Power software and hardware equipment fingerprint management method and system

Abstract

The invention discloses an electric power software and hardware equipment fingerprint management method and system, and belongs to the field of power grid security, and the method comprises the steps: obtaining the state data of electric power software and hardware equipment; comparing the state data of the electric power software and hardware equipment in the latest time period with the state data of the equipment fingerprint generated in the previous stage to obtain equipment fingerprint updating judgment; obtaining the state data of the electric power software and hardware equipment in the latest time period and the state data of the electric power software and hardware equipment in the previous life cycle, and carrying out equipment fingerprint destruction judgment; generating an updating or destroying instruction; carrying out equipment fingerprint updating based on the updating instruction; and based on the destroying instruction, encrypting the destroying instruction by adopting a packet encryption destroying mode, generating a target data ciphertext, encrypting and overwriting for multiple times, and then destroying the key immediately to realize data destroying. By timely finding equipment problems and maintaining the equipment, the maintenance cost and the failure rate are reduced, the service life of the equipment is prolonged, and the utilization rate and the economic benefit of the equipment are improved.

Description

Technical Field

[0001] The present invention relates to the field of power grid security, and in particular to a fingerprint management method and system for power software and hardware equipment. Background Art

[0002] With the continuous development of intelligent power grid systems, more and more power hardware and software devices are being introduced into them, including sensors, metering equipment, communication equipment, etc. For these devices, it is of great significance to adopt device fingerprint management methods, which can ensure that each device has unique fingerprint information and realize the unique identification and recognition of the device. By establishing a device fingerprint database and management system, these devices can be fully managed. This management method can improve the equipment management efficiency and operation reliability of smart grids.

[0003] The power software and hardware equipment in the smart grid faces various security threats and attack risks. Facing the overall life cycle of the equipment in the smart grid, many current management systems only focus on specific stages of the equipment and lack a holistic management and monitoring mechanism. Summary of the invention

[0004] The present invention provides a power software and hardware device fingerprint management method and system, which are used to solve the problem that there is no unified device fingerprint management method in the related art.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: In a first aspect, the present invention provides a method for fingerprint management of power software and hardware equipment, comprising: Obtain status data of power software and hardware equipment; The status data of the power software and hardware equipment in the latest period is compared with the status data of the device fingerprint generated in the previous stage to obtain the device fingerprint update judgment result; The status data of the power software and hardware equipment in the latest period is compared with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result; Generate an update or destruction instruction based on the device fingerprint update judgment result and the device fingerprint destruction judgment result; Update the device fingerprint based on the update instruction; Alternatively, based on the destruction instruction, it is encrypted using a block encryption destruction mode to generate a target data ciphertext, which is encrypted and overwritten multiple times, after which the key is immediately destroyed to achieve data destruction.

[0006] As a further improvement of the method of the present invention, the state data of the power software and hardware equipment is obtained as follows: The device data is obtained by integrating the method of actively sending messages to obtain device information and passively obtaining device information through probes.

[0007] As a further improvement of the method of the present invention, the device fingerprint update judgment result obtained by comparing the status data of the power software and hardware equipment based on the latest period with the status data of the device fingerprint generated in the previous stage includes: Combined with the characteristic parameters screened out in the process of device fingerprint generation, the approximate ideal solution sorting TOPSIS algorithm is adopted to integrate the multi-domain search VDS algorithm and the characteristic vector distance algorithm to determine the similarity analysis between the newly extracted device status information and the previously generated device fingerprint information, and obtain the final analysis result. Based on the final analysis result, it is determined whether the device fingerprint needs to be updated.

[0008] As a further improvement of the method of the present invention, the status data of the power software and hardware equipment based on the latest time period is compared with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result, and the Gaussian mixture model GMM is used to determine whether the status data of the power software and hardware equipment in the latest time period is an abnormal value.

[0009] As a further improvement of the method of the present invention, the device fingerprint update is performed based on the update instruction, including online and offline updates; Devices connected to the internal network use the device offline update method; Devices connected to the external network use the device online update method.

[0010] As a further improvement of the method of the present invention, after updating the device fingerprint based on the update instruction, the method further includes: The internal and external network data is securely transferred to achieve data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline. The cross-internal and external network data transfer uses triggers to capture changes in the source database and record them in the change data table. The data is exported to a file through a scheduled task, and then the target database is updated after being transferred to the target end.

[0011] As a further improvement of the method of the present invention, the data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline by using the secure transfer of internal and external network data includes: Capture changes through triggers and record data in a change table; export data in the change table to a data file; the trigger uses a keyword that temporarily resides in the database memory; The data files are transferred to the message middleware in sequence; the data files are read from the message middleware in sequence; and the data files are written to the target database through the program across the security isolation network gate to achieve real-time data synchronization.

[0012] As a further improvement of the method of the present invention, the updating of the device fingerprint based on the update instruction includes: Receive the collected device status information, verify the format of the device status information, and encode the obtained device status information; Different methods are used to update data with different characteristics, including: For feature data of numerical type, the data is first standardized; the standardized data is weighted according to the feature weight; the optimal and worst solutions of this item are determined according to different feature items; then the Euclidean distance between the data vector and the optimal solution and the worst solution is calculated, and the proximity index is calculated through the Euclidean distance as the final sorting parameter; For non-digital data, encoding processing is required. The encoding processing principle is that the best solution encoding digital value is high, and the worst solution encoding digital value is low, so as to achieve evaluation calculation; Calculate the distance between the current device state vector and the state vector used to generate the device fingerprint in the previous time period based on a weighted distance algorithm; Obtain the evaluation data value, evaluate the result and compare it with the threshold value, and determine whether the new device fingerprint needs to be updated according to the new device status; Finally, upload the judgment results.

[0013] In a second aspect, the present invention provides a fingerprint management system for power software and hardware equipment, comprising: Equipment status monitoring module, used to obtain status data of power software and hardware equipment; The fingerprint update decision module is used to compare the status data of the power software and hardware equipment in the latest period with the status data of the equipment fingerprint generated in the previous stage to obtain the equipment fingerprint update judgment result; The fingerprint destruction decision module is used to compare the status data of the power software and hardware equipment in the latest period with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result; An administrator supervision module, used to generate an update or destruction instruction based on the device fingerprint update judgment result and the device fingerprint destruction judgment result; A fingerprint update execution module, used to update the device fingerprint based on the update instruction; The fingerprint destruction module is used to encrypt the target data based on the destruction instruction in a group encryption destruction mode, generate the target data ciphertext, and encrypt and overwrite it multiple times, after which the key is immediately destroyed to achieve data destruction.

[0014] As a further improvement of the system of the present invention, in the device status monitoring module, the status data of the power software and hardware equipment is obtained by: The device status monitoring module obtains device data by integrating the method of actively sending messages to obtain device information and passively obtaining device information through probes.

[0015] As a further improvement of the system of the present invention, in the fingerprint update decision module, The status data of the power software and hardware equipment in the latest period is compared with the status data of the device fingerprint generated in the previous stage to obtain the device fingerprint update judgment results including: Combined with the characteristic parameters screened out in the process of device fingerprint generation, the approximate ideal solution sorting TOPSIS algorithm is adopted to integrate the multi-domain search VDS algorithm and the characteristic vector distance algorithm to determine the similarity analysis between the newly extracted device status information and the previously generated device fingerprint information, and obtain the final analysis result. Based on the final analysis result, it is determined whether the device fingerprint needs to be updated.

[0016] As a further improvement of the system of the present invention, in the fingerprint destruction decision module, the status data of the power software and hardware equipment in the latest period is compared with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result, and the Gaussian mixture model GMM is used to determine whether the status data of the power software and hardware equipment in the latest period is an abnormal value.

[0017] As a further improvement of the system of the present invention, the device fingerprint is updated based on the update instruction, including online and offline updates; Devices connected to the internal network use the device offline update method; Devices connected to the external network use the device online update method.

[0018] As a further improvement of the system of the present invention, the fingerprint update execution module adopts secure ferrying of intranet and extranet data to realize data synchronization between the internal database and the external cloud database after the device fingerprint is updated online and offline; cross-internet and extranet data ferrying uses triggers to capture changes in the source database and record them in the change data table, and exports the data to a file through a scheduled task, and updates the target database after transmitting it to the target end.

[0019] As a further improvement of the system of the present invention, the data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline by using the secure transfer of internal and external network data includes: Capture changes through triggers and record data in a change table; export data in the change table to a data file; the trigger uses a keyword that temporarily resides in the database memory; The data files are transferred to the message middleware in sequence; the data files are read from the message middleware in sequence; and the data files are written to the target database through the program across the security isolation network gate to achieve real-time data synchronization.

[0020] As a further improvement of the system of the present invention, the fingerprint update execution module specifically includes: Receive the collected device status information, verify the format of the device status information, and encode the obtained device status information according to the algorithm requirements; Different methods are used to update data with different characteristics, including: For numerical feature data, the data is first standardized; then the standardized data is weighted according to the feature weight; the optimal and worst solutions of each feature item are determined according to different feature items; then the Euclidean distance between the data vector and the optimal solution and the worst solution is calculated, and the proximity index is calculated through the Euclidean distance as the final sorting parameter; For non-digital data, encoding processing is required. The encoding processing principle is that the best solution encoding digital value is high, and the worst solution encoding digital value is low, so as to achieve evaluation calculation; Calculate the distance between the current device state vector and the state vector used to generate the device fingerprint in the previous time period based on a weighted distance algorithm; Obtain the evaluation data value, evaluate the result and compare it with the threshold value, and determine whether the new device fingerprint needs to be updated according to the new device status; Finally, upload the judgment results.

[0021] In a third aspect, the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the power software and hardware device fingerprint management method when executing the computer program.

[0022] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the power software and hardware device fingerprint management method is implemented.

[0023] In a fifth aspect, the present invention provides a computer program product, which includes computer instructions, characterized in that the computer instructions instruct a computer to execute the power software and hardware equipment fingerprint management method.

[0024] The beneficial effects of the present invention compared with the prior art are as follows: The present invention ensures the uniqueness and accuracy of device fingerprints and strengthens the security of device identification through fingerprint generation and dynamic update. It realizes real-time monitoring and management of device status, provides decision support for administrators, optimizes management processes, and improves management efficiency. By timely discovering equipment problems and performing maintenance, it reduces maintenance costs and failure rates, extends the service life of equipment, and improves equipment utilization and economic benefits. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the embodiments of the present invention or the drawings of related technical solutions in the prior art are introduced below. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 It is a relationship topology diagram between various modules of the present invention.

[0027] Figure 2 This is a topological diagram of the relationship between the storage and transmission of intranet and extranet data in the present invention.

[0028] Figure 3 This is a flow chart of device fingerprint management of the present invention.

[0029] Figure 4 This is a flow chart of the device fingerprint update judgment process of the present invention.

[0030] Figure 5 This is the process of securely transferring fingerprint data between the internal and external networks of the device of the present invention.

[0031] Figure 6 A schematic diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0032] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limitations of the present invention. For the step numbers in the following embodiments, they are only provided for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0033] In the description of the present invention, unless otherwise clearly defined, terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in the present invention based on the specific content of the technical solution.

[0034] Terminology explanation: VDS algorithm, VariableDepth Search, multi-field search algorithm; TOPSIS (Technique for Order Preference by Similarity to Ideal Solution), which is a method of sorting ideal solutions or a method of distance between good and bad solutions; Gaussian Mixture Model (GMM) is a probability model based on statistics, which is used to represent a data set composed of multiple Gaussian distributions (normal distributions). Its core idea is to assume that the data is generated by a mixture of multiple different Gaussian distributions.

[0035] The present invention provides a method to monitor and manage fingerprints throughout the life cycle of a device. To address these challenges, the device fingerprint management method can provide additional security and protection measures. The device fingerprint update mechanism can adapt to changes in the device state to better match the actual state of the device. In addition, the update mechanism can also avoid the leakage of device fingerprints and is more secure.

[0036] One aspect of the present invention provides a fingerprint management method for power-based software and hardware equipment, comprising: Obtain status data of power software and hardware equipment; The status data of the power software and hardware equipment in the latest period is compared with the status data of the device fingerprint generated in the previous stage to obtain the device fingerprint update judgment result; The status data of the power software and hardware equipment in the latest period is compared with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result; Generate an update or destruction instruction based on the device fingerprint update judgment result and the device fingerprint destruction judgment result; Update the device fingerprint based on the update instruction; Alternatively, based on the destruction instruction, it is encrypted using a block encryption destruction mode to generate a target data ciphertext, which is encrypted and overwritten multiple times, after which the key is immediately destroyed to achieve data destruction.

[0037] Furthermore, the VDS algorithm integrates the TOPSIS algorithm and the feature vector distance algorithm to determine whether the newly extracted device status information is significantly different from the information previously generated for the device fingerprint.

[0038] Furthermore, by combining the characteristic parameters screened out in the process of generating device fingerprints, using the TOPSIS-VD algorithm analysis method and vector distance similarity analysis, these parameters are comprehensively considered to obtain the final analysis results, which are then compared with the preset thresholds to determine whether the device fingerprint needs to be updated.

[0039] After receiving the device status information, the fingerprint destruction decision module uses the Gaussian mixture model GMM to determine whether the newly extracted device status information is an abnormal value, and passes the judgment result to the administrator supervision module.

[0040] After the administrator supervision module receives the judgment of the destruction decision module and the update decision module, the administrator issues the destruction and update commands through manual confirmation; in addition, the administrator supervision module can issue destruction or update commands based on manual judgment. Before issuing the command, the update and destruction operations decided by the administrator will be passed to the decision module for repeated analysis to provide decision reference for the administrator.

[0041] Fingerprint update execution module Since the storage methods of device information are divided into internal network offline storage and external online cloud storage, the update of device fingerprints uses two methods: offline update and online update.

[0042] Furthermore, online update is to update the device fingerprint directly in the cloud database; offline update is achieved through the following steps: first, the device fingerprint is updated in the intranet offline database, and then the offline database and the cloud database are synchronized through the Kafka distributed messaging system, database synchronization mechanism and network gate data transmission.

[0043] The fingerprint destruction module uses the group encryption destruction mode to encrypt the data to be destroyed and generate the target data ciphertext. The key generation process is strongly coupled with the hardware parameters of the target host to ensure that the key generation is associated with the specific hardware parameters of the target host. Multiple overwrite operations are then performed to complete the secure destruction of the data.

[0044] The present invention has the following advantages: Through fingerprint generation and dynamic update, the uniqueness and accuracy of device fingerprints are ensured, and the security of device identification is enhanced. Real-time monitoring and management of device status are achieved, providing decision support for administrators, optimizing management processes, and improving management efficiency. By timely discovering equipment problems and performing maintenance, maintenance costs and failure rates are reduced, equipment service life is extended, and equipment utilization and economic benefits are improved.

[0045] Figure 1 This is a topological diagram of the relationship between the modules of the fingerprint management method of the present invention. Figure 1 As shown, the present invention provides a fingerprint management system for power software and hardware equipment, including: Equipment status monitoring module, used to obtain status data of power software and hardware equipment; The fingerprint update decision module is used to compare the status data of the power software and hardware equipment in the latest period with the status data of the equipment fingerprint generated in the previous stage to obtain the equipment fingerprint update judgment result; The fingerprint destruction decision module is used to compare the status data of the power software and hardware equipment in the latest period with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result; An administrator supervision module, used to generate an update or destruction instruction based on the device fingerprint update judgment result and the device fingerprint destruction judgment result; A fingerprint update execution module, used to update the device fingerprint based on the update instruction; The fingerprint destruction module is used to encrypt the target data based on the destruction instruction in a group encryption destruction mode, generate the target data ciphertext, and encrypt and overwrite it multiple times, after which the key is immediately destroyed to achieve data destruction.

[0046] Among them, the equipment status monitoring module monitors and obtains the equipment status information of the power hardware and software equipment, including all parameters for generating equipment fingerprints. The equipment status monitoring module transmits the monitored equipment status information data to the fingerprint update decision module and the fingerprint destruction decision module. After receiving the new equipment status information, the fingerprint update decision module uses the TOPSIS_VDS algorithm to determine whether the status of the equipment has changed significantly, and transmits the judgment result to the administrator supervision module.

[0047] The working process of each module specifically includes the following steps: Step 101: The device status monitoring module obtains status data of power software and hardware devices.

[0048] Preferably, the device status monitoring module obtains the device data by integrating the methods of actively sending messages to obtain device information and passively obtaining device information through probes; and then sends the obtained data to the fingerprint update and destruction decision modules respectively.

[0049] Step 102, the fingerprint update decision module obtains the device status data of the latest period, and obtains the fingerprint update judgment after performing an algorithm comparison with the status data of the device fingerprint generated in the previous stage, and then transmits the judgment result to the administrator supervision module.

[0050] Preferably, the state comparison algorithm adopts TOPSIS_VDS algorithm.

[0051] Step 103, the fingerprint destruction decision module obtains the device status data of the latest period, and determines whether the current device status is abnormal and whether the device fingerprint needs to be destroyed through the data of the previous life cycle of the device learned by the model, and then passes the judgment result to the administrator supervision module.

[0052] Preferably, a Gaussian mixture model (GMM) is used to learn the device status data and determine whether it is abnormal.

[0053] Step 104, the administrator supervision module receives the judgment transmitted by the fingerprint destruction and update decision module, and the administrator makes a judgment and approval based on the status of the device, and then securely transmits the final update or destruction instruction to the fingerprint destruction or update module.

[0054] Preferably, the administrator supervision module can independently propose updates to a single piece of device information or suggestions for destroying a device, and can choose to submit it to the decision-making module for algorithmic decision-making again.

[0055] Step 105: The fingerprint update execution module implements online and offline updates of the device fingerprint respectively.

[0056] Preferably, since the networking modes of power equipment are divided into connecting to an internal network and connecting to an external network, the equipment connected to the internal network needs to adopt an equipment offline update method; the equipment connected to the external network needs to adopt an equipment online update method.

[0057] Preferably, data synchronization between the internal database and the external cloud database is achieved after the device fingerprint is updated online or offline by using secure data transfer between the internal and external networks.

[0058] Step 106, the fingerprint destruction execution module encrypts it using a group encryption destruction mode to generate a target data ciphertext, and encrypts and overwrites it multiple times. After completing this operation, the key is immediately destroyed to achieve data destruction.

[0059] Preferably, the key generation method is strongly coupled with the hardware parameters of the target host, and the extracted parameters include but are not limited to: product ID, CPU serial number, OS version, etc. The extracted parameters are serially represented as a serial number SeqNum, and SeqNum is used as data, and the SM3 cryptographic hashing algorithm is used to perform hashing operations multiple times, and a number of bits are extracted from it as the key for data encryption.

[0060] SM3 is a commercial cryptographic hash algorithm standard. It is a cryptographic hash function, also known as a hash function. The SM3 algorithm is mainly used for digital signatures and verification, message authentication code generation and verification, and random number generation, providing a secure and effective hash algorithm for commercial cryptographic applications.

[0061] Figure 2 It is a specific manifestation of internal and external network storage in the fingerprint management method of the present invention.

[0062] Preferably, the network architecture is divided into an internal network and an external network. The equipment monitoring center monitors the equipment in the internal and external networks respectively. The algorithm module is stored in an external cloud platform. The monitored equipment information is transmitted to the cloud platform for analysis. The external core database is updated and destroyed synchronously with the internal database.

[0063] Figure 4 This is a flow chart of the device fingerprint update judgment process of the present invention.

[0064] Step 401, receiving the collected device status information, verifying the format of the device status information, and encoding the obtained device status information according to algorithm requirements.

[0065] Step 402: using corresponding TOPSIS analysis algorithms for data with different characteristics.

[0066] Preferably, for feature data of numerical type, the data is first standardized; then the standardized data is weighted according to the feature weight; the optimal and worst solutions of this item are determined according to different feature items; then the Euclidean distance between the data vector and the optimal solution and the worst solution is calculated, and the proximity index is calculated through the Euclidean distance as the final sorting parameter.

[0067] Preferably, the Euclidean distance is calculated as follows:

[0068] in, is the i-th eigenvector to be evaluated, is the optimal solution vector, is the worst solution vector.

[0069] The distance calculation formula for the optimal solution is:

[0070] The distance calculation formula for the optimal solution is:

[0071] Preferably, the proximity indicator method is:

[0072] Preferably, similarly, non-digital data needs to be encoded, and the encoding processing principle is that the best solution encoding digital value is high, and the worst solution encoding digital value is low, thereby realizing evaluation calculation.

[0073] Step 403: Calculate the distance between the current device state vector and the state vector used to generate the device fingerprint in the previous time period based on a weighted distance algorithm.

[0074] Preferably, the distance vector refers to an n-dimensional vector, which is used to represent the distance between two different pieces of data of the same device. The formula is: , where n is the number of features finally screened by the device.

[0075] If the i-th feature of two records is the same, ,but is 0, otherwise is 1.

[0076] Preferably, the feature weight vector is also an n-dimensional vector, which is used to reflect the weight value of each feature. The weight calculation is based on the above mentioned Normalized representation. The formula is: , where n is the number of features finally screened by the device, is the feature weight of the ith feature.

[0077] Preferably, the proximity index is as follows: The distance vector of two different data of a certain device is , the feature weight vector is , then the weighted distance calculation formula for these two data is:

[0078] in, It is the inner product operation of vectors.

[0079] Preferably, the similarity calculation formula is:

[0080] in, Indicates the weighted distance between two pieces of data x and y of the device. is a constant used to control the range and degree of variation of similarity. By adjusting the value of α, we can control the sensitivity and stability of similarity to meet different needs.

[0081] Step 404, obtain the evaluation data values ​​calculated by the above two algorithms, compare the evaluation results with the threshold, and determine whether the new device fingerprint needs to be updated according to the new device status.

[0082] Step 405, finally upload the decision result to the administrator module.

[0083] Figure 5 This is the process of securely transferring fingerprint data between the internal and external networks of the device of the present invention.

[0084] Preferably, the core of data ferrying across internal and external networks is to use triggers to capture changes in the source database and record them in the change data table. Through scheduled tasks, the data is exported to SQL files, and after being transmitted to the target end, the target end database is updated to achieve the purpose of data synchronization.

[0085] Preferably, the principle of the trigger is: use the keywords of the database temporarily residing in memory: NEW and OLD. NEW is used to store a copy of all rows affected by INSERT and UPDATE operations; OLD is used to store a copy of rows affected by DELETE and UPDATE operations; a. When performing an INSERT operation, the newly created record is added to the trigger table and NEW at the same time; b. When a DELETE operation is executed, the record is deleted from the table where the trigger is located and transferred to OLD; c. When the UDPATE operation is executed, the old records are moved to OLD and the new records are added to NEW and the table where the trigger is located.

[0086] Preferably, the changes are captured by triggers and the data is recorded in a change table; the SQL file generation module exports the data in the change table to a data file at regular intervals.

[0087] Then, preferably, the text is transmitted to the message middleware in sequence; the SQL text is read from the message middleware in strict sequence; and the SQL text is written into the target database through a program across the security isolation firewall to achieve real-time data synchronization.

[0088] The GMM Gaussian mixture model learns each characteristic parameter of the equipment characteristics, and continuously fits the data of the equipment's life cycle through a Gaussian function to confirm whether the new equipment status is abnormal data.

[0089] Dynamic fingerprint generation and management: This patent application involves a method for dynamically generating and managing fingerprints of power hardware and software devices, which can update device fingerprints in real time to reflect changes in device status. This innovation is to achieve the dynamic and accurate fingerprint of the device, which helps to improve the accuracy and practicality of power equipment identification.

[0090] Offline fingerprint ferry technology: The patent application may include an offline fingerprint ferry technology, which can ensure the integrity and security of the device's fingerprint data even when the device cannot be connected online. The innovation of this technology is to ensure the persistence and reliability of fingerprint data, which helps to cope with data synchronization needs in unstable or disconnected network conditions.

[0091] Intelligent Administrator Decision Support System: This patent application may describe an intelligent administrator decision support system that provides intelligent management suggestions and decision support based on device fingerprint data and real-time status information. The innovation of this function is to use device fingerprint data to provide administrators with accurate and timely decision-making basis.

[0092] Security and privacy protection mechanism: The patent application may include a security and privacy protection mechanism to ensure the secure storage, transmission and use of device fingerprint data. This innovation lies in the use of advanced encryption and access control technology to ensure the confidentiality and integrity of device fingerprint data and effectively prevent data leakage and unauthorized access.

[0093] Efficient fingerprint update and destruction mechanism: It can timely update expired device fingerprints and safely destroy fingerprint data of abandoned devices. This innovation improves the timeliness and reliability of device fingerprint data and reduces the impact of expired and invalid data on the system.

[0094] like Figure 6 As shown, the third purpose of the embodiment of the present invention is to provide an electronic device, including a memory 701, a processor 702, and a computer program stored in the memory 701 and executable on the processor, wherein the processor implements the power software and hardware device fingerprint management method when executing the computer program. It also includes a communication interface 703 and a bus 704.

[0095] A fourth objective of an embodiment of the present invention is to provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the power software and hardware device fingerprint management method is implemented.

[0096] A fifth objective of an embodiment of the present invention is to provide a computer program product, the computer program product comprising computer instructions, wherein the computer instructions instruct a computer to execute the power software and hardware equipment fingerprint management method.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] The present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, readable storage media, optical storage, etc.) containing computer-usable program codes.

[0100] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0101] Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A fingerprint management method for power software and hardware equipment, characterized in that: include: Obtain status data of power software and hardware equipment; The status data of the power software and hardware equipment in the latest period is compared with the status data of the device fingerprint generated in the previous stage to obtain the device fingerprint update judgment result; The status data of the power software and hardware equipment in the latest period is compared with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result; Generate an update or destruction instruction based on the device fingerprint update judgment result and the device fingerprint destruction judgment result; Update the device fingerprint based on the update instruction; Alternatively, based on the destruction instruction, it is encrypted using a block encryption destruction mode to generate a target data ciphertext, which is encrypted and overwritten multiple times, after which the key is immediately destroyed to achieve data destruction.

2. The power software and hardware equipment fingerprint management method according to claim 1 is characterized in that: The state data of the power hardware and software equipment is obtained as follows: The device data is obtained by integrating the method of actively sending messages to obtain device information and passively obtaining device information through probes.

3. The power software and hardware equipment fingerprint management method according to claim 1 is characterized in that: The device fingerprint update judgment result obtained by comparing the status data of the power software and hardware equipment based on the latest period with the status data of the device fingerprint generated in the previous stage includes: Combined with the characteristic parameters screened out in the process of device fingerprint generation, the approximate ideal solution sorting TOPSIS algorithm is adopted to integrate the multi-domain search VDS algorithm and the characteristic vector distance algorithm to determine the similarity analysis between the newly extracted device status information and the previously generated device fingerprint information, and obtain the final analysis result. Based on the final analysis result, it is determined whether the device fingerprint needs to be updated.

4. The power software and hardware equipment fingerprint management method according to claim 1 is characterized in that: The status data of the power hardware and software equipment based on the latest period is compared with the status data of the power hardware and software equipment in the previous life cycle to obtain the device fingerprint destruction judgment result, and the Gaussian mixture model GMM is used to determine whether the status data of the power hardware and software equipment in the latest period is an abnormal value.

5. The power software and hardware equipment fingerprint management method according to claim 1 is characterized in that: The device fingerprint is updated based on the update instruction, including online and offline updates; Devices connected to the internal network use the device offline update method; Devices connected to the external network use the device online update method.

6. The power software and hardware equipment fingerprint management method according to claim 5 is characterized in that: After updating the device fingerprint based on the update instruction, the method further includes: The internal and external network data is securely transferred to achieve data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline. The cross-internal and external network data transfer uses triggers to capture changes in the source database and record them in the change data table. The data is exported to a file through a scheduled task, and then the target database is updated after being transferred to the target end.

7. The power software and hardware equipment fingerprint management method according to claim 6 is characterized in that: The method of realizing data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline by using the secure transfer of internal and external network data includes: Capture changes through triggers and record data in a change table; export data in the change table to a data file; the trigger uses a keyword that temporarily resides in the database memory; The data files are transferred to the message middleware in sequence; the data files are read from the message middleware in sequence; and the data files are written to the target database through the program across the security isolation network gate to achieve real-time data synchronization.

8. The power software and hardware equipment fingerprint management method according to claim 1 is characterized in that: The updating of the device fingerprint based on the update instruction includes: Receive the collected device status information, verify the format of the device status information, and encode the obtained device status information; Different methods are used to update data with different characteristics, including: For feature data of numerical type, the data is first standardized; the standardized data is weighted according to the feature weight; the optimal and worst solutions of this item are determined according to different feature items; then the Euclidean distance between the data vector and the optimal solution and the worst solution is calculated, and the proximity index is calculated through the Euclidean distance as the final sorting parameter; For non-digital data, encoding processing is required. The encoding processing principle is that the best solution encoding digital value is high, and the worst solution encoding digital value is low, so as to achieve evaluation calculation; Calculate the distance between the current device state vector and the state vector used to generate the device fingerprint in the previous time period based on a weighted distance algorithm; Obtain the evaluation data value, evaluate the result and compare it with the threshold value, and determine whether the new device fingerprint needs to be updated according to the new device status; Finally, upload the judgment results.

9. A fingerprint management system for power software and hardware equipment, characterized in that: include: Equipment status monitoring module, used to obtain status data of power software and hardware equipment; The fingerprint update decision module is used to compare the status data of the power software and hardware equipment in the latest period with the status data of the equipment fingerprint generated in the previous stage to obtain the equipment fingerprint update judgment result; The fingerprint destruction decision module is used to compare the status data of the power software and hardware equipment in the latest period with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result; An administrator supervision module, used to generate an update or destruction instruction based on the device fingerprint update judgment result and the device fingerprint destruction judgment result; A fingerprint update execution module, used to update the device fingerprint based on the update instruction; The fingerprint destruction module is used to encrypt the target data based on the destruction instruction in a group encryption destruction mode, generate the target data ciphertext, and encrypt and overwrite it multiple times, after which the key is immediately destroyed to achieve data destruction.

10. The power software and hardware equipment fingerprint management system according to claim 9 is characterized in that: In the equipment status monitoring module, the status data of the power hardware and software equipment is obtained by: The device status monitoring module obtains device data by integrating the method of actively sending messages to obtain device information and passively obtaining device information through probes.

11. The power software and hardware equipment fingerprint management system according to claim 9 is characterized in that: In the fingerprint update decision module, the device fingerprint update judgment result is obtained by comparing the status data of the power software and hardware equipment in the latest period with the status data of the device fingerprint generated in the previous stage, including: Combined with the characteristic parameters screened out in the process of device fingerprint generation, the approximate ideal solution sorting TOPSIS algorithm is adopted to integrate the multi-domain search VDS algorithm and the characteristic vector distance algorithm to determine the similarity analysis between the newly extracted device status information and the previously generated device fingerprint information, and obtain the final analysis result. Based on the final analysis result, it is determined whether the device fingerprint needs to be updated.

12. The power software and hardware equipment fingerprint management system according to claim 9 is characterized in that: In the fingerprint destruction decision module, the status data of the power software and hardware equipment in the latest period is compared with the status data of the power software and hardware equipment in the previous life cycle to obtain the device fingerprint destruction judgment result. The Gaussian mixture model GMM is used to determine whether the status data of the power software and hardware equipment in the latest period is an abnormal value.

13. The power software and hardware equipment fingerprint management system according to claim 9 is characterized in that: The device fingerprint is updated based on the update instruction, including online and offline updates; Devices connected to the internal network use the device offline update method; Devices connected to the external network use the device online update method.

14. The power software and hardware equipment fingerprint management system according to claim 9, characterized in that: The fingerprint update execution module uses secure data ferrying between internal and external networks to achieve data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline; cross-internal and external network data ferrying uses triggers to capture changes in the source database and record them in the change data table, and exports the data to a file through a scheduled task, and then updates the target database after transmitting it to the target end.

15. The power software and hardware equipment fingerprint management system according to claim 14, characterized in that: The method of realizing data synchronization between the internal database and the external cloud database after the device fingerprint is updated online or offline by using the secure transfer of internal and external network data includes: Capture changes through triggers and record data in a change table; export data in the change table to a data file; the trigger uses a keyword that temporarily resides in the database memory; The data files are transferred to the message middleware in sequence; the data files are read from the message middleware in sequence; and the data files are written to the target database through the program across the security isolation network gate to achieve real-time data synchronization.

16. The power software and hardware equipment fingerprint management system according to claim 9, characterized in that: The fingerprint update execution module specifically includes: Receive the collected device status information, verify the format of the device status information, and encode the obtained device status information according to the algorithm requirements; Different methods are used to update data with different characteristics, including: For numerical feature data, the data is first standardized; then the standardized data is weighted according to the feature weight; the optimal and worst solutions of each feature item are determined according to different feature items; then the Euclidean distance between the data vector and the optimal solution and the worst solution is calculated, and the proximity index is calculated through the Euclidean distance as the final sorting parameter; For non-digital data, encoding processing is required. The encoding processing principle is that the best solution encoding digital value is high, and the worst solution encoding digital value is low, so as to achieve evaluation calculation; Calculate the distance between the current device state vector and the state vector used to generate the device fingerprint in the previous time period based on a weighted distance algorithm; Obtain the evaluation data value, evaluate the result and compare it with the threshold value, and determine whether the new device fingerprint needs to be updated according to the new device status; Finally, upload the judgment results.

17. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the power software and hardware equipment fingerprint management method as claimed in any one of claims 1 to 8 when executing the computer program.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the power software and hardware equipment fingerprint management method according to any one of claims 1 to 8 is implemented.

19. A computer program product, comprising computer instructions, characterized in that: The computer instructions instruct the computer to execute the power software and hardware equipment fingerprint management method as described in any one of claims 1-8.

Images