Power Internet of Things security protection method and device, storage medium and electronic equipment

Abstract

The invention discloses a power Internet of Things security protection method and device, a storage medium and electronic equipment, and relates to the field of network security. The security of the power Internet of Things can be improved. The security protection method for the electric power internet of things comprises the following steps: authorizing each piece of electric power equipment needing to be connected to a gateway, and connecting with the authorized electric power equipment; when to-be-processed data sent by a sender is received, the to-be-processed data is detected so as to confirm whether the to-be-processed data is safe data, and the sender is any electrical equipment connected with a gateway; under the condition that the to-be-processed data is safe data, encrypting the to-be-processed data to obtain encrypted data; and acquiring a data processing permission of a receiver corresponding to the sender, and sending the encrypted data to the receiver under the condition that the data processing permission corresponding to the receiver meets a preset condition.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, device, storage medium and electronic device for protecting the security of an electric power Internet of Things. Background Art

[0002] With the rapid development of power Internet of Things technology, the power grid system is moving towards a new era of high intelligence and automation. At the same time, the huge and complex network system constructed by the power Internet of Things has also made the traditional "internal security" network architecture face unprecedented network security threats and challenges.

[0003] In this context, the zero-trust security model came into being. This model adopts the principle of "never trust, always verify" and conducts strict security review and verification on every access request, which can enhance the security of the system. Therefore, the introduction of the zero-trust security model has become a new idea for building the power Internet of Things. Summary of the invention

[0004] The present application provides a power Internet of Things security protection method, device, storage medium and electronic equipment, which can improve the security of the power Internet of Things.

[0005] In a first aspect, the present application provides a power Internet of Things security protection method, comprising:

[0006] Authorize each power device that needs to be connected to the gateway, and connect to the authorized power devices;

[0007] When receiving the data to be processed sent by the sender, detecting the data to be processed to confirm whether the data to be processed is safe data, wherein the sender is any power device connected to the gateway;

[0008] In the case where the data to be processed is secure data, encrypting the data to be processed to obtain encrypted data;

[0009] The data processing authority of the receiver corresponding to the sender is obtained, and when the data processing authority corresponding to the receiver meets the preset conditions, the encrypted data is sent to the receiver.

[0010] According to the power Internet of Things security protection method provided by this embodiment, on the one hand, by authorizing the power equipment, it is ensured that only verified devices can be connected to the gateway, which greatly reduces the risk of unauthorized devices accessing the network and enhances the overall security of the system. On the other hand, the data to be processed entering the network is detected to confirm its security, which helps to identify and prevent malicious data or potential security threats from entering the network, thereby protecting the stable operation of the power system. On the other hand, encrypting the data to be processed can ensure the security of the data during transmission. Even if the data is intercepted, individuals without corresponding decryption authority cannot obtain the information, which can prevent data leakage. In addition, the data outgoing authority of the recipient is used to determine whether to send data to it, further improving the security of the data. This solution can verify various links such as the connection between the power equipment and the gateway, the power equipment of all parties sending or receiving data, the data sent, the transmission of data, and the forwarding of data, so as to realize the zero-trust security model of the power Internet of Things and greatly improve the security of the power Internet of Things.

[0011] In an exemplary embodiment, encrypting the data to be processed to obtain encrypted data includes:

[0012] Detecting whether the data length of the data to be processed meets a preset condition, and padding the data to be processed if the data length does not meet the preset condition;

[0013] The padded data to be processed is encrypted using an encryption algorithm to obtain encrypted data.

[0014] In an exemplary embodiment, the step of encrypting the padded data to be processed using an encryption algorithm to obtain encrypted data includes:

[0015] generating a communication identifier of the sender;

[0016] The communication identifier and the padded data to be processed are encrypted using an encryption algorithm to obtain ciphertext data, and a digital signature of the ciphertext data is determined;

[0017] The ciphertext data is combined with the digital signature to obtain encrypted data.

[0018] In an exemplary embodiment, further comprising:

[0019] Periodically obtain the behavior data of each power device connected to the gateway;

[0020] Predicting the safety assessment index of each of the electric power equipment based on the behavior data;

[0021] The data processing authority of each electronic device is updated based on the security assessment index.

[0022] In an exemplary embodiment, when the data to be processed sent by the sender is received, before the data to be processed is detected, the method further includes:

[0023] When receiving the data to be processed sent by the sender, updating the security assessment index of the sender;

[0024] If the updated security assessment index is lower than the preset threshold, the data to be processed is discarded.

[0025] In an exemplary embodiment, encrypting the data to be processed to obtain encrypted data includes:

[0026] Obtaining an original key, where the original key is shared by the sender and the receiver;

[0027] Expanding the original key to obtain multiple round keys;

[0028] The data to be processed is divided into a plurality of data blocks; each data block is encrypted respectively using the round key to obtain encrypted data.

[0029] In an exemplary embodiment, the step of encrypting the communication identifier and the padded data to be processed using an encryption algorithm includes:

[0030] Get timestamp;

[0031] The communication identifier, the timestamp and the padded data to be processed are combined, and the combined data is encrypted.

[0032] In a second aspect, the present application provides a power Internet of Things security protection device, comprising:

[0033] The authorization module is used to authorize each power device that needs to be connected to the gateway and connect to the authorized power devices;

[0034] A data detection module, configured to detect the data to be processed when receiving the data to be processed from the sender to confirm whether the data to be processed is safe data, wherein the sender is any power device connected to the gateway;

[0035] A data encryption module, used for encrypting the data to be processed to obtain encrypted data when the data to be processed is secure data;

[0036] The data forwarding module is used to obtain the data processing authority of the receiver corresponding to the sender, and send the encrypted data to the receiver when the data processing authority corresponding to the receiver meets the preset conditions.

[0037] In a third aspect, the present application provides an electronic device, which includes a memory and one or more processors. The memory stores one or more computer programs, and the computer programs include instructions. When the instructions are executed by the processor, the electronic device can execute the power Internet of Things security protection method as in the first aspect.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on an electronic device, the electronic device executes the power Internet of Things security protection method as in the first aspect.

[0039] In a fifth aspect, the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the power Internet of Things security protection method as described in the first aspect.

[0040] It can be understood that the beneficial effects that can be achieved by the above-mentioned power Internet of Things security protection device, electronic device, computer-readable storage medium, and computer program product can refer to the beneficial effects in the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of the process of the power Internet of Things security protection method provided in the embodiment of the present application;

[0042] Figure 2 A schematic diagram of the structure of the power Internet of Things security protection device provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. For example, the first chip and the second chip are only used to distinguish different chips, and their order is not limited. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit the difference. It should be noted that in the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more.

[0045] It should be noted that the “at…” in the embodiments of the present application may be the instant when a certain situation occurs, or may be a period of time after the occurrence of a certain situation, and the embodiments of the present application do not specifically limit this.

[0046] The implementation of this embodiment will be described in detail below with reference to the accompanying drawings.

[0047] This embodiment provides a power Internet of Things security protection method, which is applied to the gateway of the power Internet of Things. Exemplarily, the power Internet of Things security protection method can also be applied to various electronic devices such as computers (PCs), tablets, virtual reality / augmented reality devices, wearable devices, industrial computers, and car computers; it can also be applied to servers, clouds, server clusters, etc., and this embodiment does not make special restrictions on this.

[0048] Figure 1 A flow chart of the power Internet of Things security protection method provided in an embodiment of the present application is shown.

[0049] like Figure 1 As shown, the power Internet of Things security protection method may include the following steps:

[0050] Step 101: Authorize each power device that needs to be connected to the gateway, and connect to the authorized power devices.

[0051] Each power device can re-register in the system to obtain a unique identifier, which can be the hardware address, serial number, or unique ID generated by the system according to the rules. The gateway can save the successfully registered power devices in the authorization table as the authorized device information. When the power device requests to establish a connection with the gateway, the gateway can query the authorization table to determine whether the power device is authorized. If the information of the power device is included in the authorization table, it can be determined that the power device is authorized and then connect to the power device.

[0052] Step 102: upon receiving the data to be processed sent by the sender, the data to be processed is detected to confirm whether the data to be processed is safe data, wherein the sender is any power device connected to the gateway.

[0053] The sender is the power equipment that needs to send data. The data to be processed is sent to the receiver through the gateway. When the gateway receives the data to be processed sent by the sender, it can check whether the format and size of the data packet conform to the agreed format and structure, and then scan the data packet for malicious data through virus scanning. In addition, the digital signature of the data packet is verified. If the verification is passed, the data to be processed is safe data.

[0054] For example, network security devices such as firewalls and intrusion detection systems can be deployed on the gateway to filter and detect data entering and leaving the power Internet of Things, prevent malicious attacks and illegal intrusions, and hide key applications and network services under the strict protection of firewalls.

[0055] Step 103: When the data to be processed is secure data, encrypt the data to be processed to obtain encrypted data.

[0056] Exemplarily, various encryption algorithms such as Advanced Encryption Standard (AES) algorithm and SM9 algorithm can be used to encrypt the data to be processed to obtain encrypted data. Specifically, it includes: detecting whether the data length of the data to be processed meets the preset conditions, and if the data length does not meet the preset conditions, padding the data to be processed; encrypting the padded data to be processed using an encryption algorithm to obtain encrypted data.

[0057] Since AES is a block encryption algorithm, it requires that the input data must be an integer multiple of 128 bits. Therefore, if the original data length is not an integer multiple of 128 bits, it is necessary to add enough padding bytes at the end of the data to ensure that the total length of the data is an integer multiple of 128 bits.

[0058] The specific encryption process is as follows: obtain an original key, which is shared by the sender and the receiver; expand the original key to obtain multiple round keys; divide the data to be processed into multiple data blocks; use the round keys to encrypt each data block respectively to obtain encrypted data.

[0059] In the power Internet of Things system, the communicating parties need to securely share a key, namely the original key. The length of this key can be 128 bits, 192 bits or 256 bits, and the specific length depends on the security requirements. According to the length of the original key, a series of round keys are generated using the key expansion algorithm. These round keys will be XORed with the data block during the encryption process. Each round of encryption is for a data block of the data to be processed. In each round, one round key is used in turn in the order of the round keys to perform an XOR operation with the data block to obtain the encrypted ciphertext of the data block. After multiple rounds of encryption, the ciphertext corresponding to each data block in the data to be processed is obtained, and these ciphertexts can be merged to obtain the corresponding encrypted data.

[0060] In an exemplary implementation, the data to be processed after padding is encrypted using an encryption algorithm to obtain encrypted data, including: generating a communication identifier of the sender; encrypting the communication identifier and the data to be processed after padding using an encryption algorithm to obtain ciphertext data, and determining a digital signature of the ciphertext data; merging the ciphertext data and the digital signature to obtain encrypted data.

[0061] The communication identifier is generated in a manner agreed upon in advance by both parties. The communication identifiers of both parties are different for each communication, that is, the communication identifiers of each communication are unique. For example, both parties can agree on an identifier list, which may include multiple communication identifiers, and the communication identifier used for each communication is determined according to the order of these communication identifiers. For example, the first communication may use the first communication identifier, the second communication may use the second communication identifier, and so on.

[0062] After determining the communication identifier of this communication, the communication identifier and the padded data to be processed can be encrypted using an encryption algorithm to obtain the corresponding ciphertext data. Then the ciphertext data is signed using a signature algorithm to obtain a digital signature of the ciphertext data. Finally, the ciphertext data and the digital signature are combined to obtain encrypted data. Exemplarily, the SM9 algorithm is used to digitally sign the ciphertext data.

[0063] In an exemplary implementation, the communication identifier and the data to be processed after filling are encrypted using an encryption algorithm, including: obtaining a timestamp; merging the communication identifier, the timestamp and the data to be processed after filling, and encrypting the merged data.

[0064] The sender's communication identification, the current timestamp, and the data to be processed are encrypted together, and the resulting encrypted data is more complex, which can improve the reliability of encryption.

[0065] Exemplarily, other data may be encrypted together with the data to be processed, for example, a random number is encrypted together with the data to be processed, a timestamp, and a communication identifier to obtain encrypted data.

[0066] Step 104: Obtain the data processing authority of the receiver corresponding to the sender, and send the encrypted data to the receiver if the data processing authority corresponding to the receiver meets the preset conditions.

[0067] Data processing permissions may include data read permissions, modification permissions, deletion permissions, etc. The gateway device can maintain the data processing permissions of each power device by managing the permission table. In addition, the behavior data of each power device connected to the gateway is periodically obtained, the security assessment index of each power device is predicted based on the behavior data, and the data processing permissions of the power device are updated based on the security assessment index.

[0068] In this implementation, devices and users must undergo strict identity authentication before exchanging data and communicating, ensuring that only legitimate users and devices can access the system. In addition, access rights are dynamically adjusted based on factors such as the user's role, permissions, and device type and status to prevent unauthorized access and data leakage.

[0069] Each power device may initially have preset data processing permissions, such as read permissions. The behavior data of the power device is used to evaluate permissions, thereby updating the data processing permissions. The behavior data of the power device specifically includes: equipment status information, such as operating status, fault status, etc.; equipment operation logs, such as equipment power on / off operations, data editing operations, data downloads, transmission operations, etc.; also includes basic performance data of the equipment, such as memory usage, CPU occupancy, etc.; it may also include safety assessment indicators of the equipment. The acquired behavior data are input into the safety assessment model to predict the current safety assessment indicators of the power equipment. Among them, the safety assessment model may include various deep learning models, which can be trained in advance by collecting training data so that it can predict the safety assessment indicators corresponding to the output device.

[0070] It should be understood that the safety assessment indicators of power equipment are updated periodically. The safety assessment indicators predicted by the behavior data of the current and historical periods of the power equipment are used as the safety assessment indicators for the next time period. Then, the corresponding safety assessment indicators are updated to the permission table in the next time period. The permission table can be updated once every time period, or it can be manually triggered by the administrator.

[0071] Different security assessment indicators correspond to different data processing permissions, and the corresponding relationship between security assessment indicators and data processing permissions can be set in advance. The higher the security assessment indicator, the more data processing permissions it corresponds to. For example, the security assessment indicator can be from 1 to 10. When it is 1, the corresponding data processing permission is read permission; when it is 2, it can correspond to read permission and download permission; when it is 3, it can correspond to read permission, download permission, modify permission, and so on.

[0072] When the gateway needs to send encrypted data to the recipient, the gateway can query the permission table to determine the data processing permissions of the recipient and determine whether its data processing permissions meet the preset conditions. The preset conditions are set according to actual needs. For example, the preset conditions can be that the data processing permissions include read permissions, modify permissions, or data processing permissions include delete permissions.

[0073] When it is determined that the data processing authority of the receiver meets the preset conditions, the gateway can forward the encrypted data that the sender needs to send to the receiver to complete the data transmission. After receiving the encrypted data, the receiver can use the pre-agreed encryption algorithm to decrypt it, thereby obtaining the sender's data to be processed, and process the data to be processed to obtain the processing result. Then the receiver can return the processing result to the original sender through the above steps.

[0074] Advanced data encryption technologies such as AES and SM9 are used to encrypt the collected data to ensure the privacy and integrity of the data, and implement end-to-end encryption, that is, the data always remains encrypted during transmission and is not decrypted until it reaches the intended recipient.

[0075] In this embodiment, when the data to be processed is received from the sender, before the data to be processed is detected, it also includes: when the data to be processed is received from the sender, the security assessment index of the sender is updated; if the updated security assessment index is lower than a preset threshold, the data to be processed is discarded.

[0076] If the sender's security assessment index is lower than the preset threshold, the gateway can discard the pending data sent by the sender, thereby ensuring the security of data transmitted within the Internet of Things.

[0077] This implementation method can select network device resources based on the security requirements and current status of the power Internet of Things, and implement comprehensive security management measures for device access control, protocol and service management, logging, configuration settings, and software version updates.

[0078] Furthermore, this embodiment also provides a power Internet of Things security protection device, which can be used to execute the above-mentioned power Internet of Things security protection method. Figure 2 As shown, the power Internet of Things security protection device may include: an authorization module 201, which is used to authorize each power device that needs to be connected to the gateway and connect to the authorized power device; a data detection module 202, which is used to detect the data to be processed when receiving the data to be processed sent by the sender to confirm whether the data to be processed is safe data, wherein the sender is any power device connected to the gateway; a data encryption module 203, which is used to encrypt the data to be processed to obtain encrypted data when the data to be processed is safe data; a data forwarding module 204, which is used to obtain the data processing authority of the receiver corresponding to the sender, and send the encrypted data to the receiver when the data processing authority corresponding to the receiver meets the preset conditions.

[0079] In an exemplary embodiment, the data detection module is specifically used to: detect whether the data length of the data to be processed meets the preset conditions, and if the data length does not meet the preset conditions, fill the data to be processed with data; encrypt the filled data to be processed using an encryption algorithm to obtain encrypted data.

[0080] In an exemplary embodiment, the data encryption module 203 includes an identification encryption module, which is used to: generate a communication identification of the sender; encrypt the communication identification and the data to be processed after padding using an encryption algorithm to obtain ciphertext data, and determine the digital signature of the ciphertext data; merge the ciphertext data with the digital signature to obtain encrypted data.

[0081] In an exemplary embodiment, the power Internet of Things security protection device 200 also includes: a permission update module, which is used to periodically obtain behavior data of each power device connected to the gateway; predict security assessment indicators of each power device based on the behavior data; and update data processing permissions of each electronic device based on the security assessment indicators.

[0082] In an exemplary embodiment, the electric power logistics network safety protection device 200 also includes: a data discarding module, which is used to update the safety assessment index of the sender when receiving the data to be processed sent by the sender; if the updated safety assessment index is lower than a preset threshold, the data to be processed is discarded.

[0083] In an exemplary embodiment, the data encryption module 203 includes a key encryption module, which is used to: obtain an original key, which is shared by the sender and the receiver; expand the original key to obtain multiple round keys; divide the data to be processed into multiple data blocks; and use the round keys to encrypt each data block separately to obtain encrypted data.

[0084] In an exemplary embodiment, the data encryption module 203 further includes a timestamp encryption module, which is used to: obtain a timestamp; merge the communication identifier, the timestamp and the data to be processed after padding, and encrypt the merged data.

[0085] The specific details of each module or unit in the above-mentioned power Internet of Things security protection device have been described in detail in the corresponding power Internet of Things security protection method, so they will not be repeated here.

[0086] The embodiment of the present application also provides an electronic device, Figure 3 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. Figure 3 The electronic device 600 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0087] like Figure 3 As shown, electronic device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In RAM 603, various programs and data required for system operation are also stored. CPU 601, ROM 602 and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to bus 604.

[0088] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0089] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the embodiment of the present application are executed.

[0090] For example, when the computer program is executed by the central processing unit (CPU) 601, it can be executed as follows: authorize each power device that needs to be connected to the gateway, and connect to the authorized power device; when receiving the data to be processed sent by the sender, detect the data to be processed to confirm whether the data to be processed is secure data, wherein the sender is any power device connected to the gateway; if the data to be processed is secure data, encrypt the data to be processed to obtain encrypted data; obtain the data processing authority of the receiver corresponding to the sender, and if the data processing authority corresponding to the receiver meets the preset conditions, send the encrypted data to the receiver.

[0091] It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0092] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0093] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0094] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and the one or more programs include instructions, and when the instructions are executed by the electronic device, the electronic device implements the method described in the above embodiment.

[0095] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0096] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A power Internet of Things security protection method, characterized in that: Gateways used in the power Internet of Things include: Authorize each power device that needs to be connected to the gateway, and connect to the authorized power devices; When receiving the data to be processed sent by the sender, detecting the data to be processed to confirm whether the data to be processed is safe data, wherein the sender is any power device connected to the gateway; In the case where the data to be processed is secure data, encrypting the data to be processed to obtain encrypted data; The data processing authority of the receiver corresponding to the sender is obtained, and when the data processing authority corresponding to the receiver meets the preset conditions, the encrypted data is sent to the receiver.

2. The power Internet of Things security protection method according to claim 1 is characterized in that: Encrypting the data to be processed to obtain encrypted data includes: Detecting whether the data length of the data to be processed meets a preset condition, and padding the data to be processed if the data length does not meet the preset condition; The padded data to be processed is encrypted using an encryption algorithm to obtain encrypted data.

3. The power Internet of Things security protection method according to claim 2 is characterized in that: The method of encrypting the filled data to be processed by using an encryption algorithm to obtain encrypted data includes: generating a communication identifier of the sender; The communication identifier and the padded data to be processed are encrypted using an encryption algorithm to obtain ciphertext data, and a digital signature of the ciphertext data is determined; The ciphertext data is combined with the digital signature to obtain encrypted data.

4. The power Internet of Things security protection method according to claim 1 is characterized in that: Also includes: Periodically obtain the behavior data of each power device connected to the gateway; Predicting the safety assessment index of each of the electric power equipment based on the behavior data; The data processing authority of each electronic device is updated based on the security assessment index.

5. The power Internet of Things security protection method according to claim 1 is characterized in that: When receiving the data to be processed sent by the sender, before detecting the data to be processed, the method further includes: When receiving the data to be processed sent by the sender, updating the security assessment index of the sender; If the updated security assessment index is lower than the preset threshold, the data to be processed is discarded.

6. The power Internet of Things security protection method according to claim 1 is characterized in that: The step of encrypting the data to be processed to obtain encrypted data includes: Obtaining an original key, where the original key is shared by the sender and the receiver; Expanding the original key to obtain multiple round keys; The data to be processed is divided into a plurality of data blocks; each data block is encrypted respectively using the round key to obtain encrypted data.

7. The power Internet of Things security protection method according to claim 3 is characterized in that: The step of encrypting the communication identifier and the padded data to be processed using an encryption algorithm comprises: Get timestamp; The communication identifier, the timestamp and the padded data to be processed are combined, and the combined data is encrypted.

8. A power Internet of Things security protection device, characterized in that: include: The authorization module is used to authorize each power device that needs to be connected to the gateway and connect to the authorized power devices; A data detection module, configured to detect the data to be processed when receiving the data to be processed from the sender to confirm whether the data to be processed is safe data, wherein the sender is any power device connected to the gateway; A data encryption module, used for encrypting the data to be processed to obtain encrypted data when the data to be processed is secure data; The data forwarding module is used to obtain the data processing authority of the receiver corresponding to the sender, and send the encrypted data to the receiver when the data processing authority corresponding to the receiver meets the preset conditions.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the power Internet of Things security protection method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes a processor and a memory, wherein one or more computer programs are stored in the memory, and the one or more computer programs include instructions. When the instructions are executed by the electronic device, the electronic device executes the power Internet of Things security protection method described in any one of claims 1 to 7.

Images