Novel power system security access resource optimization method based on unclonable function

Abstract

The invention relates to a novel power system security access resource optimization method based on an unclonable function, and the method comprises the specific steps: an aggregator collects the electric quantity of a new network access device and the distance data of the aggregator, and calculates the judgment index of the new network access device through the combination of normalization and weight; dividing the new network access equipment into low-grade equipment and high-grade equipment according to the judgment index; registering the new network access equipment on a server of the power network networking platform based on an unclonable function; the aggregator distinguishes according to the classification of the new network access equipment and sends the new network access equipment to the gateway for judgment; respectively designing a one-way authentication mode and a two-way authentication mode at the gateway according to a judgment result to perform identity authentication on the low-level equipment and the high-level equipment; and the aggregator sets a plurality of levels of tolerance according to the judgment index, sets different levels of tolerance for each network access device in the area range of the aggregator, and regularly extracts the network access devices in each level according to the proportion for re-authentication.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and in particular to a novel power system secure access resource optimization method based on an unclonable function. Background Art

[0002] The rapid progress of the power Internet of Things has improved the level of informationization of the power system[3]. However, at the same time, the security challenges faced by various types of terminals accessing the network are becoming increasingly severe. The access of massive source, load and storage resources has led to a significant difference in the number and types of devices compared to previous devices. The heterogeneity, interactivity and complexity between devices make it difficult to protect the security of the power Internet of Things. Therefore, in the face of a large number of device terminals, identity authentication is very important when accessing the Internet of Things. It is an important barrier to protect user privacy and data security.

[0003] At present, the methods of identity authentication mainly include methods based on traditional cryptography, methods based on identification cryptographic systems, and some lightweight authentication methods. The authentication methods based on traditional cryptography can be divided into two types: symmetric cryptography and asymmetric cryptography. The former requires the distribution of keys in advance and requires the improvement of password complexity to improve security. The latter is also called public key-based identity authentication, which is typically based on public key infrastructure. Certificates are issued by third-party trusted institutions to ensure key security. Compared with identity identification methods based on symmetric encryption, it is more secure and is mostly used for identity authentication on the Internet. Traditional cryptography-based methods cannot meet both security and lightweight requirements. Methods based on identification cryptographic systems and some lightweight authentication methods can meet the above requirements.

[0004] The physical unclonable function is a new lightweight security primitive based on the unique physical characteristics of the device. Unlike the symmetric key algorithm, hash function and other lightweight primitives used in the authentication of most IoT devices, PUF uses the uncontrollable process deviations in the manufacturing process of semiconductor devices, such as the non-uniformity of transistors and the slight difference in resistance, to establish a fixed mapping between input stimulus and output response. Because the deviations of each device are different and cannot be copied, PUF can generate a fixed and unique output each time it is accessed. It has the characteristics of uniqueness, anti-cloning, unpredictability, tamper-proof, and no need for storage, and can be used as the only device fingerprint of the device. And it requires fewer hardware resources, which is more suitable for resource-constrained IoT devices. Therefore, PUF can be used to design secure access authentication algorithms. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention proposes a novel power system secure access resource optimization method based on unclonable functions.

[0006] The technical solution of the present invention is as follows:

[0007] On the one hand, the present invention proposes a novel power system secure access resource optimization method based on an unclonable function, the specific steps of which include:

[0008] The aggregator collects the power consumption and distance data of the newly connected devices and calculates the judgment index of the newly connected devices by normalizing and combining weights. The newly connected devices are divided into two categories: low-level devices and high-level devices according to the judgment index.

[0009] Register the new networked equipment on the server of the power grid networking platform based on the unclonable function;

[0010] The aggregator distinguishes the newly connected devices according to their classification and sends them to the gateway for judgment. The gateway designs one-way authentication and two-way authentication methods according to the judgment results to authenticate the low-level devices and high-level devices.

[0011] The aggregator sets several levels of tolerance based on the judgment indicators, sets different levels of tolerance for each network-connected device within the aggregator's area, and periodically extracts network-connected devices within each level in proportion for re-authentication to determine whether the power of the extracted devices within each level meets the preset threshold and whether the deviation from the initial distance of the aggregator meets the preset threshold;

[0012] The extracted devices that meet all the judgment conditions will undergo identity authentication again. The devices that pass the identity authentication will remain connected, and the devices that fail the authentication will be disconnected and the information will be deleted; the extracted devices that do not meet all the judgment conditions will be directly disconnected and the information will be deleted.

[0013] As a preferred implementation, the steps of collecting the power consumption of the newly connected device and the distance data from the aggregator, and calculating the judgment index of the newly connected device by normalizing and combining the weights are specifically as follows:

[0014] The collected data on the power consumption of new networked devices and their distance from the aggregator are normalized. The specific formula is as follows:

[0015]

[0016] In the formula, x′ and y′ are the normalized power and distance, x max The maximum power allowed for a new network device, y max The maximum distance allowed between a new network device and the aggregator;

[0017] The weight calculation judgment index is set according to the power of the new network device and the influence of the distance data from the aggregator. The specific calculation formula is as follows:

[0018] z=x′*k1+y′*k2

[0019] Where k1 and k2 are weight coefficients.

[0020] As a preferred implementation, the steps of registering the new networked device on the server of the power grid networking platform based on the unclonable function are specifically as follows:

[0021] When a new device joins the network, the device first sends its ID to the server;

[0022] The server generates an anonymous ID by calling a random oracle function based on the ID of the new device. * , and generate a random incentive C1, and the anonymous ID * It is sent to the new network device with random stimulus C1 for storage;

[0023] The newly connected device uses the random stimulus C1 to perform mapping calculation based on the unclonable function to generate a random response R1, and sends the random response R1 to the server;

[0024] The server stores an anonymous ID * , random stimulus C1 and random response R1, and a copy is sent to the gateway for storage;

[0025] New network devices will be anonymously IDed * , its own power and the distance to the aggregator are sent to the aggregator, where the judgment index is calculated and the new network devices are classified according to the judgment index.

[0026] As a preferred implementation, the aggregator makes a distinction based on the classification of the newly connected devices and sends it to the gateway for judgment. The specific steps are:

[0027] The newly connected device sends its ID to the aggregator, and the aggregator looks up the category to which the newly connected device belongs based on the device ID.

[0028] The aggregator will identify the anonymous ID of the corresponding device based on the ID and category of the newly connected device. * Make changes to anonymous IDs for high-level devices * Add a 0 to distinguish it from low-level devices;

[0029] The anonymous ID of the new device * It is sent to the gateway for judgment. A one-way authentication method is used for low-level devices, and a two-way authentication method is used for high-level devices.

[0030] As a preferred implementation, the one-way authentication method is specifically as follows:

[0031] The gateway uses the anonymous ID of the new device *Find the saved random stimulus C1 and random response R1, generate a random number N1, and send the random stimulus C1 and random number N1 to the new network device; the new network device again performs mapping calculation based on the unclonable function to generate a complex random response R1', and generates a random number N1 according to the anonymous ID * , random number N1 and complex random response R1' are hashed to obtain the hash value hash1 of the new network device and sent back to the gateway;

[0032] At the gateway, a hash calculation is performed based on the new device ID, random number N1 and random response R1 to obtain the hash value hash at the gateway. It is then determined whether the hash value hash1 at the new device and the hash value hash at the gateway are the same. If they are the same, the authentication is successful, otherwise it fails.

[0033] As a preferred implementation, the two-way authentication method is specifically as follows:

[0034] The gateway uses the anonymous ID of the new device * Find the saved random stimulus C1 and random response R1, and generate a random number N 2, , and using the random response R1 and the random number N 2, Random number N3, the specific calculation formula is as follows:

[0035]

[0036] At the same time, according to the anonymous ID * , random number N2 and random response R1 are hashed to obtain the hash value hash2 at the gateway, and the random stimulus C1, random number N3 and hash value hash2 at the gateway are sent to the device.

[0037] The newly connected device performs a mapping calculation based on the unclonable function again to generate a random response R1' and a random number N2'. The specific calculation formula is as follows:

[0038]

[0039] At the same time, according to the anonymous ID * , random number N2' and random response R1' are used for hash calculation to obtain hash value hash3 of the new device, and then determine whether hash value hash2 of the gateway is the same as hash value hash3 of the new device. If they are different, authentication fails. If they are the same, the device completes security authentication of the gateway and proceeds to the next authentication step.

[0040] The device generates random numbers X and C2, performs mapping calculation based on the unclonable function to generate a re-random response R2, performs hash calculation based on the random numbers X, N2′ and C2, the re-random response R1′ and the re-random response R2, and obtains the hash value hash4 at the gateway at this time; the random numbers X and C2, the hash value hash4 and The value is sent to the gateway;

[0041] The final random response R2' and hash value hash5 are calculated at the gateway according to the random response R1, the second random response R1 and the re-random response R2. The specific calculation formula is as follows:

[0042]

[0043] hash5=Hash(C2, R′2, R1, N1, X)

[0044] Determine whether hash4 and hash5 are the same. If they are different, the authentication fails. If they are the same, the gateway completes the security authentication of the device. At this point, the authentication of both parties is completed.

[0045] As a preferred implementation, the aggregator sets several levels of tolerance according to the judgment index, and the steps of setting different levels of tolerance for each network access device within the aggregator area are as follows:

[0046] Three levels of tolerance are set based on the judgment indicators:

[0047] When the tolerance is level 3, the latitude and longitude 100,000th and 10,000th percentiles are mapped to 0, allowing the device to move within a range of about 100 meters.

[0048] When the tolerance is level 2, the latitude and longitude 100,000th percentile is mapped to 0, allowing the device to move within a range of approximately 10 meters;

[0049] When tolerance is level 1, the distance to the aggregator is not allowed to change.

[0050] On the other hand, the present invention proposes a novel power system secure access resource optimization system based on an unclonable function, comprising:

[0051] In the new network device classification module, the aggregator collects the power consumption and distance data of the new network devices, calculates the judgment index of the new network devices by normalization and weight, and divides the new network devices into two categories: low-level devices and high-level devices according to the judgment index;

[0052] A new network device registration module is used to register new network devices on the server of the power grid networking platform based on an unclonable function;

[0053] New network device identity authentication module: The aggregator distinguishes the newly connected devices according to their classification and sends them to the gateway for judgment. The gateway designs one-way authentication and two-way authentication methods according to the judgment results to authenticate low-level devices and high-level devices.

[0054] In the module for judging the status of connected devices, the aggregator sets several levels of tolerance according to the judgment index, sets different levels of tolerance for each connected device within the aggregator's area, and periodically extracts connected devices in each level in proportion for re-authentication, judging whether the power of the extracted devices in each level meets the preset threshold and whether the deviation from the initial distance of the aggregator meets the preset threshold;

[0055] The identity re-authentication module for devices that have been connected to the network will re-authenticate the extracted devices that meet all the judgment conditions. Devices that pass the authentication will remain connected, while devices that fail the authentication will be disconnected and their information will be deleted. Extracted devices that do not meet all the judgment conditions will be directly disconnected and their information will be deleted.

[0056] On the other hand, the present invention proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements a new method for optimizing safe access resources of a power system based on an unclonable function as described in any embodiment of the present invention.

[0057] On the other hand, the present invention proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a new power system secure access resource optimization method based on an unclonable function as described in any embodiment of the present invention.

[0058] The present invention has the following beneficial effects:

[0059] 1. The present invention uses two identity authentication methods, and optimizes the allocation of communication and storage resources by reducing and increasing the steps and calculations of the corresponding identity authentication in a targeted manner, thereby maximizing resource utilization while meeting the requirements of secure access.

[0060] 2. The present invention uses gateways and aggregators to share the computing tasks of the server, and is more suitable for secure access of lightweight devices.

[0061] 3. The present invention utilizes re-authentication to solve the problem that the access security cannot be fully guaranteed due to the excessive total number of devices that need to be accessed in some areas and the excessive total power consumption. The authentication requirements for the access devices can also be flexibly adjusted. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 is a flow chart of the steps of the present invention;

[0063] Figure 2 This is a registration flow chart;

[0064] Figure 3 This is a flow chart for determining the type of new network equipment. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0067] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0068] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0069] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0070] Embodiment 1:

[0071] See also Figure 1 , a new power system secure access resource optimization method based on unclonable functions, the specific steps include:

[0072] The aggregator collects the power consumption and distance data of the newly connected devices and calculates the judgment index of the newly connected devices by normalizing and combining weights. The newly connected devices are divided into two categories: low-level devices and high-level devices according to the judgment index.

[0073] In this embodiment, the access to massive source, load and storage resources will inevitably require a large amount of computing and storage space. Even if you choose to use an aggregator to divide the area and share part of the access computing pressure, the overhead generated cannot be underestimated. Traditional access authentication only uses one method to identify the device, without taking into account the large number and variety of source, load and storage resources and the limited computing resources of the power Internet of Things management platform. The source, load and storage resources accessed by the power Internet of Things include a large number of large-scale power generation and storage equipment, as well as various small-scale power consumption equipment required by users. Their access has different impacts on the power grid. The complexity and security requirements of the identity authentication for the equipment can be increased or decreased accordingly, making full use of the characteristics of the equipment, reasonably saving computing resources, and improving the efficiency of secure access.

[0074] The bottom-level node devices of the Internet of Things are connected to the aggregator via adjacent nodes. Therefore, the closer the device is to the aggregator, the lower the communication cost. Wireless access is less likely to be intercepted by eavesdroppers or illegally accessed by disguising identities. There is less signal electromagnetic interference. Therefore, when the distance is short, using a simple identity authentication method can not only better meet security requirements, but also save various resources.

[0075] The access of devices with different power (including maximum power generation, storage, and consumption) to the power Internet of Things will have different impacts. The access of devices with excessive power may more easily cause local power grid overload and affect the stable operation of the power grid. Due to the continuous access of new energy power generation equipment, the power supply may also fluctuate greatly, increasing the difficulty of power grid dispatch. The harmonics and DC components generated by them will distort the grid voltage and reduce the power quality. It can be seen that once the above-mentioned illegal external devices forge their identities and access the power grid, it will affect the normal operation of the power grid and even destroy sensitive equipment, causing huge losses. Therefore, a more complex and safer access method should be adopted for such devices.

[0076] Considering the impact of device access on the power Internet of Things, the distance from the device to the aggregator and the power (maximum power generation, storage, and power consumption) are selected as the judgment indicators, and the access devices are divided into two categories. When accessing, a one-way simple identity authentication method and a two-way more complex identity authentication method are used respectively. The specific operation is: normalize the distance and power respectively, and then multiply them with the corresponding proportion according to the actual situation, and the result is used as the final judgment indicator.

[0077] Register the new networked equipment on the server of the power grid networking platform based on the unclonable function;

[0078] The aggregator distinguishes the newly connected devices according to their classification and sends them to the gateway for judgment. The gateway designs one-way authentication and two-way authentication methods according to the judgment results to authenticate the low-level devices and high-level devices.

[0079] The aggregator sets several levels of tolerance based on the judgment indicators, sets different levels of tolerance for each network-connected device within the aggregator's area, and periodically extracts network-connected devices within each level in proportion for re-authentication to determine whether the power of the extracted devices within each level meets the preset threshold and whether the deviation from the initial distance of the aggregator meets the preset threshold;

[0080] The extracted devices that meet all the judgment conditions will undergo identity authentication again. The devices that pass the identity authentication will remain connected, and the devices that fail the authentication will be disconnected and the information will be deleted; the extracted devices that do not meet all the judgment conditions will be directly disconnected and the information will be deleted.

[0081] As a preferred implementation of this embodiment, the steps of collecting the power consumption of the new network device and the distance data from the aggregator, and calculating the judgment index of the new network device by normalizing and combining the weight are specifically as follows:

[0082] The collected data on the power consumption of new networked devices and their distance from the aggregator are normalized. The specific formula is as follows:

[0083]

[0084] In the formula, x′ and y′ are the normalized power and distance, x max The maximum power allowed for a new network device, y max The maximum distance allowed between a new network device and the aggregator;

[0085] The weight calculation judgment index is set according to the power of the new network device and the influence of the distance data from the aggregator. The specific calculation formula is as follows:

[0086] z=x′*k1+y′*k2

[0087] Where k1 and k2 are weight coefficients.

[0088] In this embodiment, if the calculated x' or y' value is greater than 1, the device is not allowed to access.

[0089] In actual situations, in large industrial areas, the equipment is far away from the aggregator, so the proportion of distance in the judgment index can be appropriately increased; in commercial areas, the power consumption of equipment varies greatly, so the proportion of power in the judgment index can be appropriately increased; in residential areas, distance and power consumption are relatively average, and the proportion can be k1+k2=1.

[0090] In large industrial areas, the equipment is far away from the aggregator, so the proportion k2 of the distance in the judgment index can be appropriately increased; in commercial areas, the power consumption of equipment varies greatly, so the proportion k1 of power in the judgment index can be appropriately increased; in residential areas, the distance and power consumption are relatively average, and the proportion can be k1=k2=0.5.

[0091] As a preferred implementation of this embodiment, the steps of registering the new network-connected device on the server of the power grid networking platform based on the unclonable function are specifically as follows:

[0092] When a new device joins the network, the device first sends its ID to the server;

[0093] The server generates an anonymous ID by calling a random oracle function based on the ID of the new device. * , and generate a random incentive C1, and the anonymous ID * It is sent to the new network device with random stimulus C1 for storage;

[0094] The newly connected device uses the random stimulus C1 to perform mapping calculation based on the unclonable function to generate a random response R1, and sends the random response R1 to the server;

[0095] The server stores an anonymous ID * , random stimulus C1 and random response R1, and a copy is sent to the gateway for storage;

[0096] New network devices will be anonymously IDed * , its own power and the distance to the aggregator are sent to the aggregator, where the judgment index is calculated and the new network devices are classified according to the judgment index.

[0097] In this embodiment, the registration process is as follows: Figure 2 shown.

[0098] As a preferred implementation of this embodiment, the aggregator makes a distinction based on the classification of the newly connected devices and sends it to the gateway for judgment. The specific steps are:

[0099] The newly connected device sends its ID to the aggregator, and the aggregator looks up the category to which the newly connected device belongs based on the device ID.

[0100] The aggregator will identify the anonymous ID of the corresponding device based on the ID and category of the newly connected device. * Make changes to anonymous IDs for high-level devices * Add a 0 to distinguish it from low-level devices;

[0101] The anonymous ID of the new device * It is sent to the gateway for judgment. A one-way authentication method is used for low-level devices, and a two-way authentication method is used for high-level devices.

[0102] In this embodiment, the type determination process of the new network device is as follows: Figure 3 shown.

[0103] As a preferred implementation of this embodiment, the one-way authentication method is specifically:

[0104] The gateway uses the anonymous ID of the new device * Find the saved random stimulus C1 and random response R1, generate a random number N1, and send the random stimulus C1 and random number N1 to the new network device; the new network device again performs mapping calculation based on the unclonable function to generate a complex random response R1', and generates a random number N1 according to the anonymous ID * , random number N1 and complex random response R1' are hashed to obtain the hash value hash1 of the new network device and sent back to the gateway;

[0105] At the gateway, a hash calculation is performed based on the new device ID, random number N1 and random response R1 to obtain the hash value hash at the gateway. It is then determined whether the hash value hash1 at the new device and the hash value hash at the gateway are the same. If they are the same, the authentication is successful, otherwise it fails.

[0106] As a preferred implementation of this embodiment, the two-way authentication method is specifically:

[0107] The gateway uses the anonymous ID of the new device * Find the saved random stimulus C1 and random response R1, and generate a random number N 2, , and using the random response R1 and the random number N 2, Random number N3, the specific calculation formula is as follows:

[0108]

[0109] At the same time, according to the anonymous ID * , random number N2 and random response R1 are hashed to obtain the hash value hash2 at the gateway, and the random stimulus C1, random number N3 and hash value hash2 at the gateway are sent to the device.

[0110] The newly connected device performs a mapping calculation based on the unclonable function again to generate a random response R1' and a random number N2'. The specific calculation formula is as follows:

[0111]

[0112] At the same time, according to the anonymous ID * , random number N2' and random response R1' are used for hash calculation to obtain hash value hash3 of the new device, and then determine whether hash value hash2 of the gateway is the same as hash value hash3 of the new device. If they are different, authentication fails. If they are the same, the device completes security authentication of the gateway and proceeds to the next authentication step.

[0113] The device generates random numbers X and C2, performs mapping calculation based on the unclonable function to generate a re-random response R2, performs hash calculation based on the random numbers X, N2′ and C2, the re-random response R1′ and the re-random response R2, and obtains the hash value hash4 at the gateway at this time; the random numbers X and C2, the hash value hash4 and The value is sent to the gateway;

[0114] The final random response R2' and hash value hash5 are calculated at the gateway according to the random response R1, the second random response R1 and the re-random response R2. The specific calculation formula is as follows:

[0115]

[0116] hash5=Hash(C2, R′2, R1, N1, X)

[0117] Determine whether hash4 and hash5 are the same. If they are different, the authentication fails. If they are the same, the gateway completes the security authentication of the device. At this point, the authentication of both parties is completed.

[0118] As a preferred implementation of this embodiment, the aggregator sets several levels of tolerance according to the judgment index, and the steps of setting different levels of tolerance for each network access device within the aggregator area are specifically as follows:

[0119] Three levels of tolerance are set based on the judgment indicators:

[0120] When the tolerance is level 3, the latitude and longitude 100,000th and 10,000th percentiles are mapped to 0, allowing the device to move within a range of about 100 meters.

[0121] When the tolerance is level 2, the latitude and longitude 100,000th percentile is mapped to 0, allowing the device to move within a range of approximately 10 meters;

[0122] When tolerance is level 1, the distance to the aggregator is not allowed to change.

[0123] In this embodiment, the implementation path of source-grid-load-storage integration requires the reasonable distribution of infrastructure in urban commercial areas, residential areas, areas with large industrial loads, and areas with superior new energy conditions to improve the system balancing ability. Here, aggregators are set up in different regions for access classification. There may be a phenomenon that the total number of devices that need to be accessed in some areas is too large, the total power is too large, etc., resulting in the aggregator's access security to the device cannot be fully guaranteed. In order to prevent the security problems that may be caused by this phenomenon, a re-authentication module can be designed. The aggregator sets different dynamic tolerances for different devices, and regularly extracts some devices in proportion for re-authentication. The extracted device sends the current power and network location to the aggregator. The aggregator first determines whether the network location and power are reasonable according to the tolerance level. If it is not reasonable, it will directly disconnect and delete the information, and it will need to re-register the next time it accesses. If it is reasonable, the corresponding authentication calculation will be performed. If the authentication is passed, the access will continue. If the authentication fails, the connection will be directly disconnected and the information will be deleted, and it will need to re-register the next time it accesses. This method can dynamically check the operation status of the device, including the change in the power and location of the device, grasp the characteristics of the device, and perform access authentication more accurately, with higher security. Three tolerance levels are set here. The judgment index (maximum power * distance) is divided into three parts according to size as the discrimination standard. The smaller the value, the lower the risk when accessing. The higher the tolerance level is set, the greater the distance the device is allowed to move. When the tolerance is level three, the latitude and longitude 100,000th and 10,000th percentiles are mapped to 0, and the device is allowed to move within a range of about 100 meters. When the tolerance is level two, the latitude and longitude 100,000th percentiles are mapped to 0, and the device is allowed to move within a range of about 10 meters. When the tolerance is level one, as long as the device network location changes slightly, it will be judged as unreasonable by the aggregator and disconnected. The specific steps are as follows:

[0124] The latitude and longitude of the device are unified as degrees, and are retained to the fifth decimal place, that is, the 100,000th place (approximately 10 meters accuracy). For example, if the judgment result is tolerance level 2, the 100,000th place of the latitude and longitude will be mapped to 0 when compared with the location at the time of registration. At this time, the change range of the latitude and longitude of the device is approximately 10 meters, and it will be judged unreasonable if it exceeds 10 meters.

[0125] If the longitude sent by the device to the aggregator is 116.451591 and the latitude is 39.971629, the tolerance mapping process is shown in Table 1 below.

[0126] longitude latitude Equipment is sent to aggregators 116.451591 39.971629 Aggregators retain 5 decimal places 116.45159 39.97163 Secondary Tolerance Mapping 116.45150 39.97160

[0127] Table 1 Tolerance mapping process

[0128] Embodiment 2:

[0129] A novel power system secure access resource optimization system based on unclonable functions, comprising:

[0130] In the new network device classification module, the aggregator collects the power consumption and distance data of the new network devices, calculates the judgment index of the new network devices by normalization and weight, and divides the new network devices into two categories: low-level devices and high-level devices according to the judgment index;

[0131] A new network device registration module is used to register new network devices on the server of the power grid networking platform based on an unclonable function;

[0132] New network device identity authentication module: The aggregator distinguishes the newly connected devices according to their classification and sends them to the gateway for judgment. The gateway designs one-way authentication and two-way authentication methods according to the judgment results to authenticate low-level devices and high-level devices.

[0133] In the module for judging the status of connected devices, the aggregator sets several levels of tolerance according to the judgment index, sets different levels of tolerance for each connected device within the aggregator's area, and periodically extracts connected devices in each level in proportion for re-authentication, judging whether the power of the extracted devices in each level meets the preset threshold and whether the deviation from the initial distance of the aggregator meets the preset threshold;

[0134] The identity re-authentication module for devices that have been connected to the network will re-authenticate the extracted devices that meet all the judgment conditions. Devices that pass the authentication will remain connected, while devices that fail the authentication will be disconnected and their information will be deleted. Extracted devices that do not meet all the judgment conditions will be directly disconnected and their information will be deleted.

[0135] Embodiment three:

[0136] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a new method for optimizing power system secure access resources based on an unclonable function as described in any embodiment of the present invention is implemented.

[0137] Embodiment 4:

[0138] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a novel power system secure access resource optimization method based on an unclonable function as described in any embodiment of the present invention.

[0139] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A new power system security access resource optimization method based on unclonable functions, characterized in that: The specific steps include: The aggregator collects the power consumption and distance data of the newly connected devices and calculates the judgment index of the newly connected devices by normalizing and combining weights. The newly connected devices are divided into two categories: low-level devices and high-level devices according to the judgment index. Register the new networked equipment on the server of the power grid networking platform based on the unclonable function; The aggregator distinguishes the newly connected devices according to their classification and sends them to the gateway for judgment. The gateway designs one-way authentication and two-way authentication methods according to the judgment results to authenticate the low-level devices and high-level devices. The aggregator sets several levels of tolerance based on the judgment indicators, sets different levels of tolerance for each network-connected device within the aggregator's area, and periodically extracts network-connected devices within each level in proportion for re-authentication to determine whether the power of the extracted devices within each level meets the preset threshold and whether the deviation from the initial distance of the aggregator meets the preset threshold; The extracted devices that meet all the judgment conditions will undergo identity authentication again. The devices that pass the identity authentication will remain connected, and the devices that fail the authentication will be disconnected and the information will be deleted; the extracted devices that do not meet all the judgment conditions will be directly disconnected and the information will be deleted.

2. The novel power system secure access resource optimization method based on unclonable functions according to claim 1 is characterized in that: The steps of collecting the power consumption of the new networked device and the distance data from the aggregator and calculating the judgment index of the new networked device by normalizing and combining the weights are as follows: The collected data on the power consumption of new networked devices and their distance from the aggregator are normalized. The specific formula is as follows: In the formula, x′ and y′ are the normalized power and distance, x max The maximum power allowed for a new network device, y max The maximum distance allowed between a new network device and the aggregator; The weight calculation judgment index is set according to the power of the new network device and the influence of the distance data from the aggregator. The specific calculation formula is as follows: z=x′*k1+y′*k2 Where k1 and k2 are weight coefficients.

3. The novel power system secure access resource optimization method based on unclonable functions according to claim 2 is characterized in that: The steps of registering the new networked device on the server of the power grid networking platform based on the unclonable function are specifically as follows: When a new device joins the network, the device first sends its ID to the server; The server generates an anonymous ID by calling a random oracle function based on the ID of the new device. * , and generate a random incentive C1, and the anonymous ID * It is sent to the new network device with random stimulus C1 for storage; The newly connected device uses the random stimulus C1 to perform mapping calculation based on the unclonable function to generate a random response R1, and sends the random response R1 to the server; The server stores an anonymous ID * , random stimulus C1 and random response R1, and a copy is sent to the gateway for storage; New network devices will be anonymously IDed * , its own power and the distance to the aggregator are sent to the aggregator, where the judgment index is calculated and the new network devices are classified according to the judgment index.

4. The novel power system secure access resource optimization method based on unclonable functions according to claim 3 is characterized in that: The aggregator makes a distinction based on the classification of the newly connected devices and sends it to the gateway for judgment. The specific steps are as follows: The newly connected device sends its ID to the aggregator, and the aggregator looks up the category to which the newly connected device belongs based on the device ID. The aggregator will identify the anonymous ID of the corresponding device based on the ID and category of the newly connected device. * Make changes to anonymous IDs for high-level devices * Add a 0 to distinguish it from low-level devices; The anonymous ID of the new device * It is sent to the gateway for judgment. A one-way authentication method is used for low-level devices, and a two-way authentication method is used for high-level devices.

5. The novel power system secure access resource optimization method based on unclonable functions according to claim 4 is characterized in that: The one-way authentication method is specifically: The gateway uses the anonymous ID of the new device * Find the saved random stimulus C1 and random response R1, generate a random number N1, and send the random stimulus C1 and random number N1 to the new network device; the new network device again performs mapping calculation based on the unclonable function to generate a complex random response R1 ’ , according to the anonymous ID * , random number N1 and complex random response R1' are hashed to obtain the hash value hash1 of the new network device and sent back to the gateway; At the gateway, a hash calculation is performed based on the new device ID, random number N1 and random response R1 to obtain the hash value hash at the gateway. It is then determined whether the hash value hash1 at the new device and the hash value hash at the gateway are the same. If they are the same, the authentication is successful, otherwise it fails.

6. The novel power system secure access resource optimization method based on unclonable functions according to claim 4 is characterized in that: The two-way authentication method is specifically: The gateway uses the anonymous ID of the new device * Find the saved random stimulus C1 and random response R1, and generate a random number N 2, , and using the random response R1 and the random number N 2, Random number N3, the specific calculation formula is as follows: At the same time, according to the anonymous ID * , random number N2 and random response R1 are hashed to obtain the hash value hash2 at the gateway, and the random stimulus C1, random number N3 and hash value hash2 at the gateway are sent to the device. The newly connected device performs a mapping calculation based on the unclonable function again to generate a random response R1' and a random number N2'. The specific calculation formula is as follows: At the same time, according to the anonymous ID * , random number N2' and random response R1' are used for hash calculation to obtain hash value hash3 of the new device, and then determine whether hash value hash2 of the gateway is the same as hash value hash3 of the new device. If they are different, authentication fails. If they are the same, the device completes security authentication of the gateway and proceeds to the next authentication step. The device generates random numbers X and C2, performs mapping calculation based on the unclonable function to generate a re-random response R2, performs hash calculation based on the random numbers X, N2′ and C2, the re-random response R1′ and the re-random response R2, and obtains the hash value hash4 at the gateway at this time; the random numbers X and C2, the hash value hash4 and The value is sent to the gateway; The final random response R2' and hash value hash5 are calculated at the gateway according to the random response R1, the second random response R1 and the re-random response R2. The specific calculation formula is as follows: hash5=Hash(C2, R′2, R1, N1, X) Determine whether hash4 and hash5 are the same. If they are different, the authentication fails. If they are the same, the gateway completes the security authentication of the device. At this point, the authentication of both parties is completed.

7. A magnetic wireless temperature measurement method with dual power backup power supply according to claim 6, characterized in that: The aggregator sets several levels of tolerance according to the judgment index, and the steps of setting different levels of tolerance for each network access device within the aggregator area are as follows: Three levels of tolerance are set based on the judgment indicators: When the tolerance is level 3, the latitude and longitude 100,000th and 10,000th percentiles are mapped to 0, allowing the device to move within a range of about 100 meters. When the tolerance is level 2, the latitude and longitude 100,000th percentile is mapped to 0, allowing the device to move within a range of approximately 10 meters; When tolerance is level 1, the distance to the aggregator is not allowed to change.

8. A new power system secure access resource optimization system based on unclonable functions, characterized in that: include: In the new network device classification module, the aggregator collects the power consumption and distance data of the new network devices, calculates the judgment index of the new network devices by normalization and weight, and divides the new network devices into two categories: low-level devices and high-level devices according to the judgment index; A new network device registration module is used to register new network devices on the server of the power grid networking platform based on an unclonable function; New network device identity authentication module: the aggregator distinguishes the newly connected devices according to their classification and sends them to the gateway for judgment; At the gateway, two authentication methods, one-way authentication and two-way authentication, are designed according to the judgment results to authenticate the identities of low-level devices and high-level devices; In the module for judging the status of connected devices, the aggregator sets several levels of tolerance according to the judgment index, sets different levels of tolerance for each connected device within the aggregator's area, and periodically extracts connected devices in each level in proportion for re-authentication, judging whether the power of the extracted devices in each level meets the preset threshold and whether the deviation from the initial distance of the aggregator meets the preset threshold; The identity re-authentication module for devices that have been connected to the network will re-authenticate the extracted devices that meet all the judgment conditions. Devices that pass the authentication will remain connected, while devices that fail the authentication will be disconnected and their information will be deleted. Extracted devices that do not meet all the judgment conditions will be directly disconnected and their information will be deleted.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the novel power system secure access resource optimization method based on unclonable functions as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a novel power system secure access resource optimization method based on an unclonable function as described in any one of claims 1 to 7 is implemented.

Images