things device, input the device hardware information and identification code as key parameters for encryption, check the security of data in transmission and storage, and perform data integrity verification. The execution process of generating an encrypted device identification is as follows;

[0069] According to the identification code allocation record, the hardware information and identification code of the power distribution IoT device are encrypted, and advanced encryption technology is used to ensure the secure transmission and storage of device information inside and outside. Through a specially designed encryption algorithm, the hardware information and identification code of the device are input, and the encrypted device identification is output. The encryption process not only improves the security of the data, but also protects the device from the risk of unauthorized access. After the encryption is completed, a series of data integrity verifications will be carried out to ensure that the data has not been tampered with during the encryption process. The verification process includes the inspection and comparison of the encryption results to ensure the accuracy and reliability of each step of the operation, and generate the encrypted device identification. The formula used is:

[0070]

[0071] Among them, E b Represents the encryption device identifier, H ib The hardware information of the ath device, ID ib is the device identification code, n a is the total number of devices, and encrypt represents the encryption function.

[0072] S103: storing and associating the encrypted device identification with the hardware information of the device, checking the matching degree between the encrypted identification and the hardware information, verifying the consistency of the association, classifying and storing the data, and generating the identity recognition record. The execution process is as follows;

[0073] The encrypted device identification is stored and associated with the hardware information of the device, and the encryption identification is checked to see if it is consistent with the hardware information of the corresponding device. Through the matching function, each encryption identification is ensured to match the correct hardware information. The accuracy of the association operation is crucial to ensure data security and the effectiveness of device management. After the matching verification is completed, the relevant information is classified and stored for quick retrieval and access, aiming to enhance the confidentiality of data, improve the efficiency of device management, and generate identity records. The formula used is:

[0074]

[0075] Among them, M c E stands for identity record. jc is the encryption identifier of the ath device, H jc is the corresponding hardware information, n a is the total number of devices, verify represents the verification function, and decrypt represents the decryption function.

[0076] See also Figure 3 ,Based on the identity recognition record, configure the communication key for the power distribution IoT device, synchronously update the device communication protocol, match the device target requirements, and generate the communication protocol adjustment plan. The specific steps are:

[0077] S201: Based on the identity recognition record, identify the target requirements and security levels of the power distribution IoT device, configure the communication key according to the requirements, match the security requirements of the differentiated devices, and generate the device key configuration table. The execution process is as follows;

[0078] Based on the identity recognition records, the target requirements and security levels of each power distribution IoT device are identified. By analyzing the functional requirements and security sensitivity of the device, a suitable communication key will be configured for each device according to the device requirements to ensure that the key can meet the security requirements of the device and match the operating characteristics. This includes selecting the appropriate encryption algorithm and key length to prevent unauthorized access and data leakage. After the configuration is completed, the device key configuration table is generated, using the formula:

[0079]

[0080] Among them, K d Indicates the device key configuration table, N id is the demand of the ath device, L id is the security level, n a is the total number of devices, and encrypt represents the encryption function.

[0081] S202: Use the device key configuration table to synchronously update the communication protocol of the power distribution Internet of Things device, adjust the protocol parameters to match the function and security standards of the device, and adjust the transmission rate and encryption level to check the security and efficiency of the communication. The execution process of generating the communication protocol update record is as follows;

[0082] Use the device key configuration table to synchronously update the communication protocol of the power distribution IoT device to ensure that the communication protocol of each device matches the functional and security standards. This includes adjusting protocol parameters such as transmission rate and encryption level to optimize communication efficiency and security. Through adjustment, it can ensure that communication remains efficient and secure while meeting operational requirements. After completing the protocol update, generate a communication protocol update record using the formula:

[0083]

[0084] Among them, U f Indicates the communication protocol update record, P jf is the protocol parameter of the ath device, S jf is the safety standard, n a is the total number of devices, and adjust represents the adjustment function.

[0085] S203: According to the communication protocol update record, the adjusted protocol is verified and optimized, the practicality and security of the protocol are checked for consistency with the device target requirements, and the execution process of generating the communication protocol adjustment plan is as follows;

[0086] Further verification and optimization are carried out according to the communication protocol update records to ensure that the practicality and security of each communication protocol are fully consistent with the target requirements of the device. The performance and security characteristics of the protocol are carefully checked to evaluate whether they meet the predetermined standards and requirements. If any problems that need further adjustment are found during the verification process, the problems are optimized to form a communication protocol adjustment plan, using the formula:

[0087]

[0088] Among them, V g Indicates the communication protocol adjustment scheme, C kg is the adjusted protocol for the ath device, Q kg is the target demand, n a is the total number of devices, and verify represents the verification function.

[0089] See also Figure 4 ,Adopt the communication protocol adjustment scheme, set encryption and access control rules for differentiated power distribution IoT device types, verify the validity of the rules through simulated interaction, and generate the device communication security strategy in the following steps:

[0090] S301: Adopt the communication protocol adjustment scheme, use symmetric encryption technology, formulate encryption rules for differentiated types of power distribution IoT devices, configure encryption settings according to the functions and security requirements of the devices, and select encryption levels and key lengths. The execution process of generating a device encryption rule table is as follows;

[0091] The communication protocol adjustment scheme is adopted, combined with symmetric encryption technology, to formulate targeted encryption rules for different types of devices in the power distribution Internet of Things, and the appropriate encryption settings will be configured in detail according to the functions and security requirements of each device. This includes selecting the appropriate encryption level and key length to ensure that the encryption measures can meet the security requirements and adapt to the operating performance of the device, and generate a device encryption rule table.

[0092] The formula for symmetric encryption technology is as follows:

[0093]

[0094] Among them, C is the encrypted text, E is the encryption function, k is the encryption key, M is the original message, α is the time sensitivity coefficient, t is the timestamp, β is the sequence number sensitivity coefficient, s is the message sequence number, γ is the load balancing coefficient, and l is the load amount.

[0095] The execution flow is as follows:

[0096] Perform standard symmetric encryption on the message M using the key k to obtain the basic encrypted text, calculate the weighted factor, and use the timestamp t and message sequence number s to provide an additional level of security. The time sensitivity coefficient α and the sequence number sensitivity coefficient β adjust the influence of the parameters. The load l and the load balancing coefficient γ jointly determine how to balance the security requirements and performance at different times and in different sequences. The weighted factor is integrated into the basic encryption result through multiplication operations to improve security while maintaining operational flexibility, generate the encrypted text C, and improve the complexity and security of the encryption process to ensure efficiency and security during data transmission.

[0097] S302: Based on the device encryption rule table, access control rules are set for each device type, including access control rules for users and devices, and the security of communication is optimized by specifying access rights and conditions. The execution process of generating the access control policy table is as follows;

[0098] Based on the device encryption rule table, set access control rules for each device type, including defining the devices that users can access and under what conditions. By accurately specifying access rights and conditions, optimize the security of the communication process, prevent unauthorized access and data leakage, and generate an access control policy table using the formula:

[0099]

[0100] Among them, A k represents the access control policy table, T jk is the ath device type, P jk For access rights and conditions, n a is the total number of device types, and access represents the access control configuration function.

[0101] S303: Perform a simulated interaction test using the access control policy table to verify the validity of the set encryption and access control rules by simulating various network attacks and communication behaviors under normal use, and generate the execution process of the device communication security policy as follows;

[0102] Use the access control policy table to conduct simulated interaction tests, verify the effectiveness of encryption and access control rules, simulate various network attacks and communication behaviors under normal use, and detect the security and responsiveness of the device in actual operation. Through testing, you can evaluate and optimize the existing encryption and access control settings to ensure that they can effectively resist potential security threats and form a device communication security strategy. The formula used is:

[0103]

[0104] Among them, C l Represents the device communication security policy, V klis the verification result of the dth test scenario, B kl For the behavior simulation based on access control policy, l is the total number of test scenarios, and test represents the test function.

[0105] See also Figure 5 Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored and tracked in real time, the communication behaviors of the power distribution IoT devices are automatically recorded and analyzed, and abnormal behaviors are identified. The specific steps for building a real-time monitoring model are as follows:

[0106] S401: Based on the device communication security policy, the communication activities of the power distribution IoT devices are monitored in real time. By setting monitoring parameters, recording the communication frequency and data volume threshold, and capturing the transmission data, the coverage of the communication of the cloud-edge devices of the power distribution IoT is checked, and the execution process of generating the communication activity monitoring record is as follows;

[0107] Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored in real time. By setting detailed monitoring parameters, the communication frequency and data volume threshold of each device can be recorded in real time, and the data in transmission can be captured. Monitoring activities help ensure that all device communications are carried out within the preset security parameters, protecting the entire network from unauthorized access and potential threats, and generating communication activity monitoring records. The formula used is:

[0108]

[0109] Among them, M m Indicates communication activity monitoring records, F im is the communication frequency of the ath device, D im is the data volume threshold, n a is the total number of devices, and monitor represents the monitoring function.

[0110] S402: Using the communication activity monitoring records, automatically record and analyze the communication behaviors of the devices in the cloud-edge-end interactive environment of the power distribution Internet of Things, including data packets, transmission rates, and target addresses. By comparing the collected data with normal behavior patterns, identify behaviors that deviate from the norm, and generate communication behavior analysis results, the execution process is as follows;

[0111] By using communication activity monitoring records, the communication behaviors of devices in the cloud-edge-end interactive environment of the power distribution Internet of Things are automatically recorded and analyzed, including detailed records of the transmission rate and destination address of data packets. By comparing the collected data with normal behavior patterns, behaviors that deviate from the norm can be identified. Deviations are precursors to network security threats. Through in-depth analysis, the communication behavior analysis results are generated, using the formula:

[0112]

[0113] Among them, A o represents the communication behavior analysis result, P jo is the data packet information of the ath device, R jo is the transmission rate, n a is the total number of devices, and analyze represents the analysis function.

[0114] S403: According to the communication behavior analysis results, evaluate and identify abnormal behaviors in communication, analyze the potential risks of abnormal behaviors according to preset abnormal behavior indicators, and adjust monitoring parameters to optimize the detection efficiency of abnormal behaviors. The execution process of building a real-time monitoring model is as follows;

[0115] According to the communication behavior analysis results, abnormal behaviors in communication are evaluated and identified. By applying the preset abnormal behavior indicators, any potential risks can be accurately analyzed, and monitoring parameters can be adjusted according to the risks to optimize the detection efficiency of abnormal behaviors. It not only enhances the security of the network, but also improves the response speed to potential threats. A real-time monitoring model is constructed, and the formula used is:

[0116]

[0117] Among them, C p represents the real-time monitoring model, X kp is the abnormal behavior indicator of the a-th device, Y kp is the potential risk, n a is the total number of devices, and evaluate represents the evaluation function.

[0118] See also Figure 6 , according to the real-time monitoring model, set up an automatic response mechanism to handle abnormal communications, including blocking and warning, and record the response effect to optimize the response speed and efficiency. The specific steps to form an emergency response mechanism are:

[0119] S501: Based on the real-time monitoring model, automatically respond, set rules to automatically block communications identified as abnormal and issue security warnings, verify that the communication behavior triggers the preset conditions according to the differentiated blocking conditions and warning levels, and execute the response to generate the automatic blocking and warning signal execution process as follows;

[0120] Based on the real-time monitoring model, automatic response is performed and a series of rules are set to automatically block communications identified as abnormal and issue security warnings. The rules are set differently according to different blocking conditions and warning levels to ensure that the corresponding response measures can be immediately executed when the communication behavior triggers the preset conditions. Enhance network security defense capabilities, quickly reduce or prevent the spread of security threats, and generate automatic blocking and warning signals through automated measures. The formula used is:

[0121]

[0122] Among them, B q Indicates automatic blocking and warning signal, C iq is the communication behavior triggered by the ath device, L iq is the preset warning level, n a is the total number of devices, and block represents the blocking function.

[0123] S502: Using automatic blocking and warning signals, the information of each response is recorded in real time, including the response time, associated equipment and processing results. By timestamping the response events and classifying the effects, the execution flow of generating a response effect record table is as follows;

[0124] Utilize automatic blocking and warning signals to record detailed information of each response in real time, including response time, associated devices, and processing results. Each response event is assigned a timestamp and classified according to the processing effect. This helps to deeply analyze the effect of the response strategy, ensure that all security incidents are properly handled, and generate a response effect record table using the formula:

[0125]

[0126] Among them, R s Represents the response effect record table, T js is the response time of the sth event, D js For associated devices, P js is the processing result, m s is the total number of events, and record represents the recording function.

[0127] S503: According to the response effect record table, the speed and efficiency of the response mechanism are evaluated and optimized. By analyzing the response time data and success rate, the response strategy is adjusted to avoid false alarms and missed alarms. The execution process of the emergency response mechanism is generated as follows;

[0128] According to the response effect record table, evaluate and optimize the speed and efficiency of the response mechanism. By analyzing the response time data and success rate, identify the deficiencies in the existing response strategy, such as false positives and missed negatives. It helps to adjust the response strategy and improve accuracy and efficiency. By continuously optimizing the response mechanism, ensure that you can respond quickly and accurately when facing security threats, and generate an emergency response mechanism.

[0129] See also Figure 7 , extract key security events from the data collected by the emergency response mechanism, analyze the security events, and evaluate the overall security of the cloud-edge terminal of the power distribution Internet of Things. The specific steps to obtain the security assessment results are as follows:

[0130] S601: Collect response data from the emergency response mechanism, filter according to the severity level and frequency of the incident, extract key security incidents, including unauthorized access and potential data leakage incidents, and generate the key security incident record. The execution process is as follows;

[0131] Collect response data from the emergency response mechanism, collect and screen response data, and perform detailed screening based on the severity level and frequency of each event to extract key security events, with special attention to unauthorized access and potential data leakage events. Key events represent high-risk or high-impact security threats and require special attention. Through the screening method, list all identified high-priority security events in detail to provide a data basis for further analysis and response, and generate key security event records. The formula used is:

[0132]

[0133] Among them, R u Indicates key security event records, G iu is the severity level of the sth event, F iu is the frequency of the event, m s is the total number of events, and filter represents the filtering function.

[0134] S602: Using key security event records and data mining technology, analyze security events, including event sources, impact scope, and potential consequences. By comparing security event data with security performance data, identify abnormal patterns and potential security vulnerabilities, and generate security event analysis results, the execution process is as follows;

[0135] Using key security event records, data mining technology is used to conduct in-depth analysis of security events, including detailed analysis of event sources, impact scope, and potential consequences. By comparing security event data with known security performance data, abnormal patterns and potential security vulnerabilities can be identified. This helps to understand the background and causes of security events, better design preventive measures, and generate security event analysis results.

[0136] The formula for data mining technique is as follows:

[0137]

[0138] Among them, R z Score the security risk, w z is the weight of each security event feature, x z is the corresponding security event characteristic value, s z is the number of times the event occurs, t z is the time interval between the event and the last occurrence, n z is the number of security events z.

[0139] The execution flow is as follows:

[0140] Each security event feature value x z With weight w z Multiply by the number of times the event occurs s z , consider the frequency of the event, divided by the time interval t since the last occurrence of the event z Add one to prevent the divisor from being zero. The weight coefficient can be determined through statistical analysis or expert evaluation. The influence of each feature is determined based on historical data and industry standards. All calculation results are accumulated to obtain the total security risk score R z , by combining the frequency of events, the accuracy and practicality of risk scoring can be improved, ensuring the effective assessment and management of security threats.

[0141] S603: Based on the security incident analysis results, the overall security of the power distribution IoT cloud-edge is evaluated. Referring to the situation of key security incidents and the effects of the response measures that have been taken, the security performance indicators are calculated and the design optimization measures are designed to match the real-time changing security challenges. The execution process of generating security assessment results is as follows;

[0142] According to the results of security incident analysis, the overall security of the power distribution IoT cloud-edge terminal is evaluated. By referring to the situation of key security incidents and the effects of the response measures taken, the security performance indicators are calculated, and optimization measures are designed to respond to real-time changing security challenges. The process involves quantitative analysis of the effectiveness of current security measures, and adjusting and optimizing security policies based on the analysis results. Guide future security decisions and policy adjustments, ensure that security performance keeps pace with security requirements, and generate security assessment results. The formula used is:

[0143]

[0144] Among them, E w represents the safety assessment result, Q kw is the safety performance index of the sth event, M kw is the effect of the response measures, m s is the total number of events, and evaluate represents the evaluation function.

[0145] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A secure interaction method for a power distribution Internet of Things cloud-edge terminal, characterized in that: The following steps are involved: Through the equipment list of the cloud-edge-end interactive environment of the power distribution Internet of Things, an identification code is assigned to each device, the device information is encrypted and identified, and the device hardware information is associated with the identification code to generate an identity record; Based on the identity recognition record, configure the communication key for the power distribution IoT device, synchronously update the device communication protocol, match the device target requirements, and generate a communication protocol adjustment plan; The communication protocol adjustment scheme is adopted to set encryption and access control rules for differentiated power distribution IoT device types, and the validity of the rules is verified by simulating interactions to generate device communication security policies; Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored and tracked in real time, the communication behaviors of the power distribution IoT devices are automatically recorded and analyzed, and abnormal behaviors are identified to build a real-time monitoring model; According to the real-time monitoring model, an automatic response mechanism is set to handle abnormal communications, including blocking and warning, and the response effect is recorded to optimize the response speed and efficiency, forming an emergency response mechanism; Key security events are extracted from the data collected by the emergency response mechanism, the security events are analyzed, the overall security of the distribution Internet of Things cloud edge is evaluated, and the security assessment results are obtained.

2. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: The identity identification record includes the device type, encryption identifier and identification code; the communication protocol adjustment plan includes key distribution, protocol update content and device requirement matching information; the device communication security policy includes encryption rules, access control lists and simulated interaction results; the real-time monitoring model includes communication behavior logs, abnormal behavior identification and monitoring trigger conditions; the emergency response mechanism includes automatic blocking rules, warning signals and effect records; the security assessment results include event analysis results, security ratings and optimization plans.

3. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: Through the equipment list of the cloud-edge-end interactive environment of the power distribution Internet of Things, an identification code is assigned to each device, the device information is encrypted and identified, and the device hardware information is associated with the identification code. The specific steps for generating an identity record are as follows: Based on the equipment list of the cloud-edge-end interactive environment of the power distribution IoT, record the model and specifications of each device, assign an identification code to each device, and generate an identification code allocation record by checking the equipment list item by item; According to the identification code allocation record, encrypt the hardware information and identification code of the power distribution Internet of Things device, input the device hardware information and identification code as key parameters for encryption, check the security of data in transmission and storage, perform data integrity verification, and generate an encrypted device identification; The encrypted device identification is stored and associated with the hardware information of the device, the matching degree between the encrypted identification and the hardware information is checked, the consistency of the association is verified, the data is classified and stored, and an identity recognition record is generated.

4. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: Based on the identity recognition record, the communication key is configured for the power distribution IoT device, the device communication protocol is synchronously updated, the device target requirements are matched, and the steps of generating a communication protocol adjustment plan are as follows: Based on the identity recognition record, identify the target requirements and security levels of the power distribution IoT device, configure communication keys according to the requirements, match the security requirements of differentiated devices, and generate a device key configuration table; Using the device key configuration table, synchronously update the communication protocol of the power distribution Internet of Things device, adjust the protocol parameters to match the functions and security standards of the device, adjust the transmission rate and encryption level, check the security and efficiency of the communication, and generate a communication protocol update record; According to the communication protocol update record, the adjusted protocol is verified and optimized, the practicality and security of the protocol are checked for consistency with the target requirements of the equipment, and a communication protocol adjustment plan is generated.

5. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: By adopting the communication protocol adjustment scheme, encryption and access control rules are set for differentiated power distribution IoT device types, and the effectiveness of the rules is verified by simulating interactions. The specific steps of generating device communication security policies are as follows: Adopting the communication protocol adjustment scheme, using symmetric encryption technology, formulating encryption rules for differentiated types of power distribution IoT devices, configuring encryption settings according to the functions and security requirements of the devices, and selecting encryption levels and key lengths to generate a device encryption rule table; Based on the device encryption rule table, access control rules are set for each device type, including access control rules for users and devices, and the security of communication is optimized by specifying access rights and conditions to generate an access control policy table; The access control policy table is used to perform simulated interaction testing, and the effectiveness of the set encryption and access control rules is verified by simulating communication behaviors under various network attacks and normal use, so as to generate a device communication security policy.

6. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 5 is characterized in that: The formula of the symmetric encryption technique is as follows: Among them, C is the encrypted text, E is the encryption function, k is the encryption key, M is the original message, α is the time sensitivity coefficient, t is the timestamp, β is the sequence number sensitivity coefficient, s is the message sequence number, γ is the load balancing coefficient, and l is the load amount.

7. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored and tracked in real time, the communication behaviors of the power distribution IoT devices are automatically recorded and analyzed, and abnormal behaviors are identified. The specific steps for building a real-time monitoring model are as follows: Based on the device communication security strategy, the communication activities of the power distribution IoT devices are monitored in real time. By setting monitoring parameters, recording the communication frequency and data volume threshold, and capturing transmission data, the coverage of the communication of the cloud-edge devices of the power distribution IoT is checked, and the communication activity monitoring records are generated; Using the communication activity monitoring records, the communication behaviors of devices in the cloud-edge-end interactive environment of the power distribution Internet of Things are automatically recorded and analyzed, including data packets, transmission rates, and target addresses. By comparing the collected data with normal behavior patterns, behaviors that deviate from the norm are identified, and communication behavior analysis results are generated; According to the communication behavior analysis results, abnormal behavior in communication is evaluated and identified, and according to preset abnormal behavior indicators, the potential risks of abnormal behavior are analyzed, and monitoring parameters are adjusted to optimize the detection efficiency of abnormal behavior and build a real-time monitoring model.

8. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: According to the real-time monitoring model, an automatic response mechanism is set to handle abnormal communications, including blocking and warning, and the response effect is recorded to optimize the response speed and efficiency. The steps of forming an emergency response mechanism are as follows: Based on the real-time monitoring model, automatic response is performed, rules are set to automatically block communications identified as abnormal and issue security warnings, and according to differentiated blocking conditions and warning levels, responses are executed when communication behaviors trigger preset conditions, generating automatic blocking and warning signals; Using the automatic blocking and warning signals, the information of each response is recorded in real time, including the response time, associated equipment and processing results, and a response effect record table is generated by timestamping the response events and classifying the effects; According to the response effect record table, the speed and efficiency of the response mechanism are evaluated and optimized, and by analyzing the response time data and success rate, the response strategy is adjusted to avoid false alarms and missed alarms, and an emergency response mechanism is generated.

9. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 1 is characterized in that: The steps of extracting key security events from the data collected by the emergency response mechanism, analyzing the security events, and evaluating the overall security of the cloud-edge terminal of the power distribution Internet of Things to obtain the security assessment results are as follows: Collect response data from the emergency response mechanism, screen according to the severity level and frequency of the incident, extract key security incidents, including unauthorized access and potential data leakage incidents, and generate key security incident records; Utilizing the key security event records, using data mining technology, to analyze security events, including event sources, impact scope, and potential consequences, and by comparing security event data with security performance data, identifying abnormal patterns and potential security vulnerabilities, and generating security event analysis results; Based on the results of the security incident analysis, the overall security of the distribution Internet of Things cloud edge is evaluated. Referring to the situation of key security incidents and the effectiveness of the response measures taken, the security performance indicators are calculated and the design optimization measures are designed to match the real-time changing security challenges and generate security assessment results.

10. The secure interaction method of the power distribution Internet of Things cloud-edge terminal according to claim 9 is characterized in that: The formula of the data mining technique is as follows: Among them, R z Score the security risk, w z is the weight of each security event feature, x z is the corresponding security event characteristic value, s z is the number of times the event occurs, t z is the time interval between the event and the last occurrence, n z is the number of security events z.

Images