Security device registration system expired device information determination method and related apparatus

Abstract

The application discloses a kind of security equipment registration system expired equipment information determination method and related device, comprising: edge authentication gateway sends the first access request of first security equipment to central server;Center server receives first access request, and determines the equipment type of first security equipment according to the registration equipment list stored locally, equipment type includes trigger interactive device or periodic interactive device;Center server determines the equipment trust score of first security equipment according to the equipment type of first security equipment and first access request;If equipment trust score is lower than preset score, then center server generates first expired equipment information, and first expired equipment information includes the first equipment identification of first security equipment;Center server sends first expired equipment information to edge authentication gateway, and first expired equipment information is used to indicate the equipment identification of registration identity expiration. By implementing the method in the application, the processing efficiency and security are improved.

Description

Technical Field

[0001] This invention relates to the field of communication-related technologies for security equipment, and in particular to a method and related apparatus for determining expired equipment information in a security equipment registration system. Background Technology

[0002] With the continuous development of the security field, existing security equipment typically needs to communicate with servers via the Internet of Things (IoT) to enable the servers to support various aspects of the security equipment's operation. Current security equipment authentication technologies include centralized certificate management, pre-shared key schemes, and lightweight authentication protocols. These schemes require a central server to centrally process the registration and verification of terminal devices, thus necessitating the storage of large amounts of related data over long periods. This ultimately leads to problems such as insufficient storage resources and low processing efficiency on the relevant servers during network equipment operation. Summary of the Invention

[0003] To address the aforementioned issues, this application provides a method and related apparatus for determining expired equipment information in a security equipment registration system. Adopting the solution of this application helps reduce the false alarm rate of fire alarm systems.

[0004] In a first aspect, embodiments of this application provide a method for determining expired device information in a security device registration system. The security device registration system includes a first security device, a central server, and an edge authentication gateway. The method includes: the edge authentication gateway sending a first access request from the first security device to the central server; the central server receiving the first access request and determining the device type of the first security device based on a locally stored list of registered devices, where the device type includes a trigger-interactive device or a periodic interactive device; the central server determining a device trust score for the first security device based on its device type and the first access request; if the device trust score is lower than a preset score, the central server generating first expired device information, which includes a first device identifier of the first security device; and the central server sending the first expired device information to the edge authentication gateway, whereby the first expired device information indicates a device identifier whose registration identity has expired.

[0005] As can be seen, this embodiment achieves automated expiration judgment based on device behavior analysis by dynamically calculating trust scores by combining device type and access requests. The collaborative mechanism between the edge authentication gateway and the central server reduces the processing pressure on the central server and improves operational efficiency. Furthermore, the central server can effectively identify abnormal devices and update their identity status in a timely manner, enhancing the security of the security device registration system.

[0006] In conjunction with the first aspect, in one possible embodiment, the central server determines the device trust score of the first security device based on the device type of the first security device and the first access request, including: if the first security device type is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device based on the comparison similarity, and the device trust score is positively correlated with the comparison similarity; if the first security device type is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device based on the first access request; the central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, and the device trust score is inversely correlated with the frequency difference.

[0007] As can be seen, this embodiment achieves refined device behavior monitoring by designing differentiated trust assessment algorithms for different device types. For trigger-based devices, the focus is on the compliance of individual requests; for periodic devices, the focus is on the regularity of long-term behavior. This dual assessment mechanism greatly enhances the system's ability to identify abnormal devices, thereby effectively improving the security and reliability of the entire security system.

[0008] In conjunction with the first aspect, in one possible embodiment, the method further includes: if the device trust score is not lower than a preset score, the central server generates renewal information and sends the renewal information to the first security device; if no confirmation renewal information is received from the first security device in response to the renewal information, the central server generates third expired device information, the expired device information including the first device identifier of the first security device; the central server sends the third expired device information to the edge authentication gateway.

[0009] As can be seen, this embodiment establishes an automated renewal mechanism based on device behavior trust scoring, combined with a two-way confirmation process, to achieve intelligent management of the certificate lifecycle, thereby reducing the operation and maintenance costs of the security device registration system, enabling timely identification and handling of abnormal devices, and improving the security of the entire security device registration system.

[0010] In conjunction with the first aspect, in one possible embodiment, before the edge authentication gateway sends the first access request of the first security device to the central server, the method further includes: the first security device sending the first access request to the edge authentication gateway, the first access request including a first registration certificate generated by the central server, the first registration certificate including a first device identifier of the first security device; the edge authentication gateway receiving the first access request and performing a first legality verification and a validity verification on the first device identifier; the edge authentication gateway determining that the first legality verification of the first device identifier is passed and the validity verification of the first device identifier is passed.

[0011] As can be seen, by implementing preliminary certificate verification at the edge authentication gateway in this embodiment, the authentication pressure is effectively diverted, which not only ensures the security of the authentication process, but also significantly improves the overall processing efficiency of the system.

[0012] In conjunction with the first aspect, in one possible embodiment, the first device identifier is subjected to a first legitimacy verification and a first validity verification, including: the central server sending registered device information and second expired device information to the edge authentication gateway; the edge authentication gateway receiving the registered device information and the second expired device information; the edge authentication gateway decrypting the first registration certificate using a first key to obtain the first device identifier; the edge authentication gateway obtaining a list of registered devices based on the registered device information; if the list of registered devices includes the first device identifier of the first security device, the edge authentication gateway determines that the first legitimacy verification of the first device identifier has passed; the edge authentication gateway obtaining a list of expired devices based on the second expired device information; if the list of expired devices does not include the first device identifier, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

[0013] As can be seen, in this embodiment, efficient and reliable device authentication is achieved by synchronizing the status information between the central server and the edge authentication gateway, combined with a localized list query mechanism.

[0014] In conjunction with the first aspect, in one possible embodiment, before the first security device sends the first access request to the edge authentication gateway, the method further includes: the first security device sending a first registration request to a central server, the first registration request including a first device identifier of the first security device; the central server receiving the first registration request and generating a first registration certificate based on the first device identifier; the central server sending the first registration certificate to the first security device; the first security device receiving the first registration certificate; and the central server generating registered device information, the registered device information including the first device identifier.

[0015] As can be seen, by establishing a complete device registration and certificate distribution mechanism in this embodiment, a secure trust foundation is established for the entire security device registration system, thereby providing a data foundation for subsequent device status monitoring and lifecycle management.

[0016] In conjunction with the first aspect, in one possible embodiment, generating a first registration certificate based on a first device identifier includes: a central server performing a second legitimacy verification on the first device identifier based on a first registration request; if the second legitimacy verification of the first device identifier passes, the central server generates a first registration certificate and encrypts the first registration certificate based on a second key, wherein the first key and the second key are a set of public and private keys.

[0017] As can be seen, this embodiment establishes a highly secure device registration process through strict second legitimacy verification and a certificate encryption mechanism based on public-private key cryptography. This design not only ensures that only legitimate devices can obtain valid certificates, but also prevents certificates from being stolen or tampered with during distribution through encrypted transmission, thereby improving the security of the security device registration system.

[0018] Secondly, embodiments of this application provide an apparatus for determining expired device information in a security equipment registration system, used to execute a method for determining expired device information in a security equipment registration system. The apparatus includes: The sending unit is used to send the first access request of the first security device to the central server; The receiving unit is used to receive the first access request and determine the device type of the first security device according to the locally stored list of registered devices. The device type includes a trigger-interactive device or a periodic interactive device. A determination unit is used to determine the device trust score of the first security device based on the device type of the first security device and the first access request; The generation unit is used to generate first expired device information if the device trust score is lower than the preset score. The first expired device information includes the first device identifier of the first security device. The sending unit is used to send first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0019] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, a communication interface, and one or more programs, the one or more programs being stored in the memory and configured to be executed by the processor, and one or more instructions being adapted to be loaded by the processor and to execute part or all of the methods of the first aspect and / or the second aspect.

[0020] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program for electronic data interchange, wherein the computer program causes a computer to perform part or all of the methods of the first aspect and / or the second aspect.

[0021] Fifthly, this application provides a computer program product that, when read and executed by a computer, causes the computer to perform part or all of the methods of the first aspect and / or the second aspect.

[0022] It is understood that the beneficial effects of the embodiments of the second to fifth aspects can be referred to the beneficial effects of the method of the first aspect, and will not be repeated here. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram illustrating an application scenario of a method for determining expired equipment information in a security equipment registration system, as provided in an embodiment of this application. Figure 2 A flowchart illustrating a method for determining expired device information in a security equipment registration system provided in this application embodiment; Figure 3 A flowchart illustrating another method for determining expired device information in a security device registration system provided in this application embodiment; Figure 4 A schematic diagram illustrating the generation and transmission process of a first registration certificate provided in an embodiment of this application; Figure 5 This application provides a schematic diagram of certificate issuance for a security equipment cluster. Figure 6 A flowchart illustrating another method for determining expired device information in a security device registration system provided in this application embodiment; Figure 7 A schematic diagram of the structure of an expired device information determination device for a security equipment registration system provided in this application embodiment; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0026] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0027] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0028] The embodiments of this application will now be described with reference to the accompanying drawings.

[0029] Example 1: Please refer to Figure 1 , Figure 1 This is a schematic diagram of an application scenario for a method for determining expired device information in a security device registration system provided in this application embodiment. The application scenario 100 includes a first security device 101, a central server 102, and an edge authentication gateway 103.

[0030] The first security device 101 is specifically a type of security device (for example) that can communicate with the central server 102 to perform device registration, data upload, and data download, etc.

[0031] The central server 102 is specifically used to accept registration requests from various security devices, store data uploaded by security devices, and provide data to security devices.

[0032] Edge authentication gateway 103 is deployed at the network edge and has local certificate and credential verification capabilities, which can reduce the burden on central server 102.

[0033] In this embodiment, the first security device 101, the central server 102, and the edge authentication gateway 103 belong to the security device registration system. The method for determining expired device information in the security device registration system is applied to the security device registration system, and the method includes: The edge authentication gateway 103 sends the first access request of the first security device 101 to the central server 102.

[0034] Specifically, the first access request here refers to the data upload and download request made by the first security device 101 to the central server 102. The first security device 101 will send the first access request to the edge authentication gateway 103, which will review the first access request of the first security device 101 and forward it to the central server 102 after the review is passed.

[0035] The central server 102 receives the first access request and determines the device type of the first security device 101 based on the locally stored list of registered devices. The device type includes trigger interactive devices or periodic interactive devices.

[0036] Specifically, the central server 102 receives the first access request and determines the device type of the first security device 101 based on the locally stored list of registered devices in order to perform the subsequent device trust scoring process. In addition, the central server 102 will also provide corresponding services to the first security device 101 according to the content of the first access request.

[0037] The central server 102 determines the device trust score of the first security device 101 based on the device type of the first security device 101 and the first access request.

[0038] Specifically, the central server 102 matches different scoring criteria according to the device type of the first security device 101 to determine the device trust score of the first security device 101 for the first access request of the first security device 101.

[0039] The device trust score here represents the degree of trust that the central server 102 has in the first security device 101. The higher the device trust score, the higher the degree of trust that the central server 102 has in the first security device 101, indicating that the operation of the first security device 101 is more in line with the characteristics of a security device.

[0040] The lower the device trust score, the lower the level of trust that the central server 102 has in the first security device 101. This indicates that the operation of the first security device 101 is less consistent with the characteristics of a security device, and the first security device 101 may be a malicious access device disguised as a security device.

[0041] If the device trust score is lower than the preset score, the central server 102 will generate the first expired device information, which includes the first device identifier of the first security device 101.

[0042] Specifically, the first expired device information here is used to indicate that the device identifier of the included security device has expired. The first device identifier here is the unique device identifier of the first security device 101, such as a hardware identifier or certificate serial number.

[0043] The central server 102 sends the first expired device information to the edge authentication gateway 103. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0044] When the edge authentication gateway 103 receives the first expired device information, it will determine that the first security device 101's verification is not approved when it subsequently receives the first security device 101's access request, thereby excluding the security device with higher risk from accessing the center server 102.

[0045] As can be seen, this embodiment achieves automated expiration judgment based on device behavior analysis by dynamically calculating trust scores by combining device type and access requests. The collaborative mechanism between the edge authentication gateway and the central server reduces the processing pressure on the central server and improves operational efficiency. Furthermore, the central server can effectively identify abnormal devices and update their identity status in a timely manner, enhancing the security of the security device registration system.

[0046] Please see Figure 2 , Figure 2 This application provides a flowchart illustrating a method for determining expired device information in a security device registration system, which can be based on... Figure 1 The application scenario 100 shown is implemented as follows: Figure 2 As shown, it includes steps S201-S205.

[0047] S201: The edge authentication gateway sends the first access request of the first security device to the central server.

[0048] S202: The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger interactive devices or periodic interactive devices.

[0049] Specifically, after receiving the first access request, the central server queries the locally stored list of registered devices, which records the identifiers and type information of the registered devices. Device types are divided into trigger-interactive devices and periodic interactive devices. Trigger-interactive devices typically initiate access when a specific event is triggered (such as when a sensor detects an anomaly), while periodic interactive devices access the device periodically at fixed time intervals (such as devices that report data on a regular schedule).

[0050] S203: The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request.

[0051] Specifically, the central server dynamically calculates the device trust score based on the device type and the first access request. For devices that trigger interaction, the central server evaluates the trust score by comparing the timing and content of the access requests with the expected pattern; for periodically interactive devices, the central server evaluates the trust score by assessing the deviation of the access frequency from the standard pattern.

[0052] Optionally, the central server determines the device trust score of the first security device based on the device type of the first security device and the first access request, including: if the first security device type is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device based on the comparison similarity, and the device trust score is positively correlated with the comparison similarity; if the first security device type is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device based on the first access request; the central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, and the device trust score is inversely correlated with the frequency difference.

[0053] Specifically, in this embodiment of the application, the specific implementation method of the central server determining the device trust score based on the device type is described in detail.

[0054] The central server employs differentiated trust assessment strategies for different types of security devices. For interactive security devices (such as intrusion detectors and emergency buttons), their access behavior is typically triggered by specific events. The central server first obtains the device's standard access request. This standard request can be a template of the device's typical access behavior under normal conditions, including but not limited to the timing characteristics of the request, data packet structure, and parameter range.

[0055] The first actual access request is then compared with this standard request across multiple dimensions to calculate the similarity. This comparison process may involve pattern recognition algorithms, such as comparing the reasonableness of the request time and event triggering logic, the completeness of data fields, and their numerical range. The device trust score is positively correlated with the similarity score; that is, the higher the similarity, the higher the trust score, indicating that the device behavior more closely matches the expected pattern.

[0056] For periodically interactive security devices (such as sensors that periodically report their status, periodic inspection devices, etc.), their access behavior exhibits a temporal regularity. The central server determines the standard access frequency based on the device's historical behavior data or preset policies. Simultaneously, it analyzes the first access request and related historical records to determine the device's current access frequency. The device's trust score is determined by calculating the frequency difference (e.g., absolute difference or relative deviation rate) between the current access frequency and the standard access frequency. The device trust score is inversely correlated with the frequency difference; that is, the larger the frequency difference, the lower the trust score. Abnormal frequency changes (such as excessively frequent or prolonged periods of silence) may indicate device malfunction, malicious control, or certificate theft.

[0057] As can be seen, this embodiment achieves refined device behavior monitoring by designing differentiated trust assessment algorithms for different device types. For trigger-based devices, the focus is on the compliance of individual requests; for periodic devices, the focus is on the regularity of long-term behavior. This dual assessment mechanism greatly enhances the system's ability to identify abnormal devices, thereby effectively improving the security and reliability of the entire security system.

[0058] S204: If the device trust score is lower than the preset score, the central server will generate the first expired device information, which includes the first device identifier of the first security device.

[0059] Specifically, if a device's trust score is lower than a preset score (which can be dynamically adjusted according to security policies), it indicates that the device may have abnormal behavior, expired certificates, or potential security risks. The central server will then automatically generate information on the first expired device, which includes a first device identifier (such as a hardware identifier or certificate serial number) to indicate that the device's registration identity has expired.

[0060] S205: The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0061] Finally, the central server sends the first expired device information to the edge authentication gateway, enabling the gateway to update its locally cached blacklist or revocation list in a timely manner, preventing expired devices from continuing to access network resources.

[0062] Example 2: The above-mentioned application embodiment provides a method for determining expired device information in a security device registration system by judging device trust score through a first access request. Based on this, for the preliminary review of the first access request of the first security device, this application embodiment also provides another more detailed method for determining expired device information in a security device registration system.

[0063] Please see Figure 3 , Figure 3This is a flowchart illustrating another method for determining expired device information in a security device registration system provided in this application embodiment. It can be based on... Figure 1 The application scenario 100 shown is implemented as follows: Figure 3 As shown, it includes steps S301-S308.

[0064] S301: The first security device sends a first access request to the edge authentication gateway. The first access request includes a first registration certificate generated by the central server. The first registration certificate includes the first device identifier of the first security device.

[0065] Specifically, when the first security device needs to access network resources, it proactively sends a first access request to the nearest deployed edge authentication gateway. This request contains a first registration certificate pre-issued by the central server, which contains the unique identifier of the first security device – the first device identifier. This first device identifier is an HWID (Hardware Identifier) ​​generated based on the device's hardware characteristics.

[0066] S302: The edge authentication gateway receives the first access request and performs the first legality and validity verification on the first device identifier.

[0067] Specifically, after receiving an access request, the edge authentication gateway does not immediately forward the request to the central server, but first verifies it locally to ensure that the certificate itself is authentic and trustworthy.

[0068] Optionally, the first device identifier is further validated for both legality and validity, including: the central server sending registered device information and second expired device information to the edge authentication gateway; the edge authentication gateway receiving the registered device information and second expired device information; the edge authentication gateway decrypting the first registration certificate using the first key to obtain the first device identifier; the edge authentication gateway obtaining a list of registered devices based on the registered device information; if the list of registered devices includes the first device identifier of the first security device, the edge authentication gateway determines that the first legality verification of the first device identifier has passed; the edge authentication gateway obtaining a list of expired devices based on the second expired device information; if the list of expired devices does not include the first device identifier, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

[0069] Specifically, in the embodiments of this application, the specific implementation process of the edge authentication gateway performing the first legality verification and validity verification is described in detail.

[0070] First, the central server periodically or on demand synchronizes two types of key information with the edge authentication gateway: registered device information and expired device information. The registered device information constitutes a whitelist of legitimate devices, while the expired device information constitutes an incremental certificate revocation list, containing identifiers of devices deemed expired by the central server. This information synchronization mechanism ensures that the edge gateway can obtain the latest device status while avoiding the need to query the central server for each verification.

[0071] When the edge authentication gateway needs to verify the first registration certificate, it first uses the first key to decrypt the certificate and extract the plaintext first device identifier.

[0072] Subsequently, the edge authentication gateway performs two levels of verification: the first, legitimacy verification, checks the list of registered devices to confirm whether the device identifier is within the system's recognized range of legitimate devices; this is equivalent to verifying whether the device is "qualified" to access the system. The second, validity verification, checks the list of expired devices to confirm whether the device identifier has not been revoked or marked as expired; this is equivalent to verifying whether the device's current "status" is normal. Only when the device is both on the legitimate list and not on the expired list is the verification considered successful.

[0073] As can be seen, in this embodiment, efficient and reliable device authentication is achieved by synchronizing the status information between the central server and the edge authentication gateway, combined with a localized list query mechanism.

[0074] S303: The edge authentication gateway determines that the first legality verification of the first device identifier has passed and the validity verification of the first device identifier has passed.

[0075] As can be seen, by implementing preliminary certificate verification at the edge authentication gateway in this embodiment, the authentication pressure is effectively diverted, which not only ensures the security of the authentication process, but also significantly improves the overall processing efficiency of the system.

[0076] S304: The edge authentication gateway sends the first access request of the first security device to the central server.

[0077] S305: The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger interactive devices or periodic interactive devices.

[0078] S306: The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request.

[0079] S307: If the device trust score is lower than the preset score, the central server will generate the first expired device information, which includes the first device identifier of the first security device.

[0080] S308: The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0081] For detailed explanations of steps S304-S308, please refer to the descriptions and related content of steps S201-S205 in the above application embodiments, which will not be repeated here.

[0082] Optionally, before the first security device sends the first access request to the edge authentication gateway, the method further includes: the first security device sending a first registration request to the central server, the first registration request including a first device identifier of the first security device; the central server receiving the first registration request and generating a first registration certificate based on the first device identifier; the central server sending the first registration certificate to the first security device; the first security device receiving the first registration certificate; and the central server generating registered device information, the registered device information including the first device identifier.

[0083] Specifically, in this embodiment of the application, the initial registration process of the first security device in the system is described in detail.

[0084] First, when the first security device is deployed for the first time or needs to be re-authenticated, it will proactively send a first registration request to the central server.

[0085] After receiving a registration request, the central server executes a device identity verification process and generates a first registration certificate (e.g., an X.509 digital certificate) based on the verification result. Once generated, the central server distributes the certificate to the first security device. The device receives and securely stores this certificate as a credential for subsequent identity authentication.

[0086] At the same time, the central server updates the registered device information in the system and adds the first device identifier to the list of legitimate devices. This information will be used for the subsequent legitimacy verification of the edge authentication gateway, as described in the verification process in the previous embodiments.

[0087] For example, please see Figure 4 , Figure 4 This is a schematic diagram illustrating the generation and transmission process of a first registration certificate provided in an embodiment of this application. The central server can issue a first registration certificate to the first security device after the first security device has registered. It should be noted that the first registration certificate is encrypted with a key, which includes the first device identifier of the first security device.

[0088] The first security device forwards its first registration certificate to the edge authentication gateway. The edge authentication gateway decrypts the first registration certificate to obtain the first device identifier of the first security device. Simultaneously, the edge authentication gateway receives encrypted registered device information from the central server and decrypts it to obtain the list of registered devices. Therefore, it can be seen that the first device identifier of the first security device is encrypted throughout the transmission process and decrypted only locally at the edge authentication gateway, thus ensuring the security of the security device registration system.

[0089] As can be seen, by establishing a complete device registration and certificate distribution mechanism in this embodiment, a secure trust foundation is established for the entire security device registration system, thereby providing a data foundation for subsequent device status monitoring and lifecycle management.

[0090] Optionally, generating a first registration certificate based on a first device identifier includes: the central server verifying the first device identifier according to the first registration request and performing a second legality verification; if the second legality verification of the first device identifier passes, the central server generates a first registration certificate and encrypts the first registration certificate according to a second key, wherein the first key and the second key are a set of public and private keys.

[0091] Specifically, in this embodiment, the central server does not need to perform a second legitimacy verification on the first device identifier in the first registration request after receiving it. This verification differs from the first legitimacy verification performed by the edge authentication gateway; it is a deeper verification performed at the highest trust level of the system. The verification content includes, but is not limited to: checking whether the format of the first device identifier conforms to the specifications; verifying whether the identifier is within the range of device types allowed for registration by the system; confirming that the identifier has not been registered repeatedly by other devices; and verifying the authenticity and validity of the first device identifier to prevent counterfeit device registration.

[0092] Only after the second legitimacy verification passes will the central server proceed to the certificate generation stage. During certificate generation, the central server cryptographically binds the first device identifier to the certificate, for example, by writing the hash value of the HWID into the certificate's extended field or using it as a signature salt in the certificate generation process, thereby achieving cryptographic-level hardware binding. The first key held by the edge authentication gateway (as the private key) is used for subsequent certificate decryption and verification. This public-private key mechanism forms the foundation of the PKI system.

[0093] As can be seen, this embodiment establishes a highly secure device registration process through strict second legitimacy verification and a certificate encryption mechanism based on public-private key cryptography. This design not only ensures that only legitimate devices can obtain valid certificates, but also prevents certificates from being stolen or tampered with during distribution through encrypted transmission, thereby improving the security of the security device registration system.

[0094] Optionally, the security device registration system also includes a second security device, which belongs to the same security device cluster as the first security device. The method further includes: a central server sending authorization information to the first security device based on a first registration request sent by the first security device, the authorization information indicating that the first security device is the central security device in the security device cluster; the first security device receiving the authorization information and obtaining a second device identifier for the second security device based on the authorization information; the first security device encrypting the first registration certificate based on the second device identifier to obtain a second registration certificate and sending the second registration certificate to the second security device; the second security device receiving the second registration certificate and decrypting the second registration certificate based on the second device identifier to obtain the first registration certificate; the second security device sending a second access request to an edge authentication gateway, the second access request including the first registration certificate; the edge authentication gateway receiving the second access request and performing a third legality verification and validity verification on the first device identifier; if the third legality verification and validity verification pass, the edge authentication gateway sends access authorization information to the first security device.

[0095] In this embodiment of the application, the first security device belongs to a security device cluster, which also includes a second security device. Furthermore, the security device cluster also includes more other security devices. The second security device specifically refers to any other security device in the security device cluster other than the first security device.

[0096] A security equipment cluster specifically refers to a group of security devices with the same function and type, such as multiple sensors and cameras with the same function and type deployed in the same location.

[0097] After completing the registration of the first security device, the central server grants it special permissions as the cluster central node. This authorization allows the first security device to obtain the device identifiers of other devices within the cluster (such as the second security device).

[0098] Furthermore, the primary security device here can obtain the device identifiers of other devices within the cluster via a local network connection.

[0099] The first security device then uses the second device identifier as a key to encrypt its own first registration certificate, generating a second registration certificate. This encryption process essentially creates a trust transfer mechanism between devices, and the second registration certificate can be regarded as a derived credential "issued" by the first security device for the second security device.

[0100] After obtaining the second registration certificate, the second security device uses its own second device identifier to decrypt and restore the first registration certificate. This encryption and decryption process ensures that only devices with the correct device identifier can successfully obtain the original certificate, achieving a high degree of binding between the certificate and the device hardware. When the second security device initiates an access request to the edge authentication gateway, it submits the first registration certificate instead of its own certificate, indicating its identity as a cluster member.

[0101] When the edge authentication gateway performs third-party legitimacy and validity verification, it verifies the first device identifier, not the second device identifier. The first registration certificate acts as a group certificate, while the second device identifier, combined with the encryption operation, constitutes a lightweight device credential.

[0102] For example, please see Figure 5 , Figure 5 This is a schematic diagram of certificate issuance for a security device cluster provided in an embodiment of this application. It includes a first security device and other security devices (the second security device is any one of the other security devices). It can be seen that the central server issues a first registration certificate to the first security device, and the first security device then generates a second registration certificate based on the first registration certificate and distributes it to the other security devices.

[0103] As can be seen, this embodiment achieves efficient intra-group device authentication by establishing a certificate distribution and trust transfer mechanism between devices. This design greatly reduces the certificate issuance burden on the central server; a single cluster only requires the central server to issue a certificate once to support the authentication needs of multiple devices. Simultaneously, by using device identifiers in the encryption / decryption process, the security characteristics of hardware binding are maintained, achieving an optimal balance between scalability and security.

[0104] Example 3: The above-described embodiments primarily depict a control method for an indoor fire alarm system based on sound data to determine the presence of a fire threat in a first area. Based on this, when a fire threat is determined to exist in the first area, this embodiment also provides another, more detailed method for determining the fire threat. Please refer to... Figure 6 , Figure 6 This is a flowchart illustrating another method for determining expired device information in a security device registration system provided in this application embodiment. It can be based on... Figure 1 The application scenario 100 shown is implemented as follows: Figure 6 As shown, it includes steps S601-S608.

[0105] S601: The edge authentication gateway sends the first access request of the first security device to the central server; S602: The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger interactive devices or periodic interactive devices. S603: The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request; S604: If the device trust score is lower than the preset score, the central server will generate the first expired device information, which includes the first device identifier of the first security device. S605: The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0106] For a detailed explanation of steps S601-S605, please refer to the description and related content of steps S201-S205 in the above application embodiments, which will not be repeated here.

[0107] S606: If the device trust score is not lower than the preset score, the central server will generate renewal information and send the renewal information to the first security device.

[0108] Specifically, the central server calculates a device trust score through device behavior analysis. When the central server determines that the score is not lower than a preset score, it indicates that the device has behaved normally during the observation period and meets the renewal conditions. At this time, the central server will automatically generate renewal information and send this information to the first security device.

[0109] After receiving the renewal request, the first security device needs to return a confirmation message within a specified time to confirm that it is in normal working order and accepts the renewal. This two-way confirmation mechanism ensures the verification of device activity and prevents unnecessary renewal operations on malfunctioning or offline devices.

[0110] S607: If the central server does not receive a confirmation renewal message from the first security device in response to the renewal message, the central server will generate third expired device information, which includes the first device identifier of the first security device.

[0111] Specifically, if the central server does not receive confirmation from the first security device within a preset time, it may indicate that the device has a communication failure, has been removed, or is in an abnormal state. In this case, the central server will generate information on the third expired device and add the identifier of the first device to the expired list.

[0112] S608: The central server sends information about the third expired device to the edge authentication gateway.

[0113] Specifically, the central server synchronizes this information with the edge authentication gateway to ensure that the edge side can update its local cache in a timely manner and block subsequent access requests from the device.

[0114] Furthermore, if the central server still does not receive a new registration request or access request from the first security device within the second preset time, the central server can determine that the first security device is closed, and at this time, the data and information related to the first security device can be deleted.

[0115] As can be seen, this embodiment establishes an automated renewal mechanism based on device behavior trust scoring, combined with a two-way confirmation process, to achieve intelligent management of the certificate lifecycle, thereby reducing the operation and maintenance costs of the security device registration system, enabling timely identification and handling of abnormal devices, and improving the security of the entire security device registration system.

[0116] As can be seen from the methods described in the above embodiments, by calculating trust scores, automated expiration judgment based on device behavior analysis is achieved, reducing the processing pressure on the central server, improving operational efficiency, and enhancing the security of the security device registration system. Establishing an automated renewal mechanism based on device behavior trust scores reduces the operational costs of the security device registration system. Implementing preliminary certificate verification at the edge authentication gateway further ensures the security of the authentication process and improves the overall processing efficiency of the system. Establishing a complete device registration and certificate distribution mechanism establishes a secure trust foundation for the entire security device registration system, thereby providing a data foundation for subsequent device status monitoring and lifecycle management. Strict secondary legitimacy verification and a certificate encryption mechanism based on public-private key cryptography further enhance the security of the security device registration system.

[0117] Based on the description of the above configuration method embodiments, this application also provides an expired device information determination device 700 for a security device registration system. This expired device information determination device 700 for a security device registration system can operate in... Figure 1 A computer program (including program code) is shown in the first security device 101, the central server 102, or the edge authentication gateway 103, and is used to execute... Figure 2 , Figure 3 and Figure 6 The method shown. See also Figure 7 , Figure 7 This application provides a schematic diagram of the structure of an expired device information determination device for a security equipment registration system. The expired device information determination device 700 for the security equipment registration system includes: The sending unit 701 is used to send the first access request of the first security device to the central server; The receiving unit 702 is used to receive the first access request and determine the device type of the first security device according to the locally stored list of registered devices. The device type includes a trigger-interactive device or a periodic interactive device. The determination unit 703 is used to determine the device trust score of the first security device based on the device type of the first security device and the first access request; The generation unit 704 is used to generate first expired device information if the device trust score is lower than a preset score. The first expired device information includes the first device identifier of the first security device. The sending unit 701 is used to send first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

[0118] In one possible embodiment, in determining the device trust score of the first security device based on the device type and the first access request, the determining unit 703 is further specifically configured to: if the first security device type is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device based on the comparison similarity, wherein the device trust score is positively correlated with the comparison similarity; if the first security device type is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device based on the first access request; the central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, wherein the device trust score is inversely correlated with the frequency difference.

[0119] In one possible embodiment, the sending unit 701 is further configured to: if the device trust score is not lower than a preset score, the central server generates renewal information and sends the renewal information to the first security device; if it does not receive a confirmation renewal information from the first security device in response to the renewal information, the central server generates third expired device information, the expired device information including the first device identifier of the first security device; and the central server sends the third expired device information to the edge authentication gateway.

[0120] In one possible embodiment, before the edge authentication gateway sends the first access request of the first security device to the central server, the sending unit 701 is further specifically configured to: send the first access request to the edge authentication gateway, the first access request including a first registration certificate generated by the central server, the first registration certificate including a first device identifier of the first security device; the edge authentication gateway receives the first access request and performs a first legality verification and a validity verification on the first device identifier; the edge authentication gateway determines that the first legality verification of the first device identifier is passed and the validity verification of the first device identifier is passed.

[0121] In one possible embodiment, in performing the first legitimacy verification and validity verification on the first device identifier, the determining unit 703 is further specifically configured to: send registered device information and second expired device information to the edge authentication gateway; the edge authentication gateway receives the registered device information and the second expired device information; the edge authentication gateway decrypts the first registration certificate according to the first key to obtain the first device identifier; the edge authentication gateway obtains a list of registered devices according to the registered device information; if the list of registered devices includes the first device identifier of the first security device, the edge authentication gateway determines that the first legitimacy verification of the first device identifier has passed; the edge authentication gateway obtains a list of expired devices according to the second expired device information; if the list of expired devices does not include the first device identifier, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

[0122] In one possible embodiment, before the first security device sends the first access request to the edge authentication gateway, the sending unit 701 is further configured to: send a first registration request to the central server, the first registration request including a first device identifier of the first security device; the central server receives the first registration request and generates a first registration certificate based on the first device identifier; the central server sends the first registration certificate to the first security device; the first security device receives the first registration certificate; and the central server generates registered device information, which includes the first device identifier.

[0123] In one possible embodiment, in generating the first registration certificate based on the first device identifier, the generating unit 704 is further specifically configured to: the central server verify the first device identifier according to the first registration request and perform a second legality verification; if the second legality verification of the first device identifier passes, the central server generates the first registration certificate and encrypts the first registration certificate according to the second key, wherein the first key and the second key are a set of public and private keys.

[0124] Based on the description of the above method and device embodiments, please refer to... Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 The electronic device 800 shown (specifically, the electronic device 800 may be a computer device, Figure 1 The first security device 101, central server 102, or edge authentication gateway 103 shown includes a memory 801, a processor 802, a communication interface 803, and a bus 804. The memory 801, processor 802, and communication interface 803 are interconnected via the bus 804.

[0125] The memory 801 may be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM).

[0126] The memory 801 can store programs. When the program code stored in the memory 801 is executed by the processor 802, the processor 802 and the communication interface 803 are used to execute the various steps of the expired device information determination method of the security device registration system of this application embodiment.

[0127] The processor 802 may be a general-purpose central processing unit (CPU), microcontroller, application specific integrated circuit (ASIC), graphics processing unit (GPU), or one or more integrated circuits, used to execute relevant programs to achieve the functions required by the units in the electronic device 800 of this application embodiment, or to execute the expired device information determination method of the security device registration system of this application method embodiment.

[0128] The processor 802 can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of the expired device information determination method of the security equipment registration system of this application can be completed by the integrated logic circuits in the hardware of the processor 802 or by instructions in software form. The aforementioned processor 802 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microcontroller or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory 801. The processor 802 reads the information in the memory 801 and, in conjunction with its hardware, performs the functions required by the units included in the electronic device 800 of this application embodiment, or performs the expired device information determination method of the security device registration system of this application method embodiment.

[0129] The communication interface 803 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between the electronic device 800 and other devices or communication networks. For example, data can be acquired through the communication interface 803.

[0130] Bus 804 may include a pathway for transmitting information between various components of electronic device 800 (e.g., memory 801, processor 802, communication interface 803).

[0131] It should be noted that, although Figure 8 The illustrated electronic device 800 only shows a memory 801, a processor 802, and a communication interface 803. However, those skilled in the art should understand that in specific implementations, the electronic device 800 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that the electronic device 800 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that the electronic device 800 may only include the devices necessary for implementing the embodiments of this application, and may not necessarily include... Figure 8 All the devices shown.

[0132] This application embodiment also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in the memory through the data interface to implement the method for determining expired device information in the security device registration system.

[0133] Optionally, as one implementation, the chip may further include a memory storing instructions, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the expired device information determination method of the security device registration system.

[0134] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps of any of the above methods.

[0135] This application also provides a computer program product containing instructions. When the computer program product is run on a computer or processor, it causes the computer or processor to perform one or more steps of any of the methods described above.

[0136] Those skilled in the art will appreciate that the functionality described in conjunction with the various illustrative logic blocks, modules, and algorithmic steps disclosed herein can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality described by the various illustrative logic blocks, modules, and steps can be stored or transmitted as one or more instructions or codes on a computer-readable medium and executed by a hardware-based processing unit. The computer-readable medium may comprise a computer-readable storage medium, which corresponds to a tangible medium, such as a data storage medium, or a communication medium that includes any medium facilitating the transfer of a computer program from one place to another (e.g., based on a communication protocol). In this way, the computer-readable medium may substantially correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium, such as a signal or carrier wave. The data storage medium may be any available medium accessible by one or more computers or one or more processors to retrieve instructions, code, and / or data structures for implementing the techniques described in this application. A computer program product may comprise a computer-readable medium.

[0137] By way of example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory, or any other media that can be used to store desired program code in the form of instructions or data structures and is accessible by a computer. Furthermore, any connection is properly referred to as computer-readable media. For example, if instructions are transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of media. However, it should be understood that the computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other temporary media, but are specifically addressed to non-temporary tangible storage media. As used herein, disks and optical discs include compact optical discs (CDs), laser optical discs, optical discs, digital versatile optical discs (DVDs), and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs reproduce data optically using lasers. The combination of the above items should also be included in the scope of computer-readable media.

[0138] Instructions can be executed by one or more processors, such as digital signal processors (DSPs), general-purpose microcontrollers, application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Therefore, the term "processor" as used herein can refer to any of the foregoing structures or any other structures suitable for implementing the techniques described herein. Furthermore, in some aspects, the functionality described in the various illustrative logic blocks, modules, and steps described herein can be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated into combined codecs. Moreover, the techniques can be fully implemented within one or more circuit or logic elements.

[0139] The technology of this application can be implemented in a wide variety of devices or apparatuses, including wireless handheld devices, integrated circuits (ICs), or a set of ICs (e.g., chipsets). The various components, modules, or units described in this application are intended to emphasize functional aspects of the apparatus for performing the disclosed technology, but do not necessarily need to be implemented by different hardware units. In fact, as described above, the various units can be combined with suitable software and / or firmware within coded hardware units, or provided via interoperable hardware units (containing one or more processors as described above).

[0140] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the specific descriptions of the corresponding steps in the foregoing method embodiments, and will not be repeated here.

[0141] It should be understood that in the description of this application, unless otherwise stated, " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B can represent A or B; where A and B can be singular or plural. Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first," "second," etc., are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and the terms "first," "second," etc., do not necessarily imply difference. In this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner to facilitate understanding.

[0142] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the division of units is merely a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The coupling, direct coupling, or communication connection shown or discussed between each other may be indirect coupling or communication connection through some interfaces, apparatuses, or units, and may be electrical, mechanical, or other forms.

[0143] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0144] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid state disks (SSDs).

[0145] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

[0146] The device embodiments described above are merely illustrative. The units and modules described as separate components may or may not be physically separate. Furthermore, some or all of the units and modules can be selected to achieve the purpose of this embodiment, depending on actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0147] The above description is only a specific embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining expired equipment information in a security equipment registration system, characterized in that, The method, applied to a security device registration system, comprising a first security device, a central server, and an edge authentication gateway, includes: The edge authentication gateway sends a first access request from the first security device to the central server. The central server receives the first access request and determines the device type of the first security device based on the locally stored list of registered devices. The device type includes trigger-interactive devices or periodic interactive devices. The central server determines the device trust score of the first security device based on the device type of the first security device and the first access request. Specifically, this includes: if the first security device is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device based on the comparison similarity, and the device trust score is positively correlated with the comparison similarity; if the first security device is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device based on the first access request; the central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, and the device trust score is inversely correlated with the frequency difference. If the device trust score is lower than the preset score, the central server generates first expired device information, which includes the first device identifier of the first security device. The central server sends the first expired device information to the edge authentication gateway. The first expired device information is used to indicate the device identifier whose registered identity has expired.

2. The method according to claim 1, characterized in that, The method further includes: If the device trust score is not lower than the preset score, the central server generates renewal information and sends the renewal information to the first security device. If the central server does not receive a confirmation renewal information from the first security device in response to the renewal information, the central server generates third expired device information, which includes the first device identifier of the first security device. The central server sends the third expired device information to the edge authentication gateway.

3. The method according to claim 1, characterized in that, Before the edge authentication gateway sends the first access request of the first security device to the central server, the method further includes: The first security device sends a first access request to the edge authentication gateway. The first access request includes a first registration certificate generated by the central server. The first registration certificate includes a first device identifier of the first security device. The edge authentication gateway receives the first access request and performs a first legality verification and validity verification on the first device identifier; The edge authentication gateway determines that the first legitimacy verification of the first device identifier has passed and the validity verification of the first device identifier has passed.

4. The method according to claim 3, characterized in that, The first legality and validity verification of the first device identifier includes: The central server sends registered device information and second expired device information to the edge authentication gateway; The edge authentication gateway receives the registered device information and the second expired device information; The edge authentication gateway decrypts the first registration certificate using the first key to obtain the first device identifier; The edge authentication gateway obtains a list of registered devices based on the registered device information; If the registered device list includes the first device identifier of the first security device, the edge authentication gateway determines that the first legality verification of the first device identifier has passed; The edge authentication gateway obtains the list of expired devices based on the second expired device information; If the first device identifier is not included in the list of expired devices, the edge authentication gateway determines that the validity verification of the first device identifier has passed.

5. The method according to claim 4, characterized in that, Before the first security device sends the first access request to the edge authentication gateway, the method further includes: The first security device sends a first registration request to the central server, the first registration request including the first device identifier of the first security device; The central server receives the first registration request and generates a first registration certificate based on the first device identifier; The central server sends the first registration certificate to the first security device; The first security device receives the first registration certificate; The central server generates the registered device information, which includes the first device identifier.

6. The method according to claim 5, characterized in that, The step of generating a first registration certificate based on the first device identifier includes: The central server performs a second legality verification based on the first registration request to verify the first device identifier; If the second legitimacy verification of the first device identifier passes, the central server generates the first registration certificate and encrypts the first registration certificate according to the second key, wherein the first key and the second key are a set of public and private keys.

7. A device for determining expired equipment information in a security equipment registration system, characterized in that, For performing the method as described in any one of claims 1-6, the security device registration system includes a first security device, a central server, and an edge authentication gateway, the apparatus comprising: The sending unit is used to send a first access request of the first security device to the central server; A receiving unit is configured to receive the first access request and determine the device type of the first security device based on a locally stored list of registered devices, wherein the device type includes a trigger-interactive device or a periodic interactive device. A determining unit, used to determine the device trust score of the first security device based on the device type of the first security device and the first access request, specifically includes: if the first security device type is a trigger-interactive security device, the central server obtains the standard access request of the first security device and compares the first access request with the standard access request to obtain the comparison similarity of the first security device; the central server determines the device trust score of the first security device based on the comparison similarity, and the device trust score is positively correlated with the comparison similarity; if the first security device type is a periodic interactive security device, the central server determines the standard access frequency of the first security device; the central server determines the access frequency of the first security device based on the first access request; the central server determines the device trust score of the first security device based on the frequency difference between the access frequency of the first security device and the standard access frequency, and the device trust score is inversely correlated with the frequency difference; The generation unit is configured to generate first expired device information if the device trust score is lower than a preset score, wherein the first expired device information includes the first device identifier of the first security device. The sending unit is used to send the first expired device information to the edge authentication gateway, wherein the first expired device information is used to indicate the device identifier whose registered identity has expired.

8. An electronic device, characterized in that, The method includes a processor, a memory, a communication interface, and one or more programs, said programs being stored in the memory and configured to be executed by the processor, said programs including instructions for performing the steps of the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program for electronic data interchange, wherein the computer program causes a computer to perform the method as described in any one of claims 1-6.

Images