Edge gateway, registration method thereof, APP management method and power Internet of Things system
By generating a registration code that combines a machine code and a unique code for edge gateway authentication and authorization, the security issues in the edge gateway registration phase are resolved, enabling the system to operate securely and reliably and be intelligently managed.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XJ ELECTRIC CO LTD
- Filing Date
- 2025-12-09
- Publication Date
- 2026-04-17
AI Technical Summary
In existing technologies, edge gateways lack verification and auditing during the registration phase, resulting in poor system security, inability to accurately identify illegal apps, and threats to system security and stability.
By generating a registration code that combines a machine code and a unique code, layer-by-layer identity verification and security policy auditing are performed to ensure the legitimacy of the registration tools and devices of the edge gateway. The SM2 algorithm is used for authorization authentication, and apps that fail to pass authentication are forcibly exited.
This enhances system security, prevents unauthorized devices from accessing the system, avoids malware intrusion, and improves system security, stability, and operational efficiency.
Smart Images
Figure CN121887443A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of power Internet of Things (IoT) technology, specifically relating to an edge gateway and its registration method, an APP management method, and a power IoT system. Background Technology
[0002] With the widespread penetration and deepening application of IoT technology in power systems, system architectures are becoming increasingly complex, placing more stringent demands on the collaborative work between edge gateways and edge clusters. Innovative technical solutions are urgently needed to ensure the safe and reliable operation of edge gateways, improve the access rate of the main station, and optimize operational efficiency and service levels. Currently, power dispatching main stations / edge clusters and edge gateways strive to achieve plug-and-play functionality, while ensuring that all running apps can flexibly complete operations such as installation, uninstallation, enabling, starting, and stopping. This undoubtedly poses a significant challenge to the app operation enabling mechanism. Traditional edge gateway registration methods and app operation management mechanisms have many limitations. For example, during the device registration phase, the lack of strict identity verification and security policy review processes makes it difficult to prevent malicious access by unauthorized devices; for app management, it is impossible to accurately identify unauthorized apps, leading to potential malware intrusion into the system, seriously threatening system security and stability, and also significantly increasing operation and maintenance costs and management difficulty. Summary of the Invention
[0003] The purpose of this invention is to provide an edge gateway registration method and a power Internet of Things (IoT) system to solve the technical problem of poor system security caused by the lack of verification and auditing during the registration stage of edge gateways in the prior art. Another purpose of this invention is to provide an edge gateway and its APP management method to solve the technical problem of poor system security caused by the inability of edge gateways to accurately identify illegal APPs in the prior art.
[0004] To solve the above-mentioned technical problems, the present invention provides a technical solution for an edge gateway registration method, which includes: an edge gateway registration method comprising: S1. Obtain a pre-generated machine code, encrypt the machine code to generate a machine code file, and write the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number. S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
[0005] The beneficial effects of the above technical solution are as follows: This invention provides a secure and efficient edge gateway registration method. It generates a registration code by combining a machine code and a unique code containing information about the edge gateway device itself. This method performs rigorous identity verification and security policy review processes on both the registration tool itself and the layered edge gateways, greatly enhancing the ability to resist malicious access from unauthorized devices and improving system security. This invention solves the technical problem in existing technologies where the lack of verification and review during the edge gateway registration phase leads to poor system security.
[0006] Furthermore, in S1, the process of encrypting the machine code to generate a machine code file includes: encrypting the machine code and its check value together to generate a machine code file.
[0007] Furthermore, the hardware information includes the CPU serial number, hard drive serial number, and BIOS serial number.
[0008] Furthermore, the process of generating a unique code in S2 based on the hardware information of the edge gateway to be registered and the verification value of the machine code includes: combining the CPU serial number, hard disk serial number, BIOS serial number of the edge gateway to be registered with the verification value of the machine code to form a unique code.
[0009] Furthermore, the production information of the edge gateway includes one, two, or a combination of three of the following: product model, production batch information, customer ID, and description information.
[0010] Furthermore, in S3, the obtained machine code and unique code are determined to match in the following way: a first check value is obtained from the obtained unique code to generate the machine code; a second check value is obtained by calculating the check value from the obtained machine code; if the first check value and the second check value are the same, the obtained machine code and unique code are considered to match.
[0011] The present invention also provides a technical solution for an edge gateway APP management method: an edge gateway APP management method, the method comprising: after the edge gateway is started, first verifying whether the edge gateway is registered; if the edge gateway is registered, then authorizing and authenticating all APPs of the edge gateway according to the unique code and machine code in the registration process, and enabling the APPs that have passed the authorization and authentication. The registration process includes: S1, obtaining a pre-generated machine code, encrypting the machine code to generate a machine code file, and writing the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number; S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
[0012] The beneficial effects of the above technical solution are as follows: This invention proposes an innovative method for APP authorization management in IoT edge gateways. By constructing a secure and efficient registration mechanism and authorization authentication system, it achieves secure and reliable operation and intelligent management of the edge gateway. When the edge gateway starts up, it performs authorization authentication on all APPs, greatly preventing the operation of unauthorized APPs and preventing malicious software from invading the system, thus enhancing the system's security and stability. This invention solves the technical problem of edge gateways being unable to accurately identify unauthorized APPs, leading to poor system security.
[0013] Furthermore, the SM2 algorithm is used for authorization and authentication.
[0014] Furthermore, apps that have not passed authorization and authentication will be forced to exit.
[0015] Furthermore, if the edge gateway is not registered, all running apps on that edge gateway will be forcibly exited.
[0016] The present invention also provides a technical solution for an edge gateway: an edge gateway, including a processor, the processor being used to execute the following steps of the edge gateway APP management method described in the computer program: after the edge gateway is started, it first verifies whether the edge gateway is registered; if the edge gateway is registered, it then authorizes and authenticates all APPs of the edge gateway according to the unique code and machine code during the registration process, and enables the APPs that have passed the authorization and authentication. The registration process includes: S1, obtaining a pre-generated machine code, encrypting the machine code to generate a machine code file, and writing the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number; S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
[0017] The beneficial effects of the above technical solution are as follows: This invention proposes an innovative method for APP authorization management in IoT edge gateways. By constructing a secure and efficient registration mechanism and authorization authentication system, it achieves secure and reliable operation and intelligent management of the edge gateway. When the edge gateway starts up, it performs authorization authentication on all APPs, greatly preventing the operation of unauthorized APPs and preventing malicious software from invading the system, thus enhancing the system's security and stability. This invention solves the technical problem of edge gateways being unable to accurately identify unauthorized APPs, leading to poor system security.
[0018] Furthermore, the SM2 algorithm is used for authorization and authentication.
[0019] Furthermore, apps that have not passed authorization and authentication will be forced to exit.
[0020] Furthermore, if the edge gateway is not registered, all running apps on that edge gateway will be forcibly exited.
[0021] This invention also provides a technical solution for a power Internet of Things (IoT) system: a power IoT system, comprising an edge cluster and an edge gateway, wherein the edge cluster includes a processor, the processor being used to execute a computer program to implement the steps of the edge gateway registration method described below: S1. Obtain a pre-generated machine code, encrypt the machine code to generate a machine code file, and write the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number. S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
[0022] The beneficial effects of the above technical solution are as follows: This invention provides a secure and efficient edge gateway registration method. It generates a registration code by combining a machine code and a unique code containing information about the edge gateway device itself. This method performs rigorous identity verification and security policy review processes on both the registration tool itself and the layered edge gateways, greatly enhancing the ability to resist malicious access from unauthorized devices and improving system security. This invention solves the technical problem in existing technologies where the lack of verification and review during the edge gateway registration phase leads to poor system security.
[0023] Furthermore, in S1, the process of encrypting the machine code to generate a machine code file includes: encrypting the machine code and its check value together to generate a machine code file.
[0024] Furthermore, the hardware information includes the CPU serial number, hard drive serial number, and BIOS serial number.
[0025] Furthermore, the process of generating a unique code in S2 based on the hardware information of the edge gateway to be registered and the verification value of the machine code includes: combining the CPU serial number, hard disk serial number, BIOS serial number of the edge gateway to be registered with the verification value of the machine code to form a unique code.
[0026] Furthermore, the production information of the edge gateway includes one, two, or a combination of three of the following: product model, production batch information, customer ID, and description information.
[0027] Furthermore, in S3, the obtained machine code and unique code are determined to match in the following way: a first check value is obtained from the obtained unique code to generate the machine code; a second check value is obtained by calculating the check value from the obtained machine code; if the first check value and the second check value are the same, the obtained machine code and unique code are considered to match. Attached Figure Description
[0028] Figure 1 This is a schematic diagram illustrating the generation of the machine code database in an embodiment of the power Internet of Things system of the present invention; Figure 2 This is a flowchart of the registration method for an embodiment of the power Internet of Things system of the present invention; Figure 3 This is a flowchart illustrating the APP authentication process in an embodiment of the power Internet of Things system of the present invention. Figure 4This is a schematic diagram of the edge gateway basic APP for an implementation of the power Internet of Things system of the present invention. Detailed Implementation
[0029] This invention provides a secure and efficient edge gateway registration method. A registration code is generated using a machine code and a unique code containing information about the edge gateway device itself. A rigorous identity verification and security policy review process is implemented for both the registration tool and the layered edge gateways, significantly enhancing the ability to resist malicious access by unauthorized devices and improving system security. This invention solves the technical problem of poor system security caused by the lack of verification and review during the registration phase of existing edge gateways. This invention also proposes an innovative IoT edge gateway APP authorization management method. By constructing a secure and efficient registration mechanism and authorization authentication system, it achieves secure and reliable operation and intelligent management of the edge gateway. When the edge gateway starts up, it authorizes and authenticates all APPs, greatly preventing the operation of unauthorized APPs and preventing malicious software intrusion into the system, thus enhancing system security and stability. This invention also solves the technical problem of poor system security caused by the edge gateway's inability to accurately identify unauthorized APPs.
[0030] Implementation methods for power Internet of Things (IoT) systems: A power Internet of Things (IoT) system includes an edge cluster and several edge gateways connected to the edge cluster. When a new edge gateway needs to connect to the edge cluster, it must register before being allowed access. The registration method is as follows: First, as... Figure 1 As shown, the registration and authorization tool generates a machine code database for this batch based on relevant information such as production batch, product model, manufacturer, and operator. It then connects to the registration server, extracts a machine code, links to the device to be registered (i.e., the edge gateway to be registered), generates a matching machine code file and a unique code file, and downloads them to the target gateway device. Finally, it retrieves the machine code and unique code from the target gateway device and sends them to the registration tool's registration machine. After verification, it generates a registration file and downloads it to the corresponding directory on the target gateway device, completing the device registration.
[0031] The registration and authorization tool is a software module deployed on the edge cluster for edge gateway registration.
[0032] Specifically, such as Figure 2 As shown, the edge gateway registration method of this embodiment includes the following steps: The registration and authorization tool selects the product model based on the production contract information, and sequentially adds production batch information (including edge gateway production time information accurate to at least the second), customer ID and description information, and, together with multiple random numbers, encrypts and generates a machine code database file for this batch.
[0033] During registration, the registration and authorization tool connects to the device to be authorized (target gateway, edge gateway to be registered), loads the machine code database file of the generated batch of devices, extracts a machine code information, calculates the CRC value of the machine code, encrypts the machine code and its CRC value to generate a machine code file, and downloads the machine code file to the corresponding directory of the target gateway. Then, the registration and authorization tool extracts the device's own hardware information such as CPU serial number, hard disk serial number, and BIOS serial number, and the CRC value of the machine code to synthesize a unique device code using the SM2 encryption algorithm. The unique code is then written into the device chip. After successfully writing the unique code, the device chip is locked. The unique code is then read from the chip, encrypted to generate a unique code file, and downloaded to the corresponding directory of the target gateway machine. The registration and authorization tool reads the device's machine code and unique code, verifies their compatibility, and if successful, synthesizes a registration code, encrypts it, generates a device registration file, and downloads the file to the corresponding directory on the target gateway. This completes the successful registration of one device. If the machine code and unique code do not match, device registration fails, the device is considered to be operating illegally, all apps on the device will fail to launch, an illegal log will be generated, and an alarm will be sent to the local or remote backend.
[0034] Specifically, verifying whether the machine code and the unique code match is as follows: decrypt the read unique code to obtain the first CRC value; generate a CRC based on the read machine code as the second CRC value; if the first CRC value and the second CRC value are the same, then the machine code and the unique code match successfully.
[0035] Specifically, the registration code is synthesized as follows: the encrypted data, including the machine code and unique code, is encrypted together with the relevant parameters used in the encryption algorithm, and then encrypted again to obtain the registration code. The encryption algorithm is the SM2 algorithm. In this embodiment, a CRC checksum is used as the check value of the machine code. In other embodiments, other forms of checksums, such as hash values, can also be used as the check value of the machine code.
[0036] In other implementations, other types of encryption algorithms, such as the SM4 algorithm, may also be used.
[0037] After the device starts up, the edge gateway's guardian APP starts first, checks the device registration code, and verifies whether it is registered. If the device is registered, it checks all APPs connected to the MQTT bus, asks for their identities one by one, and authorizes and authenticates the APPs. Only APPs that pass the authentication are allowed to run normally (i.e., APP is enabled), and illegal APPs are forcibly exited. If the device is not registered, it forcibly exits all APPs running on the edge gateway.
[0038] Specifically, the above verification process for registration is as follows: the registration code is stored in a specific directory of the gateway, and the machine code and unique code are also stored in a specific directory. The result obtained by encrypting the machine code and unique code through the SM2 encryption algorithm (i.e., the above process of synthesizing the registration code) is compared with the registration information. If they are completely identical, the registration is complete.
[0039] The SM2 digital certificate, which meets the national cryptographic standard, is used to achieve two-way identity authentication between the authentication guardian app and the protocol and advanced application apps. For example... Figure 3 As shown, the two-way authentication process between the Guardian App and the Protocol and Advanced Application App is as follows: 1. Establish network connections between the guardian app and the protocol and advanced application apps (i.e. Figure 3 TCP connection in the middle); 2. The Guardian App generates a random number R1 and sends R1 to the protocol and the advanced application App; 3. The protocol and advanced application APP generate a random number R2, sign R1+R2+unique code+machine code and send it to the guardian APP. At the same time, the protocol and advanced application APP save R1. The aforementioned unique code and machine code are obtained from a specific directory of the edge gateway.
[0040] 4. Verify the validity of the signature using the SM2 digital certificate. If the verification is successful, the Guardian App completes the identity authentication of the Protocol App and the Advanced Application App. The unique code + machine code are used to verify the consistency of the registration information (the same process as the above verification of whether the registration is successful). If they are consistent, the Guardian App signs the signature with a random number R2 and sends the signature result to the Protocol App and the Advanced Application App. Otherwise, the authentication fails (i.e., they are inconsistent), and the failed authentication App is forcibly exited. 5. The protocol and advanced application APP verify the correctness of the signature. If the verification is successful, the protocol and advanced application APP complete the identity authentication of the guardian APP and return the authentication confirmation information.
[0041] All apps launched via this guardian, regardless of their method (whether they are protocol-based, service-based, or container-based), must connect to the MQTT bus and be queried and authenticated. Unauthorized connections will result in forced termination. Figure 4 As shown, the commonly used certified apps for the IoT edge gateway device of this invention include basic service apps: Guardian App, Virtual Computing App, Historical Storage App, Log Service App, AGC / AVC Service App, IEC104 Protocol App, IEC101 Protocol App, IEC61850 Protocol App, Southern Power Grid MQTT Protocol App, and State Grid MQTT Protocol App. The software framework adopts a layered architecture design and has flexible app extension interfaces.
[0042] Implementation method of edge gateway registration: like Figure 1 and Figure 2 As shown, the edge gateway registration method of this embodiment includes the following steps: S1. Obtain the pre-generated machine code, encrypt the machine code to generate a machine code file, and write the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number.
[0043] Based on the production contract information, select the product model, and then add the production batch information (including edge gateway production time information accurate to at least the second), customer ID and description information in sequence. Combined with multiple random numbers, generate the machine code database file for this batch.
[0044] During registration, the registration and authorization tool connects to the device to be authorized (target gateway, edge gateway to be registered), loads the machine code database file of the generated batch of devices, extracts a machine code information, calculates the CRC value of the machine code, encrypts the machine code and its CRC value to generate a machine code file, and downloads the machine code file to the corresponding directory of the target gateway.
[0045] S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered.
[0046] The registration and authorization tool extracts the device's CPU serial number, hard drive serial number, BIOS serial number, and other hardware information, and combines them with the CRC value of the machine code. This CRC value is then used to synthesize a unique device code using the SM2 encryption algorithm. This unique code is written to the device chip. After successful writing, the device chip is locked. The unique code is then read from the chip, encrypted, and used to generate a unique code file, which is downloaded to the corresponding directory on the target gateway. S3: The machine code and unique code are retrieved from the machine code file and unique code file in the gateway to be registered. If the retrieved machine code and unique code match, a registration code is generated based on them. This registration code is then encrypted to generate a registration file, which is written to the edge gateway to be registered to complete the registration. Otherwise, registration fails.
[0047] The registration and authorization tool reads the device's machine code and unique code, verifies their compatibility, and if successful, synthesizes a registration code, encrypts it, generates a device registration file, and downloads the file to the corresponding directory on the target gateway. This completes the successful registration of one device. If the machine code and unique code do not match, device registration fails, the device is considered to be operating illegally, all apps on the device will fail to launch, an illegal log will be generated, and an alarm will be sent to the local or remote backend.
[0048] Specifically, verifying whether the machine code and the unique code match is as follows: decrypt the read unique code to obtain the first CRC value; generate a CRC based on the read machine code as the second CRC value; if the first CRC value and the second CRC value are the same, then the machine code and the unique code match successfully.
[0049] Specifically, the registration code is synthesized as follows: the encrypted data, including the machine code and unique code, is encrypted together with the relevant parameters used in the encryption algorithm, and then encrypted again to obtain the registration code. The encryption algorithm is the SM2 algorithm. In this embodiment, a CRC checksum is used as the check value of the machine code. In other embodiments, other forms of checksums, such as hash values, can also be used as the check value of the machine code.
[0050] In other implementations, other types of encryption algorithms, such as the SM4 algorithm, may also be used.
[0051] Implementation method of APP management for edge gateway: The edge gateway APP management method of this embodiment is implemented by a guardian APP deployed in the edge gateway device. The method includes: after the edge gateway starts, it first verifies whether the edge gateway is registered. If the edge gateway is registered, it authorizes and authenticates all APPs connected to the MQTT bus of the edge gateway according to the unique code and machine code during the registration process, and enables the APPs that have passed the authorization and authentication.
[0052] Specifically, after the device starts up, the edge gateway's guardian APP starts first, checks the device registration code, and verifies whether it is registered. If the device is registered, it checks all APPs connected to the MQTT bus, asks for their identities one by one, and authorizes and authenticates the APPs. Only APPs that pass the authentication are allowed to run normally (i.e., APP is enabled), and illegal APPs are forcibly exited. If the device is not registered, it forcibly exits all APPs running on the edge gateway.
[0053] Specifically, the above verification process for registration is as follows: the registration code is stored in a specific directory of the gateway, and the machine code and unique code are also stored in a specific directory. The result obtained by encrypting the machine code and unique code through the SM2 encryption algorithm (i.e., the above process of synthesizing the registration code) is compared with the registration information. If they are completely identical, the registration is complete.
[0054] The SM2 digital certificate, which meets the national cryptographic standard, is used to achieve two-way identity authentication between the authentication guardian app and the protocol and advanced application apps. For example... Figure 3 As shown, the two-way authentication process between the Guardian App and the Protocol and Advanced Application App is as follows: 1. Establish network connections between the guardian app and the protocol and advanced application apps (i.e. Figure 3 TCP connection in the middle); 2. The Guardian App generates a random number R1 and sends R1 to the protocol and the advanced application App; 3. The protocol and advanced application APP generate a random number R2, sign R1+R2+unique code+machine code and send it to the guardian APP, while the protocol and advanced application APP save R1. 4. Verify the validity of the signature using the SM2 digital certificate. If the verification is successful, the Guardian App will verify the identity of the Protocol App and the Advanced Application App. The unique code and machine code will be used to verify the consistency of the registration information. If they match, the Guardian App will sign the signature using a random number R2 and send the signature result to the Protocol App and the Advanced Application App. Otherwise, the authentication will fail (i.e., the signature will not match), and the app that failed the authentication will be forced to exit. 5. The protocol and advanced application APP verify the correctness of the signature. If the verification is successful, the protocol and advanced application APP complete the identity authentication of the guardian APP and return the authentication confirmation information.
[0055] All apps launched via this guardian, regardless of their method (whether they are protocol-based, service-based, or container-based), must connect to the MQTT bus and be queried and authenticated. Unauthorized connections will result in forced termination. Figure 4 As shown, the commonly used certified apps for the IoT edge gateway device of this invention include basic service apps: Guardian App, Virtual Computing App, Historical Storage App, Log Service App, AGC / AVC Service App, IEC104 Protocol App, IEC101 Protocol App, IEC61850 Protocol App, Southern Power Grid MQTT Protocol App, and State Grid MQTT Protocol App. The software framework adopts a layered architecture design and has flexible app extension interfaces.
[0056] Specifically, the methods for obtaining the machine code, unique code, and registration code (which serves as registration information) can be found in the registration process described below: S1. Obtain a pre-generated machine code, encrypt the machine code to generate a machine code file, and write the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number. S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
[0057] For details regarding the registration process, please refer to the description in the implementation method of the edge gateway registration method; this implementation method will not provide further details.
[0058] Edge gateway implementation: An edge gateway includes a processor, the processor being configured to execute the following steps of an edge gateway APP management method described in a computer program: After the edge gateway starts, it first verifies whether the edge gateway is registered. If the edge gateway is registered, it then authorizes and authenticates all APPs connected to the MQTT bus of the edge gateway according to the unique code and machine code obtained during the registration process, and enables the APPs that have passed the authorization and authentication.
[0059] The edge gateway APP management method of this embodiment is implemented by a guardian APP deployed in the edge gateway device. The method includes: after the edge gateway starts, it first verifies whether the edge gateway is registered. If the edge gateway is registered, it authorizes and authenticates all APPs connected to the MQTT bus of the edge gateway according to the unique code and machine code during the registration process, and enables the APPs that have passed the authorization and authentication.
[0060] Specifically, after the device starts up, the edge gateway's guardian APP starts first, checks the device registration code, and verifies whether it is registered. If the device is registered, it checks all APPs connected to the MQTT bus, asks for their identities one by one, and authorizes and authenticates the APPs. Only APPs that pass the authentication are allowed to run normally (i.e., APP is enabled), and illegal APPs are forcibly exited. If the device is not registered, it forcibly exits all APPs running on the edge gateway.
[0061] Specifically, the above verification process for registration is as follows: the registration code is stored in a specific directory of the gateway, and the machine code and unique code are also stored in a specific directory. The result obtained by encrypting the machine code and unique code through the SM2 encryption algorithm (i.e., the above process of synthesizing the registration code) is compared with the registration information. If they are completely identical, the registration is complete.
[0062] The SM2 digital certificate, which meets the national cryptographic standard, is used to achieve two-way identity authentication between the authentication guardian app and the protocol and advanced application apps. For example... Figure 3 As shown, the two-way authentication process between the Guardian App and the Protocol and Advanced Application App is as follows: 1. Establish network connections between the guardian app and the protocol and advanced application apps (i.e. Figure 3 TCP connection in the middle); 2. The Guardian App generates a random number R1 and sends R1 to the protocol and the advanced application App; 3. The protocol and advanced application APP generate a random number R2, sign R1+R2+unique code+machine code and send it to the guardian APP, while the protocol and advanced application APP save R1. 4. Verify the validity of the signature using the SM2 digital certificate. If the verification is successful, the Guardian App will verify the identity of the Protocol App and the Advanced Application App. The unique code and machine code will be used to verify the consistency of the registration information. If they match, the Guardian App will sign the signature using a random number R2 and send the signature result to the Protocol App and the Advanced Application App. Otherwise, the authentication will fail (i.e., the signature will not match), and the app that failed the authentication will be forced to exit. 5. The protocol and advanced application APP verify the correctness of the signature. If the verification is successful, the protocol and advanced application APP complete the identity authentication of the guardian APP and return the authentication confirmation information.
[0063] All apps launched via this guardian, regardless of their method (whether they are protocol-based, service-based, or container-based), must connect to the MQTT bus and be queried and authenticated. Unauthorized connections will result in forced termination. Figure 4 As shown, the commonly used certified apps for the IoT edge gateway device of this invention include basic service apps: Guardian App, Virtual Computing App, Historical Storage App, Log Service App, AGC / AVC Service App, IEC104 Protocol App, IEC101 Protocol App, IEC61850 Protocol App, Southern Power Grid MQTT Protocol App, and State Grid MQTT Protocol App. The software framework adopts a layered architecture design and has flexible app extension interfaces.
[0064] Specifically, the methods for obtaining the machine code, unique code, and registration code (which serves as registration information) can be found in the registration process described below: S1. Obtain a pre-generated machine code, encrypt the machine code to generate a machine code file, and write the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number. S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
[0065] For details regarding the registration process, please refer to the description in the implementation method of the edge gateway registration method; this implementation method will not provide further details.
[0066] This invention has the following characteristics: This invention aims to overcome existing technical challenges and provide an innovative registration method and device for IoT edge gateways. By constructing a complete registration process and management mechanism, it enables plug-and-play functionality for the device, ensuring the reliability of the app's operation from the source, effectively preventing the operation of unauthorized apps, thereby building a solid defense for the secure and stable operation of the system and significantly reducing maintenance costs.
[0067] This invention proposes an innovative method for IoT edge gateway registration and APP authorization. By constructing a secure and efficient registration mechanism and authorization authentication system, it achieves secure and reliable operation and intelligent management of the edge gateway. This method supports plug-and-play functionality for devices, significantly simplifying the deployment process, while allowing flexible APP management, including individual installation, uninstallation, stopping, and starting, thereby greatly reducing the installation and debugging time of the edge gateway. Furthermore, by optimizing the master station access process, it effectively improves the master station access rate of the edge gateway, further enhancing system stability and response speed. This method not only improves operational efficiency and service levels but also provides reliable technical support for the large-scale deployment and maintenance of IoT devices, possessing broad application prospects and commercial value.
[0068] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still make modifications to the technical solutions described in the foregoing embodiments without creative effort, or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. An edge gateway registration method, characterized in that, The method includes: S1. Obtain a pre-generated machine code, encrypt the machine code to generate a machine code file, and write the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number. S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
2. The edge gateway registration method according to claim 1, characterized in that, In S1, the process of encrypting the machine code to generate a machine code file includes: encrypting the machine code and its check value together to generate a machine code file.
3. The edge gateway registration method according to claim 1, characterized in that, The hardware information includes the CPU serial number, hard drive serial number, and BIOS serial number.
4. The edge gateway registration method according to claim 3, characterized in that, The process of generating a unique code in S2 based on the hardware information of the edge gateway to be registered and the verification value of the machine code includes: combining the CPU serial number, hard disk serial number, BIOS serial number of the edge gateway to be registered with the verification value of the machine code to form a unique code.
5. The edge gateway registration method according to claim 1, characterized in that, The production information of the edge gateway includes one, two, or a combination of three of the following: product model, production batch information, customer ID, and description information.
6. The edge gateway registration method according to claim 1, characterized in that, In S3, the matching between the obtained machine code and the unique code is determined as follows: the first check value of the machine code used to generate the unique code is obtained based on the obtained unique code; the second check value is obtained by calculating the check value based on the obtained machine code. If the first check value is the same as the second check value, then the obtained machine code and unique code are considered to match.
7. An APP management method for an edge gateway, characterized in that, The method includes: after the edge gateway starts, it first verifies whether the edge gateway is registered. If the edge gateway is registered, it authorizes and authenticates all the apps of the edge gateway according to the unique code and machine code during the registration process, and enables the apps that have passed the authorization and authentication. The registration process includes: S1, obtaining a pre-generated machine code, encrypting the machine code to generate a machine code file, and writing the machine code file into the edge gateway to be registered; the machine code is generated based on the production information of the edge gateway and a random number; S2. Generate a unique code based on the hardware information of the edge gateway to be registered and the verification value of the machine code, write the unique code into the edge gateway to be registered and lock it; then, read the unique code and encrypt it to generate a unique code file, and write the unique code file into the edge gateway to be registered. S3. Obtain the machine code and unique code from the machine code file and unique code file in the gateway to be registered, respectively. If the obtained machine code and unique code match, generate a registration code based on the machine code and unique code, encrypt the registration code to generate a registration file, and write the registration file into the edge gateway to be registered to complete the registration; otherwise, the registration fails.
8. The APP management method for an edge gateway according to claim 7, characterized in that, The SM2 algorithm is used for authorization and authentication.
9. The APP management method for an edge gateway according to claim 7, characterized in that, Force the app to exit if it has not been authorized.
10. The APP management method for an edge gateway according to claim 7, characterized in that, If the edge gateway is not registered, all running apps on that edge gateway will be forcibly exited.
11. An edge gateway, comprising a processor, characterized in that, The processor is used to execute a computer program to implement the steps of the edge gateway APP management method as described in any one of claims 7 to 10.
12. A power Internet of Things (IoT) system, comprising an edge cluster and an edge gateway, wherein the edge cluster includes a processor, characterized in that, The processor is used to execute a computer program to implement the steps of the edge gateway registration method as described in any one of claims 1 to 6.