Equipment access method and device applying power system and electronic equipment

Abstract

The invention discloses an equipment access method and device applying a power system and electronic equipment. Under the condition that an equipment access request is received and the equipment access request does not comprise a security certificate, an authentication result of to-be-accessed power equipment is determined based on equipment information in the equipment access request and signature information corresponding to the to-be-accessed power equipment; when the authentication result is consistent with a preset result, issuing a temporary certificate to the to-be-accessed power equipment, so as to control the access of the to-be-accessed power equipment based on the temporary certificate; and when it is detected that the to-be-accessed power equipment is accessed, configuring system access parameters for the to-be-accessed power equipment, so as to generate a target certificate corresponding to the to-be-accessed power equipment based on the system access parameters and the temporary certificate, thereby realizing access of the to-be-accessed power equipment under the condition that the security certificate or the target certificate of the to-be-accessed power equipment exists. The to-be-accessed power equipment is accessed to the cross-regional power system, so that the consistency, flexibility and safety of the access of the to-be-accessed power equipment are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, a device and an electronic device for accessing equipment to an electric power system. Background Art

[0002] With the development of power systems, informatization and intelligence, the demand for cross-regional access and cross-regional collaboration of power equipment has gradually emerged.

[0003] At present, due to the different equipment information of the power equipment that needs to be accessed across regions, the access methods when accessing the power system of the corresponding region are also different, which increases the complexity and risk of cross-regional communication. In addition, when accessing cross-regional power equipment, the equipment safety of the power equipment cannot be guaranteed, resulting in safety risks in the power system after accessing the power equipment. Summary of the invention

[0004] The present invention provides a method, device and electronic device for accessing equipment to an electric power system, which realizes accessing the electric power equipment to be accessed to a cross-regional electric power system in the presence of a security certificate or a target certificate of the electric power equipment to be accessed, thereby ensuring the consistency, flexibility and security of the access of the electric power equipment to be accessed.

[0005] According to one aspect of the present invention, a method for accessing a device using a power system is provided, which is applied to access a power device in a first area to a power system corresponding to a second area, where the power systems used by the first area and the second area are different, and the method includes:

[0006] When receiving a device access request and the device access request does not include a security certificate, determining an authentication result of the power device to be accessed based on the device information in the device access request and the signature information corresponding to the power device to be accessed; wherein the power device to be accessed is a power device in the first area;

[0007] When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be connected, so as to control the access of the power device to be connected based on the temporary certificate;

[0008] When it is detected that the power device to be connected is connected, system access parameters are configured for the power device to be connected, so as to generate a target certificate corresponding to the power device to be connected based on the system access parameters and the temporary certificate.

[0009] According to another aspect of the present invention, there is provided a device for accessing a device using a power system, which is used to access a power device in a first area to a power system corresponding to a second area, wherein the power systems used in the first area and the second area are different, and the device comprises:

[0010] An authentication result determination module is used to determine the authentication result of the power device to be connected based on the device information in the device access request and the signature information corresponding to the power device to be connected, when receiving the device access request and the device access request does not include a security certificate; wherein the power device to be connected is a power device in the first area;

[0011] A temporary certificate issuing module is used to issue a temporary certificate to the power equipment to be connected when the authentication result is consistent with the preset result, so as to control the access of the power equipment to be connected based on the temporary certificate;

[0012] The target certificate generation module is used to configure system access parameters for the power device to be connected when it is detected that the power device to be connected is connected, so as to generate a target certificate corresponding to the power device to be connected based on the system access parameters and the temporary certificate.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to at least one processor; wherein,

[0016] The memory stores a computer program executable by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the device access method for the application power system according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for enabling a processor to implement the device access method for an application power system according to any embodiment of the present invention when the computer instructions are executed.

[0018] According to another aspect of the present invention, there is provided a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, the method for accessing a device to an application power system according to any embodiment of the present invention is implemented.

[0019] The technical solution of the embodiment of the present invention ensures the security of the power device to be accessed by determining the authentication result of the power device to be accessed based on the device information in the device access request and the signature information of the power device to be accessed when a device access request is received and the security certificate is not included in the device access request. When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be accessed to control the access process of the power device to be accessed based on the temporary certificate, thereby reducing the security risk when the power device is accessed. When the access of the power device to be accessed is detected, system access parameters are configured for the power device to be accessed to generate a target certificate corresponding to the power device to be accessed based on the system access parameters and the temporary certificate, so as to control the access rights of the power device to be accessed through the target certificate, thereby ensuring the security of the power system after the power device is accessed. The present invention solves the problems in the prior art of different access methods due to different device information and the inability to guarantee the security of the power system after the power equipment is connected. The present invention unifies the access methods of cross-regional power equipment to be connected, and performs device authentication, temporary certificates and target certificates for power equipment to be connected that does not have security certificates, so that power equipment to be connected that has security certificates or target certificates can access the cross-regional power system, thereby ensuring the consistency, flexibility and security of the access of the power equipment to be connected.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a method for accessing a device to an application power system provided by an embodiment of the present invention;

[0023] Figure 2 is a flow chart of a method for accessing a device to an application power system provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural schematic diagram of a device access apparatus for an application power system provided by an embodiment of the present invention;

[0025] Figure 4 The present invention is a schematic diagram of the structure of an electronic device for implementing the device access method of the application power system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 This is a flowchart of a device access method for an application power system provided in the first embodiment of the present invention. This embodiment can be applied to the device authentication, temporary certificate and target certificate issuance for the power equipment to be connected that does not have a security certificate, so that the power equipment to be connected that has a security certificate or a target certificate can access the cross-regional power system. The method can be executed by a device access device for the application power system. The device access device for the application power system can be implemented in the form of hardware and / or software. The device access device for the application power system can be configured in electronic devices such as mobile phones, computers or servers. Figure 1 As shown, the method includes:

[0030] S110. When a device access request is received and the device access request does not include a security certificate, determine the authentication result of the power device to be accessed based on the device information in the device access request and the signature information corresponding to the power device to be accessed; wherein the power device to be accessed is a power device within the first area.

[0031] The embodiment of the present invention is applied to the scenario of connecting the power equipment in the first area to the power system corresponding to the second area to realize the communication between the cross-regional power equipment. The power systems used by the first area and the second area are different. When the power equipment in the first area is to be connected to the power system of the second area, the power equipment in the first area can be used as the power equipment to be connected. The access request sent by the power equipment to be connected to the power system of the second area is a device access request.

[0032] To ensure the security of the power equipment to be connected and the power system in the second area, it is possible to detect whether the device access request carries a security certificate, or whether the security certificate of the current power equipment to be connected is stored in the power system in the second area. The security certificate is used to characterize the security of the power equipment to be connected and the authority to access the power system in the second area. Only the power equipment to be connected that carries a security certificate can access the power system in the second area and communicate across regions with the power equipment in the power system in the second area. Malicious power equipment or power equipment that is not trusted by the power system in the second area can be effectively isolated through security certificates.

[0033] The device information may include the device type and device hardware information of the power device to be connected. The signature information may be a digital signature determined based on the device information of the power device to be connected before the power device to be connected sends a device access request. The signature information may be used to authenticate the device identity of the power device to be connected. Optionally, the signature information may be obtained by encrypting the hash value corresponding to the device information of the power device to be connected before the device access request is sent.

[0034] The authentication result is used to characterize the device identity of the power device to be connected. When the hash value corresponding to the device information of the device access request is consistent with the hash value after the signature information is decrypted, the authentication result is authentication passed, and the power device to be connected can access the power system of the second area. Correspondingly, when the hash value corresponding to the device information of the device access request is inconsistent with the hash value after the signature information is decrypted, the authentication result is authentication failed, and the power device to be connected cannot access the power system of the second area.

[0035] Specifically, when receiving a device access request sent by the power device to be connected in the first area to the power system in the second area, detect whether the device access request carries a security certificate. If the device access request does not carry a security certificate, determine the hash value corresponding to the device information of the power device to be connected based on the device information in the device access request. And parse the signature information carried in the device access request to obtain the standard hash value corresponding to the power device to be connected. When the standard hash value is consistent with the hash value corresponding to the device information, the authentication result of the power device to be connected is authentication passed, that is, the power device to be connected can access the power system in the second area.

[0036] It should be noted that the encryption algorithm applied to the device access request sent when the power equipment in the first area is connected to the power system in the second area can be preset. Based on this, when the power system in the second area receives the device access request, it can parse the device access request according to the corresponding encryption algorithm, thereby quickly realizing the device authentication of the power equipment to be connected. The above device authentication process supports authentication protocols, public key infrastructure certificate systems, zero trust architectures, and lightweight cryptographic protocols.

[0037] For example, when the power equipment to be connected in the first area is connected to the power system in the second area, the RSA asymmetric encryption algorithm or the ECC asymmetric encryption algorithm can be used to authenticate the power equipment to be connected. Among them, the RSA asymmetric encryption algorithm is a public key encryption algorithm used for device identity authentication and digital signature. The specific method can be: before the power equipment to be connected sends a device access request, the device information to be sent can be encrypted by a public key encryption function according to the RSA asymmetric encryption algorithm. That is, C = M e modn, where M is the plaintext device information, e is the public key exponent, n is the modulus, and C is the encrypted device information. The digital signature corresponding to the hash value of the device information is generated through the data signature generation function. That is, S = H (M) d modn, where S is the signature information of the power device to be connected, M is the plaintext device information, H(M) is the hash value of the device information, d is the private key exponent, and n is the modulus. A device access request is generated based on the signature information S and the encrypted device information C to send the device access request to the power system in the second area.

[0038] After the power system in the second area receives the device access request, the encrypted device information C in the device access request is decrypted according to the private key decryption function in the corresponding RSA asymmetric encryption algorithm. That is, M'=C dmodn, where M' is the decrypted device information, C is the encrypted device information in the device access request, d is the private key exponent, and n is the modulus. Hash the decrypted device information M' to obtain the hash value H(M') corresponding to the decrypted device information. The signature information S in the device access request is parsed using the digital signature verification function to obtain the hash value H(M) corresponding to the signature information. That is, H(M) = S e modn, where H(M) is the hash value corresponding to the signature information, S is the signature information in the device access request, e is the public key exponent, and n is the modulus.

[0039] By comparing the hash value H(M) corresponding to the signature information with the hash value H(M') corresponding to the device information in the received device access request, the authentication result of the power device to be connected is determined. When H(M) is consistent with H(M'), the authentication result of the power device to be connected is authentication passed.

[0040] Exemplarily, the ECC asymmetric encryption algorithm can be used to authenticate the power device to be connected. That is, a message authentication code that combines a hash function and a key is used to authenticate the power device to be connected. Before sending a device access request, a message authentication code corresponding to the device information of the power device to be connected can be determined by a hash-based message authentication code generation function. That is,

[0041]

[0042] Among them, HMAC(K,M) is the message authentication code, K is the key, M is the device information, opad is the external padding constant, ipad is the internal padding constant, and H is the hash function.

[0043] When the power system in the second area receives the device access request, it generates a corresponding message verification code to be verified according to the device information in the device access request. When the message verification code to be verified is consistent with the message verification code carried in the device access request, the authentication result of the power device to be connected is authentication passed.

[0044] In an embodiment of the present invention, the method for determining the authentication result of the power equipment to be connected can be: after decrypting the signature information, a first hash value corresponding to the power equipment to be connected is obtained; after hashing the device information in the device access request, a second hash value of the power equipment to be connected is obtained; when the first hash value and the second hash value are the same, it is determined that the authentication result of the power equipment to be connected is authentication passed.

[0045] The first hash value may be a standard hash value corresponding to the device information of the power device to be connected, and the second hash value may be a hash value corresponding to the received device information.

[0046] Specifically, the signature information carried in the device access request is decrypted to obtain a first hash value corresponding to the power device to be accessed. The device information in the access request is hashed to obtain a second hash value of the power device to be accessed. The authentication result of the power device to be accessed is obtained by comparing the first hash value and the second hash value. When the first hash value and the second hash value are the same, it is determined that the authentication result of the power device to be accessed is authentication passed, and the power device to be accessed can access the power system of the second area. Correspondingly, when the first hash value and the second hash value are different, it is determined that the authentication result is authentication failed, and the power device to be accessed cannot be accessed to the power system of the second area. Based on this, device authentication of the power device to be accessed is implemented, and the access of power equipment that has not passed the authentication is prevented, and malicious or untrusted power equipment is effectively isolated. Through the above-mentioned automated authentication of the power equipment to be accessed, the management process of large-scale power equipment access can be simplified and the access efficiency can be improved.

[0047] Exemplarily, in combination with the above example, the first hash value is H(M) of the above example, and the second hash value is H(M') of the above example. When H(M) is the same as H(M'), the authentication result of the power device to be connected is authentication passed.

[0048] Optionally, when a security certificate is included in a device access request, or when it is detected that a target certificate corresponding to the power device to be accessed has been generated, a target key is issued to the power device to be accessed so that the power device to be accessed encrypts data sent to the power system based on the target key; and, when a data access request or a data upload request is received from the power device to be accessed, feedback data corresponding to the request is encrypted based on the symmetric key corresponding to the target key and fed back.

[0049] Among them, the target certificate can be a security certificate obtained after the temporary certificate issued is activated after the power device to be connected passes the authentication. The temporary certificate can be a certificate issued when the authentication result of the power device to be connected is authentication passed. If the power device to be connected is not a device that is connected to the power system of the second area for the first time, the target certificate of the power device to be connected may exist in the power system of the second area. Based on this, repeated authentication and repeated issuance of certificates for the power device to be connected can be avoided, thereby accelerating the access efficiency of the power device to be connected.

[0050] The target key and the symmetric key may be keys determined by a preset encryption algorithm and used for data encryption communication between the power device to be connected and the second regional power system. The preset encryption algorithm may be an algorithm for data encryption communication between the power device to be connected and the second regional power system. The target key may be stored in the power device to be connected, so that the power device to be connected uses the target key to encrypt data transmitted to the second regional power system. The symmetric key may be stored in the second regional power system, so that the second regional power system encrypts and transmits data to the power device to be connected according to the symmetric key.

[0051] The data access request is a request issued by the power device to be connected, and is used to obtain the business processing data in the second regional power system. When the request is a data access request, the feedback data corresponding to the request may be the business processing data of the second regional power system corresponding to the data access request. The data upload request may be issued by the power device to be connected, and is used to upload the business processing data of the power device to be connected to the second regional power system. When the request is a data upload request, the feedback data corresponding to the request may be the feedback information fed back by the second regional power system to the power device to be connected, and the business processing data of the power device to be connected is received.

[0052] Specifically, when the second regional power system receives a device access request from the power device to be connected, if it is detected that the device access request includes a security certificate, or a target certificate corresponding to the power device to be connected has been generated in the second regional power system, a target key is issued to the power device to be connected according to a preset encryption algorithm. At the same time, the second regional power system saves the symmetric key corresponding to the target key. Based on this, when the power device to be connected sends data to the second regional power system, the data sent can be encrypted according to the target key. And, when the second regional power system receives a data access request or a data upload request sent by the power device to be connected, it encrypts the feedback data of the corresponding request according to the symmetric key corresponding to the target key, and transmits the encrypted feedback data to the power device to be connected.

[0053] S120. When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be connected, so as to control the access of the power device to be connected based on the temporary certificate.

[0054] The preset result may be the result of the authentication of the power device to be connected. The temporary certificate is used to provide the power device to be connected with a temporary identity and temporary permission to access the power system of the second area. The temporary certificate allows the power device to be connected to access the power system of the second area within a certain time range and to perform cross-regional encrypted communication with the power system of the second area. Optionally, the temporary certificate may include information such as the device information of the power device to be connected, the time range of temporary access, etc.

[0055] Specifically, when the authentication result is consistent with the preset result, it means that the power equipment to be connected meets the requirements for accessing the second-region power system, and a temporary certificate can be issued to the power equipment to be connected, so that the power equipment to be connected can communicate with the second-region power system across regions in encrypted form within a certain temporary access time range. Through the temporary certificate, the second-region power system can effectively control and manage the power equipment to be connected. For example, the second-region power system can monitor the operating status of the power equipment to be connected to ensure that it does not have an adverse effect on the entire power system; at the same time, the second-region power system can also automatically disconnect the power equipment to be connected from the power system after the temporary certificate expires based on the access validity period of the temporary certificate, so as to ensure the long-term security of the power system.

[0056] S130. When it is detected that the power device to be connected is connected, configure system access parameters for the power device to be connected, so as to generate a target certificate corresponding to the power device to be connected based on the system access parameters and the temporary certificate.

[0057] Among them, the system access parameters may include permission information for the power device to be connected to access the second regional power system. For example, which types of business processing data in the second regional power system can the power device to be connected obtain, or which business processing data corresponding to which power devices. The target certificate may be a security certificate obtained after the activation process of the temporary certificate. Generally, the access validity period corresponding to the target certificate is longer than the access validity period of the temporary certificate. The access validity period may be the effective duration of access to the second regional power system. Optionally, the target certificate may also specify the types of business data and power devices of the second regional power system that the power device to be connected can access.

[0058] Specifically, when it is detected that the power device to be connected is connected to the second regional power system, the system access parameters are configured for the power device to be connected. Based on this, the temporary certificate of the power device to be connected can be activated as the target certificate according to the system access parameters before the access validity period corresponding to the temporary certificate of the power device to be connected expires.

[0059] Optionally, according to the area to which the power equipment to be connected belongs, the target certificate is stored in a database corresponding to the area; the usable period information corresponding to the target certificate is recorded, and the usable period information, the target certificate and the device information of the power equipment to be connected are stored in association.

[0060] The usable period information can be understood as the validity period of the access of the power device to be connected to the power system in the second region. For example, if the usable period information is one year, then from the issuance of the target certificate to the next year, the power device to be connected can access the power system in the second region and conduct cross-regional encrypted communication with the power system in the second region. After one year, the target certificate expires and becomes invalid.

[0061] Specifically, during cross-regional communication, there may be one or more power devices to be connected that need to perform cross-regional encrypted communication with the power system in the second area. Then, according to the processing methods of S110 to S130 above, target certificates corresponding to the power devices to be connected can be generated respectively. And according to the area to which each power device to be connected belongs, the target certificate is stored in the database corresponding to the area to which it belongs. In order to realize encrypted communication between power devices to be connected and the power system in multiple areas, the usable period information corresponding to each target certificate can be recorded, and the usable period information corresponding to multiple power devices to be connected, the target certificate and the device information of the power devices to be connected can be associated and stored in the database of the power system in the second area. Based on this, a cross-domain certificate mutual trust mechanism is implemented, which can enable power devices to be connected in multiple areas to perform cross-domain encrypted communication with the power system in the second area, thereby enhancing the flexibility of data communication.

[0062] Optionally, the usable period information, target certificate and device information of the power equipment to be connected corresponding to multiple regions can be associated and processed to establish a multi-level certificate trust chain. And through the distributed PKI (Public Key Infrastructure) model, large-scale power equipment to be connected in different regions and different equipment types can be managed to improve the efficiency and security of power equipment management. By updating the usable period information of the power equipment to be connected in different regions in real time, the validity of the target certificate of the power equipment to be connected is guaranteed. It should be noted that when it is detected that the usable period information of the target certificate of the power equipment to be connected has expired, the target certificate of the power equipment to be connected is revoked, and the target certificate is regenerated according to the above process. The distributed PKI model also supports the update and conversion of the target certificate. By establishing a multi-level certificate trust chain, the problem of forging or tampering with security certificates is avoided, so that power equipment and power systems in different regions can communicate with each other through mutual authentication, and support cross-regional and cross-platform equipment management and data exchange.

[0063] The technical solution of this embodiment ensures the security of the power device to be accessed by determining the authentication result of the power device to be accessed based on the device information in the device access request and the signature information of the power device to be accessed when the device access request is received and the security certificate is not included in the device access request. When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be accessed to control the access process of the power device to be accessed based on the temporary certificate, thereby reducing the security risk when the power device is accessed. When the access of the power device to be accessed is detected, the system access parameters are configured for the power device to be accessed to generate a target certificate corresponding to the power device to be accessed based on the system access parameters and the temporary certificate, so as to control the access rights of the power device to be accessed through the target certificate, thereby ensuring the security of the power system after the power device is accessed. The present invention solves the problems in the prior art of different access methods due to different equipment information and the inability to guarantee the security of the power system after the power equipment is connected. The present invention unifies the access methods of cross-regional power equipment to be connected, and performs equipment authentication, temporary certificates and target certificates for power equipment to be connected that does not have security certificates, so that power equipment to be connected that has security certificates or target certificates can access the cross-regional power system, thereby ensuring the consistency, flexibility and security of the access of the power equipment to be connected.

[0064] Embodiment 2

[0065] Figure 2 This is a flowchart of a device access method for an application power system provided in the second embodiment of the present invention. This embodiment is based on the above embodiment and refines the step of "configuring system access parameters for the power device to be connected to generate a target certificate corresponding to the power device to be connected based on the system access parameters". For its specific implementation, please refer to the technical solution of this embodiment. Among them, the technical terms that are the same or corresponding to the above embodiment are not repeated here. Figure 2 As shown, the method includes:

[0066] S210. When a device access request is received and the device access request does not include a security certificate, determine the authentication result of the power device to be accessed based on the device information in the device access request and the signature information corresponding to the power device to be accessed; wherein the power device to be accessed is a power device within the first area.

[0067] S220. When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be connected, so as to control the access of the power device to be connected based on the temporary certificate.

[0068] S230. When it is detected that the power device to be connected is connected, system access parameters are configured for the power device to be connected according to the device type of the power device to be connected and the data collection authority corresponding to the power device to be connected in the first area, wherein the system access parameters include authority information for accessing the power system.

[0069] Among them, the device type can be understood as the device type of the power device to be connected. The data collection authority can be understood as the business processing authority that the power device to be connected can collect in the first area to which it belongs. The system access parameters include permission information for accessing the power system of the second area. The permission information may include the business processing data of which power devices in the power system of the second area can be accessed by the power device to be connected, or what types of business processing data can be accessed by the power device to be connected.

[0070] Specifically, when the access of the power device to be connected is detected, the data type of the business processing data that can be collected by the power device to be connected can be determined according to the device type of the power device to be connected and the corresponding data collection authority of the power device to be connected in the first area. Correspondingly, the data type when the power device to be connected conducts cross-regional data communication with the power system in the second area is determined. According to the data type, the permission information for accessing the power system in the second area, that is, the system access parameter, can be configured for the power device to be connected.

[0071] S240: Determine an activation code corresponding to the power device to be connected based on the device type, the system access parameter, and the coverage range applied by the power device to be connected.

[0072] The coverage range applied by the power device to be connected can be used to characterize the power devices of the second regional power system that the power device to be connected can access. Through the coverage range, it can be determined which power devices in the second regional power system the power device to be connected can perform cross-regional encrypted communication with. The activation code can be a code for converting a temporary certificate into a target certificate.

[0073] Specifically, the activation code corresponding to the power device to be connected is determined according to the device type of the power device to be connected, the system access parameters, and the coverage range used by the power device to be connected.

[0074] Exemplarily, the system access parameters are the authorization parameters of the power equipment to be connected, and the coverage scope of the power equipment to be connected is the usage scenario of the power equipment to be connected. According to the device type, authorization parameters and usage scenario of the power equipment to be connected, an activation code management system is used to encrypt and generate a unique activation code, and the activation code is verified to prevent the activation code from being tampered with or forged. Based on this, the temporary certificate of the power equipment to be connected can be converted into a target certificate through the activation code. It should be noted that the activation code management system can support large-scale temporary certificate activation processing of power equipment to be connected, and can efficiently and safely ensure the normal generation of activation codes, and effectively prevent malicious attacks.

[0075] S250: Convert the temporary certificate to a target certificate based on the activation code.

[0076] The target certificate may be understood as the formal security certificate corresponding to the power equipment to be connected.

[0077] Specifically, according to the activation code corresponding to the power device to be connected, the temporary certificate of the power device to be connected is converted into a target certificate, so as to control the cross-domain encrypted communication between the power device to be connected and the second area power system through the target certificate.

[0078] Optionally, when it is detected that the system access parameter of the power device to be connected has changed, the target certificate corresponding to the power device to be connected is regenerated, and the target certificate currently used is updated.

[0079] Specifically, in the actual application process, the system access parameters configured by the power device to be connected may change. When it is detected that the system access parameters of the power device to be connected have changed, the changed system access parameters are obtained. According to the device type of the power device to be connected, the changed system access parameters and the coverage applied by the power device to be connected, the target certificate corresponding to the power device to be connected is updated to control the cross-domain communication processing between the power device to be connected and the second regional power system based on the updated target certificate.

[0080] Optionally, the historical interaction behavior between the power device to be connected and the power system in the second area and the power devices that have historically accessed the power system in the second area can be dynamically evaluated through the zero trust model, and the system access parameters of the power device to be connected can be adjusted to update the target certificate based on the adjusted system access parameters. Based on this, the power system's defense capability against internal threats can be enhanced, and overall security can be improved.

[0081] Optionally, the above-mentioned power device to be connected can also be an edge device, and the second regional power system can also be a cloud system. Through the above-mentioned processing methods of S210 to S260, the cloud system can realize device authentication of the edge device, and the cloud system can issue, update and revoke the target certificate for the edge device to ensure the data integrity, security and confidentiality of cloud-edge communication.

[0082] Specifically, with the deep integration of edge computing and cloud computing, data exchange and service collaboration can only be carried out after the cloud system and edge devices establish a mutual trust relationship. Then, according to the processing method of S210 to S260 above, the target certificate can be issued to the edge device to establish a mutual trust relationship between the edge device and the cloud system. It should be noted that under the framework of cloud-edge mutual trust, data exchange can be encrypted and verified, thereby effectively preventing data leakage and tampering. The distribution, update, revocation and other operations of edge device target certificates are managed through a centralized certificate management platform to improve management efficiency and flexibility.

[0083] Optionally, after issuing the target certificate to the power device to be connected, communication encryption parameters with the power device to be connected are established to transmit data between the power device to be connected and the power system based on the communication encryption parameters.

[0084] The communication encryption parameters may include information such as the key for encrypted communication between the power equipment to be connected and the power system, access control parameters, and security management parameters.

[0085] Specifically, after issuing the target certificate to the power equipment to be connected, communication encryption parameters for cross-domain encrypted communication between the second area power system and the power equipment to be connected can be established, so that the second area power system and the power equipment to be connected can transmit data through communication encryption parameters.

[0086] Exemplarily, the communication encryption parameters are used as access control parameters and security management parameters in the communication process as an example for explanation. After the target certificate is issued to the power device to be connected, the access control rules between the power device to be connected and the second regional power system can be set according to the access control parameters in the communication encryption parameters. The security policy for communication between the power device to be connected and the second regional power system is configured through the security management parameters. And a data transmission layer security protection mechanism is established. Based on the above, when it is detected that there is a target certificate corresponding to the power device to be connected, a target key is issued to the power device to be connected according to a preset encryption algorithm, so that the power device to be connected encrypts the data sent to the power system based on the target key, and transmits the encrypted data to the second regional power system through access control rules and security policies. After receiving the encrypted data, the second regional power system decrypts the encrypted data according to the decryption key in the preset encryption algorithm, and stores the decrypted data at the corresponding position of the power system. The above process can ensure that data will not be stolen, tampered with or forged during cross-regional transmission, support cross-regional transmission between power equipment and power systems in different regions, effectively resist external attacks such as man-in-the-middle attacks and replay attacks, enhance the overall security of data exchange, promote data sharing and collaboration, and improve the work efficiency of the entire power system.

[0087] Optionally, during the cross-domain encrypted communication between the power equipment to be connected and the power system in the second region, a cross-domain trust evaluation can be performed on the above cross-domain communication process through secure multi-party computing technology, so as to encrypt and protect the privacy of the communication process according to the evaluation results. Blockchain technology is used to record the device authentication of the power equipment to be connected and the process of data communication with the power system in a decentralized manner, thereby improving the transparency and traceability of data communication. Among them, secure multi-party computing technology is used to protect the device information and authentication results of the power equipment to be connected during the cross-domain trust evaluation process, so as to ensure that the data exchange between the power equipment to be connected and the cross-domain power system between multiple regions does not leak sensitive information.

[0088] Optionally, when interaction with the power device to be connected is detected, the generated interaction data is recorded.

[0089] Among them, the interactive data can be the data corresponding to the equipment authentication and cross-domain data interaction process between the second regional power system and the power equipment to be connected.

[0090] Specifically, when data interaction is detected between the power system in the second area and the power equipment to be connected, such as device authentication of the power equipment to be connected, issuing temporary certificates and target certificates to the power equipment to be connected, and cross-domain data encryption communication with the power equipment to be connected, the corresponding interaction data can be recorded and logs can be generated to facilitate subsequent data tracing. Abnormal interaction behaviors can also be detected through logs to promptly discover and respond to potential security issues, such as unauthorized access and certificate abuse, to ensure security during the interaction process. By recording and auditing all interactive operations, the transparency of data interaction is enhanced, and data tampering and operation concealment are avoided. The management of logs needs to comply with the security compliance requirements of various regulations such as ISO 27001 and GDPR to improve the compliance and reliability of data interaction.

[0091] The technical solution of this embodiment ensures the security of the power device to be accessed by determining the authentication result of the power device to be accessed based on the device information in the device access request and the signature information of the power device to be accessed when the device access request is received and the security certificate is not included in the device access request. When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be accessed to control the access process of the power device to be accessed based on the temporary certificate, thereby reducing the security risk when the power device is accessed. When the access of the power device to be accessed is detected, the system access parameters are configured for the power device to be accessed according to the device type of the power device to be accessed and the data collection authority corresponding to the power device to be accessed in the first area. Based on the device type, system access parameters and the coverage applied by the power device to be accessed, the activation code corresponding to the power device to be accessed is determined. The temporary certificate is converted into a target certificate based on the activation code to control the access rights of the power device to be accessed through the target certificate, thereby ensuring the security of the power system after the power device is accessed. The present invention solves the problems in the prior art of different access methods due to different equipment information and the inability to guarantee the security of the power system after the power equipment is connected. The present invention unifies the access methods of cross-regional power equipment to be connected, and performs equipment authentication, temporary certificates and target certificates for power equipment to be connected that does not have security certificates, so that power equipment to be connected that has security certificates or target certificates can access the cross-regional power system, thereby ensuring the consistency, flexibility and security of the access of the power equipment to be connected.

[0092] Embodiment 3

[0093] Figure 3 Schematic diagram of a device access device for a power system provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: an authentication result determination module 310, a temporary certificate issuing module 320 and a target certificate generating module 330.

[0094] An authentication result determination module 310 is used to determine the authentication result of the power device to be accessed based on the device information in the device access request and the signature information corresponding to the power device to be accessed when a device access request is received and the device access request does not include a security certificate; wherein the power device to be accessed is a power device within the first area; a temporary certificate issuance module 320 is used to issue a temporary certificate to the power device to be accessed when the authentication result is consistent with a preset result, so as to control the access of the power device to be accessed based on the temporary certificate; a target certificate generation module 330 is used to configure system access parameters for the power device to be accessed when the access of the power device to be accessed is detected, so as to generate a target certificate corresponding to the power device to be accessed based on the system access parameters and the temporary certificate.

[0095] The technical solution of this embodiment ensures the security of the power device to be accessed by determining the authentication result of the power device to be accessed based on the device information in the device access request and the signature information of the power device to be accessed when the device access request is received and the security certificate is not included in the device access request. When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be accessed to control the access process of the power device to be accessed based on the temporary certificate, thereby reducing the security risk when the power device is accessed. When the access of the power device to be accessed is detected, the system access parameters are configured for the power device to be accessed to generate a target certificate corresponding to the power device to be accessed based on the system access parameters and the temporary certificate, so as to control the access rights of the power device to be accessed through the target certificate, thereby ensuring the security of the power system after the power device is accessed. The present invention solves the problems in the prior art of different access methods due to different equipment information and the inability to guarantee the security of the power system after the power equipment is connected. The present invention unifies the access methods of cross-regional power equipment to be connected, and performs equipment authentication, temporary certificates and target certificates for power equipment to be connected that does not have security certificates, so that power equipment to be connected that has security certificates or target certificates can access the cross-regional power system, thereby ensuring the consistency, flexibility and security of the access of the power equipment to be connected.

[0096] On the basis of the above embodiments, optionally, the device also includes: a data encryption communication module, which is used to issue a target key to the power device to be connected when a security certificate is included in the device access request, or when it is detected that a target certificate corresponding to the power device to be connected has been generated, so that the power device to be connected encrypts the data sent to the power system based on the target key; and when a data access request or a data upload request sent by the power device to be connected is received, the feedback data corresponding to the request is encrypted based on the symmetric key corresponding to the target key and fed back.

[0097] Optionally, an authentication result determination module is used to obtain a first hash value corresponding to the power equipment to be connected after decrypting the signature information; to obtain a second hash value of the power equipment to be connected after hashing the device information in the device access request; and to determine that the authentication result of the power equipment to be connected is authentication passed when the first hash value and the second hash value are the same.

[0098] Optionally, a target certificate generation module is used to configure system access parameters for the power equipment to be connected according to the device type of the power equipment to be connected and the data collection permissions corresponding to the power equipment to be connected in the first area, wherein the system access parameters include permission information for accessing the power system; determine the activation code corresponding to the power equipment to be connected based on the device type, system access parameters and the coverage scope applied by the power equipment to be connected; and convert the temporary certificate into a target certificate based on the activation code.

[0099] Optionally, the device also includes: an information association storage module, which is used to store the target certificate in a database corresponding to the area to which the power equipment to be connected belongs; record the usable period information corresponding to the target certificate, and store the usable period information, the target certificate and the equipment information of the power equipment to be connected in an associated manner.

[0100] Optionally, the device further includes: a target certificate updating module, configured to regenerate a target certificate corresponding to the power device to be connected and update a currently used target certificate when a change in a system access parameter of the power device to be connected is detected.

[0101] Optionally, the device further includes: an encryption parameter determination module, used to establish communication encryption parameters with the power device to be connected, so as to transmit data between the power device to be connected and the power system based on the communication encryption parameters.

[0102] Optionally, the device further includes: an interaction data recording module, configured to record the generated interaction data when interaction with the power device to be connected is detected.

[0103] The device for accessing the application power system provided by the embodiment of the present invention can execute the device for accessing the application power system provided by any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0104] Embodiment 4

[0105] Figure 41 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0106] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0107] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0108] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the device access method for applying the power system.

[0109] In some embodiments, the device access method for the application power system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the device access method for the application power system described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the device access method for the application power system in any other appropriate manner (e.g., by means of firmware).

[0110] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0111] The computer program for implementing the device access method of the application power system of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed completely on the machine, partially on the machine, partially on the machine as an independent software package and partially on a remote machine, or completely on a remote machine or server.

[0112] Embodiment 5

[0113] Embodiment 5 of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute a method for accessing a device to an application power system, the method comprising:

[0114] When a device access request is received and the device access request does not include a security certificate, an authentication result of the power device to be accessed is determined based on the device information in the device access request and the signature information corresponding to the power device to be accessed; wherein the power device to be accessed is a power device within the first area; when the authentication result is consistent with a preset result, a temporary certificate is issued to the power device to be accessed to control access of the power device to be accessed based on the temporary certificate; when access of the power device to be accessed is detected, system access parameters are configured for the power device to be accessed to generate a target certificate corresponding to the power device to be accessed based on the system access parameters and the temporary certificate.

[0115] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0117] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0118] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0120] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for accessing equipment to an electric power system, characterized in that: Applied to connecting power equipment in a first area to a power system corresponding to a second area, the power systems used by the first area and the second area are different, the method comprising: Upon receiving a device access request, and the device access request does not include a security certificate, determining an authentication result of the power device to be accessed based on the device information in the device access request and the signature information corresponding to the power device to be accessed; wherein the power device to be accessed is a power device in the first area; When the authentication result is consistent with the preset result, a temporary certificate is issued to the power device to be connected, so as to control the access of the power device to be connected based on the temporary certificate; When it is detected that the power device to be connected is connected, a system access parameter is configured for the power device to be connected, so as to generate a target certificate corresponding to the power device to be connected based on the system access parameter and the temporary certificate.

2. The method according to claim 1, characterized in that The method further comprises: In the case where the security certificate is included in the device access request, or in the case where it is detected that a target certificate corresponding to the power device to be connected has been generated, a target key is issued to the power device to be connected, so that the power device to be connected encrypts data sent to the power system based on the target key; and When receiving a data access request or a data upload request sent by the power device to be connected, the feedback data corresponding to the request is encrypted based on the symmetric key corresponding to the target key and fed back.

3. The method according to claim 1, characterized in that The determining, based on the device information in the device access request and the signature information corresponding to the power device to be accessed, the authentication result of the power device to be accessed includes: After decrypting the signature information, a first hash value corresponding to the power device to be connected is obtained; After hashing the device information in the device access request, a second hash value of the power device to be connected is obtained; When the first hash value and the second hash value are the same, it is determined that the authentication result of the power device to be connected is authentication passed.

4. The method according to claim 1, characterized in that The configuring system access parameters for the power device to be connected, so as to generate a target certificate corresponding to the power device to be connected based on the system access parameters, comprises: According to the device type of the power device to be connected and the data collection authority corresponding to the power device to be connected in the first area, configuring system access parameters for the power device to be connected, wherein the system access parameters include authority information for accessing the power system; Determine the activation code corresponding to the power device to be connected based on the device type, the system access parameter, and the coverage range applied by the power device to be connected; The temporary certificate is converted into a target certificate based on the activation code.

5. The method according to claim 1, characterized in that The method further comprises: According to the area to which the power equipment to be connected belongs, storing the target certificate in a database corresponding to the area; The usable period information corresponding to the target certificate is recorded, and the usable period information, the target certificate, and the device information of the power device to be connected are stored in association with each other.

6. The method according to claim 1, characterized in that The method further comprises: When it is detected that the system access parameter of the power device to be connected is changed, a target certificate corresponding to the power device to be connected is regenerated, and the currently used target certificate is updated.

7. The method according to claim 1, characterized in that The method further comprises: Establish communication encryption parameters with the power device to be connected, so as to transmit data between the power device to be connected and the power system based on the communication encryption parameters.

8. The method according to claim 1, characterized in that The method further comprises: When interaction with the power device to be connected is detected, the generated interaction data is recorded.

9. A device for accessing an electric power system, characterized in that: The device is used to connect power equipment in a first area to a power system corresponding to a second area, where the power systems used by the first area and the second area are different, and the device includes: an authentication result determination module, configured to determine, upon receiving a device access request and in the case where the device access request does not include a security certificate, an authentication result of the power device to be connected based on the device information in the device access request and the signature information corresponding to the power device to be connected; wherein the power device to be connected is a power device within the first area; A temporary certificate issuing module, used for issuing a temporary certificate to the power device to be connected when the authentication result is consistent with the preset result, so as to control the access of the power device to be connected based on the temporary certificate; The target certificate generation module is used to configure system access parameters for the power device to be connected when it is detected that the power device to be connected is connected, so as to generate a target certificate corresponding to the power device to be connected based on the system access parameters and the temporary certificate.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the device access method for the application power system according to any one of claims 1-8.

Images