Policy updating method, device and equipment of end-side equipment, medium and product

Abstract

The invention discloses a strategy updating method, device and equipment of end-side equipment, a medium and a product. The method comprises the following steps: when a newly-added strategy file corresponding to end-side equipment is received, encrypting the newly-added strategy file to obtain an encrypted strategy file, and performing hash processing on the encrypted strategy file to obtain a first hash value; determining a signature array corresponding to the encryption strategy file based on the first hash value, the current signature moment, a preset private key and a preset elliptic curve parameter; under the condition that the encryption strategy file meets a preset configuration condition, verifying the signature array to obtain a verification result; and under the condition that the verification result is consistent with a preset result, decrypting the encrypted strategy file to obtain a decrypted strategy file, and updating the strategy file in the end-side equipment based on the decrypted strategy file. According to the technical scheme provided by the embodiment of the invention, the effects of ensuring the integrity of the strategy file, improving the strategy updating safety of the end-side equipment and ensuring the operation stability of the equipment can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a policy update method, device, equipment, medium and product for edge devices. Background Art

[0002] With the rapid development of smart grids, the power grid includes not only traditional power generation, transmission and distribution facilities, but also a large number of intelligent edge devices. These devices include smart meters, distribution automation terminals, substation automation equipment, etc. They are distributed in every corner of the power grid and are responsible for data collection, monitoring, protection and control. In order to adapt to the ever-changing power grid operation environment and safety requirements, the operation strategies of these devices need to be regularly updated and optimized.

[0003] At present, the way to update the edge device policy is usually to transmit the policy file through the remote network. When the edge device receives the policy file, it updates the device's operation policy based on the policy file. However, since edge devices are widely distributed and usually in a relatively open network environment, there is a risk that the policy file may be tampered with, stolen or forged during transmission and application, affecting the security and stability of device operation. Summary of the invention

[0004] The present invention provides a policy update method, apparatus, device, medium and product for an edge device, so as to ensure the integrity of a policy file while improving the security of the edge device policy update, thereby achieving the effect of ensuring the security and stability of device operation.

[0005] According to one aspect of the present invention, a policy updating method for an edge device is provided, the method comprising:

[0006] When a new policy file corresponding to the end-edge device is received, the new policy file is encrypted to obtain an encrypted policy file, and the encrypted policy file is hashed to obtain a first hash value;

[0007] Determine a signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key, and the preset elliptic curve parameters;

[0008] When the encryption policy file meets the preset configuration conditions, verify the signature array to obtain a verification result;

[0009] When the verification result is consistent with the preset result, the encrypted policy file is decrypted to obtain a decrypted policy file, and the policy file in the edge device is updated based on the decrypted policy file.

[0010] According to another aspect of the present invention, a policy updating device for an edge device is provided, the device comprising:

[0011] A file encryption module is used to, when receiving a new policy file corresponding to the end-edge device, encrypt the new policy file to obtain an encrypted policy file, and perform hash processing on the encrypted policy file to obtain a first hash value;

[0012] A signature array determination module, used to determine the signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters;

[0013] A verification result determination module, used to verify the signature array and obtain a verification result when the encryption policy file meets the preset configuration conditions;

[0014] The decryption module is used to decrypt the encryption policy file to obtain a decryption policy file when the verification result is consistent with the preset result, and update the policy file in the edge device based on the decryption policy file.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0016] at least one processor; and a memory in communication with the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the policy update method for the edge device described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the policy update method for an edge device described in any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the policy update method for an edge device as described in any embodiment of the present invention.

[0020] The technical solution of the embodiment of the present invention is to encrypt the newly added policy file corresponding to the edge device when it is received to obtain the encrypted policy file, and hash the encrypted policy file to obtain a first hash value; determine the signature array corresponding to the encrypted policy file based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters; when the encrypted policy file meets the preset configuration conditions, verify the signature array to obtain a verification result; when the verification result is consistent with the preset result, decrypt the encrypted policy file to obtain a decrypted policy file, and update the policy file in the edge device based on the decrypted policy file, so as to solve the problem of low security and poor accuracy of policy update caused by network transmission of policy files and updating of operation policies of edge devices in the prior art, and realize that the newly added policy file corresponding to the edge device is first encrypted to obtain the encrypted policy file, and the encrypted policy file is hashed to obtain the first hash value, and then, in combination with the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters, the signature array corresponding to the encrypted policy file is determined to improve the encryption strength of the signature array. When the encrypted policy file meets the preset configuration conditions, the signature array is verified to ensure the integrity of the policy file. When the verification result is consistent with the preset result, the encrypted policy file is decrypted, and the policy file in the edge device is updated based on the decrypted policy file, thereby improving the security and accuracy of the edge device policy update and ensuring the security and stability of the device operation.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 This is a flow chart of a method for updating a policy of an edge device provided according to Embodiment 1 of the present invention;

[0024] Figure 2 This is a flow chart of a method for updating a policy of an edge device provided according to Embodiment 2 of the present invention;

[0025] Figure 3 This is a flow chart of a method for updating a policy of an edge device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 This is a flow chart of a method for updating a policy of an edge device provided according to a fourth embodiment of the present invention;

[0027] Figure 5 2 is a schematic diagram of the structure of a policy updating device for a terminal device provided according to Embodiment 5 of the present invention;

[0028] Figure 6 It is a structural schematic diagram of an electronic device for implementing the policy update method of the edge device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 This is a flow chart of a method for updating a policy of an edge device according to Embodiment 1 of the present invention. This embodiment is applicable to the case of securely updating a policy file of an edge device. The method can be executed by a policy updating device of an edge device. The policy updating device of the edge device can be implemented in the form of hardware and / or software. The policy updating device of the edge device can be configured in a computing device. Figure 1 As shown, the method includes:

[0033] S110. When a new policy file corresponding to the edge device is received, the new policy file is encrypted to obtain an encrypted policy file, and the encrypted policy file is hashed to obtain a first hash value.

[0034] Among them, the end-edge device can be a device in the power grid with functions such as collection, monitoring, protection, control and / or network connection. For example, the end-edge device can be a smart meter, a distribution automation terminal, a substation automation equipment, a feeder terminal device, an opening and closing terminal device, a distribution transformer terminal device, a data transmission unit, and a transformer temperature collection unit, etc. The above are examples, and the end-edge device is not limited in this embodiment. The newly added policy file can be a policy file for defining and managing device operation behaviors and permissions. For example, these files can contain policy information, configuration parameters, rule information or other setting information, so that the device can perform corresponding work according to the information in the file. The encrypted policy file can be a policy file that is encrypted from the newly added policy file.

[0035] In this embodiment, when the policy generation end generates a new policy configuration file for a certain edge device, the policy configuration file can be used as a new policy file for the edge device. That is to say, the new policy file is a policy file generated by the policy generation end and is not configured in the edge device. The new policy file can be encrypted using a symmetric encryption algorithm to obtain an encrypted policy file. For example, the symmetric encryption algorithm can be a DES (Data Encryption Standard) algorithm, a 3DES (Triple Data Encryption) algorithm, an AES (Advanced Encryption Standard) algorithm, and the like. Furthermore, the SHA-512 algorithm (Secure Hash Algorithm) can be used to hash the encrypted policy file to obtain a hash value as the first hash value. The digital signature of the encrypted policy file is determined based on the first hash value to verify the integrity and security of the policy file to ensure that the policy file has not been tampered with.

[0036] Exemplarily, the calculation formula for determining the first hash value can be expressed as: H(C)=SHA-512(C); wherein SHA-512() represents the objective function of the SHA-512 algorithm, and C represents the encryption policy file; H(C) represents the first hash value, and the length of the first hash value is 512 bits (i.e., 64 bytes).

[0037] In this embodiment, the newly added policy file is encrypted to obtain an encrypted policy file, including: generating an initialization vector and a random key based on a random number generation algorithm; converting the newly added policy file to obtain byte data; and encrypting the byte data based on the initialization vector and the random key to obtain an encrypted policy file.

[0038] The random number generation algorithm may be at least one of a pseudo-random number generator, a true random number generator, and a cryptographically secure random number generator. The vector values ​​of the initialization vector and the random key may be different; the vector lengths of the initialization vector and the random key are the same, for example, the vector lengths may both be 128 bits (i.e., 16 bytes). The data structure of the byte data is a byte array, and the byte data includes a plurality of block data, each block data occupies a preset number of bytes of the entire byte array. For example, the size of each block data may be 128 bits.

[0039] Specifically, a random number generation algorithm can be used to randomly generate two random vectors, one random vector as an initialization vector, and the other random vector as a random key. Read the file content in the newly added policy file, convert the file content into binary data, store it in a byte array, and obtain byte data. Then, the byte data is divided into blocks according to the block size (such as 128 bits) of the AES algorithm to obtain multiple block data. If the byte data is not an integer multiple of the block size, the byte data can be padded to meet the block size requirements. Further, the AES algorithm can be used in combination with the CBC (Cipher Block Chaining) mode to encrypt multiple block data respectively to obtain the encrypted data corresponding to each block data in the byte data. When encrypting the first block data, the initialization vector can be used to encrypt the first block data to obtain the encrypted data corresponding to the first block data. When encrypting each block data after the first block data, the random key and the encrypted data corresponding to the block data before the current block data can be used to encrypt the current block data. For example, the encrypted data of the current block data and the previous block data are subjected to a bitwise XOR operation, and the data after the bitwise XOR operation is encrypted using the second random vector to obtain the encrypted data corresponding to the current block data. The encrypted data corresponding to each block data can be integrated to obtain an encrypted policy file. After encryption, the original newly added policy file is converted into an encrypted policy file and cannot be used directly. The encrypted policy file can only be decrypted by having the same random vector and performing the corresponding restoration process.

[0040] Exemplarily, the calculation formula for determining the random key can be expressed as: K = RandomBytes(128); wherein RandomBytes() represents the objective function of the random number generation algorithm, and K represents the random key, which is 128 bits in length. At the same time, the random number generation algorithm is used to generate the initialization vector IV, which is also 128 bits in length. The calculation formula for determining the encryption policy file can be expressed as: C = AES_CBC_Encrypt(P_bytes, K, IV); wherein C represents the encryption policy file; P_bytes represents byte data; AES_CBC_Encrypt represents the objective function of the AES algorithm. The objective function of the AES algorithm can be expressed as; C i =E K (P i ⊕C i-1 )(i=1,2,…,n); where P i Indicates the i-th block data in the byte data; C i Indicates the encrypted data corresponding to the i-th block data; E K Represents an AES encryption operation using a random key K; C i-1 represents the encrypted data corresponding to the i-1th block data (the encrypted data corresponding to the first block data is the initialization vector, i.e. C0 = IV); ⊕ represents the bitwise XOR operation. All encrypted Ci are combined to form the final encryption strategy file C.

[0041] The technical solution provided in this embodiment generates a random key and an initialization vector, and then adopts the AES-CBC mode to encrypt the newly added policy file. In the CBC mode, each block data is XOR-operated with the encrypted data of the previous block data during encryption, so that the encryption result of the same block data is different each time, thereby ensuring the security of the policy file during storage and transmission.

[0042] S120. Determine a signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key, and the preset elliptic curve parameters.

[0043] Among them, the preset private key refers to the key used for signing. The preset elliptic curve parameters refer to the mathematical parameters describing the elliptic curve, and the preset elliptic curve parameters include order and base point. The base point of the preset elliptic curve parameters is a fixed point on the elliptic curve corresponding to the preset elliptic curve parameters. The order can refer to the number of all points on the elliptic curve, or it can be the order of the base point, which refers to the number of points that can be generated by addition operations starting from the base point. The order and base point depend on the selected elliptic curve, and this embodiment does not specifically limit them. The current signing moment can be a timestamp to ensure the timeliness of the signature array. The signature array includes at least two signature values, the first signature value can be a signature value determined based on the first hash value, the current signing moment, and the preset elliptic curve parameters; the second signature value can be a signature value determined based on the first hash value, the first signature value, the preset private key, and the preset elliptic curve parameters.

[0044] In this embodiment, a preset private key and preset elliptic curve parameters can be used to digitally sign the first hash value at the current signing time and the current signing time to generate a signature array corresponding to the encryption policy file to verify the correctness and integrity of the encryption policy file based on the signature array.

[0045] In this embodiment, based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters, the signature array corresponding to the encryption policy file is determined, including: a message authentication code algorithm based on a hash function determines a random vector according to the first hash value and the current signing time; determines a first signature value based on the random vector and the preset elliptic curve parameters; determines a second signature value based on the preset private key, the first signature value, the first hash value, the random vector and the preset elliptic curve parameters; determines a signature array based on the first signature value and the second signature value.

[0046] The message authentication code algorithm based on the hash function may be a message authentication code algorithm based on the SHA-256 hash function (HMAC-SHA-256 algorithm), which is used to combine the hash function and the key to generate a message authentication code.

[0047] In this embodiment, the first hash value can be used as the key, the current signing time can be used as the message, and the SHA-256 algorithm can be used to perform a hash operation on the key and the message to generate a 256-bit message authentication code, which is a random vector. For example, the key and the message are combined, such as the combination process can be an XOR process or a splicing process, and the combined key and message are subjected to a first hash operation to obtain the result of the first hash operation; the result of the first hash operation and the key (i.e., the first hash value) are used to perform a second hash operation, and the result of the second hash operation is used as the message authentication code. Furthermore, based on the Elliptic Curve Digital Signature Algorithm (ECDSA), the random vector can be digitally signed using preset elliptic curve parameters to obtain a first signature value. Further, the first signature and the preset private key can be multiplied to obtain a first product value; the first hash value and the first product value can be summed to obtain a sum value; the modular inverse of the random vector under the order of the preset elliptic curve parameter is calculated as the first modular inverse, that is, the product value of the first modular inverse and the random vector divided by the order is equal to 1. The sum value and the first modular inverse are multiplied to obtain a second product value; the second product value and the order of the preset elliptic curve parameter are modularly operated to obtain a second signature value, that is, the remainder obtained by dividing the second product value by the order is used as the second signature value. Further, the first signature value and the second signature value can be used as two signature values ​​in the signature array.

[0048] Exemplarily, the calculation formula for determining the random vector can be expressed as: k = HMAC-SHA-256 (H (C) || T); where: HMAC-SHA-256 represents the objective function of the message authentication code algorithm based on the hash function; H (C) represents the first hash value; T represents the current signing time; k represents the generated signature random number, that is, the random vector. The calculation formula for determining the second signature value can be expressed as: s = k -1 (H(C)+r·d)mod n; where: k -1 represents the modular inverse of the random vector k under the order n of the preset elliptic curve parameters, that is, the first modular inverse; mod represents the modular operation, that is, the remainder operation; d represents the preset private key; H(C) represents the first hash value; n represents the order of the preset elliptic curve parameters; r represents the first signature value; the final signature array is a tuple consisting of r and s, that is, (r, s).

[0049] The technical solution provided in this embodiment can ensure that each signature moment and hash value are different by using the current signature moment and the first hash value to determine the random vector, so that the random vector determined each time has high randomness and high security, thereby enhancing the security of the signature value. At the same time, the first signature value is determined by the random vector and the preset elliptic curve parameters, and the second signature value is determined by the preset private key, the first signature value, the first hash value, the random vector and the preset elliptic curve parameters, further enhancing the security of the signature array and ensuring the integrity of the policy file.

[0050] In this embodiment, determining the first signature value based on the random vector and the preset elliptic curve parameters includes: determining the elliptic curve coordinates based on the random vector and the base point of the preset elliptic curve parameters; determining the first signature value based on the coordinate value of the first coordinate axis in the elliptic curve coordinates and the order of the preset elliptic curve. The first coordinate axis may be an X coordinate axis.

[0051] Specifically, the random vector and the base point of the preset elliptic curve parameters can be multiplied to obtain the elliptic curve coordinates; the horizontal coordinate value on the X-axis of the elliptic curve coordinates is extracted, and a modular operation is performed on the horizontal coordinate value and the order of the preset elliptic curve, and the remainder obtained is used as the first signature value.

[0052] Exemplarily, the calculation formula for determining the elliptic curve coordinates may be: k = k·G; where k represents a random vector; G represents a base point; P k represents the elliptic curve coordinates, P k The coordinates of (x k ,y k ), where x k YesP k The abscissa value on the elliptic curve. The calculation formula for determining the first signature value may be: r = x kmod n; wherein: n represents the order of the preset elliptic curve parameters; mod represents the modular operation; r represents the first signature value. The technical solution provided in this embodiment generates the first signature value in this way, so as to calculate the second signature value s based on the preset private key, the first hash value, the random vector, the first signature value r and the order of the elliptic curve; and obtains the final signature array (r, s) based on the calculated signature values ​​r and s, which can improve the security of the signature array.

[0053] S130. When the encryption policy file meets the preset update condition, the signature array is verified to obtain a verification result.

[0054] The preset update condition may refer to a condition for determining whether to configure the encryption policy file to the edge device.

[0055] In this embodiment, it is possible to determine whether the encryption policy file meets the preset update conditions. Optionally, the preset update conditions may be the triggering of a scheduled update task; or the determination of the signature array corresponding to the encryption policy file; or, the receipt of an instruction to configure the encryption policy file to the edge device; or, the edge device receives the encryption policy file and its corresponding encryption policy file. In this way, when the encryption policy file meets the preset update conditions, the signature array may be verified using the public key corresponding to the preset private key; or, it may be determined whether each signature in the signature array is within a preset interval to verify its validity. If the verification is valid, the verification result is determined to be a passed verification; if the verification is invalid, the verification result is determined to be a failed verification.

[0056] S140: When the verification result is consistent with the preset result, the encrypted policy file is decrypted to obtain a decrypted policy file, and the policy file in the edge device is updated based on the decrypted policy file.

[0057] In this embodiment, if the verification result is consistent with the preset result, it means that the signature array verification is successful. At this time, the encryption policy file can be decrypted using a random key and an initialization vector. Through the decryption operation, the encryption policy file is restored to the original newly added policy file and used as a decryption policy file. Furthermore, the decryption policy file can be configured in the edge device to implement the update and upgrade of the policy file in the edge device. Exemplarily, the calculation formula for determining the decryption policy file can be expressed as: P = AES-Decrypt (E, K, IV); wherein: AES-Decrypt represents a function for decryption using the AES algorithm; P represents the newly added policy file after decryption, that is, the decryption policy file; E represents the received encryption policy file; K represents the shared random key; IV represents the initialization vector.

[0058] The technical solution provided by the embodiment of the present invention is as follows: when a new policy file corresponding to an edge device is received, the new policy file is encrypted to obtain an encrypted policy file, and the encrypted policy file is hashed to obtain a first hash value; based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters, the signature array corresponding to the encrypted policy file is determined; when the encrypted policy file meets the preset configuration conditions, the signature array is verified to obtain a verification result; when the verification result is consistent with the preset result, the encrypted policy file is decrypted to obtain a decrypted policy file, and the policy file in the edge device is updated based on the decrypted policy file, which solves the problem of low security and poor accuracy of policy update caused by updating the operation policy of the edge device based on the network transmission policy file in the prior art, and realizes that the new policy file corresponding to the edge device is first encrypted to obtain the encrypted policy file, and the encrypted policy file is hashed to obtain the first hash value, and then, in combination with the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters, the signature array corresponding to the encrypted policy file is determined to improve the encryption strength of the signature array. When the encrypted policy file meets the preset configuration conditions, the signature array is verified to ensure the integrity of the policy file. When the verification result is consistent with the preset result, the encrypted policy file is decrypted, and the policy file in the edge device is updated based on the decrypted policy file, thereby improving the security and accuracy of the edge device policy update, thereby ensuring the security and stability of the device operation.

[0059] Embodiment 2

[0060] Figure 2 This is a flow chart of a method for updating a policy of an edge device according to Embodiment 2 of the present invention. Based on the above embodiment, "S130" is further introduced. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same as or corresponding to the above embodiment are not repeated here.

[0061] like Figure 2 As shown, the method specifically comprises the following steps:

[0062] S210. When a new policy file corresponding to the edge device is received, the new policy file is encrypted to obtain an encrypted policy file, and the encrypted policy file is hashed to obtain a first hash value.

[0063] S220. Determine a signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key, and the preset elliptic curve parameters.

[0064] S230. When the encryption policy file meets the preset update condition, determine whether the first signature value and the second signature value in the signature array are within the preset range. If not, execute step S240; if so, execute step S250.

[0065] Among them, the preset range is determined based on the order of the preset elliptic curve parameters and a preset value. The preset value can be 1, and the preset range can be [1, order).

[0066] In this embodiment, it can be determined whether the first signature value and the second signature value in the signature array are within the preset range. If so, execute step S250; if not, determine that the verification result is verification failed.

[0067] Exemplarily, when the edge device receives the encryption policy file and the signature array sent by the policy generation end, it can be determined whether the first signature value r and the second signature value s are within the preset range [1, n). If 1 ≤ r < n and 1 ≤ s < n, execute step S250 to calculate the second hash value H(E) of the received encryption policy file using the SHA-512 algorithm; otherwise, directly determine that the signature array is invalid, that is, the verification result is verification failed. Among them, n represents the order.

[0068] S240. Determine that the verification result is verification failed.

[0069] S250. Perform hash processing on the encryption policy file to obtain the second hash value.

[0070] In practical applications, when it is determined that both the first signature value and the second signature value in the signature array are within the preset range, the SHA-512 algorithm can be used to perform hash processing on the encryption policy file to obtain a 512-bit (i.e., 64-byte) hash value as the second hash value.

[0071] S260. Determine the first intermediate value based on the preset elliptic curve parameters, the second hash value, the preset public key, the first signature value, and the second signature value.

[0072] Among them, the preset public key corresponds to the preset private key.

[0073] In this embodiment, a verification value can be obtained using the preset elliptic curve parameters, the second hash value, the preset public key, the first signature value, and the second signature value, and used as the first intermediate value. The first intermediate value can be determined by: determining the inverse element based on the order of the preset elliptic curve parameters and the second signature value; determining the second intermediate value based on the inverse element, the second hash value and the order; determining the third intermediate value based on the inverse element, the first signature value and the order; determining the first intermediate value based on the preset elliptic curve parameters, the preset public key, the second intermediate value and the third intermediate value. The second intermediate value and the third intermediate value are two integers, corresponding to the weights of the hash value and the signature value, respectively.

[0074] Specifically, the modular inverse of the second signature value under the order of the preset elliptic curve parameter can be calculated as the second modular inverse; the modular inverse of the second modular inverse under the order is calculated as the inverse element. That is, the product value of the second modular inverse and the second signature value divided by the order is equal to 1; the product value of the inverse element and the second modular inverse divided by the order is equal to 1. Further, the inverse element and the second hash value can be multiplied to obtain a third product value, the third product value and the order are subjected to a modular operation, and the remainder obtained is used as the second intermediate value. The inverse element and the second signature value are multiplied to obtain a fourth product value, the fourth product value and the order are subjected to a modular operation, and the remainder obtained is used as the third intermediate value. Further, the first intermediate value is determined in combination with the preset elliptic curve parameter, the preset public key, the second intermediate value and the third intermediate value.

[0075] Exemplarily, the calculation formula for determining the inverse element can be expressed as: w = s -1 mod n;s -1 represents the inverse element of the second signature value s at order n, that is, s -1 . w represents the second modular inverse s -1 The inverse element at order n. The calculation formula for determining the second intermediate value u1 can be expressed as: u1 = H(E)·w mod n; H(E) represents the second hash value. The calculation formula for determining the third intermediate value u2 can be expressed as: u2 = r·w mod n; r represents the second signature value.

[0076] In this embodiment, the first intermediate value is determined based on the preset elliptic curve parameters, the preset public key, the second intermediate value and the third intermediate value, including: determining the verification point coordinates based on the base point of the preset elliptic curve parameters, the preset public key, the second intermediate value and the third intermediate value; determining the first intermediate value based on the verification point coordinates and the order of the preset elliptic curve parameters.

[0077] In practical applications, the base point of the preset elliptic curve parameter and the second intermediate value may be multiplied to obtain a fifth product value, and the preset public key and the third intermediate value may be multiplied to obtain a sixth product value. The fifth product value and the sixth product value are summed to obtain the verification point coordinates on the elliptic curve. The abscissa under the first coordinate axis is extracted from the verification point coordinates. A modulo operation is performed on the abscissa and the order of the preset elliptic curve parameter, and the remainder obtained is used as the first intermediate value.

[0078] Exemplarily, the calculation formula for determining the verification point coordinates can be expressed as: v =u1·G+u2·PK; where P v represents the coordinates of the verification point; u1 represents the second intermediate value; u2 represents the third intermediate value; G represents the base point; PK represents the preset public key; · represents the operator symbol of scalar multiplication. v Extract the horizontal coordinate x from v , the calculation formula for determining the first intermediate value can be expressed as: j = x v mod n; n represents the order, j represents the first intermediate value. If the first intermediate value and the second signature value are consistent, the verification result is determined to be the preset result, that is, the signature verification is successful. If the two are inconsistent, the verification result is determined to be a verification failure, that is, the signature verification fails. At this time, the end-edge device refuses to use the policy file and records a log.

[0079] S270: When the first intermediate value is consistent with the second signature value, determine that the verification result is a preset result.

[0080] Among them, the preset result is verification passed.

[0081] Specifically, the first intermediate value and the second signature value may be compared, and if the two are consistent, the verification result is determined to be a preset result. If the two are inconsistent, the verification result is determined to be verification failure.

[0082] S280: When the verification result is consistent with the preset result, the encrypted policy file is decrypted to obtain a decrypted policy file, and the policy file in the edge device is updated based on the decrypted policy file.

[0083] The technical solution provided in this embodiment performs hash processing on the encryption policy file when the first signature value and the second signature value in the signature array are within a preset range to obtain a second hash value, and then determines the first intermediate value based on the preset elliptic curve parameters, the second hash value, the preset public key, the first signature value and the second signature value, and determines that the verification result is verification passed when the first intermediate value is consistent with the second signature value.

[0084] Embodiment 3

[0085] Figure 3This is a flow chart of a policy update method for an edge device according to Embodiment 3 of the present invention. Based on the above embodiments, before updating the policy file in the edge device based on the decryption policy file, the decryption policy file can also be detected based on a detection method of at least one detection dimension, so that if the detection passes, the policy file in the edge device is updated based on the decryption policy file. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same as or corresponding to the above embodiments are not repeated here.

[0086] like Figure 3 As shown, the method specifically comprises the following steps:

[0087] S310: Detect the decryption policy file based on a detection method of at least one detection dimension.

[0088] Among them, the detection dimensions include at least file header detection dimension, field detection dimension, nested structure detection dimension, parameter compliance detection dimension, dependency detection dimension, context detection dimension, configuration conflict detection dimension and environment adaptability verification dimension.

[0089] In the case where the detection dimension includes the file header detection dimension, the method for detecting the decryption strategy file can be: confirming whether the file type and format of the decryption strategy file meet the preset requirements; or, checking whether the file header of the decryption strategy file contains a predetermined identifier. If so, determining that the detection result under the file header detection dimension is a passed detection; if not, determining that the detection result is a failed detection, so as to ensure the correctness of the decryption strategy file.

[0090] In the case where the detection dimension includes the field detection dimension, the method for detecting the decryption policy file can be: the field order, field type and data length in the decryption policy file can be verified to be in accordance with the predefined format. If so, the detection result under the field detection dimension is determined to be passed, otherwise, the detection result under the field detection dimension is determined to be failed. For example, a rule-based parser can be used to check whether the field type (such as string, number, Boolean value) in the decryption policy file matches the expectation according to the predefined JSON / YAML / XMLschema rules. For example, the policy configuration field max_connections (maximum number of connections) should be an integer. If it is found to be a string during parsing, the format verification fails, that is, the detection result under the field detection dimension is failed. Alternatively, a pattern matching-based verification method is used to check whether the field content in the decryption policy file conforms to the predetermined format. For example, assuming that a date field expiration_date in the policy configuration file must conform to the yyyy-mm-dd format, a regular expression can be used for matching to determine whether the date field content conforms to the predetermined format.

[0091] In the case where the detection dimension includes a nested structure detection dimension, the method for detecting the decryption policy file can be: verifying the nested structure in the decryption policy file, such as checking whether the format of JSON, XML, etc. is correct. If so, the detection result is determined to be a passed detection, and if not, the detection result is determined to be a failed detection, so as to ensure the accuracy of the decryption policy file. Exemplarily, for multi-layer nested configuration items in the decryption policy file (such as JSON or XML format), it can be recursively verified whether the structure of each layer meets the predetermined rules. For example, a tree structure validator can be constructed to automatically check the dependency and hierarchical order of parent-child nodes in the decryption policy file.

[0092] In the case where the detection dimension includes the parameter compliance detection dimension, the method for detecting the decryption policy file can be: checking whether the parameters in the decryption policy file meet the preset compliance conditions, for example, whether max_connections exceeds the maximum value supported by the edge device. If so, it is determined that the detection result under the parameter compliance detection dimension is failure to pass the detection. At this time, a warning can be triggered or the application of the policy can be refused to ensure that the range or value domain of each parameter value in the file meets the limitations of the current environment of the edge device.

[0093] In the case where the detection dimension includes the dependency detection dimension, the method of detecting the decryption policy file may be: verify whether there is incompatibility in the dependencies in the decryption policy file, for example, some fields in the policy file may depend on the values ​​of other fields, such as network_timeout (network timeout) depends on the size of max_connections. When max_connections is set to 0, network_timeout should not be a valid value. If network_timeout is a valid value, it is determined that the detection result under the dependency detection dimension is a failure to pass the detection.

[0094] In the case where the detection dimension includes the context detection dimension, the method for detecting the decryption policy file can be: detecting the decryption policy file according to the current state or environment configuration of the edge device. For example, if the edge device is in a low load state, the power_saving_mode configuration item should be enabled and should not be configured to be disabled. If the power_saving_mode configuration item in the decryption policy file is disabled, it is determined that the detection result under the context detection dimension is a detection failure.

[0095] In the case where the detection dimension includes the configuration conflict detection dimension, the method for detecting the decryption policy file may be: parsing the decryption policy file and extracting the key information therein, which includes but is not limited to the fields and values ​​of the policy configuration. For example, assuming that the decryption policy file is in JSON format, the fields may include max_connections (indicating the maximum number of connections allowed, the number of other devices that can be connected at the same time), timeout (indicating the timeout of idle connections), security_level (indicating the security level), etc. Obtain the current status of the edge device (such as the current configuration, hardware capabilities, performance load, etc.) and compare it with the key information in the decryption policy file. Check whether the configuration value of the key information conflicts with the existing settings of the edge device. For example, the new configuration value requires the device to enable an unsupported hardware function, or the configured resource limit exceeds the current carrying capacity of the device. At this time, it can be determined that the detection result under the configuration conflict detection dimension is detection failure.

[0096] In this embodiment, it is also possible to detect whether there is a conflict in the configuration information of the decryption policy file based on a preset conflict detection condition. Optionally, the preset conflict detection condition may include but is not limited to at least one of the following: resource conflict detection condition: such as the max_connections configuration exceeds the maximum number of connections supported by the device; compatibility conflict detection condition: such as certain security protocol configurations in the new policy are incompatible with the device hardware or existing software versions; logical conflict detection condition: such as setting an unreasonable timeout parameter (timeout is too short, resulting in frequent reconnections).

[0097] For example, suppose the maximum number of connections supported by the device is max_supported_connections, and the maximum number of connections required in the decryption policy file is max_connections. If max_connections exceeds the maximum number of connections supported by the device, there is a conflict.

[0098] The calculation formula for this conflict detection can be expressed as:

[0099]

[0100] Among them, max_connections indicates the maximum number of connections in the decryption policy file;

[0101] max_supported_connections indicates the maximum number of connections currently supported by the end device; if

[0102] Conflict max_connections If 1, it indicates a conflict; if Conflict max_connections A value of 0 indicates no conflict.

[0103] For another example, assume that the minimum timeout supported by the edge device is min_timeout_limit. If the timeout in the decryption policy file is less than the minimum value, there is a conflict. The calculation formula for this conflict detection can be expressed as:

[0104]

[0105] Where: timeout indicates the timeout in the decryption policy file; min_timeout_limit indicates the minimum timeout allowed by the edge device; if Conflict timeout If 1, it indicates a conflict; if Conflict timeout A value of 0 indicates no conflict.

[0106] For another example, assuming that the minimum security level of the device is min_security_level, if the security level security_level in the decryption policy file is lower than the minimum security level, there is a conflict. The calculation formula for this conflict detection can be expressed as:

[0107]

[0108] Where: security_level indicates the security level in the decryption policy file; min_security_level indicates the minimum security level supported by the edge device; if Conflict security_level If 1, it indicates a conflict; if Conflict security_level A value of 0 indicates no conflict.

[0109] It should be noted that if the conflicts among multiple configuration parameters in the decryption policy file affect the resources of the edge device (such as memory, CPU), these conflicts can be weighted according to the degree of impact. For example, the conflict of configuring max_connections may be more serious, while the conflict of timeout has a smaller impact, and different weights can be assigned; the final detection result under the configuration conflict detection dimension can be determined based on the detection results of each conflict type, and the calculation formula can be expressed as: Where: w i Indicates the weight of each conflict type; i Indicates the detection result of each conflict type (1 or 0); Conflict Weighted Indicates the final test result.

[0110] It should also be noted that the preset conflict detection conditions can be adjusted according to the update of the edge device or new hardware features. Machine learning algorithms (such as support vector machines, decision trees, etc.) can be used to dynamically adjust the preset conflict detection conditions to improve the accuracy and flexibility of conflict detection.

[0111] By using the above-mentioned preset conflict detection conditions to perform conflict detection on the decryption policy file under the configuration conflict detection dimension, it can be ensured that potential conflict issues can be fully checked before the policy file is applied in the edge device. By combining factors such as resource limitations, hardware compatibility, and security requirements, potential configuration conflicts can be detected and fed back in real time to ensure the normal operation and security of the device. It should be noted that a conflict detection engine can also be built, through which the conflict detection engine searches for interdependencies in the decryption policy file and compares their values ​​to detect conflicts and determine the detection results under the configuration conflict detection dimension.

[0112] In this embodiment, when the detection dimension includes the environmental adaptability verification dimension, the method for detecting the decryption policy file can be: for different edge device models and firmware versions, check whether the decryption policy file is compatible with the hardware and software environment of the current edge device. If compatible, the detection result under the environmental adaptability verification dimension is determined to be a passed detection; otherwise, the detection result is a failed detection. For example, assuming that there are multiple versions of the network configuration of the edge device, verify whether the network parameters in the decryption policy file support the network hardware interface of the current edge device. If supported, the detection passes.

[0113] For example, assume that the resource allocation of CPU and memory needs to meet a certain proportional relationship, that is, cpu limit +memory limit ≤total resources ; Where: cpu limit Indicates the specified CPU resource allocation percentage; memory limit Indicates the specified memory resource allocation percentage; total resources Indicates the total resources of the edge device. If the ratio between cpu_limit (CPU limit) and memory_limit (memory limit) in the decryption policy file does not satisfy this inequality, it means that the content of the decryption policy file is incorrect, which will lead to unreasonable resource allocation and affect device performance or security.

[0114] It should be noted that the test results under at least one test dimension can be recorded in the log and a verification report can be generated for subsequent audit and analysis. For example, the log may include but is not limited to: whether the format verification is passed, if it fails, the detailed record of the error location and type; content verification results, including specific legality detection, conflict detection, etc.; the calculation formula used in the verification process and its results.

[0115] S320: When the detection result in at least one detection dimension is detection passed, update the policy file in the edge device based on the decryption policy file.

[0116] In this embodiment, when the detection result under all or part of the detection dimensions is detection pass, the decryption policy file can be updated to the edge device to replace the old policy file on the edge device and apply the new policy file.

[0117] The technical solution provided in this embodiment detects the decryption policy file through a detection method based on at least one detection dimension. When the detection result under at least one detection dimension is a passed detection, the policy file in the edge device is updated based on the decryption policy file, thereby ensuring the correctness and completeness of the content of the decryption policy file, thereby ensuring that the edge device uses the policy file in actual operation as expected and ensuring the stability of the device operation.

[0118] Embodiment 4

[0119] Figure 4 It is a flowchart of a policy update method for an edge device provided according to Embodiment 4 of the present invention. On the basis of the aforementioned embodiment, before updating the policy file in the edge device based on the decryption policy file, a virtual operating environment corresponding to the edge device can also be constructed; the decryption policy file is run in the virtual operating environment to obtain monitoring data under multiple monitoring indicators, so that when the monitoring data meets the preset operating conditions, the policy file in the edge device is updated based on the decryption policy file. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same as or corresponding to the above embodiments are not repeated here.

[0120] like Figure 4 As shown, the method specifically comprises the following steps:

[0121] S410: Build a virtual operating environment corresponding to the edge device.

[0122] In this embodiment, virtualization technology (such as VMware, Hyper-V, KVM) or container technology (such as Docker, Kubernetes) can be used to create a virtual operating environment similar to the edge device; or an isolated virtual environment or sandbox environment can be created in the edge device as a virtual operating environment. This allows the decryption policy file to be run in the virtual operating environment, simulating the execution of the new policy without interfering with the normal operation of the edge device.

[0123] Specifically, the way to build a virtual operating environment corresponding to the edge device can be: deploy a lightweight virtualization technology (such as container-based virtualization) in the edge device, which can simulate the configuration of the device hardware and software, allowing the simulation policy to run on the "virtual device" and use the container as a sandbox environment. The resources configured in the sandbox environment (such as CPU, memory, disk I / O, network bandwidth, etc.) and the current workload of the device should match the resource status of the actual edge device to ensure that the virtual operating environment has sufficient similarity with the real environment by real-time monitoring of the device status and performance.

[0124] S420: Run the decryption policy file in the virtual operating environment to obtain monitoring data under multiple monitoring indicators, so that when the monitoring data meets the preset operating conditions, the policy file in the end-edge device is updated based on the decryption policy file.

[0125] The monitoring indicators include, but are not limited to, CPU usage, memory usage, network traffic, response time, error rate, etc. The preset operating conditions can be used to determine whether the expected operating data of the decryption policy file meets the expected conditions. For example, the preset operating conditions can include performance thresholds, security standards, stability requirements, etc.

[0126] In this embodiment, the decryption policy file can be deployed to a virtual operating environment, loaded and executed in the virtual operating environment, and its operation on a real edge device can be simulated. The monitoring data of the decryption policy file under multiple monitoring indicators can be determined based on the policy operation data at runtime. Furthermore, it can be determined whether the monitoring data under each monitoring indicator meets the preset operating conditions. If so, the actual edge device can be further updated based on the decryption policy file to replace the old policy file. If not, the decryption policy file is not used.

[0127] Optionally, the monitoring indicators include at least system resource consumption indicators, response delay indicators, system stability indicators, security vulnerability indicators, etc. Among them, the monitoring data under the system resource consumption indicators are used to reflect the consumption of resources such as CPU, memory, disk and network of the device during the execution of the policy, for example, whether there is excessive resource consumption, memory leakage or excessive CPU load. The monitoring data under the response delay indicators are used to reflect whether the device response time (such as request response, data transmission delay) is within a reasonable range after the policy is applied. If the delay is too high, it means that the policy may cause performance bottlenecks. The monitoring data under the system stability indicators are used to reflect problems such as crashes, abnormal restarts or resource conflicts during the policy simulation operation, which can be analyzed through crash logs, error reports, etc. The monitoring data under the security vulnerability indicators can be used to detect whether new security vulnerabilities have occurred through integrated security tools (such as vulnerability scanning tools).

[0128] For example, assuming that the CPU usage and memory occupancy of the device in the virtual operating environment are U cpu and U mem , we can calculate the monitoring data under the two monitoring indicators of resource consumption rate and memory consumption rate. The calculation formula for the monitoring data under resource consumption rate can be expressed as: Among them: U cpu Indicates the CPU usage during the simulation; U cpu0 Indicates the initial CPU usage of the device before the policy is applied; U cpumaxIndicates the maximum CPU load available to the device. The calculation formula for the monitoring data under the memory consumption rate can be expressed as:

[0129] Among them: U mem Indicates the memory usage during the simulation; U mem0 Indicates the initial memory usage of the device before applying the policy; U memmax Indicates the maximum memory available on the device.

[0130] If the resource consumption rate exceeds a certain threshold (for example, R cpu >90% or R mem >85%), it means that the new strategy may impose a heavy burden on the equipment, and it can be considered that the monitoring data does not meet the preset operating conditions, and the applicability of the strategy can be re-evaluated.

[0131] In this embodiment, in the process of running the decryption policy file in the virtual operating environment, the monitoring data can be analyzed in real time in combination with historical performance data and preset security specifications to determine whether the decryption policy file meets the expected goals. Exemplarily, by comparing the simulation operation results with the standard performance data of the edge device, the impact of the decryption policy file on the device performance is evaluated. Combined with security vulnerability scanning, log analysis, etc., the possibility of the decryption policy file introducing new security risks is evaluated.

[0132] If problems are found during the simulation (such as significant performance degradation, system instability, etc.), the automatic feedback mechanism will be triggered and the abnormal event will be recorded. The system can be restored to the state before the policy was applied according to the preset "rollback policy".

[0133] As an optional implementation of this embodiment, each step and result of the entire policy file update process can be recorded, the log can be audited regularly, and potential security issues can be analyzed and handled. The method can be: during the entire update process of the policy file, at each key step (such as file transfer, signature verification, decryption process, etc.), a log recording operation can be triggered. The log not only records the timestamp and operation type of the operation, but also records the detailed information of the operation (such as file size, version number, verification result, etc.). Among them, the log type can include information logs, warning logs, error logs, and security logs. Each log in the log content should at least include an operation identifier, operation type, operation time, device ID, file name, file size, version information, operation result (success or failure), exception information, etc.

[0134] In this embodiment, a structured log format (such as JSON) can be used to facilitate automated analysis and archiving. File encryption technology is used to encrypt and save the log to ensure the security of the log file content and prevent external tampering. A log rotation mechanism can be used on the device side to prevent the log file from occupying too much storage space. The log can also be audited automatically, such as setting a log audit cycle (such as hourly, daily, etc.), automatically scanning all log files, and identifying abnormal or potential risk operations; log analysis is performed based on preset security rules, such as checking whether the modification time of a policy file is abnormal, whether there is unauthorized decryption operation, etc.; if access beyond the authority is detected in the log (such as unauthorized device access policy configuration file), an early warning is triggered and the relevant log is recorded. Machine learning or rule-based anomaly detection algorithms are used to classify and analyze log data to automatically identify unusual operations. For example, if a certain end-edge device updates a policy file multiple times in a short period of time, this may be abnormal behavior. Combine predefined security rules (such as "a certain device should not frequently download policy configuration files") to match the log content in real time. For example: If the log shows "Device ID edge_device_123 received 3 configuration file updates within 5 minutes", the system may trigger an alarm. Audit logs can help trace historical operations and promptly discover potential security vulnerabilities. For example, if the device fails to decrypt multiple times, it may indicate a problem with key management or that the key has been leaked. At this point, the audit system needs to trigger a security analysis and report to the administrator. If potential security issues are found during the device policy update process (for example, malicious file tampering), the device can be rolled back to a safe state through automated policies, the current policy application can be stopped, and a security warning can be triggered. When a security risk is detected, the device management user can be notified through the event response system (such as automatically sending emails, text messages, or triggering alarms), and detailed information about potential security issues can be provided so that the management user can take further preventive measures based on the report, providing effective protection for ensuring device security and stable system operation.

[0135] The technical solution of this embodiment is to construct a virtual operating environment corresponding to the edge device; run the decryption policy file in the virtual operating environment to obtain monitoring data under multiple monitoring indicators, and when the monitoring data meets the preset operating conditions, update the policy file in the edge device based on the decryption policy file, so as to ensure that the decryption policy file updated to the edge device can be correctly applied, thereby ensuring the accuracy of the policy update of the edge device.

[0136] Embodiment 5

[0137] Figure 5 1 is a schematic diagram of a structure of a policy updating device for a terminal device according to Embodiment 5 of the present invention. Figure 5As shown, the device includes: a file encryption module 510, a signature array determination module 520, a verification result determination module 530 and a decryption module 540.

[0138] Among them, the file encryption module 510 is used to encrypt the newly added policy file corresponding to the edge device when it is received to obtain the encrypted policy file, and hash the encrypted policy file to obtain a first hash value; the signature array determination module 520 is used to determine the signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters; the verification result determination module 530 is used to verify the signature array and obtain the verification result when the encryption policy file meets the preset configuration conditions; the decryption module 540 is used to decrypt the encryption policy file and obtain the decrypted policy file when the verification result is consistent with the preset result, and update the policy file in the edge device based on the decrypted policy file.

[0139] The technical solution of this embodiment is to encrypt the newly added policy file corresponding to the edge device when it is received to obtain the encrypted policy file, and hash the encrypted policy file to obtain a first hash value; determine the signature array corresponding to the encrypted policy file based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters; when the encrypted policy file meets the preset configuration conditions, verify the signature array to obtain a verification result; when the verification result is consistent with the preset result, decrypt the encrypted policy file to obtain a decrypted policy file, and update the policy file in the edge device based on the decrypted policy file, so as to solve the problem of low security and poor accuracy of policy update caused by network transmission of policy files and updating of operation policies of edge devices in the prior art, and realize that the newly added policy file corresponding to the edge device is first encrypted to obtain the encrypted policy file, and the encrypted policy file is hashed to obtain the first hash value, and then, the signature array corresponding to the encrypted policy file is determined in combination with the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters, so as to improve the encryption strength of the signature array. When the encrypted policy file meets the preset configuration conditions, the signature array is verified to ensure the integrity of the policy file. When the verification result is consistent with the preset result, the encrypted policy file is decrypted, and the policy file in the edge device is updated based on the decrypted policy file, thereby improving the security and accuracy of the edge device policy update, thereby ensuring the security and stability of the device operation.

[0140] Based on the above device, optionally, the file encryption module 510 includes:

[0141] A key determination unit, used to generate an initialization vector and a random key based on a random number generation algorithm;

[0142] A byte data determination unit, used for converting the newly added policy file to obtain byte data;

[0143] The encryption policy file determining unit is used to encrypt the byte data based on the initialization vector and the random key to obtain an encryption policy file.

[0144] Based on the above device, optionally, the signature array determination module 520 includes:

[0145] A random vector determining unit, configured to determine a random vector based on a message authentication code algorithm of a hash function according to the first hash value and a current signing time;

[0146] A first signature value determining unit, configured to determine a first signature value based on the random vector and preset elliptic curve parameters;

[0147] A second signature value determining unit, configured to determine a second signature value based on a preset private key, the first signature value, the first Hash value, the random vector, and the preset elliptic curve parameter;

[0148] A signature array determining unit is used to determine a signature array based on the first signature value and the second signature value.

[0149] Based on the above device, optionally, the first signature value determining unit includes:

[0150] An elliptic curve coordinate determination unit, configured to determine the elliptic curve coordinates based on the random vector and a base point of preset elliptic curve parameters;

[0151] The first signature value determining subunit is used to determine the first signature value based on the coordinate value of the first coordinate axis in the elliptic curve coordinates and the order of the preset elliptic curve.

[0152] Based on the above device, optionally, the verification result determination module 530 includes:

[0153] A second hash value determination unit, configured to perform hash processing on the encryption policy file to obtain a second hash value if the first signature value and the second signature value in the signature array are within a preset range; wherein the preset range is determined based on the order and preset value of the preset elliptic curve parameter;

[0154] a first intermediate value determining unit, configured to determine a first intermediate value based on the preset elliptic curve parameter, the second Hash value, a preset public key, the first signature value, and the second signature value;

[0155] A verification result determination unit is used to determine that the verification result is a preset result when the first intermediate value is consistent with the second signature value; wherein the preset result is that the verification is passed.

[0156] Based on the above device, optionally, the first intermediate value determining unit includes:

[0157] an inverse element determining unit, configured to determine an inverse element based on the order of the preset elliptic curve parameter and the second signature value;

[0158] a second intermediate value determining unit, configured to determine a second intermediate value based on the inverse element, the second Hash value and the order;

[0159] a third intermediate value determining unit, configured to determine a third intermediate value based on the inverse element, the first signature value and the order;

[0160] The first intermediate value determination subunit is used to determine a first intermediate value based on the preset elliptic curve parameter, the preset public key, the second intermediate value and the third intermediate value.

[0161] Based on the above device, optionally, the first intermediate value determination subunit includes:

[0162] A verification point coordinate determination unit, configured to determine the verification point coordinates based on a base point of the preset elliptic curve parameters, a preset public key, the second intermediate value, and the third intermediate value;

[0163] The first intermediate value determination subunit is used to determine the first intermediate value based on the verification point coordinates and the order of the preset elliptic curve parameters.

[0164] On the basis of the above device, optionally, the device further includes:

[0165] A detection result determination unit is used to detect the decryption policy file based on a detection method of at least one detection dimension, so that when the detection result under at least one detection dimension is a detection pass, the policy file in the end-edge device is updated based on the decryption policy file; wherein the detection dimension includes at least a file header detection dimension, a field detection dimension, a nested structure detection dimension, a parameter compliance detection dimension, a dependency detection dimension, a context detection dimension, a configuration conflict detection dimension, and an environmental adaptability verification dimension.

[0166] On the basis of the above device, optionally, the device further includes:

[0167] A virtual operating environment construction unit, used to construct a virtual operating environment corresponding to the edge device;

[0168] A monitoring data determination unit is used to run the decryption policy file in the virtual operating environment to obtain monitoring data under multiple monitoring indicators, so as to update the policy file in the edge device based on the decryption policy file when the monitoring data meets the preset operating conditions.

[0169] The policy updating device of the edge device provided in the embodiment of the present invention can execute the policy updating method of the edge device provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0170] Embodiment 6

[0171] Figure 6 1 is a schematic diagram of the structure of an electronic device that implements the policy update method of the edge device of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0172] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0173] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0174] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a policy update method for an edge device.

[0175] In some embodiments, the policy update method of the edge device may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the policy update method of the edge device described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the policy update method of the edge device in any other appropriate manner (e.g., by means of firmware).

[0176] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0177] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0178] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0179] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0180] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0181] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0182] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements a policy update method for an edge device as provided in any embodiment of the present invention.

[0183] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0184] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0185] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A policy update method for an edge device, characterized in that: include: When a new policy file corresponding to the edge device is received, the new policy file is encrypted to obtain an encrypted policy file, and the encrypted policy file is hashed to obtain a first hash value; Determine a signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key, and the preset elliptic curve parameters; When the encryption policy file meets the preset configuration conditions, verify the signature array to obtain a verification result; When the verification result is consistent with the preset result, the encrypted policy file is decrypted to obtain a decrypted policy file, and the policy file in the edge device is updated based on the decrypted policy file.

2. The method according to claim 1, characterized in that The step of encrypting the newly added policy file to obtain an encrypted policy file includes: Generate an initialization vector and a random key based on a random number generation algorithm; Converting the newly added policy file to obtain byte data; The byte data is encrypted based on the initialization vector and the random key to obtain an encryption policy file.

3. The method according to claim 1, characterized in that The determining, based on the first hash value, the current signing time, the preset private key, and the preset elliptic curve parameters, of the signature array corresponding to the encryption policy file includes: The message authentication code algorithm based on the hash function determines the random vector according to the first hash value and the current signing time; Determine a first signature value based on the random vector and preset elliptic curve parameters; Determine a second signature value based on a preset private key, the first signature value, the first Hash value, the random vector, and the preset elliptic curve parameters; A signature array is determined based on the first signature value and the second signature value.

4. The method according to claim 3, characterized in that The determining of the first signature value based on the random vector and the preset elliptic curve parameter includes: Determining elliptic curve coordinates based on the random vector and a base point of preset elliptic curve parameters; A first signature value is determined based on the coordinate value of the first coordinate axis in the elliptic curve coordinates and the order of the preset elliptic curve.

5. The method according to claim 1, characterized in that The verifying the signature array to obtain a verification result includes: If the first signature value and the second signature value in the signature array are within a preset range, the encryption policy file is hashed to obtain a second hash value; wherein the preset range is determined based on the order and preset value of the preset elliptic curve parameter; Determine a first intermediate value based on the preset elliptic curve parameter, the second Hash value, a preset public key, the first signature value, and the second signature value; When the first intermediate value is consistent with the second signature value, it is determined that the verification result is a preset result; wherein the preset result is that the verification is passed.

6. The method according to claim 5, characterized in that The determining a first intermediate value based on the preset elliptic curve parameter, the second Hash value, a preset public key, the first signature value, and the second signature value includes: Determining an inverse element based on the order of the preset elliptic curve parameter and the second signature value; determining a second intermediate value based on the inverse element, the second hash value, and the order; determining a third intermediate value based on the inverse element, the first signature value, and the order; A first intermediate value is determined based on the preset elliptic curve parameter, the preset public key, the second intermediate value, and the third intermediate value.

7. The method according to claim 6, characterized in that The determining of the first intermediate value based on the preset elliptic curve parameter, the preset public key, the second intermediate value and the third intermediate value includes: Determine the verification point coordinates based on the base point of the preset elliptic curve parameters, the preset public key, the second intermediate value and the third intermediate value; A first intermediate value is determined based on the verification point coordinates and the order of the preset elliptic curve parameter.

8. The method according to claim 1, characterized in that Before updating the policy file in the edge device based on the decryption policy file, the method further includes: The decryption policy file is detected based on a detection method of at least one detection dimension, so that when the detection result under at least one detection dimension is a detection pass, the policy file in the end-edge device is updated based on the decryption policy file; Among them, the detection dimensions include at least file header detection dimension, field detection dimension, nested structure detection dimension, parameter compliance detection dimension, dependency detection dimension, context detection dimension, configuration conflict detection dimension and environment adaptability verification dimension.

9. The method according to claim 1, characterized in that: Before updating the policy file in the edge device based on the decryption policy file, the method further includes: Constructing a virtual operating environment corresponding to the edge device; The decryption policy file is run in the virtual operating environment to obtain monitoring data under multiple monitoring indicators, so that when the monitoring data meets the preset operating conditions, the policy file in the edge device is updated based on the decryption policy file.

10. A policy updating device for an edge device, characterized in that: include: A file encryption module is used to, when receiving a new policy file corresponding to the end-edge device, encrypt the new policy file to obtain an encrypted policy file, and perform hash processing on the encrypted policy file to obtain a first hash value; A signature array determination module, used to determine the signature array corresponding to the encryption policy file based on the first hash value, the current signing time, the preset private key and the preset elliptic curve parameters; A verification result determination module, used to verify the signature array and obtain a verification result when the encryption policy file meets the preset configuration conditions; The decryption module is used to decrypt the encryption policy file to obtain a decryption policy file when the verification result is consistent with the preset result, and update the policy file in the edge device based on the decryption policy file.

Images