Power distribution edge Internet of Things terminal multi-factor trust evaluation system, method and application

Abstract

The invention discloses a zero-trust-based power distribution edge Internet of Things intelligent terminal multi-factor trust evaluation system. The system comprises a cloud server layer, an edge layer and an Internet of Things terminal layer, the cloud server layer serves as a data center, can interact with an edge Internet of Things proxy server in the edge layer through a communication network, provides services required by an edge Internet of Things proxy, and performs identity authentication on the edge Internet of Things proxy; the edge layer comprises one or more edge internet-of-things proxy servers, and a zero-trust engine is arranged in each edge internet-of-things proxy server; the Internet of Things terminal layer refers to an intelligent terminal accessed to the power distribution Internet of Things, a zero-trust client is deployed on the intelligent terminal, and the intelligent terminal can interact with an edge Internet of Things proxy server of a region where the intelligent terminal is located through the zero-trust client and submit an access request. The invention further discloses a zero-trust-based multi-factor trust evaluation method and application of the intelligent terminal of the power distribution edge Internet of Things.

Description

Technical Field

[0001] The present invention belongs to the technical field of trust assessment and relates to a multi-factor trust assessment method, an assessment system and an application of a power distribution edge Internet of Things intelligent terminal based on zero trust. Background Art

[0002] The power Internet of Things is the application of ubiquitous Internet of Things technology in smart power systems, and it continues to develop with the innovation of Internet of Things technology. By deploying intelligent software and hardware in each link of the traditional power grid "generation, transmission, transformation, distribution, and delivery", the power Internet of Things can achieve efficient and coordinated development of each link, and its security needs to be paid more attention to. [1] There are many types of intelligent terminals connected to the power distribution Internet of Things, and the number is gradually increasing, and the exposure of the power system on the distribution side is increasing accordingly. [2] . Smart terminals produced by different manufacturers need to interact frequently with the power system on the distribution side. However, since standard specifications tailored for the ubiquitous power Internet of Things have not yet been released, there has been no unified mechanism for continuous verification of the identity and trustworthiness of smart terminals on the distribution side. The traditional method of relying solely on identity authentication to grant access control is difficult to resist threats within the system, and static trust assessment methods may have a negative impact on the stability and security of the power system on the distribution side. At the same time, the introduction of many emerging technologies such as the "cloud-edge-end" edge network architecture and edge computing has made the security responsibilities and functional attribution of traditional power systems increasingly blurred. Traditional power information networks use physical boundaries, deploy firewalls or passwords to distinguish between objects within and outside the system's boundaries. They are no longer suitable for the current distribution Internet of Things scenarios where the internal and external boundaries are unclear. There is an urgent need for a new method for evaluating the trust value of smart terminals. [3] .

[0003] The gradual failure of the traditional network boundary trust system has given rise to the concept of Zero Trust (ZT). Its core idea of ​​"continuous authentication, never trust" breaks the network boundary restrictions and can effectively counter internal threats. [4] In the Zero Trust Architecture (ZTA), all participating network entities are considered untrustworthy. Each interactive access requires the organizer to conduct trust assessment and access authorization based on the current situation, thereby solving the problem of trusted protection in borderless networks. [5]. As the power Internet of Things enters the "cloud-edge-end" collaborative mode, the zero-trust architecture meets the needs of multi-terminal access control and trust management models. Current research on zero trust for distribution Internet of Things focuses on centralized zero-trust engine architecture and protection solutions, and lacks a zero-trust deployment architecture in the "cloud-edge-end" power Internet of Things environment. There are more theoretical studies and conceptual interpretations of zero-trust architecture, and less research on dynamic trust assessment methods for network entities. In addition, existing static trust assessment methods are mostly based on a single identity authentication result, which presents a relatively one-sided view of the terminal's trustworthiness, and it is difficult to reflect sudden malicious behavior threats in the trust value. Dynamic trust assessment is worth in-depth research. Summary of the invention

[0004] In order to address the deficiencies in the prior art, the object of the present invention is to provide a multi-factor trust assessment method, assessment system and application for smart terminals at the edge of the power distribution network based on zero trust.

[0005] Based on the zero trust concept and the requirements of "cloud-edge-end", combined with the actual security requirements of the power distribution Internet of Things, the present invention proposes a zero trust architecture deployment scheme for the power distribution edge Internet of Things, and clarifies the deployment of zero trust architecture components in the power distribution edge Internet of Things. A multi-factor trust evaluation method is constructed for smart terminals connected to the power distribution edge Internet of Things, including a smart terminal identity authentication method based on the SM9 algorithm, and the identity authentication result is used as a factor affecting the trust value of the smart terminal. Experiments show that the identity authentication result reflects the trustworthiness of the smart terminal. The trust evaluation method proposed in the present invention gives a higher trust value to smart terminals that have no historical behavior and maintain good interactive behavior; the trust value of smart terminals that maintain good historical behavior drops sharply after abnormal behavior occurs; smart terminals with unreliable historical behavior cannot obtain a higher trust value after few abnormal behaviors and identity authentication passes; the method of the present invention obtains different trust values ​​on smart terminals with different historical behaviors or current behaviors, and historical behaviors have a continuous effect on the trustworthiness of smart terminals.

[0006] The present invention provides a power distribution Internet of Things system capable of deploying zero-trust components, the system comprising a cloud server layer, an edge layer, and an Internet of Things terminal layer;

[0007] The cloud server layer acts as a data center, providing multiple functions such as device management, data resources, and computing resources, and interacts with the edge IoT proxy server in the edge layer through the communication network to provide the services required by the edge IoT proxy and authenticate the edge IoT proxy;

[0008] The edge layer includes one or more edge IoT proxy servers; the edge IoT proxy servers can be divided according to regions and functions, including distribution management servers, energy management servers, substation management servers, etc.; the zero trust engine in the edge IoT proxy server can be further abstracted into three logical architectures, namely: policy engine PE, policy manager PA and policy execution point PEP; the edge IoT proxy server stores trust evaluation factors that affect the trustworthiness of smart terminals in the region, and completes the trust evaluation of smart terminals based on the zero trust model; the zero trust model refers to a trust value evaluation model for distribution edge IoT smart terminals that includes time degradation factors, abnormal behavior factors and identity authentication schemes based on SM9; wherein,

[0009] The policy manager PA is a logical component responsible for the logical connection between the access request subject and the access object, and relies on the decision of the policy engine PE to confirm whether to allow or deny the connection; the policy manager PA takes the access request information of the intelligent terminal as input, extracts factors that affect the trust value and / or access control, and forms an authentication result;

[0010] The policy engine PE is a logical component that makes a control result for an access request; it makes an access control result for the access request of the smart terminal according to the authentication result of the smart terminal, that is, providing service or denying service;

[0011] The policy enforcement point PEP is a logical component used to continuously monitor the connection between the access subject and the accessed resource and execute the access control result;

[0012] The policy engine PE and the policy manager PA are both policy decision points, and the policy decision points belong to the control plane; the policy execution point PEP belongs to the data plane;

[0013] The IoT terminal layer includes a smart terminal connected to the power distribution IoT, on which a zero-trust client is deployed. The smart terminal can interact with the edge IoT proxy server in the area through the zero-trust client and submit an access request.

[0014] The present invention also provides a multi-factor trust assessment method for a power distribution edge IoT intelligent terminal based on zero trust, the method comprising the following steps:

[0015] Step 1: Zero-trust client perception on the smart terminal collects real-time data from the smart terminal and sends an access request to the edge IoT proxy server in the area corresponding to the smart terminal;

[0016] Step 2: The edge IoT proxy server authenticates the smart terminal and calculates the trust value of the smart terminal;

[0017] Step 3: Compare the calculated trust value of the smart terminal with the preset trust value threshold to determine whether the interaction is successful, complete the smart terminal trust evaluation, and record the result in the edge IoT proxy server.

[0018] Step 1 also includes the step of initializing the system parameters required for identity authentication of the smart terminal and the edge IoT proxy server, wherein the system parameters required for identity authentication include the system master key P generated by the trusted third-party key generation center KGC (Key Generation Center) pub , Intelligent terminal symbol T i , Edge IoT proxy server identifier S j , the private key generation function identifier hid selected and published by the trusted third-party key generation center KGC, the user private keys P1 and P2; the hash function H1 and the conversion function KDF used in this step are confirmed.

[0019] In step 1, the real-time data collected by the sensing includes ab1 data packet anomaly, ab2 information detection, ab3 password anomaly, and ab4 request anomaly; the real-time data will be recorded in the edge IoT proxy server, reflecting the abnormal behavior of the smart terminal;

[0020] In step 2, the identity authentication is performed through the following steps:

[0021] Step a: Intelligent terminal T i Initiate authentication request: Smart terminal T i To the edge IoT proxy server S j Send an authentication request, which is expressed as follows:

[0022] T i →S j :AccessReq||T i ∣∣S j ||H||S||R

[0023] Among them, AccessReq is the authentication request, R is a number generated using the elliptic curve group random number, and (H, S) is the digital signature calculated based on the SM9 signature algorithm and the private key of the smart terminal user.

[0024] Step b: The edge IoT proxy server verifies the signature of the smart terminal: After receiving the identity authentication request, the edge IoT proxy server verifies the signature according to the SM9 algorithm; after verification, the edge IoT proxy server first calculates Q according to the following formula d Whether it meets the requirements of SM9 algorithm:

[0025] Q d =[H1(T i∣∣hid,N)]P1+P pub

[0026] Among them, H1 represents a hash function with an output length of 1, hid represents the private key generation function identifier selected and published by the trusted third party KGC, N represents a one-time random number, P pub represents the master public key, and P1 is the user's private key;

[0027] And calculate the shared key according to the following formula:

[0028] Shared key SK = KDF(Cipher||e(P pub ,P2) r ∣∣D,klen)

[0029] Where KDF is the key derivation function defined in the SM9 algorithm, Cipher is the encapsulated ciphertext confirmed according to the system parameter group, e represents the bilinear pairing generated on the elliptic curve group that meets the requirements of the SM9 signature cryptographic algorithm, klen is the length of the shared key SK, P pub represents the master public key, P2 is the user private key, r represents a random number and r∈[1,N-1], D represents an element in the elliptic curve group, D=e(R,r*Q d ) r ;

[0030] S j →T i :AccessRes||S j ∣∣Cipher∣∣H∣∣S

[0031] The above formula represents the edge IoT proxy server S j To the intelligent terminal T i The authentication message sent, AccessRes is the access response sent by the edge IoT proxy server.

[0032] Step c, the smart terminal verifies the signature of the edge IoT proxy server: After receiving the data packet from the edge IoT proxy server, the smart terminal verifies the signature and parses the encapsulated ciphertext Cipher. According to the conversion algorithm in the SM9 algorithm, Cipher is converted into a bit stream, and the shared key SK can be calculated based on the following formula for subsequent session encryption.

[0033] w′=e(Cipher,d)

[0034] SK=KDF(Cipher∣∣w′∣∣S j ∣∣klen)

[0035] T i →S j :AccessAck||key(Ti ∣∣S j )

[0036] Among them, AccessAck represents the confirmation response, and d is the private key of the smart terminal. If the key parsing is 0, it means that the authentication has failed, and the identity authentication of the smart terminal is completed.

[0037] In step 2, the calculation of the trust value of the smart terminal involves multiple factors, including basic trust factor, time degradation factor, abnormal behavior penalty factor, and identity authentication factor;

[0038] The basic trust factor is calculated using Beta distribution as the basic model of trust statistical probability. The calculation result is a static trust value based on historical interaction conditions. The statistical expectation of the static trust value is shown in the following formula:

[0039]

[0040] Among them, r and s represent the number of successful and failed interactions between edge IoT proxy server i and smart terminal j, respectively;

[0041] The introduction of the time degradation factor is used to reflect the dynamic decay of the historical behavior influence over time. The definition of the time degradation factor is as follows:

[0042]

[0043] Among them, h represents the trust status of the edge IoT proxy server in the most recent h interactions, and k represents the kth interaction among the most recent h interactions;

[0044] After adding the time degradation factor, the edge IoT proxy server i redefines the number of successful and failed interactions r and s for smart terminal j as follows:

[0045]

[0046]

[0047] Among them, ρ represents the trust situation of each interaction. If the edge IoT proxy server i interacts successfully with the smart terminal j, ρ = 1, otherwise ρ = 0;

[0048] The abnormal behavior penalty factor is used to reflect the negative impact of abnormal behavior on the trust value; the abnormal behavior of smart terminal j is detected by the zero trust client, including ab1 data packet anomaly, ab2 information detection, ab3 password anomaly, and ab4 request anomaly. If the zero trust client detects abnormal behavior, then the abnormal behavior set A of smart terminal j j = corresponding ab in {ab1,ab2,ab3,ab4} kIt will be set to the number of times abnormal behavior occurs in the corresponding interaction cycle. The default value is 0.

[0049] After normalizing the abnormal behavior penalty factor, the penalty factor of the intelligent terminal to be evaluated in this interaction is obtained, as shown in the following formula:

[0050]

[0051] The identity authentication factor is included in the trust evaluation as a factor to enhance the resilience of the trust value evaluation result. If the smart terminal j passes the identity authentication, the identity authentication factor Ver j =v, otherwise Ver j =1-v, where v is a preset value, v∈[0,1], which is used to control the impact of identity authentication on the trust value. In particular, when v=1, the identity of the smart terminal is always considered to be trustworthy, and when v=0, the identity of the smart terminal is always considered to be untrustworthy.

[0052] The trust value of the smart device in step 2 is a comprehensive trust value, which is the result of weighting various influencing factors. The basic trust value with time degradation factor, abnormal behavior penalty factor and identity authentication factor are weighted to obtain a comprehensive trust value.

[0053] This section uses the entropy weight method to determine the weight of each factor, that is, to confirm the objective weight according to the amount of information of each factor to achieve the final weighting effect. The entropy weight method has the advantage of objectively reflecting the ability to distinguish each factor, avoiding the perspective limitations brought by subjective weighting, and has a simple calculation form. It is suitable for the scenario where a large number of terminals are connected to the edge of the power distribution network, reducing the impact of subjective factors on the weight.

[0054] To confirm the entropy value, it is necessary to calculate the trust value influencing factors F of each smart terminal j The information entropy of is calculated as follows:

[0055] Information entropy H j =-F j logF j -(1-F j )log(1-F j )

[0056] Trust evaluation factors f of smart terminals j The weight w j The calculation method is as follows:

[0057]

[0058] Finally, we get the intelligent terminal T i The comprehensive trust value is calculated as follows:

[0059] Comprehensive Trust Value CRj =Σw j F j .

[0060] In step three, when the trust value of the smart terminal is greater than the preset trust value threshold, the smart terminal passes the trust evaluation and provides the requested service for it; when the trust value of the smart terminal is less than the preset trust value threshold, the smart terminal fails the trust evaluation and refuses to provide the requested service for it; after step three, the step of recording the result in the edge IoT proxy server is also included.

[0061] The beneficial effects of the present invention include: not taking a single factor as the evaluation standard, introducing time degradation factor, abnormal behavior factor and identity authentication to design a trust value evaluation model for the power distribution edge IoT smart terminal, proposing a corresponding identity authentication scheme based on the SM9 algorithm, the identity authentication scheme of the smart terminal can effectively avoid replay attacks and counterfeit attacks, and the multi-factor trust evaluation algorithm can dynamically reflect the terminal's credibility, distinguish and contain risky terminals, thereby achieving the role of protection. Different from the scheme using indirect trust value, the present invention does not involve the trust evaluation of edge devices outside the region, thus reducing the number of interactions and the amount of calculation, and the coupling degree is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 It is a schematic diagram of zero trust components and zero trust architecture.

[0064] Figure 2 It is a schematic diagram of the power distribution edge IoT system.

[0065] Figure 3 This is a diagram of the deployment of the zero-trust access control engine.

[0066] Figure 4 This is a schematic diagram of Scyther’s verification results.

[0067] Figure 5 This is a schematic diagram of the change of terminal trust value under different algorithms.

[0068] Figure 6 It is the change of trust value of different terminals.

[0069] Figure 7 This is the overall flow chart of the evaluation method. DETAILED DESCRIPTION

[0070] The present invention is further described in detail with reference to the following specific examples and drawings. The process, conditions, experimental methods, etc. for implementing the present invention, except for the contents specifically mentioned below, are all common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0071] The prototype of zero trust was born in the Jericho Forum, which means "never trust, continuous authentication" to solve the growing security problems of borderless networks. The National Institute of Standards and Technology (NIST) of the United States has released the "Zero Trust Security Architecture", which specifically explains the concept, architecture and components of zero trust security. [6] The International Cloud Security Alliance (CSA) has released two versions of the "Software Defined Perimeter Standard Specification", which elaborates on the zero trust model in borderless networks. [7] .

[0072] like Figure 1 As shown in the figure, the zero-trust architecture is divided into the control plane and the data plane, and access control is implemented using zero-trust components. Among them, the Policy Enforcement Point (PEP) belongs to the data plane, which is used to continuously monitor the connection between the access subject and the accessed resource and execute the access control results. The Policy Administrator (PA) and the Policy Engine (PE) belong to the control plane. Among them, PA takes the access request information of the smart terminal as input, extracts the factors affecting the trust value and / or access control, and forms an authentication result; PE makes an access control result for the access request based on the authentication result, that is, provides or denies the service. PEP, PE and PA constitute the zero-trust components, and the three are combined to realize the trust assessment method and access control architecture based on zero trust. In the figure, the data diagnosis system, industry compliance regulations, threat intelligence, and activity log are domain knowledge or industry standards, and the data access strategy, public key infrastructure, identity management, and security event management are the management regulations in the industry and the existing cryptography system standards, which are all the basis for establishing a reference for the zero-trust architecture.

[0073] In the field of power IoT security, trust management and access control of terminals have always been a research hotspot, and security solutions based on zero-trust architecture are emerging in an endless stream. Huang Jie et al. [8] Analyze the security risks of distributed data centers in the power Internet of Things, and propose a data center access control solution based on zero trust to achieve minimum authorization for access subjects; Feng Jingyu et al. [9] Propose an edge zero-trust model to combat compromised IoT terminals by maintaining alliance blockchain and lightweight signcryption scheme; Yu Jiexiao et al.

[10] Based on blockchain technology, a terminal trust consensus method based on alliance blockchain was constructed, and a multi-trust evaluation mechanism and dynamic weight were established to propose an IoT terminal trust solution; Wang Tiantian

[11] A trust evaluation scheme is proposed for edge devices in edge computing, and the comprehensive trust value is calculated using improved grayscale trust and dynamic update factors; Mehraj S et al.

[12] proposed the dilemma faced by static security policies in cloud computing environments and pointed out the importance of zero-trust policies for trust establishment in this environment; DeCusatis C et al.

[13] Using transmission access control and first packet authentication mechanism, a zero-trust approach was implemented in the cloud; Yin Haoran et al.

[14] A three-dimensional convolutional neural network is used to construct a mapping between the electrical quantity, communication volume and abnormal state of the distribution Internet of Things to complete the anomaly detection task of the distribution Internet of Things.

[0074] As for the current status of research on zero-trust systems and smart grids, there are few studies on the application and deployment of the "cloud-edge-end" power distribution physical network, and there are more theoretical explanations and conceptual interpretations. In the trust value calculation scheme involving dynamic evaluation, there is a scheme that regards smart terminals and trusted network nodes as equivalent, which is inconsistent with the relatively single working scenario of the distribution IoT terminal and the actual situation of its computing power level. In addition, the trustworthiness assessment of IoT terminals mostly adopts static assessment methods, or only obtains binary authentication results based on terminal identity authentication, lacks dynamic grayscale calculation methods, and is not well matched with the access requests of smart IoT terminals.

[0075] Power Distribution Edge IoT System

[0076] In order to meet the business needs of smart grid collection, computing and control, the edge computing framework has become a key application in the development of the power Internet of Things, forming the core of the construction of the smart Internet of Things system.

[15] The inherent distributed nature of edge IoT can reduce computing and communication pressures, centralize data centers, business centers, and computing centers in the cloud, give edge proxy servers certain computing and storage capabilities, and manage IoT smart terminals more efficiently in different regions.

[16] .

[0077] The popularization of smart grids and the introduction of edge computing have made the defense of traditional network border systems insufficient, and the access of a large number of terminals has increased the exposure surface. This paper proposes a "cloud-edge-end" deployment architecture for the power distribution Internet of Things, and constructs a deployment method for the zero-trust engine in the power distribution edge Internet of Things. This paper proposes a trust-driven trust assessment method for power distribution edge Internet of Things terminals, in which SM 9 is introduced to design the smart terminal identity authentication process, and the trust value of the Internet of Things terminal is calculated by information entropy weighting using the time degradation factor, abnormal behavior penalty factor and identity authentication factor, which can be applied to the dynamic evaluation of access control. Experiments show that the trust assessment method for power distribution edge Internet of Things terminals can be effectively used to evaluate the trust trend of Internet of Things terminals, identify abnormal terminal behavior, and enhance the security of power distribution Internet of Things terminal authentication.

[0078] Based on the edge computing architecture of "cloud-edge-end" and the characteristics of the power distribution Internet of Things, combined with zero-trust components, the present invention designs a power distribution Internet of Things system that can deploy zero-trust components. The hierarchical structures of the power distribution Internet of Things system that can deploy zero-trust components are as follows: Figure 2 As shown, it includes cloud server layer, edge layer and IoT terminal layer.

[0079] Cloud server layer: As a data center, the cloud server is mainly responsible for processing and storing core business data. It has the most core computing resources and storage capabilities, completes complex data flow processing services, interacts with the edge layer through the communication network, can provide the edge IoT agent in the edge layer with the requested services, and is responsible for authenticating the edge IoT agent.

[0080] Edge layer: The edge layer is mainly composed of one or more edge IoT proxy servers. Edge IoT proxy servers can be divided by region and by different functions to perform power distribution management, energy management or substation management, etc. Edge IoT proxy servers have certain computing power and storage space. The edge IoT proxy servers in each region store the trust evaluation factors that affect the trustworthiness of smart terminals in the region, calculate the trust value of smart terminals based on the trust evaluation factors, and perform identity authentication and trust evaluation judgment on IoT smart terminals. The zero trust engine for the trustworthiness of IoT smart terminals is deployed in the edge layer. The zero trust engine in the edge IoT proxy server responsible for completing the trust evaluation of IoT smart terminals can be abstracted into three components: Policy Engine (PE), Policy Administration (PA) and Policy Enforcement Point (PEP), which can complete the trust evaluation of smart terminals based on the zero trust model.

[0081] IoT terminal layer: mainly intelligent terminals (sensors) connected to the power distribution IoT, such as ring main units and smart transformers in the distribution room; a series of sensors such as temperature and humidity sensors, smoke sensors, gas sensors, etc. that interact with the energy management edge proxy server; smart meters and charging piles also belong to the IoT terminal layer; a zero-trust client is deployed on each terminal with limited computing and storage capabilities. The terminal can interact and send requests with the edge IoT proxy server in the corresponding area through the zero-trust client; the zero-trust client collects and processes data from smart terminals in real time, interacts with edge IoT proxy devices and submits access requests, etc.

[0082] The power distribution IoT system divides smart terminal types according to their types and business types. The edge IoT proxy servers in each area interact with the smart terminals and perform trust assessments. If cross-regional data flow is required, the edge IoT proxy servers initiate requests and interact with each other.

[0083] The data center is isolated through the "cloud-edge-end" architecture. The cloud server processes and stores core business data as a data center and has core computing resources and storage capabilities. The edge layer is composed of one or more edge IoT proxy servers, which have certain computing resources and storage capabilities. The edge layer is composed of edge IoT proxy servers. Smart terminals can only interact with edge IoT proxy servers and cannot directly request core business data from cloud servers. They can only request data that can be obtained with corresponding trust values ​​after authentication and authorization by edge IoT proxy servers. Therefore, data leakage caused by hijacked malicious smart terminals directly accessing the data center can be avoided, and the overall defense capability can be improved. Using edge IoT proxy servers to perform smart terminal identity authentication and trust value evaluation can meet the timeliness requirements for security and authentication in cloud-edge collaboration scenarios, reduce the computing and storage burdens on the cloud, and reduce the delay caused by transmission.

[0084] Zero Trust Engine Deployment for IoT at the Power Distribution Edge

[0085] In order to effectively use zero-trust components in the power distribution edge IoT environment, based on the "cloud-edge-end" tripartite functional description and architecture, combined with zero-trust architecture components and the smart terminal access requirements in the power distribution edge IoT, Figure 3The deployment of the zero-trust engine in the edge IoT of power distribution shows the zero-trust model in this scenario: the smart terminal equipped with a client serves as the zero-trust access subject, and the zero-trust client collects and senses data in real time, and sends access requests when applying for access to data or transmitting data; the terminal-oriented zero-trust access control engine is deployed on the edge IoT proxy server, where PEP receives the access request sent by the terminal, and PA transmits the abnormal behavior set contained in the access request; PE receives the abnormal behavior set transmitted by PA, extracts the abnormal behavior factors in the set, calculates the terminal trust value in combination with other trust evaluation factors, queries the PE policy library for the corresponding access control policy, writes the result of this request into the historical behavior, and stores it in the edge IoT proxy server; after PA obtains the access control policy decision, it delivers the execution result to PEP. If access is allowed, PEP will send the corresponding business data request to the cloud data center, and return the access request result or request data to the smart terminal.

[0086] Among them, the PE policy library is pre-designed according to the actual business scenario requirements. The simplest mode sets a multi-level trust threshold. If the trust value of the smart terminal calculated by PE is greater than the threshold, the requested service is provided, otherwise the service is denied. For example, the trust value required for requesting different services is divided, such as the trust value required for reading and writing core business data is high, while the trust value required for reading ordinary data is low. The smart terminal will get different feedback when initiating different requests.

[0087] Trust evaluation method based on multiple factors ( Figure 7 )

[0088] Trust evaluation process based on multiple factors:

[0089] Dynamic trust assessment for smart terminals connected to the edge IoT of power distribution is an important part of implementing access control for the edge IoT of power distribution. It can directly reflect the trustworthiness of smart terminals and is an important basis for achieving zero trust. Based on the zero trust concept and the deployment of the zero trust engine in the edge IoT of power distribution, the trust assessment method for smart terminals is as follows:

[0090] 1) Initialize the system parameters required for identity authentication. This step confirms the system master key F generated by the trusted third party KGC required for the authentication phase between the smart terminal and the corresponding edge IoT proxy server. pub , Intelligent terminal symbol T i , Edge IoT proxy server identifier S j , the private key generation function identifier hid selected and published by the trusted third party KGC, the user private keys P1 and P2; the hash function H1 and the conversion function KDF used in this step;

[0091] 2) The client on the smart terminal device senses and collects the real-time data of the smart terminal, and sends an access request to the edge IoT proxy server in the corresponding area; the real-time data sensed and collected includes ab1 data packet anomaly, ab2 information detection, ab3 password anomaly, and ab4 request anomaly; the real-time data will be recorded in the edge IoT proxy server, reflecting the abnormal behavior of the smart terminal

[0092] 3) The edge IoT proxy server authenticates the smart terminal based on the information of the smart terminal, and then calculates the trust value of the smart terminal to compare whether it reaches the trust value required to obtain the requested service;

[0093] 4) If the trust value of the smart terminal meets the requirement, the edge IoT proxy server obtains the corresponding service from the cloud (cloud server layer) and returns it to the terminal, and the interaction is successful; otherwise, the service is rejected and the interaction fails; the trust evaluation of the smart terminal is completed, and the result of this interaction is recorded in the edge IoT proxy server.

[0094] Trust evaluation algorithm based on multiple factors

[0095] Basic Trust Factor

[0096] Beta distribution can well fit the terminal trust distribution in the IoT environment. Therefore, Beta distribution is selected as the basic model of trust statistical probability to calculate the basic trust factor of the IoT terminal at the edge of the power distribution network.

[17] , the calculation result is a static trust value based on historical interactions.

[0097] r and s represent the number of successful and failed interactions between edge IoT proxy server i and smart terminal j, respectively. The statistical expectation of the static trust value of edge IoT proxy server i to smart terminal j is shown in formula (1):

[0098]

[0099] Among them, r and s represent the number of successful or failed interactions between edge IoT proxy server i and smart terminal j. The number is based on the historical data stored in the edge proxy server. It is assumed that the interaction between the smart terminal and the edge physical proxy server is carried out in a safe and stable channel, that is, the historical data of whether the interaction is successful or not can reflect the subsequent interaction situation. If the edge IoT proxy server provides the requested service to the smart terminal, it is considered a success, and if it refuses the requested service, it is considered a failure. In particular, if a single smart terminal requests multiple services at a time, the number of requested services is used as the basis for counting.

[0100] Time degradation factor

[0101] The time degradation factor is a value that decreases over time and can be used to reflect the dynamic weakening of the impact of historical behavior over time. Introducing the time degradation factor in the static trust value estimation can strengthen the dynamic change of the smart terminal trust value over time and reflect the recent smart terminal behavior trend on the trust value.

[0102] In order to adapt to the storage and computing pressure brought by the number of intelligent terminals in the power distribution IoT to the edge IoT proxy server, the edge IoT proxy server only records the trust status of the most recent h interactions, where k represents the kth interaction among the most recent h interactions. The time degradation factor is defined as follows:

[0103]

[0104] In order to facilitate the use of the time degradation factor in the Beta function, the variable ρ is introduced to represent the trust situation of each interaction. If the edge IoT proxy server i and the smart terminal j interact successfully, ρ = 1, otherwise ρ = 0; after adding the time degradation factor, the new definitions of r and s are shown in formula (3) and formula (4) respectively:

[0105]

[0106]

[0107] Abnormal behavior penalty factor

[0108] If an intelligent terminal has abnormal behavior, its trustworthiness will be reduced. Therefore, an abnormal behavior penalty factor is introduced to reflect the negative impact of abnormal behavior on the trust value. The abnormal behavior of intelligent terminal j is detected by the client, including ab1 data packet anomaly, ab2 information detection, ab3 password anomaly, and ab4 request anomaly. If the client detects abnormal behavior, then the abnormal behavior set A of intelligent terminal j is j = corresponding ab in {ab1,ab2,ab3,ab4} k It will be set to the number of abnormal behaviors that occurred during the corresponding interaction cycle, and the default value is 0. For example, during this interaction cycle, the zero-trust client installed on smart terminal t detected that the terminal had 2 information detection behaviors. The abnormal behavior set A corresponding to smart terminal t is t ={0,2,0,0}.

[0109] After normalizing the abnormal behavior penalty factor, the penalty factor of the intelligent terminal to be evaluated in this interaction is obtained, as shown in formula (5):

[0110]

[0111] Authentication Factor

[0112] The edge IoT proxy server authenticates the smart terminal that issues the access request and includes the authentication result as part of the trust evaluation. Authentication is not the only criterion for measuring the trustworthiness of the terminal, but it can enhance the resilience of the trust value evaluation result. Devices that fail to pass the authentication can still have certain interaction permissions, but the corresponding interaction permissions are lower.

[0113] If the smart terminal j passes the identity authentication, then the identity authentication factor Ver j =v, otherwise Ver j =1-v, where v is a preset value, v∈[0,1], which is used to control the impact of identity authentication on the trust value. In particular, when v=1, the identity of the smart terminal is always considered to be trustworthy, and when v=0, the identity of the smart terminal is always considered to be untrustworthy.

[0114] The SM9 algorithm uses the user's own identity to generate public and private keys, eliminating the need for digital certificate management, certificate library, and key library settings.

[18] , which is suitable for scenarios where there are many and diverse devices to be authenticated in the edge IoT of power distribution. Therefore, an identity authentication scheme for smart terminals is designed based on the national secret SM9 algorithm of user identity identification. The system master key involved in the SM9 algorithm is generated by a trusted third party KGC, and the user key is generated based on the user's own identity. The user's own identity can be selected from the motherboard serial number, CPUID, other hardware information or a combination thereof. The main authentication process is as follows:

[0115] Terminal authentication request

[0116] Smart Terminal i To the edge IoT proxy server S j Send an authentication request, the content of which is as shown in (6).

[0117] T i →S j :AccessReq||T i ∣∣S j ||H||S||R (6)

[0118] AccessReq is the authentication request, R is a random number, and (H, S) is the digital signature calculated based on the SM9 signature algorithm and the private key of the smart terminal user.

[0119] Edge IoT proxy server signature verification

[0120] After receiving the identity authentication request, the edge IoT proxy server verifies the signature according to the SM9 algorithm. After verification, the edge IoT proxy server first calculates Q according to (7) dWhether the SM9 algorithm requirements are met, the shared key is calculated according to (8). Among them, KDF is the key derivation function defined in the SM9 algorithm, Cipher is the encapsulated ciphertext confirmed according to the system parameter group, klen is the length of the shared key SK, P1 and P2 are both user private keys, and AccessRes is the access response issued by the edge server.

[0121] Q d =[H1(T i ∣∣hid,N)]P1+P pub (7)

[0122] SK=KDF(Cipher||e(P pub ,P2) r ∣∣D,klen) (8)

[0123] S j →T i :AccessRes||S j ∣∣Cipher∣∣H∣∣S (9)

[0124] Smart terminal signature verification

[0125] After receiving the data packet, the intelligent terminal verifies the signature and parses the encapsulated ciphertext Cipher. According to the conversion algorithm in the SM9 algorithm, Cipher is converted into a bit stream, and the shared key SK can be calculated based on (10) and (11) for subsequent session encryption.

[0126] w′=e(Cipher,d) (10)

[0127] SK=KDF(Cipher∣∣w′∣∣S j ∣∣klen) (11)

[0128] T i →S j :AccessAck||key(T i ∣∣S j ) (12)

[0129] AccessAck represents the confirmation response, and d is the private key of the smart terminal. If the key resolution is 0, it means that the authentication has failed, and the identity authentication of the smart terminal is completed.

[0130] Comprehensive trust value

[0131] The comprehensive trust value is the result obtained by weighting the above-mentioned influencing factors. The basic trust value with time degradation factor, abnormal behavior penalty factor and identity authentication factor are weighted to obtain the comprehensive trust value.

[0132] This section uses the entropy weight method to determine the weight of each factor, that is, to confirm the objective weight according to the amount of information of each factor to achieve the final weighting effect. The entropy weight method has the advantage of objectively reflecting the ability to distinguish each factor, avoiding the perspective limitations brought by subjective weighting, and has a simple calculation form. It is suitable for the scenario where a large number of terminals are connected to the edge of the power distribution network, reducing the impact of subjective factors on the weight.

[0133] To confirm the entropy value, it is necessary to calculate the trust value influencing factors F of each smart terminal j The information entropy of is calculated as shown in formula (13).

[0134] H j =-F j logF j -(1-F j )log(1-F j ) (13)

[0135] Trust evaluation factors F of smart terminals j The weight w j The calculation method of is shown in formula (14), and finally the intelligent terminal T i The comprehensive trust value of is calculated as shown in formula (15).

[0136]

[0137] CR j =Σw j F j (15)

[0138] In order to verify the effectiveness of the multi-factor trust evaluation algorithm proposed in this paper and the rationality of the identity authentication scheme, Scythe is used to verify the security of the identity authentication scheme, and the changes in the initial node trust values ​​in different trust evaluation schemes and their corresponding trust change trends are compared.

[0139] This section conducts experimental simulation based on Ubuntu 22.04ARM 64 system and Python 3.8 environment. The computer hardware used is Apple M2 and 16G memory. The global parameters used in the experimental simulation are shown in Table 1.

[0140] Table 1 Global simulation parameters

[0141] Parameter name describe Default Value h Maximum number of interactions 10 v Identity Factor 0.7 δ Minimum trust threshold 0.5 T Number of simulation rounds 40,10

[0142] In the table, h represents the upper limit of the historical behavior of each terminal stored in the edge server, v represents the weight of the identity authentication result, δ is the minimum trust value requirement for the smart terminal to obtain services, and T is the number of rounds of experimental simulation tests.

[0143] Security Assessment of Identity Authentication Schemes

[0144] Scyther is an automated analysis tool for verifying the security of protocols. The tool can directly authenticate the security of protocols in a formalized way. It is developed based on Python in Linux system and directly displays the analysis results in a UI interface.

[19] .

[0145] Use the Scyther tool to perform security analysis on the smart terminal identity authentication solution based on the SM9 algorithm, such as Figure 4 As shown, Figure 4 In the figure, the tool analyzes from the following perspectives: SKR represents the security of the transmission process, Alive represents the liveness detection, Weakagree represents the protocol inconsistency, Nisych and Niagree are the identity authentication relationship attribute groups, and 'verified' in the figure means that the security attributes declared by the scheme have been successfully verified, and no effective attack methods have been found within the scope. This scheme can effectively avoid replay attacks and counterfeit attacks, and the introduction of random numbers in the scheme ensures freshness. In the design of the SM9 algorithm, the key is calculated based on the user identity, while in the power distribution edge IoT, the user identity is generated by the hardware serial number, CPUID or other hardware information. Therefore, as the verification results show, before obtaining the device hardware information, the attacker cannot crack the user key.

[0146] According to Scyther's verification results and security analysis, the smart terminal identity authentication scheme based on the SM9 algorithm has corresponding forward security.

[0147] Verification of the effectiveness of multi-factor trust evaluation algorithm

[0148] Trust value is an important basis for evaluating the trustworthiness of terminals in a zero-trust architecture. The changes in the trust value of the terminal under different behaviors can reflect the effectiveness of the multi-factor trust evaluation algorithm proposed in the present invention. The present invention first compares the multi-factor trust evaluation algorithm, the static trust evaluation algorithm, and the trust evaluation algorithm combined with identity authentication proposed in the present invention through 40 rounds of experimental simulations, combined with the actual conditions of different rounds of terminals, and compares the changes in the trust value of the terminal, and analyzes the effectiveness of the trust evaluation algorithm proposed in the present invention.

[0149] Figure 5 The changes in the trust values ​​of smart terminals under three different algorithms are shown. Smart terminals that have no interaction records with the edge proxy server have no abnormal behavior in the first 10 rounds of simulation and pass identity authentication; from the 11th to the 25th rounds, the terminal has abnormal behavior and always passes identity authentication; from the 25th to the 30th rounds, the terminal fails identity authentication and has no other abnormal behavior; from the 31st to the 40th rounds, the terminal recovers and passes identity authentication.

[0150] The results show that the static trust evaluation algorithm fails to directly reflect the abnormal behavior and identity authentication of the terminal in the trust value, and cannot dynamically reflect the current trustworthiness of the smart terminal. The risky terminal can always pass the authentication; the trust evaluation algorithm based on identity authentication can quickly reduce the trust value when the terminal fails to pass the identity authentication. When the terminal is hijacked and exhibits abnormal behavior, the trust value fails to decrease in time; the multi-factor trust evaluation algorithm proposed in the present invention has a sharp decrease in trust value after the terminal exhibits abnormal behavior, and the trust value during the period of abnormal behavior of the terminal is always controlled above and below the threshold value. After the terminal fails to pass the identity authentication, the trust value also quickly decays to the threshold value. In contrast, the multi-factor trust evaluation algorithm can timely and effectively reflect the current trustworthiness of the smart terminal, quickly identify smart terminals with potential risks, and control their trust values.

[0151] In the multi-factor trust evaluation algorithm proposed in this paper, the basic trust factor calculation is mainly based on the historical interaction behavior records of the intelligent terminal. Therefore, this part selects three terminals with different historical behaviors to carry out 10 rounds of experimental simulations to observe their trust value change trends. The results are as follows: Figure 6 shown.

[0152] Terminal 1 initially had no interaction with the corresponding edge proxy server, and the identity authentication was always passed, and no abnormal behavior occurred during the entire process; Terminal 2's historical interactions were all successful, and the identity authentication passed, but abnormal behavior occurred in the sixth round; Terminal 3 was initially an untrusted node, and its historical behaviors were all recorded as failures, and it was detected that there were abnormal behaviors and the identity authentication failed. From the sixth round, the abnormal behavior of the terminal disappeared and the identity authentication passed.

[0153] The results show that when there is no historical interaction and no abnormal behavior, terminal 1 maintains good interaction behavior for a period of time, and the trust value gradually increases and finally tends to a stable state; terminal 2 has abnormal behavior when the historical behavior is successful interaction, and the trust value drops sharply; when there are risks in historical behavior, abnormal behavior and identity authentication, the initial trust value of terminal 3 is lower than the minimum threshold value, and the interaction continues to fail. After the abnormal behavior disappears and the identity authentication is passed, the trust value cannot be obtained due to the unreliability of its historical behavior. It can be seen that the multi-factor trust evaluation algorithm proposed by the present invention performs differently on different historical and current terminals, and historical behavior has a continuous effect on the trust value of the terminal.

[0154] The present invention constructs a "cloud-edge-terminal" architecture for the power distribution Internet of Things, and proposes a zero-trust deployment model in the power distribution edge Internet of Things environment. The trust value evaluation model of the power distribution edge Internet of Things smart terminal is designed by introducing time degradation factors, abnormal behavior factors and identity authentication, and a corresponding identity authentication scheme is proposed based on the SM9 algorithm. The identity authentication scheme of the smart terminal can effectively avoid replay attacks and counterfeit attacks. The multi-factor trust evaluation algorithm can dynamically reflect the trustworthiness of the terminal, distinguish and contain risky terminals, thereby achieving the role of protection. It is suitable for the access control requirements of the power distribution edge physical network, as an important basis in the zero-trust architecture, and at the same time meets the needs of the power distribution edge Internet of Things scenario.

[0155] References

[0156] [1] Wu Kehe, Cheng Rui, Jiang Xiaochen, et al. Security protection scheme for power Internet of Things based on SDP[J]. Information Network Security, 2022(2):32-38.

[0157] [2] Liu Tao, Ma Yue, Jiang Hefang, et al. Research on power grid security protection architecture based on zero trust[J]. Power Information and Communication Technology, 2021, 19(7): 25-32.

[0158] [3] Cui Hengzhi, Jiang Chengling, Miao Weiwei, et al. Design and implementation of power smart IoT system based on edge computing[J]. Power Information and Communication Technology, 2020, 18(4): 33-41.

[0159] [4] Zhang Yu, Zhang Yan. A review of zero trust research[J]. Information Security Research, 2020, 6(7): 608-614.

[0160] [5] Liu Tao, Ma Yue, Jiang Hefang, et al. Research on power grid security protection architecture based on zero trust[J]. Power Information and Communication Technology, 2021, 19(7): 25-32.

[0161] [6]Rose S,Borchert O,Mitchell S,et al.Zero trust architecture[R].National Institute of Standards and Technology,2020.

[0162] [7] BILGER B, ALAN, BOEHME, et al. SDP Standard Specification Chinese Version 1.0 [EB / OL]. Cloud Security Alliance (2019: 11-14) [2021-01-03]. https: / / www.waitang.com / report / 27944.html.

[0163] [8] Huang Jie, Yu Ruochen, Mao Dong. Fine-grained access control of distributed database based on zero trust in power Internet of Things scenario[J]. Information Security Research, 2021, 7(6): 535-542.

[0164] [9] Feng Jingyu, Yu Tingting, Wang Ziying, et al. Edge zero trust model against compromised terminal threats in power IoT scenarios[J]. Journal of Computer Research and Development, 2022, 59(5): 1120-1132.

[0165]

[10] Yu Jiexiao, Yu Liying, Yang Ting. Trust consensus method for power IoT terminals based on blockchain[J]. Automation of Electric Power Systems, 2021, 45(17): 1-10.

[0166]

[11] Wang Tiantian. Research on trust evaluation mechanism for edge devices[D]. Heilongjiang: Harbin Normal University, 2020.

[0167]

[12] Mehraj S, Banday M T.Establishing a zero trust strategy in cloudcomputing environment[C].2020International Conference on ComputerCommunication and Informatics(ICCCI).IEEE,2020:1-6.

[0168]

[13] DeCusatis C, Liengtiraphan P, Sager A, et al.Implementing zero trustcloud networks with transport access control and first packet authentication[C] / / 2016IEEE International Conference on Smart Cloud(SmartCloud).IEEE,2016:5-10.

[0169]

[14] Yin Haoran, Miao Shihong, Han Ji, et al. Distribution Internet of Things anomaly identification method based on three-dimensional convolutional neural network[J]. Automation of Electric Power Systems, 2022, 46(1): 42-50.

[0170]

[15] Cui Hengzhi, Jiang Chengling, Miao Weiwei, et al. Design and implementation of power smart IoT system based on edge computing[J]. Power Information and Communication Technology, 2020, 18(4): 33-41.

[0171]

[16] Shi Weisong, Sun Hui, Cao Jie, et al. Edge computing: a new computing model in the era of the Internet of Everything[J]. Computer Research and Development, 2017, 54(5): 907-924.

[0172]

[17] Ganeriwal S,Balzano LK,Srivastava M B.Reputation-based framework for high integrity sensor networks[J].ACM Transactions on Sensor Networks(TOSN),2008,4(3):1-37.

[0173]

[18] Yuan Feng, Cheng Zhaohui. Overview of SM9 identity cryptographic algorithm[J]. Information Security Research, 2016, 2(11): 1008-1027.

[0174]

[19] Cremers CJ F. The Scyther Tool: Verification, Falsification, and Analysis of Security Protocols[C]. Proceedings of the 20th international conference on Computer Aided Verification. ACM, 7-14July 2008, Princeton, NJ, USA, 2008: 414-418.

[0175] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the present invention, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the attached claims.

Claims

1. A multi-factor trust evaluation system for intelligent terminals at the edge of the power distribution network based on zero trust, characterized in that: The system includes a cloud server layer, an edge layer, and an IoT terminal layer; The cloud server layer interacts with the edge IoT proxy server in the edge layer through the communication network, provides the services required by the edge IoT proxy, and performs identity authentication on the edge IoT proxy; The edge layer includes one or more edge IoT proxy servers, and the edge IoT proxy servers are provided with a zero trust engine; The zero trust engine stores trust evaluation factors that affect the trustworthiness of smart terminals in the region, and completes the trust evaluation of smart terminals based on the zero trust model; the zero trust model refers to a trust value evaluation model for smart terminals at the edge of the power distribution network, including time degradation factors, abnormal behavior factors, and an SM9 identity authentication scheme; The IoT terminal layer includes a smart terminal connected to the power distribution IoT, on which a zero-trust client is deployed. The smart terminal interacts with the edge IoT proxy server in the area through the zero-trust client and submits an access request.

2. The trust evaluation system according to claim 1, wherein: The edge IoT proxy server includes a power distribution management server, an energy management server, and an area management server; The zero trust engine includes a policy engine PE, a policy manager PA and a policy execution point PEP; wherein, The policy manager PA relies on the decision of the policy engine PE to confirm whether to allow or deny the connection; the policy manager PA takes the access request information of the intelligent terminal as input, extracts factors affecting the trust value and / or access control, and forms an authentication result; The policy engine PE makes an access control result for the access request according to the authentication result; The policy enforcement point PEP is used to continuously monitor the connection between the access subject and the accessed resource and execute the access control result.

3. A multi-factor trust assessment method for intelligent terminals at the edge of the power distribution network based on zero trust, characterized in that: The trust assessment method uses the trust assessment system as claimed in claim 1 or 2, comprising the following steps: Step 1: Zero-trust client perception on the smart terminal collects real-time data from the smart terminal and sends an access request to the edge IoT proxy server in the area corresponding to the smart terminal; Step 2: The edge IoT proxy server authenticates the smart terminal and calculates the trust value of the smart terminal; Step 3: Compare the calculated trust value of the smart terminal with the preset trust value threshold to complete the smart terminal trust evaluation.

4. The trust evaluation method according to claim 3, characterized in that: Step 1 also includes the step of initializing the system parameters required for identity authentication of the smart terminal and the edge IoT proxy server, wherein the system parameters required for identity authentication include the system master key P generated by the trusted third-party key generation center KGC. pub , Intelligent terminal symbol T i , Edge IoT proxy server identifier S j , the private key generation function identifier hid selected and published by the trusted third-party key generation center KGC, the user private keys P1 and P2; the hash function H1 and the conversion function KDF used in this step are confirmed.

5. The trust evaluation method according to claim 3, characterized in that: In step one, the real-time data collected by the perception include ab1 data packet anomaly, ab2 information detection, ab3 password anomaly, and ab4 request anomaly; the real-time data will be recorded in the edge proxy server, reflecting the abnormal behavior of the smart terminal.

6. The trust evaluation method according to claim 3, characterized in that: In step 2, the identity authentication includes the following steps: Step a: Intelligent terminal T i Initiate authentication request: Smart terminal T i To the edge IoT proxy server S j Send an authentication request, which is expressed as follows: T i →S j :AccessReq||T i ||S j |H||S||R, Where AccessReq is the authentication request, R is a number generated using the elliptic curve group random number, and (H, S) is a digital signature calculated using the SM9 signature algorithm and the private key of the smart terminal user; Step b: The edge IoT proxy server verifies the signature of the smart terminal: After receiving the identity authentication request, the edge IoT proxy server verifies the signature according to the SM9 algorithm; after verification, the edge IoT proxy server first calculates Q according to the following formula d Whether it meets the requirements of SM9 algorithm: Q d =[H1(T i ||hid,N)]P1+P pub , Among them, H1 represents a hash function with an output length of 1, hid represents the private key generation function identifier selected and published by the trusted third party KGC, N represents a one-time random number, P pub represents the master public key, and P1 is the user's private key; And calculate the shared key according to the following formula: SK=KDF(Cipher||e(P pub ,P2)′||D,maple), Where KDF is the key derivation function defined in the SM9 algorithm, Cipher is the encapsulated ciphertext confirmed according to the system parameter group, e represents the bilinear pairing generated on the elliptic curve group that meets the requirements of the SM9 signature cryptographic algorithm, klen is the length of the shared key SK, P pub represents the master public key, P2 is the user private key, r represents a random number and r∈[1, N-1], D represents an element in the elliptic curve group, D=e(R, r*Q d ) r ; S j →T i :AccessRes||S j ||Cipher||H||S, The above formula represents the edge IoT proxy server S j To the intelligent terminal T i The authentication message sent, AccessRes is the access response sent by the edge server; Step c, the smart terminal verifies the signature of the edge IoT proxy server: after receiving the access response data packet sent by the edge IoT proxy server, the smart terminal verifies the signature and parses the encapsulated ciphertext Cipher; according to the conversion algorithm in the SM9 algorithm, the Cipher is converted into a bit stream, and the shared key SK can be calculated based on the following formula for subsequent session encryption; w′=e(Cipher, d), SK=KDF(Cipher||w′||S j ||klen), T i →S j :AccessAck||key(T i ||S j ), Among them, AccessAck represents the confirmation response, and d is the private key of the smart terminal; if the key resolution is 0, it means that the authentication has failed, and the identity authentication of the smart terminal is completed.

7. The trust evaluation method according to claim 3, characterized in that: In step 2, the calculation of the trust value of the smart terminal involves multiple factors, including basic trust factor, time degradation factor, abnormal penalty factor, and identity authentication factor; The calculation result of the basic trust factor is a static trust value based on historical interaction conditions. The statistical expectation of the static trust value is shown in the following formula: Among them, r and s represent the number of successful and failed interactions between edge IoT proxy server i and smart terminal j, respectively; The time degradation factor is defined as follows: Among them, h represents the trust status of the edge IoT proxy server in the most recent h interactions, and k represents the kth interaction among the most recent h interactions; After adding the time degradation factor, the edge IoT proxy server i redefines the number of successful and failed interactions r and s for smart terminal j as follows: Among them, ρ represents the trust situation of each interaction. If the edge IoT proxy server i interacts successfully with the smart terminal j, ρ = 1, otherwise ρ = 0; The abnormal behavior penalty factor is used to reflect the negative impact of abnormal behavior on the trust value; the abnormal behavior of smart terminal j is detected by the client, including ab1 data packet abnormality, ab2 information detection, ab3 password abnormality, and ab4 request abnormality; when the client detects abnormal behavior, the abnormal behavior set A of smart terminal j is j = corresponding ab in {ab1, ab2, ab3, ab4} k It will be set to the number of times abnormal behavior occurs in the corresponding interaction cycle. The default value is 0. After normalizing the abnormal behavior penalty factor, the penalty factor of the intelligent terminal to be evaluated in this interaction is obtained, as shown in the following formula: The identity authentication factor is included in the trust evaluation as a factor to enhance the resilience of the trust value evaluation result. If the smart terminal j passes the identity authentication, the identity authentication factor Ver j =v, otherwise Ver j =1-v, where v is a preset value, v∈[0,1], which is used to control the influence of identity authentication in the trust value. When v=1, the identity of the smart terminal is always considered to be credible, and when v=0, the identity of the smart terminal is always considered to be untrustworthy.

8. The trust evaluation method according to claim 3, characterized in that: The trust value of the smart device in step 2 is a comprehensive trust value, which is the result of weighting various influencing factors. The basic trust value with time degradation factor, abnormal behavior penalty factor and identity authentication factor are weighted to obtain the comprehensive trust value; the weight of each influencing factor is determined by the entropy weight method.

9. The trust evaluation method according to claim 8, characterized in that: By calculating the trust value influencing factors F of each intelligent terminal j The information entropy confirms the entropy value, and the calculation method is shown as follows: Information entropy H j =-F j logF j -(1-F j )log(1-F j ), Trust evaluation factors F of smart terminals j The weight w j The calculation method is as follows: Finally, we get the intelligent terminal T i The comprehensive trust value of is calculated as follows: Comprehensive Trust Value CR j =Σw j F j .

10. The trust evaluation method according to claim 3, characterized in that: In step 3, when the trust value of the smart terminal is greater than the preset trust value threshold, the smart terminal passes the trust evaluation and provides the requested service for it; when the trust value of the smart terminal is less than the preset trust value threshold, the smart terminal fails the trust evaluation and refuses to provide the requested service for it; After step three, the step of recording the result in the edge IoT proxy server is also included.

11. Application of the trust assessment system as described in claim 1 or 2, or the trust assessment method as described in any one of claims 3 to 10 in the trust assessment of intelligent terminals at the edge of the Internet of Things for power distribution.

Images