Power secondary equipment fingerprint construction method and system, electronic device, and storage medium

Abstract

The application relates to a power secondary equipment fingerprint construction method and system, an electronic device and a storage medium, and belongs to the network security field, and solves the problems of inaccurate power secondary equipment identity recognition, large resource consumption and easy environmental interference. The method comprises the following steps: periodically collecting multi-dimensional characteristics of power secondary equipment according to a collection period and preprocessing; based on stability index values of the characteristics, dynamically assigning weights to the characteristics, and based on the weights, performing tolerance mapping on the preprocessed characteristics to generate a robust feature string; based on a plurality of high-stability characteristics of the power secondary equipment, generating a dynamic S box special for the power secondary equipment; and using the special dynamic S box to encrypt the robust feature string through a lightweight encryption algorithm, and performing a hash operation on the encryption result to dynamically generate a fixed-length device fingerprint of the current collection period. The identity authentication of the power secondary equipment is safe, efficient and stable.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of power system information security and network security technology, and particularly relates to a power secondary device fingerprint construction method and system, an electronic device and a storage medium. BACKGROUND

[0002] With the rapid development of information technology and the digital transformation of the power industry, the network space asset scale of the power monitoring system is continuously expanding, and the interaction relationship between power secondary devices (such as protection devices, measurement and control devices, network devices, etc.) becomes increasingly complex. Accurate identification of network assets and efficient mapping are important links to ensure the safe and stable operation of the power system. The identity recognition of power secondary devices is the basis for building a zero-trust security system. Traditional methods rely on single hardware identifiers (such as MAC addresses, serial numbers) or static features, which have the following problems:

[0003] Single feature, easy to be forged or tampered with;

[0004] Environmentally sensitive, some features change with temperature, humidity and other environmental factors;

[0005] Large resource consumption, traditional encryption algorithms are complex to calculate, not suitable for resource-constrained devices;

[0006] Lack of dynamics, unable to adapt to changes in device operating state.

[0007] Existing technologies such as device identification methods based on biometric features, electronic identification cards or complex signal analysis have high implementation difficulty and cost in power secondary devices, and there is a risk of affecting normal business operation. SUMMARY

[0008] In view of the above analysis, the embodiments of the present application aim to provide a power secondary device fingerprint construction method, system, electronic device and storage medium to solve the technical problems of inaccurate power secondary device identity recognition, large resource consumption and susceptibility to environmental interference.

[0009] The present application provides a power secondary device fingerprint construction method, comprising the following steps:

[0010] Step S1, periodically collecting multi-dimensional features of a power secondary device according to a collection period and pre-processing;

[0011] Step S2, dynamically assigning weights to each feature based on the stability index value of each feature, and performing tolerance mapping on the pre-processed features based on the weights to generate a robust feature string;

[0012] Step S3, generating a dynamic S-box of a lightweight encryption algorithm specific to the power secondary device based on a plurality of high-stability features of the power secondary device.

[0013] Step S4, using the exclusive dynamic S-box, the robust feature string is encrypted by a lightweight encryption algorithm, and the encryption result is hashed to dynamically generate a fixed-length device fingerprint of the current collection period.

[0014] Further, the multi-dimensional features include static features, dynamic features and environmental features.

[0015] The static features include at least one of electronic identification card information, trusted chip ID, CPU serial number, memory serial number, MAC address, operating system type, software version feature;

[0016] The dynamic features include at least one of user access behavior, process behavior, network access behavior, file access behavior, and this boot time feature;

[0017] The environmental features include at least one of boot time, geographic location, unit information, and running process list features.

[0018] Further, the preprocessing includes:

[0019] Convert the collected multi-dimensional feature values to string format;

[0020] Process the string of each feature to a preset fixed length ; wherein, for the feature value less than the preset fixed length, a pre-defined character is used to fill, and for the feature value more than the preset fixed length , a hash digest processing is performed;

[0021] For the missing feature values that are not collected, a predetermined filling character is used to mark.

[0022] Further, the hash digest processing of the feature value more than the preset fixed length includes:

[0023] Calculate the hash value of the feature value, and take the first characters of the hash value as the new feature value of the feature.

[0024] Further, the step S2 includes:

[0025] Assign a weight to each of the features;

[0026] Based on the preset mapping function and the weight corresponding to each feature, calculate the mapping parameter of each feature;

[0027] Merge the preprocessed multi-dimensional feature values and their corresponding mapping parameters to generate intermediate feature values with tolerance;

[0028] The intermediate feature values are spliced in a predetermined order to generate the robust feature string;

[0029] The weight is dynamically updated based on the stability index value of each feature.

[0030] Further, the weight is dynamically updated by the central server through a federated learning framework, aggregating the feature change information periodically reported by each power secondary device.

[0031] Further, the dynamic updating of the weight includes the following steps:

[0032] Based on the federated learning framework, the central server initializes a pre-trained global weight prediction model ;

[0033] Based on the collection period, each power secondary device reports the collected multi-dimensional features to the central server; based on the reported multi-dimensional features, the central server calculates the stability index value of each feature of each power secondary device, and calculates and encrypts the model update amount based on the stability index value;

[0034] The central server uses a secure aggregation protocol to aggregate the encrypted model update amounts to update the global weight prediction model, and dynamically outputs the weight of the corresponding feature;

[0035] The central server configures and issues the dynamically updated weight of the corresponding feature to each corresponding power secondary device.

[0036] Further, the calculation of the stability index value of the feature includes:

[0037] The standard deviation of the preprocessed features of the same feature collected multiple times in a predetermined time window is calculated, and the stability index value of the feature is calculated based on the standard deviation;

[0038] The stability index value is negatively correlated with the stability degree of the feature, and the stability index value = 1 / (1+standard deviation).

[0039] Further, the mapping function is as follows:

[0040]

[0041] wherein, is a mapping parameter, is a reference parameter; is a scaling factor, is the weight of the th feature, is a minimum value.

[0042] Further, the step S3 comprises:

[0043] generating a seed key based on the multiple high-stability features of the power secondary equipment;

[0044] generating a dynamic S-box of a lightweight encryption algorithm dedicated to the power secondary equipment by a dynamic S-box generation algorithm based on the seed key;

[0045] storing the dynamic S-box in a hardware security environment of the power secondary equipment.

[0046] Further, the generating a seed key comprises:

[0047] concatenating the multiple high-stability features of the power secondary equipment in a predetermined order to form a seed string;

[0048] calculating a hash value of the seed string;

[0049] taking the first 128 bits of the hash value as the seed key.

[0050] Further, the generating a dynamic S-box of a lightweight encryption algorithm dedicated to the power secondary equipment by a dynamic S-box generation algorithm comprises:

[0051] initializing a linear sequence S including all integers from 0 to M-1, wherein M is the size of the S-box;

[0052] generating a key stream by a key expansion algorithm based on the seed key;

[0053] performing multiple rounds of pseudo-random permutation on the linear sequence S based on the key stream to obtain a confused sequence;

[0054] performing multiplication inverse element calculation on a finite field and affine transformation on each element in the confused sequence in turn to complete nonlinear reinforcement;

[0055] outputting the sequence after nonlinear reinforcement processing as the final dynamic S-box.

[0056] Further, the key expansion algorithm comprises:

[0057] initializing a 128-bit counter and setting its initial value to 0;

[0058] encrypting the current value of the counter using the SM4 algorithm with the seed key as the key, and taking the encryption result as a data block of the key stream;

[0059] incrementing the value of the counter;

[0060] The encryption and incrementation process is repeated until the total length of the generated key stream is not less than a preset length threshold;

[0061] The preset length threshold is the product of the size of the S-box and the number of pseudo-random permutation rounds.

[0062] Further, the nonlinear reinforcement includes:

[0063] Each element x in the obfuscated sequence is calculated on a finite field GF(2 8 ) to obtain the multiplicative inverse y of x as follows:

[0064]

[0065] An invertible affine transformation is performed on y as follows:

[0066]

[0067] where A is an 8x8 invertible matrix on GF(2 8 ) and b is an 8-bit constant; z is the output value corresponding to the input element x when the dynamic S-box is used;

[0068] The output values z corresponding to all input elements x are arranged in order to form the final dynamic S-box.

[0069] Further, the step S4 includes:

[0070] The robust feature string is encrypted by the lightweight symmetric encryption algorithm using the exclusive dynamic S-box to obtain a ciphertext;

[0071] The hash value of the ciphertext is calculated, and the obtained hash value is used as the fixed-length device fingerprint in the current collection period.

[0072] The SM3 algorithm is used to calculate the hash value of the ciphertext.

[0073] Further, the method further includes a device fingerprint verification and management step.

[0074] The device fingerprint verification step is used to authenticate the identity of the power secondary device when it requests access to the service system.

[0075] The device fingerprint management step is used to handle the registration, update, and revocation of the device fingerprint.

[0076] Further, the power secondary device includes a protection device, a measurement and control device, a communication device, and a network device.

[0077] The application further discloses a power secondary equipment fingerprint construction system, which comprises a feature collection module M1, a dynamic weighting and mapping module M2, a dynamic S-box generation module M3 and an equipment fingerprint generation module M4.

[0078] The feature collection module M1 is used for periodically collecting multi-dimensional features of the power secondary equipment according to a collection period and performing preprocessing.

[0079] The dynamic weighting and mapping module M2 is used for dynamically allocating weights to the features based on the stability index values of the features, and performing tolerance mapping on the preprocessed features based on the weights to generate a robust feature string.

[0080] The dynamic S-box generation module M3 generates a dynamic S-box of a lightweight encryption algorithm special for the power secondary equipment based on a plurality of high-stability features of the power secondary equipment.

[0081] The equipment fingerprint generation module M4 is used for encrypting the robust feature string by using the special dynamic S-box through the lightweight encryption algorithm, and performing a hash operation on the encryption result to dynamically generate a fixed-length equipment fingerprint of the current collection period.

[0082] The application further discloses an electronic device for power secondary equipment fingerprint construction, and the electronic device comprises:

[0083] A memory is used for storing a computer program.

[0084] A processor is used for executing the computer program to realize the power secondary equipment fingerprint construction method.

[0085] The application further discloses a computer readable storage medium, and the computer readable storage medium stores a computer program.

[0086] Compared with the prior art, the application can realize at least one of the following beneficial effects:

[0087] 1. The application fuses static, dynamic and environmental multi-dimensional features of the power secondary equipment to construct a high-dimensional power secondary equipment identity portrait.

[0088] 2、The application introduces a weight-based tolerance mapping mechanism and a federated learning-driven dynamic weight update. The weight of volatile features (such as IP addresses and process lists) is automatically identified and reduced, and the weight of stable features (such as chip IDs) is increased. When non-critical legal changes (such as system patches and network switching) occur in power secondary equipment, the core fingerprint remains stable, effectively avoiding false identification caused by environmental interference or normal state changes. The environment is adaptable, and the fingerprint is robust. It overcomes the defects of existing device fingerprints, which are sensitive and lack dynamicity.

[0089] 3、The application adopts a lightweight encryption algorithm combined with a device-specific dynamic S-box. The S-box is pre-generated based on the device's own characteristics, and the encryption process is efficient, avoiding dependence on complex public key cryptography. The entire fingerprint generation process has small computational complexity and fast speed, fully meeting the stringent requirements of power secondary equipment and other embedded terminals in terms of computing power, memory, and power consumption. The calculation and resource consumption are low, and it is suitable for resource-constrained devices. It overcomes the defects of existing methods, which have large resource consumption and complex calculation of traditional encryption methods.

[0090] 4、In the federated learning weight update phase, the device does not need to upload the original feature data, but only uploads the encrypted model update amount, and the user data privacy is protected through secure aggregation technology. In the fingerprint verification phase, homomorphic encryption is used for blind comparison, and the server does not need to know the plaintext of the fingerprint to complete the verification. A "usable and invisible" security paradigm is constructed, which meets the increasingly stringent data security regulations. The privacy protection is strong, and it overcomes the defect that the privacy is easily leaked in the existing method.

[0091] 5、The application provides a full life cycle management framework for power secondary device fingerprints from generation, registration, verification to revocation. Combined with the hardware security environment, the key material is stored to ensure the security of the power secondary device fingerprint. At the same time, through linkage with the centralized management system, it can respond to the state changes of power secondary devices (such as scrap, loss) in time, and quickly revoke abnormal devices, forming a closed-loop security system that integrates "trusted generation, reliable verification, and efficient management", which greatly improves the security level of the entire power monitoring system. The overall security is high, and the closed-loop management is realized. It overcomes the defect that the existing technology lacks complete fingerprint full life cycle management.

[0092] In the application, the above technical solutions can be combined with each other to realize more preferred combination schemes. Other features and advantages of the application will be described in the subsequent specification, and some advantages will become apparent from the specification, or will be understood by implementing the application. The purpose and other advantages of the application can be achieved and obtained through the content specifically pointed out in the specification and the drawings. BRIEF DESCRIPTION OF DRAWINGS

[0093] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and are used to explain the principles of the application, but are not intended to limit the scope of the application.

[0094] Figure 1 A power secondary device fingerprint construction method flow chart in an embodiment of the application;

[0095] Figure 2 A power secondary device fingerprint full life cycle state flow chart in an embodiment of the application;

[0096] Figure 3 A power secondary device fingerprint verification flow chart in an embodiment of the application;

[0097] Figure 4 A device fingerprint full life cycle flow chart in an embodiment of the application;

[0098] Figure 5 A power secondary device fingerprint construction system module schematic diagram in an embodiment of the application. DETAILED DESCRIPTION

[0099] The preferred embodiments of the present application will be described in detail below with reference to the drawings, wherein the drawings constitute a part of this specification, and are used to explain the principles of the embodiments of the present application, but are not intended to limit the scope of the present application.

[0100] Embodiment one:

[0101] One specific embodiment of the present application discloses a power secondary device fingerprint construction method, as shown in the figure, comprising the following steps: Figure 1 As shown in the figure, comprising the following steps:

[0102] Step S1, periodically collecting multi-dimensional features of the power secondary device according to a collection period and preprocessing;

[0103] Step S2, dynamically assigning weights to each feature based on the stability index value of each feature, and performing tolerance mapping on the preprocessed features based on the weights, to generate a robust feature string;

[0104] Step S3, based on a plurality of high-stability features of the power secondary device, generating a dynamic S-box of a lightweight encryption algorithm exclusive to the power secondary device;

[0105] Step S4, encrypting the robust feature string through a lightweight encryption algorithm using the exclusive dynamic S-box, and performing a hash operation on the encryption result, to dynamically generate a fixed-length device fingerprint of the current collection period.

[0106] The method embodiment involves three core components:

[0107] (1) Device-side agent: deployed on power secondary devices, responsible for feature collection and transmission of collected features to the central server;

[0108] (2) Central server: deployed in the control center, responsible for device fingerprint registration, verification, storage and management, and training of the federated learning framework used for dynamic weight generation.

[0109] (3) Secure communication channel: communication channel between power secondary devices and central server, using TLCP (Transport Layer Cryptography Protocol) or TLS (Transport Layer Security) connection based on SM2 certificate.

[0110] Power secondary devices include protection devices, measurement and control devices, communication devices, and network devices.

[0111] (1) Protection device: such as line protection device, transformer protection device, bus protection device;

[0112] (2) Measurement and control device: such as fault recorder (records data at fault instant, like "black box"), power quality monitoring device;

[0113] (3) Communication device: such as serial server, power line carrier communication device;

[0114] (4) Network device: such as industrial Ethernet switch, router and gateway.

[0115] Power secondary devices, and examples of hardware and software environment of core components, as shown in Table 1. The power secondary device has CPU, with the computing power of collecting and transmitting features, but does not have the computing power of federated learning training for dynamic weight generation.

[0116] Federated learning framework training is performed on the central server.

[0117] Table 1: Hardware and software environment

[0118]

[0119] Step S1 includes steps S11-S12.

[0120] Step S11: periodically collect multi-dimensional features of power secondary devices according to the collection period.

[0121] The multi-dimensional features include static features, dynamic features and environmental features;

[0122] The static features include at least one of electronic identification card information, trusted chip ID, CPU serial number, memory serial number, MAC address, operating system type, software version features.

[0123] The dynamic features include at least one of user access behavior, process behavior, network access behavior, file access behavior, and boot time features.

[0124] The environmental features include at least one of boot time, geographic location, unit information, and running process list features.

[0125] The device-side agent collects multi-dimensional features of power secondary equipment, and transmits the collected multi-dimensional features to the central server through communication equipment and network equipment.

[0126] For example, the collection period is preset to 5 minutes, and in specific applications, it can be modified according to specific needs and computing power.

[0127] After the device-side agent is started, the preset feature collection plug-in is called to collect multi-dimensional features, as shown in Table 2.

[0128] Table 2: Multi-dimensional feature collection example

[0129]

[0130] Step S12, preprocessing the collected features to obtain preprocessed features.

[0131] The preprocessing includes:

[0132] Converting each multi-dimensional feature value collected into a string format;

[0133] Processing the string of each feature into a preset fixed length; wherein, for feature values less than the preset fixed length, a predefined character is used for padding, and for feature values longer than the preset fixed length, a hash digest is used for processing;

[0134] For missing values of features that have not been collected, a predetermined padding character is used for marking.

[0135] The collected feature information is formatted and stored in the form of a string with a fixed length.

[0136] For example, the predefined character is "zero", and the predetermined padding character is "zero". In specific applications, it can be changed according to specific needs.

[0137] The hash digest processing of the feature value longer than the preset fixed length includes:

[0138] calculating a hash value of the eigenvalue, and truncating the first characters of the hash value as a new eigenvalue of the feature.

[0139] The preset fixed length is a configurable parameter, and its value balances storage efficiency and computing power. For example, 32 bytes, 64 bytes, or 128 bytes can be set.

[0140] If it is set to 32 bytes, it is a length that balances efficiency and security. For example, the output of the SM3 algorithm is 32 bytes, and selecting this length can conveniently interface with the hash value, has small storage overhead, and is suitable for most features.

[0141] If it is set to 64 bytes, this length can provide more space for accommodating longer feature strings and hash digests, reducing the risk of information loss due to truncation, and is suitable for scenarios that require more information to be retained.

[0142] If it is set to 128 bytes, this length provides maximum flexibility, sufficient to accommodate most original eigenvalues or extended hash values, ensuring information integrity while ensuring the regularity of the feature vector, and is suitable for scenarios with extremely high requirements for information integrity.

[0143] Based on the specific needs of actual scenarios, the length value of the preset fixed length is selected.

[0144] The role of step S1 is to convert the multi-dimensional original features of power secondary equipment with heterogeneous, multi-source, and unified format, standard length, and complete information into preprocessed features, laying a data foundation for subsequent construction of stable and reliable device fingerprints.

[0145] Step S2 includes steps S21-S24.

[0146] The step S2 includes:

[0147] assigning weights to each of the features;

[0148] calculating mapping parameters for each feature based on a preset mapping function and the weight corresponding to each feature;

[0149] merging each preprocessed multi-dimensional eigenvalue and its corresponding mapping parameter to generate an intermediate eigenvalue with tolerance;

[0150] splicing each intermediate eigenvalue in a predetermined order to generate the robust feature string;

[0151] The weight is dynamically updated based on the stability index value of each feature.

[0152] At the first time of calculation, there is no feature data to calculate the stability index value of the feature. For each pre-processed feature, an initial weight is assigned.

[0153] The feature value weight is set based on expert experience, and the initial weight is assigned.

[0154] Based on the experience of experts in the field, an initial weight is assigned to each pre-processed feature , wherein, .

[0155] The weight is positively correlated with the stability of the feature. The higher the weight (close to 1), the more stable the feature (such as the trusted chip ID), and the more accurate the mapping is required; on the contrary, the lower the weight (close to 0), the more variable the feature (such as the running process list), and the higher the tolerance of the allowed mapping.

[0156] First, the center server presets the initial weight based on expert experience, and configures the initial weight for the pre-processed features of the power secondary equipment;

[0157] Second, the power secondary equipment sends the feature value to the center server during operation, and the center server dynamically adjusts the corresponding weight through the federated learning model.

[0158] The initial weight configuration, the center server defines the weight configuration file, and issues it to the device end agent. For example:

[0159] Trusted chip ID, initial weight is 1.0;

[0160] Memory serial number, initial weight is 1.0;

[0161] CPU serial number, initial weight is 0.9;

[0162] MAC address, initial weight is 0.8;

[0163] Software version, initial weight is 0.3;

[0164] This time, the initial weight of the boot time is 0.1;

[0165] The initial weight of the running process list is 0.2.

[0166] Step S21, calculate the stability index value of each feature.

[0167] The calculation of the stability index value of the feature includes:

[0168] Calculate the standard deviation of the pre-processed features of the same feature collected multiple times within a predetermined time window, and calculate the stability index value of the feature based on the standard deviation; ​

[0169] wherein the stability index value is negatively correlated with the stability degree of the feature, and the stability index value = 1 / (1+standard deviation).

[0170] Exemplarily, the preset time window is 24 hours, and the collection period is 5 minutes.

[0171] Collection times: in the 24-hour window, the device-side agent collects (24 hours 60 minutes) / 5 minutes = 288 times of feature data. The standard deviation of the 288 times of preprocessed features is calculated.

[0172] Based on the standard deviation, the stability index value of the feature is calculated.

[0173] Step S22, based on the stability index value of each feature, dynamically assigning weights to each feature.

[0174] The weight dynamic update includes the following steps:

[0175] Based on the federated learning framework, the center server initializes a pre-trained global weight prediction model

[0176] Based on the collection period, each power secondary device reports the collected multi-dimensional features to the center server; based on the reported multi-dimensional features, the center server calculates the stability index value of each feature of each power secondary device, and calculates and encrypts the model update amount based on the stability index value;

[0177] The center server uses a secure aggregation protocol to aggregate the plurality of encrypted model update amounts to update the global weight prediction model, and dynamically outputs the weight corresponding to the feature;

[0178] The center server configures and issues the dynamically updated weight corresponding to the feature to each corresponding power secondary device.

[0179] A weight prediction model is deployed on the center server, and the weight prediction model is constructed based on the federated learning framework.

[0180] Each power secondary device periodically reports the features collected by the center server to the center server, and the center server aggregates the feature stability information of all power secondary devices through federated learning technology, dynamically updates and issues the latest feature weight configuration. The federated learning process mainly includes the following steps:

[0181] (1) Center server initialization: the center server initializes a global weight prediction model . The input of this model is the preprocessed feature information, and the output is the predicted weight of the feature.

[0182] (2) Device end local calculation: the device end agent of each power secondary device is locally executed, periodically collects features, and periodically reports feature value to the center server;

[0183] (3) The center server preprocesses the features reported by the power secondary device, calculates the stability index value of the features, and calculates and encrypts the model update amount based on the calculated stability index value ;

[0184] (4) The power secondary device applies the new weight to the features.

[0185] The weight of the feature with high stability is increased, and the weight of the frequently changing feature is reduced, ensuring that the fingerprint remains stable when some features change.

[0186] The global weight prediction model constructed based on the federated learning framework is trained in the center server.

[0187] The pre-trained global weight prediction model is obtained by the following steps :

[0188] (1) Training samples and sample labels:

[0189] The training sample is the feature meta-information vector of each power secondary device collected in the historical period, that is, the preprocessed feature of the power secondary device; the sample label is the weight corresponding to the feature. Obtain the training sample set.

[0190] According to the proportion of 7:2:1, it is divided into training set, validation set and test set.

[0191] (2) In the training process, the weighted sum of the mean square error and the regularization loss is used as the loss function, as shown below:

[0192] Formula (1)

[0193] Where, is the mean square error loss, is the regularization loss; , are the weights of the mean square error loss and the regularization loss, respectively.

[0194] In the training process, the loss function weights and are configurable hyperparameters.

[0195] Exemplarily, the mean square error loss as the reference loss, takes the value of 1.0;

[0196] The regularization loss weight​​ The value range is 0.001 to 0.01; the weight is used to control the model complexity and prevent overfitting. Too small value (such as <0.001) may result in no obvious regularization effect; too large value (such as >0.01) may over-punish model parameters, resulting in underfitting of the model and inability to effectively learn the mapping relationship between feature stability and weight. A typical example value of is 0.005.

[0197] The mean square error loss is used to measure the difference between the predicted weight and the true weight, as follows:

[0198] Formula (2)

[0199] wherein, is the number of features; is the predicted weight of the feature by the model; is the sample label, and is the true weight. The regularization loss is used to prevent model overfitting and improve generalization ability, as follows:

[0200]

[0201] Formula (3) wherein,

[0202] is the regularization strength hyperparameter; is the model weight parameter vector; is the total number of model parameters. (3) Training termination condition:

[0203] The validation set loss changes less than the preset threshold for 5 consecutive epochs;

[0204] The preset maximum training round is reached;

[0205] The validation set loss does not decrease for 10 consecutive epochs;

[0206] Any one of the above three conditions is met, and the training is terminated.

[0207] (4) Perform federated learning training every 24 hours. When significant changes in feature stability are detected, trigger retraining, which is incremental training; retain the last 3 versions of the model to support fast rollback.

[0208] Step S23, tolerance mapping of the preprocessed features based on the weight.

[0209] The mapping function is as follows:

[0210]

[0211] ​Equation (4)

[0212] wherein, is a mapping parameter, is a base parameter; is a scaling factor, is a weight of the th feature, is a minimum value to prevent denominator from being zero.

[0213] The mapping function , input is the weight , output is the mapping parameter controlling the tolerance; the function satisfies: when decreases, increases, thereby increasing the tolerance.

[0214] The mapping processing, the device-side agent maps the features according to the weights. The goal of the mapping function is to convert the weights into the mapping function, i.e., the tolerance.

[0215] For high weights, tends to 1.0, indicating stable static features, which will produce a smaller to achieve accurate mapping;

[0216] For low weights, tends to 0.0, indicating unstable features, which will produce a larger to achieve fuzzy mapping.

[0217] Exemplarily, the base parameter base takes a value of 2, the scaling factor controls the degree of influence of the weight on the tolerance, takes a value of 10, the greater the weight factor, the higher the tolerance of the weight feature; takes a value of 0.001.

[0218] Step S24, generating a robust feature string.

[0219] The pre-processed multi-dimensional features are fixed-length strings;

[0220] Each pre-processed multi-dimensional feature is merged with the mapping parameter , and the operation is as follows:

[0221] Equation (5)

[0222] wherein, is a mapped intermediate value; is a merging operation.

[0223] ​The pre-processed multi-dimensional features of each power secondary device , to obtain the corresponding mapped intermediate values , and spliced in a predefined order to form a final robust feature string, as follows:

[0224] Equation (6)

[0225] wherein, is the robust feature string, is the pre-processed multi-dimensional feature corresponding mapped intermediate value; is the number of features of the power secondary device.

[0226] The predefined order is arranged based on specific requirements the order of the corresponding intermediate values .

[0227] The function of step S2 is to convert the standardized original features into a robust feature string that is not sensitive to normal changes but is alert to malicious tampering through a dynamic weight and tolerance mapping mechanism.

[0228] Step S3, in particular.

[0229] The step S3 comprises:

[0230] Generating a seed key based on multiple high-stability features of the power secondary device;

[0231] Generating a dynamic S-box of a lightweight encryption algorithm specific to the power secondary device through a dynamic S-box generation algorithm based on the seed key;

[0232] Storing the dynamic S-box securely in the hardware security environment of the power secondary device.

[0233] Generation and distribution of device-specific S-boxes. To balance efficiency and security, a dynamic S-box encryption algorithm based on SM4 is selected;

[0234] S-box generation algorithm input and output:

[0235] Input: Seed key, length 128 bits (16 bytes). Extracted from the device's high-stability static features (such as CPU serial number, trusted chip ID, etc.) by a hash function (such as SM3). S-box size N, usually 256, corresponding to an S-box with 8-bit input and output.

[0236] Output: An N-byte dynamic S-box Dynamic_SBox, which is a complete definition of a permutation from [0, N-1] to [0, N-1].

[0237] The seed key is generated, comprising:

[0238] A plurality of high-stability features of the power secondary equipment are spliced in a predetermined order to form a seed string;

[0239] The hash value of the seed string is calculated;

[0240] The first 128 bits of the hash value are intercepted as the seed key.

[0241] One or more high-stability and high-unicity static features are selected as S-box generation seeds, such as CPU serial number, trusted chip ID, memory serial number, and device manufacturer code, to ensure that the S-box generated by the same device is always consistent; and a string representing the identity and state of the power secondary equipment is formed .

[0242] The number of stable features is determined based on specific requirements.

[0243] The above features are spliced into a string in a fixed order The SM3 hash value of is calculated, and the first 16 bytes (128 bits) are taken as the S-box generation seed key , as shown below:

[0244] Equation (7)

[0245] A plurality of high-stability device features are combined into an initial string in a predetermined order , and then compressed by the cryptographic hash algorithm SM3 and a fixed-length seed key with strong randomness is extracted , which will serve as the root key for generating dynamic S-boxes subsequently.

[0246] SM3 converts feature information of indefinite length that may contain redundancy or weak randomness into a fixed-length, high-randomness, and collision-resistant digest value through a cryptographic hash algorithm.

[0247] The first 16 bytes are taken as , and the first 128 bits of the hash value are extracted as the seed key, which is to meet the key length requirement of S-box generation in symmetric cryptographic algorithms. This not only retains the randomness and uniqueness of the hash, but also controls the key length for subsequent processing.

[0248] The seed key is the only source for generating S-boxes subsequently, ensuring that S-boxes generated by different devices or the same device in different states are different, and ensuring the device specificity and security of the Zengqing cryptographic component.

[0249] Equation (7) is essentially a deterministic mapping process from a high-stability feature to a cryptographically secure key, laying the foundation for generating a unique and dynamically changing S-box for each device.

[0250] The dynamic S-box generation algorithm generates a dynamic S-box specific to the power device, comprising:

[0251] Initialize a linear sequence S including all integers from 0 to M-1, where M is the size of the S-box;

[0252] Based on the seed key, generate a key stream through a key expansion algorithm;

[0253] Based on the key stream, perform multiple rounds of pseudo-random permutation on the linear sequence S to obtain a confused sequence;

[0254] For each element in the confused sequence, perform inverse element calculation and affine transformation on the finite field in turn to complete nonlinear reinforcement.

[0255] Output the sequence after nonlinear reinforcement processing as the final dynamic S-box.

[0256] Perform the dynamic S-box generation algorithm and select a controllable finite field construction method to ensure that the generated S-box is secure. Store the generated dynamic S-box securely in the secure enclave, TrustZone or secure storage area of the trusted chip of the device. Ensure that users with ordinary permissions in the operating system cannot read.

[0257] TrustZone is an important hardware security technology in ARM architecture chips. It creates two isolated execution environments within the processor core: a "secure world" and a "normal world" to protect sensitive code and data from malicious software.

[0258] TrustZone divides the computing environment into two independent areas:

[0259] Normal world, running operating systems and regular applications such as Android, Linux, Windows and various apps you download, etc. This environment is complex and faces various security threats, vulnerable to viruses and malware.

[0260] Secure world: running a small, highly trusted operating system (called Trusted Execution Environment, TEE) that handles the most sensitive operations and data. Strictly hardware isolated from the "normal world" with higher access permissions. Only code that has been strictly verified and authorized can run in this environment. The two "worlds" run on the same physical CPU core, but are isolated from each other through hardware mechanisms. The CPU performs tasks by quickly switching between the two worlds.

[0261] The key expansion algorithm comprises:

[0262] Initialize a 128-bit counter and set its initial value to 0;

[0263] Use the SM4 algorithm to encrypt the current value of the counter with the seed key as the key, and take the encryption result as a data block of the key stream;

[0264] Increment the value of the counter;

[0265] Repeat the encryption and incrementation process until the total length of the generated key stream is not less than a preset length threshold;

[0266] The preset length threshold is the product of the size of the S-box and the number of pseudo-random permutation rounds.

[0267] The nonlinear reinforcement comprises:

[0268] Each element x in the obfuscated sequence is calculated on a finite field GF(2 8 ) to obtain the multiplicative inverse y of x as follows:

[0269] Formula (8)

[0270] An invertible affine transformation is performed on y as follows:

[0271] Formula (9)

[0272] Where A is an 8x8 invertible matrix on GF(2 8 ) and b is an 8-bit constant; z is the output value corresponding to the input element x when the dynamic S-box is executed;

[0273] The output values z corresponding to all input elements x are arranged in order to form the final dynamic S-box.

[0274] Detailed steps of the S-box generation algorithm:

[0275] Step 1, initialize the linear sequence, create an initial linear table, which is a sequence containing all integers from 0 to N-1.

[0276] Formula (10)

[0277] Step 2, key expansion, use a lightweight key expansion algorithm to expand the 128-bit seed key into a long enough key stream KeyStream for driving subsequent permutation. Take 16 bytes As the initial key. A 128-bit counter CTR (initial value 0) is encrypted with the SM4 algorithm, and the encryption result is used as a 128-bit block of the key stream. The counter CTR is incremented, and step 2 is repeated until the length of the generated key stream is not less than N Rounds bytes, where Rounds is the number of rounds of subsequent permutation (recommended Rounds ≥ 4).

[0278] Third step, pseudo-random permutation (confusion)

[0279] Using the key stream generated in the second step, the initial linear table S is subjected to multiple rounds of pseudo-random permutation to introduce randomness determined by the seed key. The algorithm code of this process is as follows:

[0280] # Assume KeyStream is the byte stream generated in step two

[0281] # Rounds is the number of permutation rounds, for example, 4 rounds;

[0282] for round in range(Rounds):

[0283] for i in range(N-1, 0, -1): # from back to front

[0284] # Take the corresponding byte from the key stream, calculate the target index j

[0285] key_byte = KeyStream[(round N + (N-1-i)) % len(KeyStream)]

[0286] j = (key_byte + i) % (i+1) # j is in the range [0, i]

[0287] # Exchange S[i] and S[j]

[0288] S[i], S[j]= S[j], S[i]

[0289] Fourth step, nonlinear reinforcement, in order to improve the nonlinear characteristics of the S-box, a fixed affine transformation is applied to the sequence S after the confusion in the third step, the purpose is to break the linear structure that may exist.

[0290] Fifth step, output dynamic S-box, the sequence S processed by the third and fourth steps is taken as the final dynamic S-box Dynamic_SBox.

[0291] The step S3 is used for converting and securely storing the characteristics of the power secondary equipment into an unforgeable and equipment-specific cryptographic core component, laying a secure foundation for generating a unique and unforgeable equipment fingerprint.

[0292] The step S4, in particular.

[0293] The step S4 includes:

[0294] The robust feature string is encrypted by the lightweight symmetric encryption algorithm using the specific dynamic S-box to obtain ciphertext.

[0295] A hash value of the ciphertext is calculated, and the obtained hash value is used as a fixed-length equipment fingerprint in a current collection period.

[0296] The SM3 algorithm is used to calculate the hash value of the ciphertext.

[0297] The dynamic S-box is used to generate the fingerprint. The output is encrypted by the lightweight symmetric encryption algorithm to ensure the consistency of the output length. Finally, a fixed-length, irreversible and unique equipment fingerprint is generated. The collision rate is counted by generating the fingerprint on thousands of devices. The scenarios such as IP address change, operating system patch upgrade and partial hardware replacement are simulated to verify whether the fingerprint is stable under the set tolerance level.

[0298] The fingerprint is generated by encrypting the feature string and then calculating the SM3 hash value of the encryption result, as shown below:

[0299] Equipment fingerprint = SM3 (SM4 (feature string)) formula (11)

[0300] The output result is a fixed-length 32-byte (64-bit hexadecimal string), for example: "4C9F2A8B1E...D3C7".

[0301] The step S4 is used for converting the variable-length robust feature string into a fixed-length, unique and irreversible equipment fingerprint by dynamic S-box encryption and SM3 hash algorithm.

[0302] In the whole life cycle of the equipment fingerprint of the power secondary equipment, fingerprint verification and fingerprint management are also included.

[0303] The method further includes an equipment fingerprint verification and management step.

[0304] The equipment fingerprint verification step is used for authenticating the identity of the power secondary equipment when the power secondary equipment requests to access the service system.

[0305] The equipment fingerprint management step is used for processing the registration, update and revocation of the equipment fingerprint.

[0306] (1) Device fingerprint verification

[0307] The device fingerprint is verified by using a homomorphic encryption algorithm. The power secondary device uses a homomorphic encryption algorithm to encrypt its own feature vector, and then sends the ciphertext to the center server. The center server performs a predetermined weighted sum calculation rule on the ciphertext (because of the homomorphic property), obtains an encrypted fingerprint result, and returns it to the power secondary device. After decryption, the power secondary device compares it with the local device fingerprint, or the device submits the final result for verification.

[0308] The specific method is as follows:

[0309] Phase one: Privacy protection registration of device fingerprint

[0310] Device side: Collect features and generate power secondary device registration fingerprint (a numerical value or numerical vector), register fingerprint This is the first registration or network access of the power secondary device, and the fixed-length device fingerprint is generated by performing steps S1-S4 in the present application.

[0311] Use the homomorphic encryption public key Encrypt the device fingerprint to obtain the ciphertext, as follows:

[0312] Formula (12)

[0313] wherein, is an encryption function that receives two inputs, the public key and the device fingerprint plaintext message , and then outputs the ciphertext of the corresponding registration fingerprint . It itself looks like a string of irregular, random data, and without the corresponding private key, the original cannot be deduced from .

[0314] Send instead of to the center server to achieve privacy protection. The center server will store this ciphertext for identity verification.

[0315] The homomorphic encryption public key is generated by the center server and distributed to all power secondary devices that need to register. The power secondary device uses to encrypt its own registration fingerprint , ensuring that the device fingerprint remains confidential during transmission and storage.

[0316] Server side: Store (device , ) to the encrypted fingerprint database. The center server has never seen Plaintext data.

[0317] Phase Two: Privacy-Preserving Fingerprint Verification Process.

[0318] When the device needs to verify identity, the process is as follows.

[0319] The device initiates a challenge: The device collects current characteristics and generates a fingerprint for this login session. Use homomorphic encryption public key Encryption, as shown below:

[0320] Formula (13)

[0321] in, This is the encrypted fingerprint for login.

[0322] Will and equipment Send to the central server.

[0323] Blind comparison by the central server: The central server compares data based on the equipment. Retrieve the encrypted fingerprint used during registration from the fingerprint database. .

[0324] Calculating the difference: Utilizing homomorphism, the central server calculates the "difference" on the ciphertext. This is actually a calculation. The encrypted value is as follows:

[0325] Formula (14)

[0326] in, This is the ciphertext of the fingerprint difference.

[0327] therefore, .

[0328] Blinding process: To prevent device decryption Get directly The central server must blind the results.

[0329] The central server generates a strong random number r. The ciphertext of the blinded result is calculated as follows:

[0330] Formula (15)

[0331] Using homomorphism, .

[0332] The central server will Return to the secondary power equipment.

[0333] Decryption and determination of secondary power equipment:

[0334] Power secondary equipment with its own homomorphic encryption private key Decryption , get homomorphic encryption decryption result, as follows:

[0335] res Equation (16)

[0336] The result is res .

[0337] Where D(.) represents the decryption operation, and D is the abbreviation of Decrypt.

[0338] Result determination:

[0339] If , res = r 0 = 0. If , res is a strong random number r multiplied by a non-zero value, and the result is almost impossible to be 0.

[0340] The device determines whether the fingerprints match according to whether res is 0. If res = 0, it means and are exactly the same, and the authentication is successful. Inform the central server of the result.

[0341] First registration (factory / network), power secondary equipment first power on, generate device fingerprint.

[0342] Through an out-of-band method (such as scanning a code) or an initial secure channel, send the device fingerprint, device barcode, generation timestamp, and other information to the central server.

[0343] The server binds this fingerprint with the device information and stores it in the registered device fingerprint library.

[0344] Runtime verification (business access):

[0345] Before requesting access to the business system (such as uploading power data), the device generates the current device fingerprint in real time.

[0346] The device sends the fingerprint, device ID, and timestamp to the central server.

[0347] The server performs the verification process, as shown in Figure 3 .

[0348] (2) Manage device fingerprints

[0349] Establish a device fingerprint database on the secure central server. When a major change in the device is detected (such as motherboard replacement or system reinstallation), trigger re-registration.

[0350] When the hardware is replaced, only the old fingerprint and authorized credentials are applied to the server. When the device is decommissioned, lost, stolen, or a security risk is found, the device fingerprint is moved into the revocation list. All authentication services that rely on the fingerprint will check the revocation list synchronously when verifying.

[0351] The life cycle of a device fingerprint is shown in Figure 2 and Figure 4 .

[0352] When the device replaces the main hardware (such as the motherboard), the device fingerprint will change. At this time, the administrator needs to confirm on the server side, revoke the old fingerprint, and audit and register the new fingerprint.

[0353] When the device is decommissioned or a security risk is found, the administrator moves its fingerprint into the revocation list, after which all authentication requests for this fingerprint will be rejected.

[0354] Through the dynamic weight and mapping mechanism of the feature, the normal change of non-critical features is tolerated, avoiding the misjudgment of legal devices caused by system patches, IP switching, etc., and being highly adaptable.

[0355] The dynamic S-box algorithm based on SM4 has fast calculation speed. In the hardware environment of the embodiment, the entire process takes an average of <5ms, meeting the real-time requirements of power business and being highly efficient. The authentication process uses the national SM4 algorithm, the fingerprint is irreversible and anti-collision, effectively preventing forgery, and being highly secure. The centralized server provides perfect registration, verification, revocation, and audit functions, and is easy to manage.

[0356] This embodiment demonstrates the complete landing path of the method on real power secondary devices, covering technical selection, data processing logic, and business processes, and has high feasibility and practicality.

[0357] Embodiment two:

[0358] One specific embodiment of the application discloses a power secondary device fingerprint construction system, thereby realizing the power secondary device fingerprint construction method in embodiment one. The specific implementation of each module is referred to the corresponding description in embodiment one.

[0359] As shown in Figure 5 , the system comprises a feature collection module M1, a dynamic weighting and mapping module M2, a dynamic S-box generation module M3, and a device fingerprint generation module M4.

[0360] The feature collection module M1 is used for periodically collecting multi-dimensional features of the power secondary device according to a collection period and performing preprocessing.

[0361] The dynamic weighting and mapping module M2 is configured to dynamically assign a weight to each feature based on the stability index value of the feature, and perform tolerance mapping on the preprocessed feature based on the weight, to generate a robust feature string.

[0362] The dynamic S-box generation module M3 is configured to generate a dynamic S-box of a lightweight encryption algorithm dedicated to the power secondary equipment based on a plurality of high-stability features of the power secondary equipment.

[0363] The device fingerprint generation module M4 is configured to encrypt the robust feature string by using the dedicated dynamic S-box through the lightweight encryption algorithm, and perform a hash operation on the encryption result, to dynamically generate a fixed-length device fingerprint of a current collection period.

[0364] Since the system in the embodiment and the method in the first embodiment are related to each other and can be mutually referred to, repeated description is not given here. Since the system embodiment and the method embodiment have the same principles as described above, the system embodiment also has the corresponding technical effects of the method embodiment.

[0365] Embodiment three

[0366] Another specific embodiment of the present application discloses an electronic device for power secondary equipment fingerprint construction, which comprises:

[0367] a memory for storing a computer program;

[0368] a processor for executing the computer program to implement the power secondary equipment fingerprint construction method according to any one of claims 1 to 17.

[0369] Embodiment four

[0370] Another specific embodiment of the present application discloses a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the power secondary equipment fingerprint construction method according to any one of claims 1 to 17.

[0371] In summary, the power secondary equipment fingerprint construction method, system, electronic device and storage medium of the embodiment of the present application have the following beneficial effects:

[0372] 1. This invention constructs a high-dimensional identity profile of secondary power equipment by integrating its static, dynamic, and environmental multi-dimensional features. Attackers find it extremely difficult to simultaneously forge or tamper with all dimensions of features (such as hardware ID, operational behavior, and environmental context). Dynamically updated device fingerprints exhibit stronger uniqueness, significantly improving anti-forgery capabilities. This greatly enhances the uniqueness and credibility of the secondary power equipment's identity, fundamentally solving the security problem of single features being easily copied, forged, or tampered with.

[0373] 2. This invention introduces a weight-based tolerance mapping mechanism and federated learning-driven dynamic weight updates. It automatically identifies and reduces the weight of volatile features (such as IP addresses and process lists) while increasing the weight of stable features (such as chip IDs). This ensures that the core fingerprint remains stable even when non-critical legitimate changes occur to the secondary power equipment (such as system patches or network switching), effectively avoiding misidentification caused by environmental interference or changes in normal state. It exhibits good environmental adaptability and high fingerprint robustness, overcoming the shortcomings of existing equipment that suffer from high fingerprint sensitivity and lack of dynamism.

[0374] 3. This invention employs a lightweight encryption algorithm combined with a device-specific dynamic S-box. This S-box is pre-generated based on the device's own characteristics, resulting in a highly efficient encryption process that avoids reliance on complex public-key cryptography. The entire fingerprint generation process is computationally intensive and fast, fully meeting the stringent limitations of computing power, memory, and power consumption in embedded terminals such as secondary power equipment. It has low computational and resource overhead, making it suitable for resource-constrained devices; overcoming the shortcomings of existing methods, such as high resource consumption and complex computation in traditional encryption methods.

[0375] 4. In the federated learning weight update stage, the device does not need to upload the original feature data, but only the encrypted model update amount, thus protecting user data privacy through secure aggregation technology. In the fingerprint verification stage, homomorphic encryption is used for blind comparison, and the server can complete the verification without knowing the plaintext fingerprint. This constructs a "usable but invisible" security paradigm, complying with increasingly stringent data security regulations. It offers strong privacy protection, overcoming the shortcomings of existing methods that are prone to privacy leaks.

[0376] 5. This invention provides a full lifecycle management framework for power secondary equipment fingerprints, encompassing generation, registration, verification, and revocation. By combining a secure hardware environment with stored key materials, the security of power secondary equipment fingerprints is ensured. Simultaneously, through linkage with a centralized management system, it can promptly respond to changes in the status of power secondary equipment (such as scrapping or theft), quickly revoking abnormal equipment. This forms a closed-loop security system integrating "trustworthy generation, reliable verification, and efficient management," significantly enhancing the security level of the entire power monitoring system. Overall security is high, achieving closed-loop management; it overcomes the shortcomings of existing technologies that lack complete fingerprint lifecycle management.

[0377] Those skilled in the art will understand that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0378] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0379] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for constructing fingerprints for secondary power equipment, characterized in that, Includes the following steps: Step S1: Periodically collect multidimensional features of the secondary power equipment according to the collection cycle and perform preprocessing; Step S2: Based on the stability index value of each feature, dynamically assign weights to each feature, and perform tolerance mapping on the preprocessed features based on the weights to generate robust feature strings; Step S3: Based on the multiple high-stability features of the power secondary equipment, generate a dynamic S-box for a lightweight encryption algorithm specific to the power secondary equipment. Step S3 includes: Based on the multiple high-stability features of the aforementioned secondary power equipment, a seed key is generated; Based on the seed key, a dynamic S-box specific to the power secondary equipment is generated using a dynamic S-box generation algorithm. The dynamic S-box is securely stored in the hardware security environment of the secondary power equipment; The seed key generation includes: Multiple highly stable features of the secondary power equipment are concatenated in a predetermined order to form a seed string; Calculate the hash value of the seed string; The first 128 bits of the hash value are extracted and used as the seed key; The process of generating a dynamic S-box specific to the power equipment using a dynamic S-box generation algorithm includes: Initialize a linear sequence S consisting of all integers from 0 to M-1, where M is the size of the box S; Based on the seed key, a key stream is generated using a key expansion algorithm; Based on the key stream, multiple rounds of pseudo-random permutations are performed on the linear sequence S to obtain a confused sequence; For each element in the confused sequence, multiplicative inverse calculation and affine transformation over a finite field are performed sequentially to complete the nonlinear enhancement; The output sequence, after nonlinear enhancement, serves as the final dynamic S-box; where the seed key... It can be obtained through the following formula: Among them, the initial string formed by combining multiple highly stable device features in a preset order is: ; It is a cryptographic hash algorithm; Indicates taking The first 16 bytes of the SM3 hash value; The key expansion algorithm includes: Initialize a 128-bit counter and set its initial value to 0; Using the SM4 algorithm, with the seed key as the key, the current value of the counter is encrypted, and the encryption result is used as a data block of the key stream; Increment the value of the counter; Repeat this encryption and incrementing process until the total length of the generated key stream is not less than the preset length threshold. The preset length threshold is the product of the size of the S-box and the number of pseudo-random permutation rounds; The nonlinear strengthening includes: Each element x in the confused sequence, in the finite field GF(2 8 Calculate the multiplicative inverse y of x as follows: Perform an invertible affine transformation on y as follows: Where A is in GF(2 8 The S-box is an 8x8 invertible matrix, where b is an 8-bit constant and z is the output value of the dynamic S-box when the input element x is given. Arrange the output values ​​z corresponding to all input elements x in order to form the final dynamic S-box; Step S4: Using the dedicated dynamic S-box, the robust feature string is encrypted using a lightweight encryption algorithm, and the encryption result is hashed to dynamically generate a fixed-length device fingerprint for the current collection period.

2. The fingerprint construction method for secondary power equipment according to claim 1, characterized in that, The multidimensional features include static features, dynamic features, and environmental features; The static features include at least one of the following: electronic identification card information, trusted chip ID, CPU serial number, memory serial number, MAC address, operating system type, and software version. The dynamic characteristics include at least one of the following: user access behavior, process behavior, network access behavior, file access behavior, and the current boot time. The environmental characteristics include at least one of the following: boot time, geographical location, affiliated unit information, and running process list.

3. The method for constructing fingerprints for secondary power equipment according to claim 2, characterized in that, The preprocessing includes: Convert the collected multidimensional feature values ​​into string format; Process the strings of each feature into a preset fixed length. Specifically, feature values ​​shorter than the preset fixed length are padded with predefined characters, while feature values ​​longer than the preset fixed length are padded with predefined characters. The feature values ​​are hashed and digested. For missing feature values ​​that were not collected, they are marked using predefined padding characters.

4. The method for constructing fingerprints for secondary power equipment according to claim 3, characterized in that, The length exceeds a preset fixed length The feature values ​​are hashed and digested, including: Calculate the hash value of the feature value, and truncate the first part of the hash value. Each character is used as a new feature value for that feature.

5. The method for constructing fingerprints for secondary power equipment according to claim 1, characterized in that, Step S2 includes: Assign weights to each of the aforementioned features; Based on the preset mapping function and the weights corresponding to each feature, the mapping parameters of each feature are calculated. The preprocessed multidimensional feature values ​​are merged with their corresponding mapping parameters to generate intermediate feature values ​​with tolerance. The intermediate feature values ​​are concatenated in a predetermined order to generate the robust feature string; The weights are dynamically updated based on the stability index values ​​of each feature.

6. The method for constructing fingerprints for secondary power equipment according to claim 5, characterized in that, The weights are dynamically updated by the central server through a federated learning framework, aggregating the feature change information periodically reported by each secondary power equipment.

7. The method for constructing fingerprints for secondary power equipment according to claim 6, characterized in that, The weights are updated dynamically, including the following steps: Based on the federated learning framework, the central server initializes a pre-trained global weight prediction model. ; Based on the data collection cycle, each secondary power device reports the collected multidimensional features to the central server. Based on the reported multidimensional features, the central server calculates the stability index value of each feature of each secondary power device, and calculates and encrypts the data based on the stability index value. Model update amount; The central server uses a secure aggregation protocol to aggregate multiple encrypted model update amounts to update the global weight prediction model and dynamically output the weights of the corresponding features. The central server will dynamically update the weights corresponding to the features and distribute the configurations to the corresponding secondary power equipment.

8. The method for constructing fingerprints for secondary power equipment according to claim 7, characterized in that, The stability index values ​​of the calculated features include: Calculate the standard deviation of the preprocessed feature collected multiple times within a predetermined time window, and calculate the stability index value of the feature based on the standard deviation. The stability index value is negatively correlated with the stability of the feature, and the stability index value = 1 / (1 + standard deviation).

9. The method for constructing fingerprints for secondary power equipment according to claim 5, characterized in that, The mapping function is as follows: in, For mapping parameters, Used as a reference parameter; Scaling factor For the first The weights of each feature, It is a local minimum.

10. The method for constructing fingerprints for secondary power equipment according to claim 1, characterized in that, Step S4 includes: Using the dedicated dynamic S-box, the robust feature string is encrypted using the lightweight symmetric encryption algorithm to obtain ciphertext; Calculate the hash value of the ciphertext and use the resulting hash value as a fixed-length device fingerprint for the current collection period; The SM3 algorithm is used to calculate the hash value of the ciphertext.

11. The method for constructing fingerprints for secondary power equipment according to any one of claims 1-10, characterized in that, The method also includes device fingerprint verification and management steps; The device fingerprint verification step is used to authenticate the identity of secondary power equipment when it requests access to the business system. The device fingerprint management steps are used to handle the registration, updating, and revocation of device fingerprints.

12. The method for constructing fingerprints for secondary power equipment according to any one of claims 1-10, characterized in that, The secondary power equipment includes protection devices, measurement and control devices, communication equipment, and network equipment.

13. A fingerprint construction system for secondary power equipment, characterized in that, The system includes a feature acquisition module M1, a dynamic weighting and mapping module M2, a dynamic S-box generation module M3, and a device fingerprint generation module M4. The feature acquisition module M1 is used to periodically acquire and preprocess the multidimensional features of the power secondary equipment according to the acquisition cycle. The dynamic weighting and mapping module M2 is used to dynamically assign weights to each feature based on the stability index value of each feature, and to perform tolerance mapping on the preprocessed features based on the weights to generate robust feature strings. The dynamic S-box generation module M3 generates a dynamic S-box with a lightweight encryption algorithm specific to the power secondary equipment, based on several highly stable features of the power secondary equipment. The dynamic S-box generation module M3 includes: Based on the multiple high-stability features of the aforementioned secondary power equipment, a seed key is generated; Based on the seed key, a dynamic S-box specific to the power secondary equipment is generated using a dynamic S-box generation algorithm. The dynamic S-box is securely stored in the hardware security environment of the secondary power equipment; The seed key generation includes: Multiple highly stable features of the secondary power equipment are concatenated in a predetermined order to form a seed string; Calculate the hash value of the seed string; The first 128 bits of the hash value are extracted and used as the seed key; The process of generating a dynamic S-box specific to the power equipment using a dynamic S-box generation algorithm includes: Initialize a linear sequence S consisting of all integers from 0 to M-1, where M is the size of the box S; Based on the seed key, a key stream is generated using a key expansion algorithm; Based on the key stream, multiple rounds of pseudo-random permutations are performed on the linear sequence S to obtain a confused sequence; For each element in the confused sequence, multiplicative inverse calculation and affine transformation over a finite field are performed sequentially to complete the nonlinear enhancement; The output sequence, after nonlinear enhancement, serves as the final dynamic S-box; where the seed key... It can be obtained through the following formula: Among them, the initial string formed by combining multiple highly stable device features in a preset order is: ; It is a cryptographic hash algorithm; Indicates taking The first 16 bytes of the SM3 hash value; The key expansion algorithm includes: Initialize a 128-bit counter and set its initial value to 0; Using the SM4 algorithm, with the seed key as the key, the current value of the counter is encrypted, and the encryption result is used as a data block of the key stream; Increment the value of the counter; Repeat this encryption and incrementing process until the total length of the generated key stream is not less than the preset length threshold. The preset length threshold is the product of the size of the S-box and the number of pseudo-random permutation rounds; The nonlinear strengthening includes: Each element x in the confused sequence, in the finite field GF(2 8 Calculate the multiplicative inverse y of x as follows: Perform an invertible affine transformation on y as follows: Where A is in GF(2 8 The S-box is an 8x8 invertible matrix, where b is an 8-bit constant and z is the output value of the dynamic S-box when the input element x is given. Arrange the output values ​​z corresponding to all input elements x in order to form the final dynamic S-box; The device fingerprint generation module M4 is used to use the dedicated dynamic S-box to encrypt the robust feature string through a lightweight encryption algorithm, and perform a hash operation on the encryption result to dynamically generate a fixed-length device fingerprint for the current collection period.

14. An electronic device for constructing fingerprints for secondary power equipment, characterized in that, The electronic device includes: Memory, used to store computer programs; A processor for executing the computer program to implement the fingerprint construction method for power secondary equipment as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the fingerprint construction method for power secondary equipment as described in any one of claims 1 to 12.

Images