Security reinforcement communication method and device, electronic equipment and medium

Abstract

The invention discloses a security reinforcement communication method and device, electronic equipment and a medium, and is applied to the technical field of communication. The security reinforcement communication method provided by the invention comprises the following steps: receiving authentication information sent by a power station, and performing security authentication on the power station based on the authentication information to obtain an authentication result; if the authentication result represents that the power station is successfully authenticated, constructing a communication connection channel with the power station; acquiring data information sent by the power station according to the communication connection channel, and performing state analysis on the power station based on the data information and historical data information of the power station to obtain an analysis result; and if the analysis result shows that the power station is abnormal, disconnecting the communication connection channel. Therefore, security reinforcement and analysis detection are performed on the connection with the power station from the connection stage and the communication stage, and the reliability of information authentication between the power station and the cloud is ensured in the connection stage; the power station is analyzed in the communication stage, the use safety of the power station and the cloud is ensured, and the risk caused by dangerous connection is avoided.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security-enhanced communication method, device, electronic device and medium. Background Art

[0002] With the rapid development of industrial and commercial energy storage, the operation and maintenance of most industrial and commercial energy storage power stations have been transferred to the cloud. The power station sends relevant data to the cloud through two-way communication with the cloud, and the cloud controls the power station to perform corresponding operations through the relevant data, thereby realizing unified management of the power station.

[0003] At present, the communication between industrial and commercial energy storage power stations and the cloud often uses the Internet of Things MQTT (Message Queuing Telemetry Transport) protocol as the communication protocol. The power station uses a pre-specified domain name (or public IP (Internet Protocol)) plus a port to communicate with the cloud, and the cloud only needs to perform a simple authentication of the connected client ID (identity). In this communication method, some network criminals can easily obtain MQTT connection information through brute force cracking, virus invasion of client computers, etc., and disguise themselves as embedded devices of power stations to connect to the MQTT server in the cloud. At the least, it will cause the data of the disguised power station to be disordered and distorted, and it will not be able to receive control instructions in time. At worst, it will cause the power station operation instructions to be hijacked, causing the power station to fail to operate normally, affecting industrial and commercial production.

[0004] In view of the above technologies, seeking a security-enhanced power station and cloud communication method is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0005] The purpose of this application is to provide a security-reinforced communication method, device, electronic device and medium, which can securely reinforce the communication process between the power station and the cloud, and eliminate the risk in a timely manner after the security risk occurs.

[0006] To solve the above technical problems, the present application provides a secure communication method, including:

[0007] Receive authentication information sent by the power station, and perform security authentication on the power station based on the authentication information to obtain an authentication result;

[0008] If the authentication result indicates that the power station authentication is successful, a communication connection channel is established with the power station;

[0009] Acquire data information sent by the power station according to the communication connection channel, and perform status analysis on the power station based on the data information and historical data information of the power station to obtain analysis results;

[0010] If the analysis result indicates that the power station is abnormal, the communication connection channel is disconnected.

[0011] Preferably, the power station is security authenticated based on the authentication information to obtain an authentication result, including:

[0012] Get the client ID, user name, password and login IP in the authentication information;

[0013] Determine whether the client ID is in the blacklist;

[0014] If the client ID is not included in the blacklist, determine whether the client ID is in the database;

[0015] If the database includes the client ID, determine whether the username and password match;

[0016] If the password and username match, determine whether the login IP is in the historical login record;

[0017] If the historical login record includes the login IP, an authentication result indicating successful authentication of the power station can be obtained.

[0018] Preferably, performing safety authentication on the power station based on the authentication information to obtain an authentication result further includes:

[0019] If the client ID is included in the blacklist, or the client ID is not included in the database, or the password and the user name do not match, an authentication result indicating that the power station authentication has failed is obtained.

[0020] Preferably, performing safety authentication on the power station based on the authentication information to obtain an authentication result further includes:

[0021] If the login IP is not included in the historical login record, the connection key is sent to the corresponding power station;

[0022] If the key analysis returned by the power station based on the connection key is received within the preset time, the authentication result indicating the successful authentication of the power station is obtained, and the login IP is recorded in the historical login record;

[0023] If the key analysis returned by the power station based on the connection key is not received within the preset time, an authentication result indicating that the power station authentication has failed is obtained, and the login IP is recorded in the blacklist.

[0024] Preferably, the power station is subjected to status analysis based on the data information and the historical data information of the power station to obtain analysis results, including:

[0025] Obtaining data frequency and data volume in the data information, and determining data flow rate according to the data frequency and data volume;

[0026] Obtain the historical data frequency and historical data volume corresponding to the historical data information, and determine the historical traffic speed according to the historical data frequency and historical data volume;

[0027] If after the communication connection channel is established for a preset connection time, and the difference between the data flow rate and the historical flow rate is less than the first threshold, an analysis result indicating that the power station is normal is obtained;

[0028] If after the communication connection channel is established for the preset connection time, and the difference between the data flow rate and the historical flow rate is not less than the first threshold and not greater than the second threshold, an analysis result indicating that the power station is normal is obtained, and a safety warning message is sent to the power station;

[0029] If after the communication connection channel is established for a preset connection time, and the difference range between the data flow rate and the historical flow rate is greater than the second threshold, an analysis result characterizing an abnormality of the power station is obtained.

[0030] Preferably, if the analysis result indicates that the power station is abnormal, after disconnecting the communication connection channel, the method further includes:

[0031] Record the client ID in the authentication information corresponding to the power station in the blacklist;

[0032] Send safety warning information to the power station and regenerate corresponding authentication information.

[0033] Preferably, before receiving the authentication information sent by the power station, the method further includes:

[0034] A corresponding virtual power station is constructed according to the power station, and corresponding authentication information is generated based on the virtual power station so that operation and maintenance personnel can configure the authentication information into the corresponding power station.

[0035] On the other hand, the present application also provides a security-enhanced communication device, comprising:

[0036] A security authentication module, used for receiving authentication information sent by the power station, and performing security authentication on the power station based on the authentication information to obtain an authentication result;

[0037] A channel building module is used to build a communication connection channel with the power station when the authentication result indicates that the power station authentication is successful;

[0038] An analysis module is used to obtain data information sent by the power station according to the communication connection channel, and perform status analysis on the power station based on the data information and historical data information of the power station to obtain analysis results;

[0039] The disconnect channel module is used to disconnect the communication connection channel when the analysis result indicates that the power station is abnormal.

[0040] On the other hand, the present application also provides an electronic device, comprising a memory for storing a computer program;

[0041] The processor is used to implement the steps of the above-mentioned security reinforcement communication method when executing the computer program.

[0042] On the other hand, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned security reinforcement communication method are implemented.

[0043] The present application provides a security reinforcement communication method, including: receiving authentication information sent by a power station, and performing security authentication on the power station based on the authentication information to obtain an authentication result; if the authentication result indicates that the power station authentication is successful, then a communication connection channel is established with the power station; data information sent by the power station is obtained according to the communication connection channel, and the power station is analyzed based on the data information and the historical data information of the power station to obtain an analysis result; if the analysis result indicates that the power station is abnormal, then the communication connection channel is disconnected. It can be seen that the present application performs security reinforcement and analysis and detection on the connection with the power station from the connection stage and the communication stage respectively, which can ensure the reliability of information authentication between the power station and the cloud in the connection stage; the power station can be analyzed in the communication stage to ensure the safe use of the power station and the cloud and avoid the risks brought by dangerous connections. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 A flowchart of a security reinforcement communication method provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of the cloud-based security authentication of a power station provided in an embodiment of the present application;

[0047] Figure 3 A flowchart of performing status analysis on a power station in the cloud provided in an embodiment of the present application;

[0048] Figure 4 A module diagram of a security-enhanced communication device provided in another embodiment of the present application;

[0049] Figure 5 A structural diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] The core of this application is to provide a security-enhanced communication method, device, electronic device and medium.

[0052] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0053] Figure 1 A flowchart of a security reinforcement communication method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the following process is included:

[0054] S10: receiving authentication information sent by the power station, and performing security authentication on the power station based on the authentication information to obtain an authentication result.

[0055] S11: If the authentication result indicates that the power station authentication is successful, a communication connection channel is established with the power station.

[0056] In a specific embodiment, the security reinforcement communication method provided by the present application is specifically applied to the two-way communication between the power station and the cloud. The power station sends relevant data to the cloud through two-way communication with the cloud, and the cloud controls the power station to perform corresponding operations through relevant data, thereby realizing unified management of the power station. In the process of communication, the power station first sends a set of authentication information to the power station, so that the cloud performs security authentication on the power station based on the authentication information, and determines whether the current power station is a power station that can establish a communication connection channel with the cloud. If the authentication result at this time indicates that the power station authentication is successful, it also indicates that the power station is a safe power station, and it is not a power station built or invaded by network criminals through brute force cracking, virus invasion, etc. Therefore, the cloud can build a communication connection channel with the current power station to realize two-way communication between the power station and the cloud. If the authentication result at this time indicates that the power station authentication fails, the communication connection channel will not be established, and the alarm system can also be triggered to remind the operation and maintenance personnel that the current cloud is at risk of being invaded. Its current S10-S11 steps mainly perform security reinforcement on the communication between the power station and the cloud from the connection stage.

[0057] The specific operation of the cloud in performing security authentication on the power station based on the authentication information is related to the type of information included in the authentication information. If the authentication information includes the client ID, the blacklist query and database query operations can be performed; if the authentication information includes the user name and password, the operation of whether the user name and password match can be performed. The specific operation can be set according to the needs of the user.

[0058] It should be noted that before step S10, a configuration step is required, and the specific implementation method of the configuration step is: build a corresponding virtual power station according to the power station, and generate corresponding authentication information based on the virtual power station, so that the operation and maintenance personnel can configure the authentication information to the corresponding power station. In other words, the operation and maintenance personnel need to build a virtual power station on the web interface of the cloud, and the cloud will generate the client ID, user name, password, etc. for the power station to connect to the MQTT server in the cloud based on the virtual power station, and save this information to the database of the authentication server in the cloud. It should also be noted that the virtual power station is mainly used as a kind of energy storage power station, which is used to store data information sent by the corresponding power station.

[0059] S12: Acquire data information sent by the power station according to the communication connection channel, and perform status analysis on the power station based on the data information and historical data information of the power station to obtain analysis results.

[0060] S13: If the analysis result indicates that the power station is abnormal, the communication connection channel is disconnected.

[0061] In a specific embodiment, the steps S10-S11 are mainly to perform security reinforcement on the communication between the power station and the cloud from the connection stage, while S12-S13 are to perform security reinforcement and security detection on the communication between the power station and the cloud from the communication stage. After the communication connection channel is established between the power station and the cloud, the power station can send relevant data information to the calculation through the communication connection channel, and the cloud can perform a preliminary status analysis of the power station based on the data information, which mainly determines whether the current power station is abnormal, that is, whether the power station is invaded by network criminals after the communication connection channel is established between the power station and the cloud.

[0062] In the specific status analysis, if the analysis result indicates that the power station is abnormal, it means that the power station may be abnormal due to intrusion by network criminals, because at this time, in order to reduce the risks brought by dangerous connections, it is necessary to disconnect the communication connection channel in time; if the analysis result indicates that the power station is normal, it means that the power station is not likely to be invaded by network criminals, because at this time, the communication connection channel is maintained to realize two-way communication between the power station and the cloud.

[0063] It should be noted that the specific analysis results can be determined based on a comparison of the data information and the historical data information. In actual applications, the data information sent by the power station to the cloud is stable, so there will generally not be a sudden increase or decrease. Therefore, the analysis results can be determined based on the data information and the historical data information of the power station.

[0064] It should also be noted that if the analysis results indicate that the power station is abnormal, after disconnecting the communication connection channel, the client ID in the authentication information corresponding to the power station can be further recorded in the blacklist, and a security warning message can be sent to the power station to regenerate the corresponding authentication information.

[0065] The present application provides a security reinforcement communication method, including: receiving authentication information sent by a power station, and performing security authentication on the power station based on the authentication information to obtain an authentication result; if the authentication result indicates that the power station authentication is successful, then a communication connection channel is established with the power station; data information sent by the power station is obtained according to the communication connection channel, and the power station is analyzed based on the data information and the historical data information of the power station to obtain an analysis result; if the analysis result indicates that the power station is abnormal, then the communication connection channel is disconnected. It can be seen that the present application performs security reinforcement and analysis and detection on the connection with the power station from the connection stage and the communication stage respectively, which can ensure the reliability of information authentication between the power station and the cloud in the connection stage; the power station can be analyzed in the communication stage to ensure the safe use of the power station and the cloud and avoid the risks brought by dangerous connections.

[0066] The security authentication of the power station is specifically related to the data type included in the authentication information. As a preferred embodiment, the above-mentioned S10 step: based on the authentication information, the power station is authenticated for security to obtain the authentication result in the following specific implementation method: obtaining the client ID, user name, password and login IP in the authentication information; determining whether the client ID is in the blacklist; if the blacklist does not include the client ID, determining whether the client ID is in the database; if the database includes the client ID, determining whether the user name and password match; if the password and user name match, determining whether the login IP is in the historical login record; if the historical login record includes the login IP, an authentication result indicating successful authentication of the power station is obtained.

[0067] This step also includes: if the client ID is included in the blacklist, or the client ID is not included in the database, or the password and the user name do not match, an authentication result indicating that the power station authentication has failed is obtained.

[0068] And if the login IP is not included in the historical login record, the connection key is sent to the corresponding power station; if the key resolution returned by the power station based on the connection key is received within the preset time, the authentication result indicating the successful authentication of the power station is obtained, and the login IP is recorded in the historical login record; if the key resolution returned by the power station based on the connection key is not received within the preset time, the authentication result indicating the failure of the power station authentication is obtained, and the login IP is recorded in the blacklist.

[0069] In a specific embodiment, a blacklist and a database are set up inside the cloud. The client IDs corresponding to power stations that are not allowed to communicate and power stations invaded by network criminals are stored in the blacklist; the client IDs corresponding to power stations that are allowed to communicate are stored in the database. When the authentication information includes the client ID, user name, password and login IP, they can be authenticated in sequence.

[0070] The first authentication determines whether the client ID is in the blacklist; if the client ID is not included in the blacklist, a second authentication is performed; if the client ID is included in the blacklist, it means that the current connection between the cloud and the power station may be a dangerous connection, and the first authentication can be determined to have failed.

[0071] The second authentication determines whether the client ID is in the database; if the database includes the client ID, a third authentication is performed; if the database does not include the client ID, it means that the current power station is not allowed to connect to the cloud, and the second authentication can determine that the authentication has failed.

[0072] The third authentication determines whether the username and password match; if the password and username match, it means that the password and username are a set of information, and the fourth authentication is performed; if the password and username do not match, it means that the password and username are two sets of information, and the third authentication can be determined as an authentication failure.

[0073] The fourth authentication determines whether the login IP is in the historical login record; if the login IP is included in the historical login record, and since the SIM card of the commercial energy storage communication module will not be easily replaced and the actual geographical location of the power station will not change after commissioning, this can indicate that the current power station has been connected to the cloud before, so if the previous three authentications are passed, this time it can still pass, and the authentication is judged to be successful; if the login IP is not included in the historical login record, and if the previous three authentications are passed, it means that the power station that needs to be connected is the first time to establish a communication connection channel with the cloud, but since the power station is connected for the first time, that is, the login IP is not included in the historical login record, it cannot be fully guaranteed that there is no risk of any dangerous connection between the current cloud and the power station. In this case, the fifth authentication is required, that is, the cloud sends the connection key to the corresponding power station; if the key parsing returned by the power station based on the connection key is received within the preset time (for example: 1 second), the authentication is successful, and the login IP is recorded in the historical login record; if the key parsing returned by the power station based on the connection key is not received within the preset time, the authentication fails, and the login IP is recorded in the blacklist. Among them, the key parsing process returned by the power station based on the connection key can be operated by the operation and maintenance personnel.

[0074] Among them, it should be noted that since the cloud is a cloud platform composed of some components, it includes an MQTT server and an authentication server. The authentication server specifically implements security authentication of the power station, while the MQTT server obtains the connection request initiated by the power station before authentication.

[0075] It should also be noted that, regardless of whether the authentication succeeds or fails, a corresponding safety warning can be issued to the power station.

[0076] Therefore, in summary, the process of cloud-based security authentication of power stations is as follows: Figure 2 As shown, the following steps are included:

[0077] S20: Start.

[0078] S21: The power station initiates a connection request to the MQTT server.

[0079] S22: The MQTT server forwards the authentication information to the authentication server for security authentication.

[0080] S23: Determine whether the client ID is in the blacklist.

[0081] S24: If the client ID is not in the blacklist, determine whether the client ID is in the database; if the client ID is in the blacklist, proceed to step S29.

[0082] S25: If the client ID is in the database, determine whether the user name and password match; if the client ID is not in the database, enter step S29.

[0083] S26: If the user name and password match, determine whether the login IP is in the historical login record; if the user name and password do not match, enter step S29.

[0084] S27: If the login IP is in the historical login record, the authentication is successful.

[0085] S28: If the login IP is not in the historical login record, it is determined whether the cloud receives the key resolution returned by the power station based on the connection key within a preset time.

[0086] S29: If the cloud receives the key analysis within the preset time, return to step S27; if the cloud does not receive the key analysis within the preset time, the authentication fails.

[0087] S30: End.

[0088] Because of its Figure 2 The steps shown are a summary of the above embodiments, and thus are not described in detail in this application.

[0089] The embodiment provided in this application is only one possible implementation method, but is not limited to this implementation method and can be set according to user needs.

[0090] The present application provides a method for the cloud to perform security authentication on a power station based on authentication information. The security authentication provided by this method includes at least four authentication processes, which further strengthens the secure communication between the cloud and the power station and reduces the possible risks brought by dangerous connections.

[0091] On the basis of the above embodiment, as a preferred embodiment, the above S12 step: performing status analysis on the power station based on the data information and the historical data information of the power station to obtain the specific implementation method of the analysis result is: obtaining the data frequency and data volume in the data information, and determining the data flow rate according to the data frequency and data volume; obtaining the historical data frequency and historical data volume corresponding to the historical data information, and determining the historical flow rate according to the historical data frequency and historical data volume; if after the communication connection channel is established at the preset connection time, and the difference range between the data flow rate and the historical flow rate is less than the first threshold, to obtain an analysis result characterizing that the power station is normal; if after the communication connection channel is established at the preset connection time, and the difference range between the data flow rate and the historical flow rate is not less than the first threshold and not greater than the second threshold, to obtain an analysis result characterizing that the power station is normal, and send a safety warning information to the power station; if after the communication connection channel is established at the preset connection time, and the difference range between the data flow rate and the historical flow rate is greater than the second threshold, to obtain an analysis result characterizing that the power station is abnormal.

[0092] In a specific embodiment, after the above steps, the power station equipment can communicate normally with the cloud. At the same time, the cloud analyzes and judges the data information uploaded by the power station (which can also be understood as monitoring). The cloud uses the time window of Flink stream calculation to calculate the data frequency and data volume in the data information, and saves it to the database. Since the data frequency and data volume are saved each time, the data frequency and data volume saved last time and before are used as the historical data frequency and historical data volume corresponding to the historical data information.

[0093] The status analysis provided in this application is performed after a certain period of time (preset connection time, for example, one day) has passed since the power station established a communication connection channel with the cloud. If the power station is still normal, the data information sent by the power station to the cloud is stable. Therefore, the status of the power station can be determined based on the comparison between the data information and the historical data information.

[0094] The specific rules are: if the difference between the data flow speed and the historical flow speed is less than the first threshold (for example, 10%), it means that the data information sent by the current power station to the cloud is stable, so it can be determined that the power station is normal and the current connection is risk-free; if the difference between the data flow speed and the historical flow speed is not less than the first threshold (for example, 10%) and not greater than the second threshold (for example, 20%), it means that the data information sent by the current power station to the cloud is relatively stable, but there is a slight increase or decrease in fluctuation. Therefore, although the power station is determined to be normal at this time, it is still necessary to send a security warning message to the power station; if the difference between the data flow speed and the historical flow speed is greater than the second threshold (for example, 20%), it means that the data information sent by the current power station to the cloud has a sudden increase or decrease, so the current power station is very likely to be invaded, and the current power station can be judged to be abnormal. After judging the abnormality, the communication connection channel is disconnected, the client ID in the authentication information corresponding to the power station is recorded in the blacklist, and a security warning message is sent to the power station, and the corresponding authentication information is regenerated.

[0095] The method for determining the difference range between the data flow speed and the historical flow speed is as follows: obtaining the speed difference between the data flow speed and the historical flow speed; and taking the ratio of the speed difference to the historical flow speed as the difference range.

[0096] Therefore, in summary, the process of cloud-based status analysis of power stations is as follows: Figure 3 As shown, the following steps are included:

[0097] S40: Start.

[0098] S41: Flink stream computing data information.

[0099] S42: Calculate the data frequency and data volume in each unit time using the time window.

[0100] S43: Save the data frequency and data volume to the database.

[0101] S44: Determine whether the duration of connection between the power station and the cloud is greater than a preset connection time.

[0102] S45: If the duration of the connection between the power station and the cloud is longer than the preset connection time, calculate the difference range between the data frequency and data volume and the historical data frequency and historical data volume; if the duration of the connection between the power station and the cloud is not longer than the preset connection time, enter step S50.

[0103] S46: If the difference range is smaller than the first threshold, return to step S42.

[0104] S47: If the difference range is not less than the first threshold, determine whether the difference range is not greater than the second threshold.

[0105] S48: If the difference range is not less than the first threshold, and it is determined whether the difference range is not greater than the second threshold, a safety warning message is issued.

[0106] S49: If the difference range is greater than the second threshold, the communication connection channel is disconnected.

[0107] S50: End.

[0108] Because of its Figure 3 The steps shown are a summary of the above embodiments, and thus are not described in detail in this application.

[0109] The embodiment provided in this application is only one possible implementation method, but is not limited to this implementation method and can be set according to user needs.

[0110] The present application provides a method for the cloud to perform status analysis on a power station based on authentication information. The status analysis provided by this method clarifies the analysis rules. In this rule, the secure communication between the cloud and the power station is further strengthened, and when a suspicious connection occurs, risks are avoided by issuing an alarm message and kicking out dangerous connections.

[0111] In summary, the process of the security reinforcement communication method provided by this application is as follows:

[0112] Step 1: The power plant operation and maintenance personnel build a virtual power plant on the cloud web interface. The cloud automatically generates the client ID, user name, and password for the power plant to connect to the MQTT server, and saves this information in the database of the authentication server.

[0113] Step 2: The power plant operation and maintenance personnel configure the client ID, user name, password, and domain name and port of the MQTT server provided in step 1 into the embedded software of the power plant.

[0114] Step 3: The power station equipment uses the authentication information in step 2 to initiate a connection request with the cloud through the MQTT protocol.

[0115] Step 4: After receiving the connection request, the MQTT server submits the login IP, client ID, user name, password and other information corresponding to the connection initiator power station to the authentication server to initiate security authentication.

[0116] Step 5: After receiving the security authentication, the authentication server first searches the blacklist for the client ID. If it exists, it directly returns authentication failure. Furthermore, the database is searched for the client ID. If it does not exist, authentication failure is returned. Furthermore, if the client ID exists in the database, it is determined whether the username and password match. If they do not match, authentication failure is returned. Furthermore, the login IP is obtained. If the last login IP does not exist, it is assumed that this login is the first login. It is then determined whether the key resolution returned by the power station based on the connection key is received within the preset time. Furthermore, if the key resolution is received, the authentication is successful, and the login IP is saved to the authentication server; if it is not received, the authentication fails, the parameter information of the login request is recorded in the security log, a security warning is issued to the power station operation and maintenance personnel, and the current login IP is recorded in the blacklist.

[0117] Step 6: After the above steps, the power plant can communicate normally with the cloud. At the same time, the cloud monitors the data information uploaded by the power plant, uses the time window of Flink stream calculation to count the data frequency and data volume of the device per unit time, and saves the data frequency and data volume in the database.

[0118] Step 7: Based on the fact that the data frequency and data volume of each power station's data transmission information are basically stable, for power stations that have been connected to the cloud for more than 1 day, the cloud monitoring module determines in real time whether the data flow rate of the power station matches the historical flow rate. When the difference between the two is less than 10%, the power station is normal and the connection between the power station and the cloud is maintained; when the difference between the two is between 10% and 20%, the monitoring module sends a security warning message to the operation and maintenance personnel; if the difference is greater than 20%, the cloud sends a command to the MQTT server to actively interrupt the connection of the power station, forcibly remove the power station, add the client ID corresponding to the power station to the blacklist of the authentication server, and send a security warning message to the power station operation and maintenance personnel, prompting that the authentication information of the power station has been leaked and a new username and password need to be regenerated.

[0119] From this, we can see that this application uses a variety of information such as blacklists, client IDs, user names, passwords, login IPs, etc. for security authentication, and identifies suspicious connections based on the power station's data information and historical data information. When suspicious connections occur, risks are avoided by issuing alarm information and kicking out dangerous connections.

[0120] In the above embodiments, the security reinforcement communication method is described in detail, and the present application also provides embodiments corresponding to the security reinforcement communication device. It should be noted that the present application describes the embodiments of the device part from two perspectives, one is based on the functional module perspective, and the other is based on the hardware perspective.

[0121] Figure 4 A module diagram of a security-enhanced communication device provided in another embodiment of the present application includes:

[0122] The security authentication module 11 is used to receive authentication information sent by the power station, and perform security authentication on the power station based on the authentication information to obtain an authentication result;

[0123] A channel building module 12 is used to build a communication connection channel with the power station when the authentication result indicates that the power station authentication is successful;

[0124] The analysis module 13 is used to obtain data information sent by the power station according to the communication connection channel, and perform status analysis on the power station based on the data information and historical data information of the power station to obtain analysis results;

[0125] The disconnect channel module 14 is used to disconnect the communication connection channel when the analysis result indicates that the power station is abnormal.

[0126] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, which will not be repeated here.

[0127] Figure 5 A structural diagram of an electronic device provided in another embodiment of the present application, such as Figure 5 As shown, the electronic device includes: a memory 20 for storing a computer program;

[0128] The processor 21 is used to implement the steps of the security reinforcement communication method mentioned in the above embodiment when executing the computer program.

[0129] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer or a desktop computer.

[0130] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0131] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the security reinforcement communication method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc.

[0132] In some embodiments, the electronic device may further include a display screen 22 , an input / output interface 23 , a communication interface 24 , a power source 25 , and a communication bus 26 .

[0133] Those skilled in the art will understand that Figure 5 The structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure.

[0134] The electronic device provided in the embodiment of the present application includes a memory and a processor. When the processor executes the program stored in the memory, it can realize the above-mentioned security reinforced communication and has the same beneficial effects.

[0135] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0136] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0137] The above is a detailed introduction to a security reinforcement communication method, device, electronic device and medium provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can refer to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can refer to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0138] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A security reinforcement communication method, characterized in that: include: Receiving authentication information sent by the power station, and performing security authentication on the power station based on the authentication information to obtain an authentication result; If the authentication result indicates that the power station is successfully authenticated, establishing a communication connection channel with the power station; Acquire data information sent by the power station according to the communication connection channel, and perform status analysis on the power station based on the data information and historical data information of the power station to obtain analysis results; If the analysis result indicates that the power station is abnormal, the communication connection channel is disconnected.

2. The security reinforcement communication method according to claim 1, characterized in that: Performing security authentication on the power station based on the authentication information to obtain the authentication result includes: Obtain the client ID, user name, password and login IP in the authentication information; Determine whether the client ID is in the blacklist; If the blacklist does not include the client ID, determining whether the client ID is in the database; If the database includes the client ID, determining whether the user name and the password match; If the password and the user name match, determine whether the login IP is in the historical login record; If the historical login record includes the login IP, the authentication result indicating successful authentication of the power station is obtained.

3. The security reinforcement communication method according to claim 2, characterized in that: The performing safety authentication on the power station based on the authentication information to obtain an authentication result further includes: If the client ID is included in the blacklist, or the client ID is not included in the database, or the password and the user name do not match, the authentication result indicating that the power station authentication has failed is obtained.

4. The security reinforcement communication method according to claim 2, characterized in that: The performing safety authentication on the power station based on the authentication information to obtain an authentication result further includes: If the login IP is not included in the historical login record, sending a connection key to the corresponding power station; If the key analysis returned by the power station based on the connection key is received within the preset time, the authentication result indicating successful authentication of the power station is obtained, and the login IP is recorded in the historical login record; If the key analysis returned by the power station based on the connection key is not received within the preset time, the authentication result indicating that the power station authentication has failed is obtained, and the login IP is recorded in the blacklist.

5. The security reinforcement communication method according to claim 1, characterized in that: Performing a status analysis on the power station based on the data information and the historical data information of the power station to obtain the analysis result includes: Acquire the data frequency and data volume in the data information, and determine the data flow rate according to the data frequency and the data volume; Acquire the historical data frequency and the historical data volume corresponding to the historical data information, and determine the historical traffic speed according to the historical data frequency and the historical data volume; If after the communication connection channel establishes the preset connection time, and the difference range between the data flow rate and the historical flow rate is less than a first threshold, the analysis result indicating that the power station is normal is obtained; If after the communication connection channel establishes the preset connection time, and the difference between the data flow rate and the historical flow rate is not less than the first threshold and not greater than the second threshold, the analysis result indicating that the power station is normal is obtained, and a safety warning message is sent to the power station; If after the preset connection time is established in the communication connection channel, and the difference range between the data flow rate and the historical flow rate is greater than the second threshold, the analysis result characterizing the abnormality of the power station is obtained.

6. The security reinforcement communication method according to claim 5, characterized in that: After disconnecting the communication connection channel if the analysis result indicates that the power station is abnormal, the method further includes: Recording the client ID in the authentication information corresponding to the power station in a blacklist; The safety warning information is sent to the power station, and the corresponding authentication information is regenerated.

7. The security reinforcement communication method according to any one of claims 1 to 6, characterized in that: Before receiving the authentication information sent by the power station, the method further includes: A corresponding virtual power station is constructed according to the power station, and the corresponding authentication information is generated based on the virtual power station, so that operation and maintenance personnel can configure the authentication information into the corresponding power station.

8. A security-enhanced communication device, characterized in that: include: A security authentication module, used to receive authentication information sent by the power station, and perform security authentication on the power station based on the authentication information to obtain an authentication result; A channel building module, configured to build a communication connection channel with the power station when the authentication result indicates that the power station is successfully authenticated; an analysis module, configured to obtain data information sent by the power station according to the communication connection channel, and perform a status analysis on the power station based on the data information and historical data information of the power station to obtain an analysis result; The channel disconnection module is used to disconnect the communication connection channel when the analysis result indicates that the power station is abnormal.

9. An electronic device, characterized in that: comprising a memory for storing a computer program; A processor, configured to implement the steps of the security reinforcement communication method as claimed in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the security reinforcement communication method according to any one of claims 1 to 7 are implemented.

Images