Edge device control method and device based on pre-sharing algorithm and encryption tunnel

Abstract

The invention belongs to the technical field of Internet of Things, and provides an edge device control method and device based on a pre-sharing algorithm and an encryption tunnel, and the method comprises the steps: receiving an SSH connection request initiated by a platform client to an edge device, and forwarding the SSH connection request to a to-be-responded edge device; a VPN request is initiated to an Internet of Things management platform, and a service port is determined by adopting a pre-sharing algorithm; verifying the device identity of the edge device to be responded, establishing an encryption tunnel according to the WI REGUARD VPN tunnel technology, and determining an accessible service port by adopting a pre-sharing algorithm after the establishment of the encryption tunnel is completed; the edge device to be responded uses the encryption tunnel to start the SSH service according to the determined service port; and a session corresponding to the SSH service is monitored, and when the SSH service is finished, the encryption tunnel is closed so as to complete one-time SSH service. According to the invention, accurate access and stable access of the edge device in a complex network environment are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an edge device control method and device based on a pre-sharing algorithm and an encrypted tunnel. Background Art

[0002] With the rapid development of IoT technology, the number and types of IoT devices have increased rapidly, especially edge smart devices. These edge devices usually rely on a unified cloud management platform for centralized configuration and maintenance. However, when an edge device fails or requires system-level operations, engineers usually need to remotely log in to the device through SSH for operation and control. Traditional SSH operations require edge devices to have a fixed and externally accessible IP address. However, in actual applications, edge devices are often deployed in geographically remote and unattended environments, and their IP addresses are usually dynamically assigned intranet IPs that cannot be directly accessed from the outside. This makes it impossible for engineers to perform remote operations through SSH, which affects troubleshooting and equipment maintenance. In addition, IoT devices generally have weak security problems, especially the lack of effective authentication and encryption mechanisms, making them easy targets for malicious attacks.

[0003] Although the SSH protocol has strong security and can ensure the confidentiality and integrity of data through encrypted communication, traditional SSH connections still face some challenges in the IoT environment. In particular, edge devices often use dynamic public IP addresses, which causes SSH connections to be affected by changes in the network environment, unable to provide a stable remote access path, and facing various malicious access or attacks.

[0004] Therefore, it is necessary to provide a new edge device control method based on a pre-sharing algorithm and an encrypted tunnel to solve the above problems. Summary of the invention

[0005] The present invention aims to provide an edge device control method and apparatus based on a pre-sharing algorithm and an encrypted tunnel, so as to solve the technical problems in the prior art that the security of data transmission needs to be improved, and the risks of potential tampering and attack interaction behaviors are monitored and defended at a finer granularity due to the oversimplification of the data interaction verification method. The technical problems to be solved by the present invention are achieved through the following technical solutions.

[0006] The first aspect of the present invention provides an edge device control method based on a pre-shared algorithm and an encrypted tunnel, comprising: receiving an SSH connection request initiated by a platform client to an edge device, and forwarding the SSH connection request to a to-be-responded edge device; the to-be-responded edge device initiates a VPN request to the Internet of Things management platform based on a public-private key pair obtained when registering on the Internet of Things management platform, and uses a pre-shared algorithm to determine the service port to provide the SSH service; the Internet of Things management platform verifies the device identity of the to-be-responded edge device through the stored device public key, establishes an encrypted tunnel based on the WI REGUARD VPN tunnel technology, and after completing the establishment of the encrypted tunnel, uses a pre-shared algorithm to determine the accessible service port of the to-be-responded edge device; the to-be-responded edge device uses the encrypted tunnel established by the Internet of Things management platform to start the SSH service according to the service port calculated by the pre-shared algorithm; monitors the session corresponding to the SSH service, and when the SSH service ends, executes the closure of the encrypted tunnel to complete an SSH service of the to-be-responded edge device.

[0007] The second aspect of the present invention provides an edge device control device based on a pre-shared algorithm and an encrypted tunnel, which executes the edge device control method based on a pre-shared algorithm and an encrypted tunnel described in the first aspect of the present invention, and the edge device control device includes: a receiving module, which is used to receive an SSH connection request initiated by a platform client to an edge device, and forward the SSH connection request to a to-be-responded edge device; a determining module, in which the to-be-responded edge device initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering on the Internet of Things management platform, and uses a pre-shared algorithm to determine the service port to provide the SSH service; an establishing module, in which the Internet of Things management platform verifies the device identity of the to-be-responded edge device through the stored device public key, establishes an encrypted tunnel according to the WIREGUARD VPN tunnel technology, and after completing the establishment of the encrypted tunnel, uses a pre-shared algorithm to determine the accessible service port of the to-be-responded edge device; a starting module, in which the to-be-responded edge device uses the encrypted tunnel established by the Internet of Things management platform to start the SSH service according to the service port calculated by the pre-shared algorithm; an executing module, which monitors the session corresponding to the SSH service, and when the SSH service ends, executes the closing of the encrypted tunnel to complete an SSH service of the to-be-responded edge device.

[0008] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the edge device control method based on the pre-sharing algorithm and encrypted tunnel described in the first aspect of the present invention.

[0009] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, the edge device control method based on a pre-sharing algorithm and an encrypted tunnel described in the first aspect of the present invention is implemented.

[0010] Beneficial effects of the present invention:

[0011] Compared with the prior art, the present invention receives an SSH connection request initiated by a platform client to an edge device, and forwards the SSH connection request to the edge device to be responded; the edge device to be responded initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering on the Internet of Things management platform, and adopts a pre-shared algorithm to determine the service port to provide the SSH service; the Internet of Things management platform verifies the device identity of the edge device to be responded through the stored device public key, establishes an encrypted tunnel according to the WI REGUARD VPN tunnel technology, and after completing the establishment of the encrypted tunnel, adopts a pre-shared algorithm to determine the accessible service port of the edge device to be responded; the edge device to be responded uses the encrypted tunnel established by the Internet of Things management platform, and starts the SSH service according to the service port calculated by the pre-shared algorithm, which can achieve accurate access and stable access to the SSH service; monitors the session corresponding to the SSH service, and when the SSH service ends, executes the closure of the encrypted tunnel to complete the SSH service of the edge device to be responded. By establishing an encrypted tunnel, not only the problem caused by the inability of the random IP of the edge gateway to continuously and effectively provide SSH services is solved, but also a more reliable encrypted tunnel is provided, which adds a layer of secure tunnel for secure communication, and can effectively prevent the communication process between the edge device and the server from being eavesdropped or tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 is a flowchart of an example of an edge device control method based on a pre-sharing algorithm and an encrypted tunnel of the present invention;

[0013] Figure 2 is a schematic diagram of an application example of the edge device control method based on the pre-sharing algorithm and the encrypted tunnel of the present invention;

[0014] Figure 3 It is a structural schematic diagram of an example of an edge device control device based on a pre-sharing algorithm and an encrypted tunnel of the present invention;

[0015] Figure 4 is a schematic structural diagram of an electronic device embodiment according to the present invention;

[0016] Figure 5 It is a schematic diagram of the structure of a computer-readable medium embodiment according to the present invention. DETAILED DESCRIPTION

[0017] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0018] In view of the above problems, the present invention provides an edge device control method based on a pre-sharing algorithm and an encrypted tunnel. The method can further enhance SSH security by combining VPN technology. By establishing a virtual private network connection (VPN connection) for each edge device, not only the dynamic IP address problem is solved, but also an encrypted tunnel is provided to ensure that the communication between the device and the management platform is not interfered by the public network. Therefore, the SSH connection is limited to a trusted virtual private network (VPN), which greatly improves the security of remote operation and ensures stable access to the device in a complex network environment.

[0019] Example 1

[0020] Refer to the following Figure 1 , Figure 2 and Figure 3 , the method of the present invention will be described in detail.

[0021] Figure 1 It is a flowchart of an example of the edge device control method based on the pre-sharing algorithm and the encrypted tunnel of the present invention.

[0022] First, in step S101, an SSH connection request initiated by a platform client to an edge device is received, and the SSH connection request is forwarded to the edge device to be responded to.

[0023] It should be noted that SSH (Secure Shell) is a network protocol used to securely log in to other computers remotely. It provides strong encryption, file transfer and forwarding functions, and is widely used to manage servers and other network devices. The SSH connection request is a connection request based on the SSH network protocol. The SSH access request is an access request based on the SSH network protocol.

[0024] Specifically, edge devices include edge processing equipment related to industrial data gateways, video artificial intelligence recognition devices, environmental data collection and analysis equipment, traffic information, etc.

[0025] In a specific application example, Figure 2As shown, the application example includes an Internet of Things management platform, multiple edge devices that can be connected to the Internet of Things management platform, and multiple platform clients. The Internet of Things management platform can remotely control and manage each edge device. The Internet of Things management platform provides the SSH access function, i.e., SSH service, of the managed edge devices through a Web page service. The platform client initiates an SSH access request and a connection request to the edge device through a page application. Among them, the platform client is installed with an SSH client.

[0026] The following will be combined Figure 2 The specific process of the edge device control method of the present invention is described with reference to an application example.

[0027] Specifically, the platform client initiates an SSH connection request to the edge device, the IoT management platform receives the SSH connection request, and forwards the SSH connection request to the edge device to be responded to.

[0028] Before forwarding the SSH connection request to the edge device to be responded, the Internet of Things management platform establishes an MQTTS connection with the edge device to be responded, and then sends the SSH connection request information to the corresponding edge device, that is, the edge device to be responded.

[0029] It should be noted that MQTTS (MQTT over SSL / TLS) is a secure version of the MQTT protocol, which ensures the security of message transmission through SSL / TLS encryption. MQTTS provides a secure and reliable communication channel for Internet of Things (IoT) devices and other applications. The MQTTS connection is a communication channel formed based on the MQTT protocol.

[0030] For MQTTS connection, first select a suitable server, such as building it yourself or using the MQTT service provided by a cloud service provider. Further use, for example, an SSL / TLS certificate for MQTTS connection. For example, configure MQTTS connection parameters in the application, for example, by specifying the address of the server (for example, ss l: / / broker.example.com:8**3), perform connection parameter authentication, and establish an MQTTS connection.

[0031] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0032] Next, in step S102, the edge device to be responded to initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering with the Internet of Things management platform, and uses a pre-sharing algorithm to determine the service port for providing SSH service.

[0033] Specifically, each edge device is registered on the IoT management platform to provide SSH services for the platform client. When each edge device is registered on the IoT management platform, the IoT management platform allocates a public-private key pair to each edge device, so that each edge device obtains the public-private key pair and the VPN public key of the IoT management platform. The public key is used for identity confirmation and authentication of both parties.

[0034] Optionally, the public key and private key are calculated based on the Curve25519 elliptic curve encryption algorithm.

[0035] For private key generation, a cryptographically secure pseudo-random number generator (usually / dev / urandom or a similar random source provided by the operating system) is used to generate a random number of 20 to 40 bytes (eg, 32 bytes) as the private key.

[0036] Specifically, Wi reGuard uses a specific format of the private key of Curve25519 to ensure that the private key is valid, that is, some specific bits in the generated (eg, 32-byte) random number need to be processed.

[0037] For public key generation, the Curve25519 algorithm is used to perform elliptic curve operations on the private key to obtain the corresponding public key. This process ensures that the public key calculated using the private key is unique and matches the private key.

[0038] In a specific implementation, the Internet of Things management platform sends an SSH connection request to the corresponding edge device, i.e., the edge device to be responded to. After receiving the SSH connection request, the edge device to be responded to uses the public-private key pair obtained when registering with the Internet of Things management platform to initiate a VPN request to the Internet of Things management platform, i.e., initiates a VPN connection request with the Internet of Things management platform having a public network fixed IP address. The VPN request refers to a connection request using a VPN protocol such as Wi reGuard, OpenVPN, IPsec, etc.

[0039] Specifically, the edge device to be responded to adopts a pre-sharing algorithm to determine a service port for providing the SSH service.

[0040] Specifically, according to the device identification code of the edge device to be responded and the dynamically determined random factor, a pre-sharing algorithm is adopted to calculate the service port of the SSH service to be provided by the edge device to be responded using the following expression:

[0041] P=Pmin+mod(H(S),(Pmax-Pmin+1))

[0042] Among them, P represents the service port of the SSH service provided by the edge device to be responded; S represents the input device identification code and random factor of the responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded; each edge device has a device identification code, which includes a unit character code and a code converted based on the device production date, and the length of the device identification code is within a specified length range.

[0043] It should be noted that a hash function is a function that maps input data to a fixed-length output value. It is usually used for fast data search and data integrity verification. You can flexibly choose commonly used public hash functions such as MD5, SHA-256, etc.

[0044] Specifically, the random factor is randomly generated when the platform initiates an SSH request to the edge device and is packaged together with the request information and sent to the edge device. For example, the random factor is a random 8-bit string.

[0045] Optionally, the length of the device identification code is in the range of 10 to 20 characters. The device identification code of the edge device to be responded is converted into a hash value of a specific number of digits, and further modulo calculation is performed to finally obtain the corresponding dynamic or private service port.

[0046] Specifically, the specific bit number is no greater than 256 bits.

[0047] For modulo calculation, mod (modulo) is an operation in mathematics that is used to calculate the remainder after dividing two integers. The modulo operator is usually represented by the symbol "%" or "mod". For example, the expression mod(a,b) represents the remainder after dividing the integer a by the integer b.

[0048] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0049] Next, in step S103, the IoT management platform verifies the device identity of the edge device to be responded to through the stored device public key, establishes an encrypted tunnel according to the WI REGUARD VPN tunnel technology, and after the encrypted tunnel is established, uses the pre-sharing algorithm to determine the accessible service port of the edge device to be responded to.

[0050] In a specific implementation, the IoT management platform stores the device information of each edge device when it is registered and the assigned public-private key pair. When performing device identity authentication on each edge device, the device identity of each edge device (e.g., the edge device to be responded to) is verified through the stored device information.

[0051] According to WI REGUARD VPN tunnel technology, at both ends of the encrypted tunnel, the other party's public key is used to verify the identity of the peer, and a session key is generated to symmetrically encrypt session information to ensure the security of communication content.

[0052] By establishing an encrypted tunnel, not only is the problem caused by the random IP of the edge gateway being unable to continuously and effectively provide SSH services solved, but a more reliable encrypted tunnel is also provided, adding a layer of security tunnel for secure communications, which can effectively prevent the communication process between the edge device and the server from being eavesdropped or tampered with.

[0053] Furthermore, after the establishment of the WIREGUARD VPN tunnel is completed, according to the working mechanism of the WIREGUARD VPN tunnel, the IoT management platform and each edge device will obtain a unique virtual private IP address, thereby solving the problem of inability to be accurately accessed due to the random dynamics of the original edge device IP address. It should be noted that the effective range of the above-mentioned unique virtual private IP address is limited to both parties of the VPN tunnel, namely the IoT management platform and each edge device. Therefore, by establishing an encrypted tunnel to connect the IoT management platform and each edge device, a secure connection between the IoT management platform (such as a virtual platform) and each edge device can be more reliably achieved.

[0054] After the encrypted tunnel is established, the IoT management platform uses a pre-sharing algorithm (specifically, a pre-sharing algorithm shared with each edge device) to determine the accessible service port.

[0055] Specifically, the IoT management platform dynamically determines the random factor corresponding to the edge device to be responded to according to the device identification code when the edge device to be responded to is registered, adopts the pre-sharing algorithm shared with the edge device to be responded to, uses the following expression to calculate the accessible service port, and informs the platform client of the SSH connection request initiated to the edge device:

[0056] P=Pmin+mod(H(S),(Pmax-Pmin+1))

[0057] Wherein, P represents the service port of the SSH service provided by the edge device to be responded; S represents the device identification code and random factor of the input responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded;

[0058] Each edge device has a device identification code, which includes a single-character code and a code converted based on a device production date, and the length of the device identification code is within a specified length range.

[0059] Optionally, the length of the device identification code is in the range of 10 to 20 characters, and the device identification code of the edge device to be responded is converted into a hash value of a specific number of bits, and further a modulus calculation is performed to obtain the service port of the corresponding dynamic or private service port.

[0060] Specifically, the random factor is randomly generated when the platform initiates an SSH request to the edge device and is packaged together with the request information and sent to the edge device. For example, the random factor is a random 8-bit string.

[0061] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0062] Next, in step S104, the edge device to be responded uses the encrypted tunnel established by the Internet of Things management platform to start the SSH service according to the service port calculated by the pre-sharing algorithm.

[0063] In a specific implementation, the Internet of Things management platform generates a public-private key pair according to each edge device, and the edge device to be responded to obtains the public-private key pair when registering with the Internet of Things management platform. When the Internet of Things management platform receives a connection request from the edge device to be responded to, it performs device identity authentication on the edge device to be responded to according to the stored public-private key pair. When the device identity authentication is passed, it is determined that the establishment of the encrypted tunnel is completed, and the connection request is a VPN request.

[0064] Specifically, the platform client initiates an SSH request to the edge device through a page application, the IoT management platform establishes an MQTTS connection with the corresponding edge device, and forwards the received SSH request to the corresponding edge device, i.e., the edge device to be responded to. The IoT management platform provides SSH access function to the managed edge smart devices through Web page services.

[0065] Next, the edge device to be responded to starts the SSH service according to the determined service port.

[0066] Preferably, the Internet of Things management platform is deployed with a key management server, and the key management server is used to centrally manage the public and private key pairs of the virtual private network (VPN).

[0067] When each edge device is connected to the Internet of Things management platform for the first time, the Internet of Things management platform sends the private key pair of each edge device and the public key of the Internet of Things management platform to each edge device.

[0068] The key management server adopts a phased update strategy to regularly rotate VPN keys.

[0069] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0070] Next, in step S105, the session corresponding to the SSH service is monitored, and when the SSH service ends, the encryption tunnel is closed to complete an SSH service of the edge device to be responded.

[0071] Specifically, the edge device to be responded to starts the SSH service according to the service port calculated by the pre-sharing algorithm. The Internet of Things management platform initiates an SSH connection request with the edge device to be responded to according to the private IP address of the edge device to be responded to and the determined service port, that is, completes the establishment of the SSH session.

[0072] Furthermore, when the platform client's page interface closes or exits the SSH function interface, that is, the platform client of the Internet of Things management platform initiates the closing of the SSH session, the edge device to be responded to detects the end of the SSH session, ends the SSH service, and closes the encrypted tunnel. Each time the SSH service is executed, the service port is determined once, specifically: according to the device identification code of the edge device to be responded to and the dynamically determined random factor, a pre-sharing algorithm is used, and the above expression is used to calculate the service port of the SSH service to be provided by the edge device to be responded to; the Internet of Things management platform uses the pre-sharing algorithm shared with the edge device to be responded to, uses the above expression, calculates the accessible service port, and informs the platform client that initiates the SSH connection request to the edge device.

[0073] In a specific implementation, the edge device starts the SSH service according to the calculated service port, and the IoT management platform initiates an SSH connection request with the edge device according to the unique private IP address of the edge device and the calculated service port. The establishment of the SSH session is completed. Since the identification code (for example, represented by SN) of each edge device is different, the corresponding service port is determined for each edge device, which can greatly reduce the probability of malicious detection of the public network, thereby improving the protection capability of the edge device.

[0074] Optionally, when the page interface of the platform client is closed or the SSH function interface is exited, the IoT management platform (SSH client) initiates closing the SSH session. After the edge service program monitors the end of the SSH session, it ends the SSH service and closes the VPN tunnel. Thus, a complete SSH session life cycle ends.

[0075] In an optional implementation, a role-based permission management method is provided, and the user who logs into the IoT management platform has identity authentication, and through hierarchical permission management with different device ranges for different users, it is ensured that only authorized personnel or services can access specific devices or perform corresponding operations. In this way, not only can the operational risks be reduced, but also the refinement and efficiency of the device management process can be ensured.

[0076] Specifically, a training data set is established based on the identifier of the platform client marked with the authorization scope, the edge device, and the calculated service port information. Based on the deep network algorithm, a device management model is constructed, and the device management model is trained using the established training data set to obtain a trained device management model. When the identifier of the platform client is input, the edge device corresponding to the identifier of the platform client and the service to be provided are obtained.

[0077] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0078] In an optional implementation, based on the key management method of WireGuard VPN (Wire Guard VPN: WireGuard is a modern open source VPN protocol and tool designed to achieve simple, secure, and efficient virtual private network connections), in order to simplify the security management of edge devices, a unified key management method based on WireGuard VPN is proposed. By deploying a key management server, public and private key pairs (such as VPN public and private key pairs, WireGuard public and private key pairs) are centrally managed. Specifically, it includes key generation and distribution, key rotation and update, key revocation and expiration management.

[0079] For key generation and distribution, the key management server generates a WireGuard key pair for each edge device. When the edge device connects to the IoT management platform for the first time, the IoT management platform sends the edge device's key pair and platform public key to the edge device.

[0080] For key rotation and update, the key management server is responsible for regularly rotating keys (such as VPN keys, WireGuard keys) to improve the security of the overall system. A phased update strategy is adopted to ensure that the connection between edge devices and the IoT management platform is not interrupted during the update process.

[0081] For key revocation and expiration management, when an edge device is removed or stolen, the key management server supports the rapid revocation of the device's WireGuard key, ensuring that the device can no longer connect to the IoT management platform to prevent security risks.

[0082] It should be noted that the above is only described as an optional example and should not be understood as a limitation to the present invention.

[0083] Compared with the prior art, the present invention receives an SSH connection request initiated by a platform client to an edge device, and forwards the SSH connection request to the edge device to be responded; the edge device to be responded initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering on the Internet of Things management platform, and adopts a pre-shared algorithm to determine the service port to provide the SSH service; the Internet of Things management platform verifies the device identity of the edge device to be responded through the stored device public key, establishes an encrypted tunnel according to the WI REGUARD VPN tunnel technology, and after completing the establishment of the encrypted tunnel, adopts a pre-shared algorithm to determine the accessible service port of the edge device to be responded; the edge device to be responded uses the encrypted tunnel established by the Internet of Things management platform, and starts the SSH service according to the service port calculated by the pre-shared algorithm, which can achieve accurate access and stable access to the SSH service; monitors the session corresponding to the SSH service, and when the SSH service ends, executes the closure of the encrypted tunnel to complete the SSH service of the edge device to be responded. By establishing an encrypted tunnel, not only the problem caused by the inability of the random IP of the edge gateway to continuously and effectively provide SSH services is solved, but also a more reliable encrypted tunnel is provided, which adds a layer of secure tunnel for secure communication, and can effectively prevent the communication process between the edge device and the server from being eavesdropped or tampered with.

[0084] Example 2

[0085] The following are embodiments of the device of the present invention, which can be used to implement the method embodiments of the present invention. For details not disclosed in the device embodiments of the present invention, please refer to the method embodiments of the present invention.

[0086] Figure 3 is a structural diagram of an example of an edge device control device based on a pre-sharing algorithm and an encrypted tunnel according to the present invention.

[0087] The following will refer to Figure 3 , the edge device control device 300 is specifically described. The edge device control device 300 includes a receiving module 310, a determining module 320, a establishing module 330, a starting module 340 and an executing module 350. The edge device control device 300 executes the edge device control method described in Embodiment 1 of the present invention.

[0088] In a specific implementation, the receiving module 310 is used to receive an SSH connection request initiated by the platform client to the edge device, and forward the SSH connection request to the edge device to be responded; the determining module 320 is used for the edge device to be responded to initiate a VPN request to the Internet of Things management platform based on the public-private key pair obtained when registering on the Internet of Things management platform, and uses a pre-sharing algorithm to determine the service port to provide the SSH service; the establishing module 330 is used for the Internet of Things management platform to verify the device identity of the edge device to be responded through the stored device public key, and to establish an encrypted tunnel based on the WIREGUARD VPN tunnel technology. After completing the establishment of the encrypted tunnel, a pre-sharing algorithm is used to determine the accessible service port of the edge device to be responded; the starting module 340 is used for the edge device to be responded to use the encrypted tunnel established by the Internet of Things management platform to start the SSH service according to the service port calculated by the pre-sharing algorithm; the executing module 350 is used to monitor the session corresponding to the SSH service, and when the SSH service ends, execute the closure of the encrypted tunnel to complete an SSH service of the edge device to be responded.

[0089] According to an optional implementation manner, based on the device identification code and random factor of the edge device to be responded, a pre-sharing algorithm is adopted to calculate the service port of the SSH service to be provided by the edge device to be responded using the following expression:

[0090] P=Pmin+mod(H(S),(Pmax-Pmin+1))

[0091] Among them, P represents the service port of the SSH service provided by the edge device to be responded; S represents the input device identification code and random factor of the responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded; each edge device has a device identification code, which includes a unit character code, a code converted based on the device production date and a random factor, and the length of the device identification code is within the specified length range.

[0092] According to an optional implementation manner, after the encrypted tunnel is established, a pre-sharing algorithm is used to determine the accessible service port.

[0093] The IoT management platform dynamically determines the random factor corresponding to the edge device to be responded to according to the device identification code when the edge device to be responded to is registered, adopts the pre-sharing algorithm shared with the edge device to be responded to, uses the following expression to calculate the accessible service port, and informs the client that initiates the SSH connection request to the edge device:

[0094] P=Pmin+mod(H(S),(Pmax-Pmin+1))

[0095] Among them, P represents the service port of the SSH service provided by the edge device to be responded; S represents the device identification code and random factor of the input responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded.

[0096] Each edge device has a device identification code, which includes a single-character code and a code converted based on a device production date, and the length of the device identification code is within a specified length range.

[0097] According to an optional implementation, the length of the device identification code is in the range of 10 to 20 characters, the device identification code of the edge device to be responded is converted into a hash value of a specific number of bits, and a modulo calculation is further performed to obtain the service port of the corresponding dynamic or private service port.

[0098] According to an optional implementation manner, the IoT management platform verifies the device identity of the edge device to be responded to through the stored device information, and establishes an encrypted tunnel based on the WI REGUARD VPN tunnel technology.

[0099] The Internet of Things management platform generates a public-private key pair according to each edge device. The edge device to be responded to obtains a public-private key pair when registering with the Internet of Things management platform. When the Internet of Things management platform receives a connection request from the edge device to be responded to, it performs device identity authentication on the edge device to be responded to according to the stored public-private key pair. When the device identity authentication is passed, it is determined that the establishment of the encrypted tunnel is completed and the connection request is a VPN request.

[0100] According to an optional implementation method, the platform client initiates an SSH request to the edge device through a page application, the Internet of Things management platform establishes an MQTTS connection with the corresponding edge device, and forwards the received SSH request to the corresponding edge device, that is, the edge device to be responded to.

[0101] The Internet of Things management platform provides SSH access function for managed edge smart devices through Web page services.

[0102] According to an optional implementation manner, the edge device to be responded to starts the SSH service according to the determined service port; the Internet of Things management platform initiates an SSH connection request with the edge device to be responded to according to the private IP address of the edge device to be responded to and the determined service port, thereby completing the establishment of the SSH session.

[0103] When the page interface of the platform client is closed or the SSH function interface is exited, that is, the platform client of the Internet of Things management platform initiates the closing of the SSH session, the responding edge device detects the end of the SSH session, ends the SSH service, and closes the encrypted tunnel.

[0104] Each time the SSH service is executed, the service port is determined once.

[0105] The Internet of Things management platform is deployed with a key management server, and the key management server is used to centrally manage public and private key pairs.

[0106] When each edge device is connected to the Internet of Things management platform for the first time, the Internet of Things management platform sends the private key pair of each edge device and the platform public key to each edge device.

[0107] The key management server adopts a phased update strategy to periodically rotate keys.

[0108] It should be noted that due to Figure 3 The edge device control method performed by the edge device control device and Figure 1 The edge device control methods in are roughly the same, so the description of the same parts is omitted.

[0109] Compared with the prior art, the present invention receives an SSH connection request initiated by a platform client to an edge device, and forwards the SSH connection request to the edge device to be responded; the edge device to be responded initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering on the Internet of Things management platform, and uses a pre-shared algorithm to determine the service port to provide the SSH service; the Internet of Things management platform verifies the device identity of the edge device to be responded through the stored device public key, establishes an encrypted tunnel according to the WIREGUARD VPN tunnel technology, and after completing the establishment of the encrypted tunnel, uses a pre-shared algorithm to determine the accessible service port of the edge device to be responded; the edge device to be responded uses the encrypted tunnel established by the Internet of Things management platform, and starts the SSH service according to the service port calculated by the pre-shared algorithm, which can achieve accurate access and stable access to the SSH service; monitors the session corresponding to the SSH service, and when the SSH service ends, executes the closure of the encrypted tunnel to complete the SSH service of the edge device to be responded. By establishing an encrypted tunnel, not only the problem caused by the inability of the random IP of the edge gateway to continuously and effectively provide SSH services is solved, but also a more reliable encrypted tunnel is provided, which adds a layer of secure tunnel for secure communication, and can effectively prevent the communication process between the edge device and the server from being eavesdropped or tampered with.

[0110] Example 4

[0111] Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

[0112] like Figure 4 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0113] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0114] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0115] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0116] It should be understood that Figure 4 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0117] Through the above description of the implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Figure 5 As shown, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of commands to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the embodiment of the present invention.

[0118] The software product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0119] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0120] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0121] The computer-readable medium carries one or more programs. When the one or more programs are executed by a device, the computer-readable medium implements the data interaction method of the present disclosure.

[0122] Those skilled in the art will appreciate that the above modules can be distributed in the device according to the description of the embodiment, or can be changed accordingly and only used in one or more devices different from the embodiment. The modules of the above embodiments can be combined into one module, or further divided into multiple sub-modules.

[0123] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several commands to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present invention.

[0124] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0125] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0126] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for controlling edge devices based on a pre-sharing algorithm and an encrypted tunnel, characterized in that: include: Receive the SSH connection request initiated by the platform client to the edge device, and forward the SSH connection request to the edge device to be responded; The edge device to be responded to initiates a VPN request to the IoT management platform based on the public-private key pair obtained when registering on the IoT management platform, and uses a pre-sharing algorithm to determine the service port for providing SSH service; The IoT management platform verifies the device identity of the edge device to be responded to through the stored device public key, establishes an encrypted tunnel based on the WIREGUARD VPN tunnel technology, and after the encrypted tunnel is established, uses the pre-sharing algorithm to determine the accessible service port of the device to be responded to; The edge device to be responded uses the encrypted tunnel established by the Internet of Things management platform to start the SSH service according to the service port calculated by the pre-sharing algorithm; The session corresponding to the SSH service is monitored, and when the SSH service ends, the encrypted tunnel is closed to complete an SSH service of the edge device to be responded.

2. The edge device control method according to claim 1, characterized in that: The edge device to be responded to initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering on the Internet of Things management platform, and uses a pre-sharing algorithm to determine the service port to provide the SSH service, including: According to the device identification code and random factor of the edge device to be responded, the pre-sharing algorithm is adopted to calculate the service port of the SSH service to be provided by the edge device to be responded using the following expression: P=Pmin+mod(H(S),(Pmax-Pmin+1)) Among them, P represents the service port of the SSH service provided by the edge device to be responded; S represents the input device identification code and random factor of the responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded; each edge device has a device identification code, which includes a unit character code, a code converted based on the device production date and a random factor, and the length of the device identification code is within the specified length range.

3. The edge device control method according to claim 1, characterized in that: After the encrypted tunnel is established, the pre-sharing algorithm is used to determine the accessible service port, including: The IoT management platform dynamically determines the random factor corresponding to the edge device to be responded to according to the device identification code when the edge device to be responded to is registered, adopts the pre-sharing algorithm shared with the edge device to be responded to, uses the following expression to calculate the accessible service port, and informs the client that initiates the SSH connection request to the edge device: P=Pmin+mod(H(S),(Pmax-Pmin+1)) Wherein, P represents the service port of the SSH service provided by the edge device to be responded; S represents the device identification code and random factor of the input responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded; Each edge device has a device identification code, which includes a single-character code and a code converted based on a device production date, and the length of the device identification code is within a specified length range.

4. The edge device control method according to claim 2 or 3, characterized in that: Further including: The length of the device identification code is in the range of 10 to 20 characters. The device identification code of the edge device to be responded is converted into a hash value of a specific number of bits, and further modulo calculation is performed to obtain the service port of the corresponding dynamic or private service port.

5. The edge device control method according to claim 1, characterized in that: The IoT management platform verifies the device identity of the edge device to be responded to through the stored device information, and establishes an encrypted tunnel based on the WIREGUARD VPN tunnel technology, including: The IoT management platform generates a public-private key pair based on each edge device; The edge device to be responded to obtains a public-private key pair when registering on the Internet of Things management platform; When the Internet of Things management platform receives a connection request from an edge device to be responded to, it performs device identity authentication on the edge device to be responded to based on the stored public-private key pair. When the device identity authentication is passed, it is determined that the establishment of the encrypted tunnel is completed and the connection request is a VPN request.

6. The edge device control method according to claim 1, characterized in that: The platform client initiates an SSH request to the edge device through a page application, and the IoT management platform establishes an MQTTS connection with the corresponding edge device, and forwards the received SSH request to the corresponding edge device, i.e., the edge device to be responded to; The Internet of Things management platform provides SSH access function for managed edge smart devices through Web page services.

7. The edge device control method according to claim 1, characterized in that: The monitoring of the session corresponding to the SSH service, and when the SSH service ends, closing the encrypted tunnel to complete an SSH service of the edge device to be responded to, includes: The edge device to be responded to starts the SSH service according to the determined service port; The IoT management platform initiates an SSH connection request with the edge device to be responded to according to the private IP address of the edge device to be responded to and the determined service port, that is, completes the establishment of the SSH session. When the page interface of the platform client is closed or the SSH function interface is exited, that is, the platform client of the IoT management platform initiates closing the SSH session, the edge device to be responded to detects the end of the SSH session, ends the SSH service, and closes the encrypted tunnel; Each time the SSH service is executed, the service port is determined once.

8. The edge device control method according to claim 1, characterized in that: The edge device to be responded to initiates a VPN request to the Internet of Things management platform based on the public-private key pair obtained when registering on the Internet of Things management platform, including The Internet of Things management platform is deployed with a key management server, which is used to centrally manage public and private key pairs. When each edge device is connected to the IoT management platform for the first time, the IoT management platform sends the private key pair of each edge device and the platform public key to each edge device; The key management server adopts a phased update strategy to periodically rotate keys.

9. An edge device control device based on a pre-sharing algorithm and an encrypted tunnel, characterized in that: It executes the edge device control method based on the pre-sharing algorithm and the encrypted tunnel according to any one of claims 1 to 8, and the edge device control device includes: The receiving module is used to receive the SSH connection request initiated by the platform client to the edge device, and forward the SSH connection request to the edge device to be responded; The determination module is to respond to the VPN request initiated by the edge device to the IoT management platform based on the public-private key pair obtained when registering on the IoT management platform, and to determine the service port to provide the SSH service using a pre-sharing algorithm; Establish a module for the IoT management platform to verify the device identity of the edge device to be responded to through the stored device public key, establish an encrypted tunnel according to the WIREGUARD VPN tunnel technology, and after the encrypted tunnel is established, use a pre-sharing algorithm to determine the accessible service port of the edge device to be responded to; A startup module, used for the edge device to be responded to use the encrypted tunnel established by the Internet of Things management platform to start the SSH service according to the service port calculated by the pre-sharing algorithm; The execution module monitors the session corresponding to the SSH service, and when the SSH service ends, executes closing of the encrypted tunnel to complete an SSH service of the edge device to be responded.

10. The edge device control device according to claim 9, characterized in that: The edge device to be responded to initiates a VPN request to the Internet of Things management platform according to the public-private key pair obtained when registering on the Internet of Things management platform, and uses a pre-sharing algorithm to determine the service port to provide the SSH service, including: According to the device identification code and random factor of the edge device to be responded, the pre-sharing algorithm is adopted to calculate the service port of the SSH service to be provided by the edge device to be responded using the following expression: P=Pmin+mod(H(S),(Pmax-Pmin+1)) Among them, P represents the service port of the SSH service provided by the edge device to be responded; S represents the input device identification code and random factor of the responding edge device; H(S) is a hash function that converts the string S into an integer; Pmax represents the maximum value of the service port of the SSH service provided by the edge device to be responded, and Pmin represents the minimum value of the service port of the SSH service provided by the edge device to be responded; each edge device has a device identification code, which includes a unit character code, a code converted based on the device production date and a random factor, and the length of the device identification code is within the specified length range.

Images