Method for determining expired equipment information of security and protection equipment registration system and related device

Abstract

The invention discloses an expired equipment information determination method of a security and protection equipment registration system and a related device. The method comprises the following steps: an edge authentication gateway sends a first access request of first security and protection equipment to a central server; the central server receives the first access request and determines the device type of the first security and protection device according to a locally stored registration device list, and the device type comprises a trigger interactive device or a periodic interactive device; the central server determines an equipment trust score of the first security and protection equipment according to the equipment type of the first security and protection equipment and the first access request; if the equipment trust score is lower than a preset score, the central server generates first expired equipment information, and the first expired equipment information comprises a first equipment identifier of the first security equipment; and the central server sends first expired equipment information to the edge authentication gateway, wherein the first expired equipment information is used for indicating the equipment identifier of which the registration identity is expired. By implementing the method provided by the invention, the processing efficiency and safety are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of security and protection equipment communication related technology, and particularly relates to a security and protection equipment registration system expired device information determination method and related device. BACKGROUND

[0002] With the continuous development of the security and protection field, the existing security and protection equipment usually needs to communicate with the server through the Internet of Things and the like to realize various supports of the server to the operation of the security and protection equipment. In the prior art, the identity authentication technology of the security and protection equipment includes a centralized certificate management, a pre-shared key scheme and a lightweight authentication protocol and the like. In these schemes, a central server needs to centrally process the identity registration and verification of the terminal equipment, and thus a large amount of related data needs to be stored in a long-time operation, which finally leads to the problems of storage resource shortage and low processing efficiency of the related server in the operation process of the network equipment. SUMMARY

[0003] In view of the above problems, the present application provides a security and protection equipment registration system expired device information determination method and related device, which is advantageous to reduce the false alarm rate of the fire alarm system.

[0004] In the first aspect, the present application provides a security and protection equipment registration system expired device information determination method, which is applied to a security and protection equipment registration system, the security and protection equipment registration system including a first security and protection equipment, a central server and an edge authentication gateway. The method includes: the edge authentication gateway sends a first access request of the first security and protection equipment to the central server; the central server receives the first access request and determines a device type of the first security and protection equipment according to a locally stored registration device list, the device type including a trigger interactive device or a periodic interactive device; the central server determines a device trust score of the first security and protection equipment according to the device type of the first security and protection equipment and the first access request; if the device trust score is lower than a preset score, the central server generates first expired device information, the first expired device information including a first device identifier of the first security and protection equipment; and the central server sends the first expired device information to the edge authentication gateway, the first expired device information being used to indicate a device identifier of an expired registration identity.

[0005] It can be seen that, in the present embodiment, the device trust score is dynamically calculated by combining the device type and the access request, the automatic expired judgment based on the device behavior analysis is realized, and the collaborative mechanism of the edge authentication gateway and the central server reduces the processing pressure of the central server and improves the operation and maintenance efficiency. In addition, the central server can effectively identify abnormal devices and update the identity state in time, thereby improving the security of the security and protection equipment registration system.

[0006] With reference to the first aspect, in a possible implementation, the center server determines the device trust score of the first security device according to the device type of the first security device and the first access request, including: if the device type of the first security device is a trigger interactive security device, the center server obtains a standard access request of the first security device, and compares the first access request with the standard access request to obtain a comparison similarity of the first security device; the center server determines the device trust score of the first security device according to the comparison similarity, and the device trust score is positively correlated with the comparison similarity; if the device type of the first security device is a periodic interactive security device, the center server determines a standard access frequency of the first security device; the center server determines an access frequency of the first security device according to the first access request; and the center server determines the device trust score of the first security device according to a frequency difference between the access frequency and the standard access frequency of the first security device, and the device trust score is inversely correlated with the frequency difference.

[0007] It can be seen that in the embodiment, by designing different trust evaluation algorithms for different device types, fine-grained device behavior monitoring is realized. For trigger devices, attention is paid to the compliance of single request, and for periodic devices, attention is paid to the regularity of long-term behavior. This dual evaluation mechanism greatly enhances the ability of the system to identify abnormal devices, and thus effectively improves the security and reliability of the entire security system.

[0008] With reference to the first aspect, in a possible implementation, the method further includes: if the device trust score is not lower than a preset score, the center server generates renewal information, and sends the renewal information to the first security device; if the center server does not receive the determination renewal information sent by the first security device in response to the renewal information, the center server generates third expired device information, and the expired device information includes the first device identifier of the first security device; and the center server sends the third expired device information to the edge authentication gateway.

[0009] It can be seen that in the embodiment, by establishing an automatic renewal mechanism based on the device behavior trust score, combined with a two-way confirmation process, intelligent management of the certificate life cycle is realized, thereby reducing the operation and maintenance cost of the security device registration system, abnormal devices can be identified and disposed in a timely manner, and the security of the entire security device registration system is improved.

[0010] With reference to the first aspect, in a possible implementation, before the edge authentication gateway sends the first access request of the first security device to the center server, the method further includes: the first security device sends a first access request to the edge authentication gateway, the first access request comprising a first registration certificate generated by the center server, the first registration certificate comprising a first device identifier of the first security device; the edge authentication gateway receives the first access request and performs first legality verification and validity verification on the first device identifier; and the edge authentication gateway determines that the first legality verification of the first device identifier passes and the validity verification of the first device identifier passes.

[0011] It can be seen that, in this embodiment, by implementing preliminary certificate verification at the edge authentication gateway, effective shunting of authentication pressure is achieved, which not only ensures the security of the authentication process, but also significantly improves the overall processing efficiency of the system.

[0012] With reference to the first aspect, in a possible implementation, the first legality verification and validity verification on the first device identifier comprises: the center server sends registered device information and second expired device information to the edge authentication gateway; the edge authentication gateway receives the registered device information and the second expired device information; the edge authentication gateway decrypts the first registration certificate according to the first secret key to obtain the first device identifier; the edge authentication gateway obtains a registered device list according to the registered device information; if the first device identifier of the first security device is included in the registered device list, the edge authentication gateway determines that the first legality verification of the first device identifier passes; the edge authentication gateway obtains an expired device list according to the second expired device information; and if the first device identifier is not included in the expired device list, the edge authentication gateway determines that the validity verification of the first device identifier passes.

[0013] It can be seen that, in this embodiment, by synchronizing the state information between the center server and the edge authentication gateway, in combination with the localized list query mechanism, efficient and reliable device identity verification is achieved.

[0014] With reference to the first aspect, in a possible implementation, before the first security device sends the first access request to the edge authentication gateway, the method further includes: the first security device sends a first registration request to the center server, the first registration request comprising a first device identifier of the first security device; the center server receives the first registration request and generates a first registration certificate according to the first device identifier; the center server sends the first registration certificate to the first security device; the first security device receives the first registration certificate; and the center server generates registered device information, the registered device information comprising the first device identifier.

[0015] It can be seen that, in the embodiment, a secure trust basis is determined for the entire security device registration system by establishing a complete device registration and certificate distribution mechanism, thereby providing a data basis for subsequent device state monitoring and life cycle management.

[0016] In combination with the first aspect, in a possible embodiment, the first registration certificate is generated according to the first device identifier, including: the central server performs second legality verification on the first device identifier according to the first registration request; if the second legality verification on the first device identifier is passed, the central server generates the first registration certificate, and encrypts the first registration certificate according to a second secret key, the first secret key and the second secret key being a set of public and private secret keys.

[0017] It can be seen that, in the embodiment, a highly secure device registration process is established through strict second legality verification and a certificate encryption mechanism based on public and private key cryptography, which not only ensures that only a legal device can obtain a valid certificate, but also prevents the certificate from being stolen or tampered with during the distribution process through encrypted transmission, thereby improving the security of the security device registration system.

[0018] In the second aspect, the embodiment of the present application provides an expired device information determination apparatus of a security device registration system, which is used to execute the expired device information determination method of the security device registration system, and the apparatus includes: The sending unit is configured to send a first access request of a first security device to a central server. The receiving unit is configured to receive the first access request, and determine a device type of the first security device according to a locally stored registration device list, the device type including a trigger interactive device or a periodic interactive device. The determining unit is configured to determine a device trust score of the first security device according to the device type of the first security device and the first access request. The generating unit is configured to generate first expired device information if the device trust score is lower than a preset score, the first expired device information including a first device identifier of the first security device. The sending unit is configured to send the first expired device information to an edge authentication gateway, the first expired device information being used to indicate a device identifier with an expired registration identity.

[0019] In the third aspect, the embodiment of the present application provides an electronic device, including a processor, a memory, a communication interface, and one or more programs, the one or more programs being stored in the memory and configured to be executed by the processor, and one or more instructions being adapted to be loaded and executed by the processor to perform part or all of the method of the first aspect and / or the second aspect.

[0020] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium storing a computer program for electronic data exchange, wherein the computer program causes a computer to perform part or all of the method in the first aspect and / or the second aspect.

[0021] In a fifth aspect, the present application provides a computer program product, which, when read and executed by a computer, causes the computer to perform part or all of the method in the first aspect and / or the second aspect.

[0022] It can be understood that the beneficial effects of the embodiments of the second aspect to the fifth aspect can refer to the beneficial effects in the method of the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0024] Figure 1 An application scenario diagram of a method for determining expired device information of a security device registration system provided by an embodiment of the present application; Figure 2 A flowchart of a method for determining expired device information of a security device registration system provided by an embodiment of the present application; Figure 3 A flowchart of another method for determining expired device information of a security device registration system provided by an embodiment of the present application; Figure 4 A schematic diagram of a first registration certificate generation and sending process provided by an embodiment of the present application; Figure 5 A certificate issuing diagram of a security device cluster provided by an embodiment of the present application; Figure 6 A flowchart of still another method for determining expired device information of a security device registration system provided by an embodiment of the present application; Figure 7 A structural diagram of a device for determining expired device information of a security device registration system provided by an embodiment of the present application; Figure 8 A structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0025] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0026] The terms “first”, “second”, and the like in the specification and claims of the present application and the above drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms “include” and “have” and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed or can optionally include other steps or units inherent to the process, method, product, or device.

[0027] Reference herein to “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The phrase appears at various locations in the specification does not necessarily all refer to the same embodiment, nor is it necessarily mutually exclusive of other embodiments. It is explicitly and implicitly understood that the embodiments described herein can be combined with other embodiments.

[0028] The embodiments of the present application are described below in conjunction with the drawings.

[0029] Embodiment one: please refer to Figure 1 , Figure 1 An application scenario diagram of an expired device information determination method of a security device registration system provided by the embodiments of the present application is shown in the application scenario 100, which includes a first security device 101, a center server 102, and an edge authentication gateway 103.

[0030] The first security device 101 is specifically a kind of security device (for example) capable of communicating with the center server 102 for device registration, data uploading, and data downloading.

[0031] The center server 102 is specifically used for accepting registration requests of various security devices, storing data uploaded by the security devices, and providing data to the security devices.

[0032] The edge authentication gateway 103 is used to be deployed at the edge of the network, has the ability of local certificate and credential verification, and can reduce the burden of the center server 102.

[0033] In the embodiments of the present application, the first security device 101, the center server 102 and the edge authentication gateway 103 belong to a security device registration system, and the expired device information determination method of the security device registration system is applied to the security device registration system. The method comprises the following steps: The edge authentication gateway 103 sends a first access request of the first security device 101 to the center server 102.

[0034] Specifically, the first access request is a request for data uploading, data downloading and the like proposed by the first security device 101 to the center server 102. The first security device 101 sends the first access request to the edge authentication gateway 103, which checks the first access request of the first security device 101 and forwards it to the center server 102 after passing the check.

[0035] The center server 102 receives the first access request and determines the device type of the first security device 101 according to the locally stored registration device list, wherein the device type comprises a trigger interactive device or a periodic interactive device.

[0036] Specifically, the center server 102 receives the first access request and determines the device type of the first security device 101 according to the locally stored registration device list to perform the subsequent device trust score step. In addition, the center server 102 also provides corresponding services for the first security device 101 according to the content of the first access request.

[0037] The center server 102 determines the device trust score of the first security device 101 according to the device type of the first security device 101 and the first access request.

[0038] Specifically, the center server 102 matches different scoring standards according to the device type of the first security device 101 to determine the device trust score of the first security device 101 according to the first access request of the first security device 101.

[0039] The device trust score represents the degree of trust of the center server 102 to the first security device 101. The higher the device trust score, the higher the degree of trust of the center server 102 to the first security device 101, which means that the operation performance of the first security device 101 is more in line with the characteristics of the security device.

[0040] The lower the device trust score, the lower the degree of trust of the center server 102 to the first security device 101, which means that the operation performance of the first security device 101 is less in line with the characteristics of the security device, and the first security device 101 may be a malicious access device disguised as a security device.

[0041] If the device trust score is lower than the preset score, the center server 102 generates first expired device information, and the first expired device information includes a first device identifier of the first security device 101.

[0042] Specifically, the first expired device information herein is used to indicate that the device identifier of the security device included therein is expired. The first device identifier herein is a unique device identifier of the first security device 101, such as a hardware identifier or a certificate serial number.

[0043] The center server 102 sends the first expired device information to the edge authentication gateway 103, and the first expired device information is used to indicate the device identifier of which the registration identity is expired.

[0044] Upon receiving the first expired device information, the edge authentication gateway 103 judges that the first security device 101 fails the audit, so as to exclude the security device with higher risk from accessing the center server 102 when subsequently receiving an access request of the first security device 101.

[0045] It can be seen that, in the embodiment, the trust score is dynamically calculated by combining the device type and the access request, the automatic expired judgment based on the device behavior analysis is realized, the collaborative mechanism of the edge authentication gateway and the center server is realized, the processing pressure of the center server is reduced, and the operation and maintenance efficiency is improved. In addition, the center server can effectively identify abnormal devices and update the identity state in time, and the security of the security device registration system is improved.

[0046] Please refer to Figure 2 , Figure 2 A flowchart of an expired device information determination method of a security device registration system provided by the embodiment of the present application can be implemented based on the application scenario 100 as shown in Figure 1 , and includes steps S201-S205 as shown in Figure 2 .

[0047] S201: The edge authentication gateway sends a first access request of the first security device to the center server.

[0048] S202: The center server receives the first access request, and determines the device type of the first security device according to the registration device list stored locally, and the device type includes a trigger interactive device or a periodic interactive device.

[0049] Specifically, after receiving the first access request, the center server queries the registration device list stored locally, and the list records the identifier and type information of the registered device. The device type is divided into a trigger interactive device or a periodic interactive device, wherein the trigger interactive device usually initiates access when a specific event is triggered (such as a sensor detecting an anomaly), and the periodic interactive device performs periodic access according to a fixed time interval (such as a device that reports data at regular intervals).

[0050] S203: The central server determines the device trust score of the first security device according to the device type of the first security device and the first access request.

[0051] Specifically, the central server dynamically calculates the device trust score according to the device type and the first access request. For a triggered interactive device, the central server specifically judges by comparing the consistency of the timing sequence, content of the access request with the expected pattern, etc.; for a periodic interactive device, it judges by evaluating the deviation of the access frequency from the standard pattern, etc.

[0052] Optionally, the central server determines the device trust score of the first security device according to the device type of the first security device and the first access request, including: if the type of the first security device is a triggered interactive security device, the central server obtains the standard access request of the first security device, and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device according to the comparison similarity, and the device trust score is positively correlated with the comparison similarity; if the type of the first security device is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device according to the first access request; the central server determines the device trust score of the first security device according to the frequency difference between the access frequency of the first security device and the standard access frequency, and the device trust score is inversely correlated with the frequency difference.

[0053] Specifically, in the embodiment of the present application, the specific implementation manner of the central server determining the device trust score according to the device type is described in detail.

[0054] The central server adopts a differentiated trust evaluation strategy for different types of security devices. For a triggered interactive security device (such as an intrusion detector, an emergency button, etc.), its access behavior is usually triggered by a specific event. The central server first obtains the standard access request of this device, and this standard request can be a template of the typical access behavior of the device in the normal state, including but not limited to the timing characteristics of the request, the data packet structure, the parameter range, etc.

[0055] Then, the actually received first access request is compared with this standard request in multiple dimensions to calculate the comparison similarity. The comparison process may involve pattern recognition algorithms, such as comparing the rationality of the request time with the event trigger logic, the integrity of the data fields, and the numerical range, etc. The device trust score is positively correlated with the comparison similarity, that is, the higher the similarity, the higher the trust score, indicating that the device behavior is more in line with the expected pattern.

[0056] For periodically interactive security devices (such as sensors that periodically report their status, periodic inspection devices, etc.), their access behavior exhibits a temporal regularity. The central server determines the standard access frequency based on the device's historical behavior data or preset policies. Simultaneously, it analyzes the first access request and related historical records to determine the device's current access frequency. The device's trust score is determined by calculating the frequency difference (e.g., absolute difference or relative deviation rate) between the current access frequency and the standard access frequency. The device trust score is inversely correlated with the frequency difference; that is, the larger the frequency difference, the lower the trust score. Abnormal frequency changes (such as excessively frequent or prolonged periods of silence) may indicate device malfunction, malicious control, or certificate theft.

[0057] As can be seen, this embodiment achieves refined device behavior monitoring by designing differentiated trust assessment algorithms for different device types. For trigger-based devices, the focus is on the compliance of individual requests; for periodic devices, the focus is on the regularity of long-term behavior. This dual assessment mechanism greatly enhances the system's ability to identify abnormal devices, thereby effectively improving the security and reliability of the entire security system.

[0058] S204: If the device trust score is lower than the preset score, the central server will generate the first expired device information, which includes the first device identifier of the first security device.

[0059] Specifically, if a device's trust score is lower than a preset score (which can be dynamically adjusted according to security policies), it indicates that the device may have abnormal behavior, expired certificates, or potential security risks. The central server will then automatically generate information on the first expired device, which includes a first device identifier (such as a hardware identifier or certificate serial number) to indicate that the device's registration identity has expired.

[0060] S205: The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0061] Finally, the central server sends the first expired device information to the edge authentication gateway, enabling the gateway to update its locally cached blacklist or revocation list in a timely manner, preventing expired devices from continuing to access network resources.

[0062] Example 2: The above-mentioned application embodiment provides a method for determining expired device information in a security device registration system by judging device trust score through a first access request. Based on this, for the preliminary review of the first access request of the first security device, this application embodiment also provides another more detailed method for determining expired device information in a security device registration system.

[0063] Please see Figure 3 , Figure 3This is a flowchart illustrating another method for determining expired device information in a security device registration system provided in this application embodiment. It can be based on... Figure 1 The application scenario 100 shown is implemented as follows: Figure 3 As shown, it includes steps S301-S308.

[0064] S301: The first security device sends a first access request to the edge authentication gateway. The first access request includes a first registration certificate generated by the central server. The first registration certificate includes the first device identifier of the first security device.

[0065] Specifically, when the first security device needs to access network resources, it proactively sends a first access request to the nearest deployed edge authentication gateway. This request contains a first registration certificate pre-issued by the central server, which contains the unique identifier of the first security device – the first device identifier. This first device identifier is an HWID (Hardware Identifier) ​​generated based on the device's hardware characteristics.

[0066] S302: The edge authentication gateway receives the first access request and performs the first legality and validity verification on the first device identifier.

[0067] Specifically, after receiving an access request, the edge authentication gateway does not immediately forward the request to the central server, but first verifies it locally to ensure that the certificate itself is authentic and trustworthy.

[0068] Optionally, the first device identifier is further validated for both legality and validity, including: the central server sending registered device information and second expired device information to the edge authentication gateway; the edge authentication gateway receiving the registered device information and second expired device information; the edge authentication gateway decrypting the first registration certificate using the first key to obtain the first device identifier; the edge authentication gateway obtaining a list of registered devices based on the registered device information; if the list of registered devices includes the first device identifier of the first security device, the edge authentication gateway determines that the first legality verification of the first device identifier has passed; the edge authentication gateway obtaining a list of expired devices based on the second expired device information; if the list of expired devices does not include the first device identifier, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

[0069] Specifically, in the embodiments of this application, the specific implementation process of the edge authentication gateway performing the first legality verification and validity verification is described in detail.

[0070] First, the central server periodically or on demand synchronizes two types of key information with the edge authentication gateway: registered device information and expired device information. The registered device information constitutes a whitelist of legitimate devices, while the expired device information constitutes an incremental certificate revocation list, containing identifiers of devices deemed expired by the central server. This information synchronization mechanism ensures that the edge gateway can obtain the latest device status while avoiding the need to query the central server for each verification.

[0071] When the edge authentication gateway needs to verify the first registration certificate, it first uses the first key to decrypt the certificate and extract the plaintext first device identifier.

[0072] Subsequently, the edge authentication gateway performs two levels of verification: the first, legitimacy verification, checks the list of registered devices to confirm whether the device identifier is within the system's recognized range of legitimate devices; this is equivalent to verifying whether the device is "qualified" to access the system. The second, validity verification, checks the list of expired devices to confirm whether the device identifier has not been revoked or marked as expired; this is equivalent to verifying whether the device's current "status" is normal. Only when the device is both on the legitimate list and not on the expired list is the verification considered successful.

[0073] As can be seen, in this embodiment, efficient and reliable device authentication is achieved by synchronizing the status information between the central server and the edge authentication gateway, combined with a localized list query mechanism.

[0074] S303: The edge authentication gateway determines that the first legality verification of the first device identifier has passed and the validity verification of the first device identifier has passed.

[0075] As can be seen, by implementing preliminary certificate verification at the edge authentication gateway in this embodiment, the authentication pressure is effectively diverted, which not only ensures the security of the authentication process, but also significantly improves the overall processing efficiency of the system.

[0076] S304: The edge authentication gateway sends the first access request of the first security device to the central server.

[0077] S305: The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger interactive devices or periodic interactive devices.

[0078] S306: The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request.

[0079] S307: If the device trust score is lower than the preset score, the central server will generate the first expired device information, which includes the first device identifier of the first security device.

[0080] S308: The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0081] For detailed explanations of steps S304-S308, please refer to the descriptions and related content of steps S201-S205 in the above application embodiments, which will not be repeated here.

[0082] Optionally, before the first security device sends the first access request to the edge authentication gateway, the method further includes: the first security device sending a first registration request to the central server, the first registration request including a first device identifier of the first security device; the central server receiving the first registration request and generating a first registration certificate based on the first device identifier; the central server sending the first registration certificate to the first security device; the first security device receiving the first registration certificate; and the central server generating registered device information, the registered device information including the first device identifier.

[0083] Specifically, in this embodiment of the application, the initial registration process of the first security device in the system is described in detail.

[0084] First, when the first security device is deployed for the first time or needs to be re-authenticated, it will proactively send a first registration request to the central server.

[0085] After receiving a registration request, the central server executes a device identity verification process and generates a first registration certificate (e.g., an X.509 digital certificate) based on the verification result. Once generated, the central server distributes the certificate to the first security device. The device receives and securely stores this certificate as a credential for subsequent identity authentication.

[0086] At the same time, the central server updates the registered device information in the system and adds the first device identifier to the list of legitimate devices. This information will be used for the subsequent legitimacy verification of the edge authentication gateway, as described in the verification process in the previous embodiments.

[0087] For example, please see Figure 4 , Figure 4 This is a schematic diagram illustrating the generation and transmission process of a first registration certificate provided in an embodiment of this application. The central server can issue a first registration certificate to the first security device after the first security device has registered. It should be noted that the first registration certificate is encrypted with a key, which includes the first device identifier of the first security device.

[0088] The first security device forwards its first registration certificate to the edge authentication gateway. The edge authentication gateway decrypts the first registration certificate to obtain the first device identifier of the first security device. Simultaneously, the edge authentication gateway receives encrypted registered device information from the central server and decrypts it to obtain the list of registered devices. Therefore, it can be seen that the first device identifier of the first security device is encrypted throughout the transmission process and decrypted only locally at the edge authentication gateway, thus ensuring the security of the security device registration system.

[0089] As can be seen, by establishing a complete device registration and certificate distribution mechanism in this embodiment, a secure trust foundation is established for the entire security device registration system, thereby providing a data foundation for subsequent device status monitoring and lifecycle management.

[0090] Optionally, generating a first registration certificate based on a first device identifier includes: the central server verifying the first device identifier according to the first registration request and performing a second legality verification; if the second legality verification of the first device identifier passes, the central server generates a first registration certificate and encrypts the first registration certificate according to a second key, wherein the first key and the second key are a set of public and private keys.

[0091] Specifically, in this embodiment, the central server does not need to perform a second legitimacy verification on the first device identifier in the first registration request after receiving it. This verification differs from the first legitimacy verification performed by the edge authentication gateway; it is a deeper verification performed at the highest trust level of the system. The verification content includes, but is not limited to: checking whether the format of the first device identifier conforms to the specifications; verifying whether the identifier is within the range of device types allowed for registration by the system; confirming that the identifier has not been registered repeatedly by other devices; and verifying the authenticity and validity of the first device identifier to prevent counterfeit device registration.

[0092] Only after the second legitimacy verification passes will the central server proceed to the certificate generation stage. During certificate generation, the central server cryptographically binds the first device identifier to the certificate, for example, by writing the hash value of the HWID into the certificate's extended field or using it as a signature salt in the certificate generation process, thereby achieving cryptographic-level hardware binding. The first key held by the edge authentication gateway (as the private key) is used for subsequent certificate decryption and verification. This public-private key mechanism forms the foundation of the PKI system.

[0093] As can be seen, this embodiment establishes a highly secure device registration process through strict second legitimacy verification and a certificate encryption mechanism based on public-private key cryptography. This design not only ensures that only legitimate devices can obtain valid certificates, but also prevents certificates from being stolen or tampered with during distribution through encrypted transmission, thereby improving the security of the security device registration system.

[0094] Optionally, the security device registration system also includes a second security device, which belongs to the same security device cluster as the first security device. The method further includes: a central server sending authorization information to the first security device based on a first registration request sent by the first security device, the authorization information indicating that the first security device is the central security device in the security device cluster; the first security device receiving the authorization information and obtaining a second device identifier for the second security device based on the authorization information; the first security device encrypting the first registration certificate based on the second device identifier to obtain a second registration certificate and sending the second registration certificate to the second security device; the second security device receiving the second registration certificate and decrypting the second registration certificate based on the second device identifier to obtain the first registration certificate; the second security device sending a second access request to an edge authentication gateway, the second access request including the first registration certificate; the edge authentication gateway receiving the second access request and performing a third legality verification and validity verification on the first device identifier; if the third legality verification and validity verification pass, the edge authentication gateway sends access authorization information to the first security device.

[0095] In this embodiment of the application, the first security device belongs to a security device cluster, which also includes a second security device. Furthermore, the security device cluster also includes more other security devices. The second security device specifically refers to any other security device in the security device cluster other than the first security device.

[0096] A security equipment cluster specifically refers to a group of security devices with the same function and type, such as multiple sensors and cameras with the same function and type deployed in the same location.

[0097] After completing the registration of the first security device, the central server grants it special permissions as the cluster central node. This authorization allows the first security device to obtain the device identifiers of other devices within the cluster (such as the second security device).

[0098] Furthermore, the primary security device here can obtain the device identifiers of other devices within the cluster via a local network connection.

[0099] The first security device then uses the second device identifier as a key to encrypt its own first registration certificate, generating a second registration certificate. This encryption process essentially creates a trust transfer mechanism between devices, and the second registration certificate can be regarded as a derived credential "issued" by the first security device for the second security device.

[0100] After obtaining the second registration certificate, the second security device uses its own second device identifier to decrypt and restore the first registration certificate. This encryption and decryption process ensures that only devices with the correct device identifier can successfully obtain the original certificate, achieving a high degree of binding between the certificate and the device hardware. When the second security device initiates an access request to the edge authentication gateway, it submits the first registration certificate instead of its own certificate, indicating its identity as a cluster member.

[0101] When the edge authentication gateway performs third-party legitimacy and validity verification, it verifies the first device identifier, not the second device identifier. The first registration certificate acts as a group certificate, while the second device identifier, combined with the encryption operation, constitutes a lightweight device credential.

[0102] For example, please see Figure 5 , Figure 5 This is a schematic diagram of certificate issuance for a security device cluster provided in an embodiment of this application. It includes a first security device and other security devices (the second security device is any one of the other security devices). It can be seen that the central server issues a first registration certificate to the first security device, and the first security device then generates a second registration certificate based on the first registration certificate and distributes it to the other security devices.

[0103] As can be seen, this embodiment achieves efficient intra-group device authentication by establishing a certificate distribution and trust transfer mechanism between devices. This design greatly reduces the certificate issuance burden on the central server; a single cluster only requires the central server to issue a certificate once to support the authentication needs of multiple devices. Simultaneously, by using device identifiers in the encryption / decryption process, the security characteristics of hardware binding are maintained, achieving an optimal balance between scalability and security.

[0104] Example 3: The above-described embodiments primarily depict a control method for an indoor fire alarm system based on sound data to determine the presence of a fire threat in a first area. Based on this, when a fire threat is determined to exist in the first area, this embodiment also provides another, more detailed method for determining the fire threat. Please refer to... Figure 6 , Figure 6 This is a flowchart illustrating another method for determining expired device information in a security device registration system provided in this application embodiment. It can be based on... Figure 1 The application scenario 100 shown is implemented as follows: Figure 6 As shown, it includes steps S601-S608.

[0105] S601: The edge authentication gateway sends the first access request of the first security device to the central server; S602: The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger interactive devices or periodic interactive devices. S603: The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request; S604: If the device trust score is lower than the preset score, the central server will generate the first expired device information, which includes the first device identifier of the first security device. S605: The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0106] For a detailed explanation of steps S601-S605, please refer to the description and related content of steps S201-S205 in the above application embodiments, which will not be repeated here.

[0107] S606: If the device trust score is not lower than the preset score, the central server will generate renewal information and send the renewal information to the first security device.

[0108] Specifically, the central server calculates a device trust score through device behavior analysis. When the central server determines that the score is not lower than a preset score, it indicates that the device has behaved normally during the observation period and meets the renewal conditions. At this time, the central server will automatically generate renewal information and send this information to the first security device.

[0109] After receiving the renewal request, the first security device needs to return a confirmation message within a specified time to confirm that it is in normal working order and accepts the renewal. This two-way confirmation mechanism ensures the verification of device activity and prevents unnecessary renewal operations on malfunctioning or offline devices.

[0110] S607: If the central server does not receive a confirmation renewal message from the first security device in response to the renewal message, the central server will generate third expired device information, which includes the first device identifier of the first security device.

[0111] Specifically, if the central server does not receive confirmation from the first security device within a preset time, it may indicate that the device has a communication failure, has been removed, or is in an abnormal state. In this case, the central server will generate information on the third expired device and add the identifier of the first device to the expired list.

[0112] S608: The central server sends information about the third expired device to the edge authentication gateway.

[0113] Specifically, the central server synchronizes this information with the edge authentication gateway to ensure that the edge side can update its local cache in a timely manner and block subsequent access requests from the device.

[0114] Furthermore, if the central server still does not receive a new registration request or access request from the first security device within the second preset time, the central server can determine that the first security device is closed, and at this time, the data and information related to the first security device can be deleted.

[0115] As can be seen, this embodiment establishes an automated renewal mechanism based on device behavior trust scoring, combined with a two-way confirmation process, to achieve intelligent management of the certificate lifecycle, thereby reducing the operation and maintenance costs of the security device registration system, enabling timely identification and handling of abnormal devices, and improving the security of the entire security device registration system.

[0116] As can be seen from the methods described in the above embodiments, by calculating trust scores, automated expiration judgment based on device behavior analysis is achieved, reducing the processing pressure on the central server, improving operational efficiency, and enhancing the security of the security device registration system. Establishing an automated renewal mechanism based on device behavior trust scores reduces the operational costs of the security device registration system. Implementing preliminary certificate verification at the edge authentication gateway further ensures the security of the authentication process and improves the overall processing efficiency of the system. Establishing a complete device registration and certificate distribution mechanism establishes a secure trust foundation for the entire security device registration system, thereby providing a data foundation for subsequent device status monitoring and lifecycle management. Strict secondary legitimacy verification and a certificate encryption mechanism based on public-private key cryptography further enhance the security of the security device registration system.

[0117] Based on the description of the above configuration method embodiments, this application also provides an expired device information determination device 700 for a security device registration system. This expired device information determination device 700 for a security device registration system can operate in... Figure 1 A computer program (including program code) is shown in the first security device 101, the central server 102, or the edge authentication gateway 103, and is used to execute... Figure 2 , Figure 3 and Figure 6 The method shown. See also Figure 7 , Figure 7 This application provides a schematic diagram of the structure of an expired device information determination device for a security equipment registration system. The expired device information determination device 700 for the security equipment registration system includes: The sending unit 701 is used to send the first access request of the first security device to the central server; The receiving unit 702 is used to receive the first access request and determine the device type of the first security device according to the locally stored list of registered devices. The device type includes a trigger-interactive device or a periodic interactive device. The determination unit 703 is used to determine the device trust score of the first security device based on the device type of the first security device and the first access request; The generation unit 704 is used to generate first expired device information if the device trust score is lower than a preset score. The first expired device information includes the first device identifier of the first security device. The sending unit 701 is used to send first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0118] In one possible embodiment, in determining the device trust score of the first security device based on the device type and the first access request, the determining unit 703 is further specifically configured to: if the first security device type is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device based on the comparison similarity, wherein the device trust score is positively correlated with the comparison similarity; if the first security device type is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device based on the first access request; the central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, wherein the device trust score is inversely correlated with the frequency difference.

[0119] In one possible embodiment, the sending unit 701 is further configured to: if the device trust score is not lower than a preset score, the central server generates renewal information and sends the renewal information to the first security device; if it does not receive a confirmation renewal information from the first security device in response to the renewal information, the central server generates third expired device information, the expired device information including the first device identifier of the first security device; and the central server sends the third expired device information to the edge authentication gateway.

[0120] In one possible embodiment, before the edge authentication gateway sends the first access request of the first security device to the central server, the sending unit 701 is further specifically configured to: send the first access request to the edge authentication gateway, the first access request including a first registration certificate generated by the central server, the first registration certificate including a first device identifier of the first security device; the edge authentication gateway receives the first access request and performs a first legality verification and a validity verification on the first device identifier; the edge authentication gateway determines that the first legality verification of the first device identifier is passed and the validity verification of the first device identifier is passed.

[0121] In one possible embodiment, in performing the first legitimacy verification and validity verification on the first device identifier, the determining unit 703 is further specifically configured to: send registered device information and second expired device information to the edge authentication gateway; the edge authentication gateway receives the registered device information and the second expired device information; the edge authentication gateway decrypts the first registration certificate according to the first key to obtain the first device identifier; the edge authentication gateway obtains a list of registered devices according to the registered device information; if the list of registered devices includes the first device identifier of the first security device, the edge authentication gateway determines that the first legitimacy verification of the first device identifier has passed; the edge authentication gateway obtains a list of expired devices according to the second expired device information; if the list of expired devices does not include the first device identifier, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

[0122] In one possible embodiment, before the first security device sends the first access request to the edge authentication gateway, the sending unit 701 is further configured to: send a first registration request to the central server, the first registration request including a first device identifier of the first security device; the central server receives the first registration request and generates a first registration certificate based on the first device identifier; the central server sends the first registration certificate to the first security device; the first security device receives the first registration certificate; and the central server generates registered device information, which includes the first device identifier.

[0123] In one possible embodiment, in generating the first registration certificate based on the first device identifier, the generating unit 704 is further specifically configured to: the central server verify the first device identifier according to the first registration request and perform a second legality verification; if the second legality verification of the first device identifier passes, the central server generates the first registration certificate and encrypts the first registration certificate according to the second key, wherein the first key and the second key are a set of public and private keys.

[0124] Based on the description of the above method and device embodiments, please refer to... Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.Figure 8 The electronic device 800 shown (specifically, the electronic device 800 may be a computer device, Figure 1 The first security device 101, central server 102, or edge authentication gateway 103 shown includes a memory 801, a processor 802, a communication interface 803, and a bus 804. The memory 801, processor 802, and communication interface 803 are interconnected via the bus 804.

[0125] The memory 801 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM).

[0126] The memory 801 can store programs. When the program code stored in the memory 801 is executed by the processor 802, the processor 802 and the communication interface 803 are used to execute the various steps of the expired device information determination method of the security device registration system of this application embodiment.

[0127] The processor 802 may be a general-purpose central processing unit (CPU), microcontroller, application specific integrated circuit (ASIC), graphics processing unit (GPU), or one or more integrated circuits, used to execute relevant programs to achieve the functions required by the units in the electronic device 800 of this application embodiment, or to execute the expired device information determination method of the security device registration system of this application method embodiment.

[0128] The processor 802 can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of the expired device information determination method of the security equipment registration system of this application can be completed by the integrated logic circuits in the hardware of the processor 802 or by instructions in software form. The aforementioned processor 802 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microcontroller or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory 801. The processor 802 reads the information in the memory 801 and, in conjunction with its hardware, performs the functions required by the units included in the electronic device 800 of this application embodiment, or performs the expired device information determination method of the security device registration system of this application method embodiment.

[0129] The communication interface 803 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between the electronic device 800 and other devices or communication networks. For example, data can be acquired through the communication interface 803.

[0130] Bus 804 may include a pathway for transmitting information between various components of electronic device 800 (e.g., memory 801, processor 802, communication interface 803).

[0131] It should be noted that, although Figure 8 The illustrated electronic device 800 only shows a memory 801, a processor 802, and a communication interface 803. However, those skilled in the art should understand that in specific implementations, the electronic device 800 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that the electronic device 800 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that the electronic device 800 may only include the devices necessary for implementing the embodiments of this application, and may not necessarily include... Figure 8 All the devices shown.

[0132] This application embodiment also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in the memory through the data interface to implement the method for determining expired device information in the security device registration system.

[0133] Optionally, as one implementation, the chip may further include a memory storing instructions, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the expired device information determination method of the security device registration system.

[0134] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps of any of the above methods.

[0135] This application also provides a computer program product containing instructions. When the computer program product is run on a computer or processor, it causes the computer or processor to perform one or more steps of any of the methods described above.

[0136] Those skilled in the art will appreciate that the functionality described in conjunction with the various illustrative logic blocks, modules, and algorithmic steps disclosed herein can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality described by the various illustrative logic blocks, modules, and steps can be stored or transmitted as one or more instructions or codes on a computer-readable medium and executed by a hardware-based processing unit. The computer-readable medium may comprise a computer-readable storage medium, which corresponds to a tangible medium, such as a data storage medium, or a communication medium that includes any medium facilitating the transfer of a computer program from one place to another (e.g., based on a communication protocol). In this way, the computer-readable medium may substantially correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium, such as a signal or carrier wave. The data storage medium may be any available medium accessible by one or more computers or one or more processors to retrieve instructions, code, and / or data structures for implementing the techniques described in this application. A computer program product may comprise a computer-readable medium.

[0137] By way of example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory, or any other media that can be used to store desired program code in the form of instructions or data structures and is accessible by a computer. Furthermore, any connection is properly referred to as computer-readable media. For example, if instructions are transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of media. However, it should be understood that the computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other temporary media, but are specifically addressed to non-temporary tangible storage media. As used herein, disks and optical discs include compact optical discs (CDs), laser optical discs, optical discs, digital versatile optical discs (DVDs), and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs reproduce data optically using lasers. The combination of the above items should also be included in the scope of computer-readable media.

[0138] Instructions can be executed by one or more processors, such as digital signal processors (DSPs), general-purpose microcontrollers, application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Therefore, the term "processor" as used herein can refer to any of the foregoing structures or any other structures suitable for implementing the techniques described herein. Furthermore, in some aspects, the functionality described in the various illustrative logic blocks, modules, and steps described herein can be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated into combined codecs. Moreover, the techniques can be fully implemented within one or more circuit or logic elements.

[0139] The technology of this application can be implemented in a wide variety of devices or apparatuses, including wireless handheld devices, integrated circuits (ICs), or a set of ICs (e.g., chipsets). The various components, modules, or units described in this application are intended to emphasize functional aspects of the apparatus for performing the disclosed technology, but do not necessarily need to be implemented by different hardware units. In fact, as described above, the various units can be combined with suitable software and / or firmware within coded hardware units, or provided via interoperable hardware units (containing one or more processors as described above).

[0140] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the specific descriptions of the corresponding steps in the foregoing method embodiments, and will not be repeated here.

[0141] It should be understood that in the description of this application, unless otherwise stated, " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B can represent A or B; where A and B can be singular or plural. Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first," "second," etc., are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and the terms "first," "second," etc., do not necessarily imply difference. In this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner to facilitate understanding.

[0142] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the division of units is merely a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The coupling, direct coupling, or communication connection shown or discussed between each other may be indirect coupling or communication connection through some interfaces, apparatuses, or units, and may be electrical, mechanical, or other forms.

[0143] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0144] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid state disks (SSDs).

[0145] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

[0146] The device embodiments described above are merely illustrative. The units and modules described as separate components may or may not be physically separate. Furthermore, some or all of the units and modules can be selected to achieve the purpose of this embodiment, depending on actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0147] The above description is only a specific embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining expired equipment information in a security equipment registration system, characterized in that, The method, applied to a security device registration system, comprising a first security device, a central server, and an edge authentication gateway, includes: The edge authentication gateway sends a first access request from the first security device to the central server. The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger-interactive devices or periodic interactive devices. The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request; If the device trust score is lower than the preset score, the central server generates first expired device information, which includes the first device identifier of the first security device. The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

2. The method according to claim 1, characterized in that, The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request, including: If the first security device type is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; The central server determines the device trust score of the first security device based on the comparison similarity, and the device trust score is positively correlated with the comparison similarity; If the first security device is a periodic interactive security device, the central server determines the standard access frequency of the first security device; The central server determines the access frequency of the first security device based on the first access request. The central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, and the device trust score is inversely correlated with the frequency difference.

3. The method according to claim 1, characterized in that, The method further includes: If the device trust score is not lower than the preset score, the central server generates renewal information and sends the renewal information to the first security device. If the central server does not receive a confirmation renewal information from the first security device in response to the renewal information, the central server generates third expired device information, which includes the first device identifier of the first security device. The central server sends the third expired device information to the edge authentication gateway.

4. The method according to claim 1, characterized in that, Before the edge authentication gateway sends the first access request of the first security device to the central server, the method further includes: The first security device sends a first access request to the edge authentication gateway. The first access request includes a first registration certificate generated by the central server. The first registration certificate includes a first device identifier of the first security device. The edge authentication gateway receives the first access request and performs a first legality verification and validity verification on the first device identifier; The edge authentication gateway determines that the first legitimacy verification of the first device identifier has passed and the validity verification of the first device identifier has passed.

5. The method according to claim 4, characterized in that, The first legality and validity verification of the first device identifier includes: The central server sends registered device information and second expired device information to the edge authentication gateway; The edge authentication gateway receives the registered device information and the second expired device information; The edge authentication gateway decrypts the first registration certificate using the first key to obtain the first device identifier; The edge authentication gateway obtains a list of registered devices based on the registered device information; If the registered device list includes the first device identifier of the first security device, the edge authentication gateway determines that the first legality verification of the first device identifier has passed; The edge authentication gateway obtains the list of expired devices based on the second expired device information; If the first device identifier is not included in the list of expired devices, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

6. The method according to claim 4 or 5, characterized in that, Before the first security device sends the first access request to the edge authentication gateway, the method further includes: The first security device sends a first registration request to the central server, the first registration request including the first device identifier of the first security device; The central server receives the first registration request and generates a first registration certificate based on the first device identifier; The central server sends the first registration certificate to the first security device; The first security device receives the first registration certificate; The central server generates the registered device information, which includes the first device identifier.

7. The method according to claim 6, characterized in that, The step of generating a first registration certificate based on the first device identifier includes: The central server performs a second legality verification based on the first registration request to verify the first device identifier; If the second legitimacy verification of the first device identifier passes, the central server generates the first registration certificate and encrypts the first registration certificate according to the second key, wherein the first key and the second key are a set of public and private keys.

8. A device for determining expired equipment information in a security equipment registration system, characterized in that, A method for determining expired equipment information in a security equipment registration system, the apparatus comprising: The sending unit is used to send a first access request of the first security device to the central server; A receiving unit is configured to receive the first access request and determine the device type of the first security device based on a locally stored list of registered devices, wherein the device type includes a trigger-interactive device or a periodic interactive device. A determining unit is used to determine the device trust score of the first security device based on the device type of the first security device and the first access request; The generation unit is configured to generate first expired device information if the device trust score is lower than a preset score, wherein the first expired device information includes the first device identifier of the first security device. The sending unit is used to send the first expired device information to the edge authentication gateway, wherein the first expired device information is used to indicate the device identifier whose registered identity has expired.

9. An electronic device, characterized in that, The method includes a processor, a memory, a communication interface, and one or more programs, said one or more programs being stored in the memory and configured to be executed by the processor, said programs including instructions for performing the steps of the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program for electronic data interchange, wherein the computer program causes a computer to perform the method as described in any one of claims 1-7.

Images