Password strength evaluation method and system based on edge node of industrial Internet of Things

Abstract

The invention discloses a password strength evaluation method and system based on industrial Internet of Things edge nodes, relates to the field of Internet of Things security, is applied to a node management gateway, and comprises the following steps: matching a plurality of edge nodes according to current service scene information; inputting the plurality of edge nodes into a preset node association knowledge graph for association clustering to obtain an association node graph of the plurality of edge nodes; calculating statistical parameters of the plurality of edge nodes based on the association node graph of the plurality of edge nodes; calculating risk propagation coefficients of the plurality of edge nodes according to the statistical parameters of the plurality of edge nodes; and according to the risk propagation coefficients of the plurality of edge nodes, correcting the password intensities of the plurality of edge nodes to obtain the corrected password intensities of the plurality of edge nodes, thereby solving the problem of insufficient edge node password intensity evaluation precision in the industrial Internet of Things at present.

Description

A method and system for evaluating cryptographic strength based on industrial IoT edge nodes Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security, specifically to a method and system for evaluating cryptographic strength based on industrial IoT edge nodes. Background Technology

[0002] In the Industrial Internet of Things (IIoT), the control commands and production data transmitted between edge nodes and gateways are related to system security and business secrets. Therefore, it is necessary to build a secure channel by configuring cryptographic algorithms to resist eavesdropping and tampering.

[0003] Currently, edge node cryptographic algorithms generally adopt a static configuration mode. Specifically, during the system deployment phase, engineers configure corresponding cryptographic algorithms for each node based on the device type or network partition using a preset configuration template. At this time, in order to ensure the continuity of communication, the cryptographic algorithms of each node usually remain unchanged throughout the entire lifecycle. Therefore, after the configuration is completed, the cryptographic algorithms of each node are also evaluated for strength. Specifically, the current evaluation method is mainly based on preset evaluation rules to score the strength of the parameter characteristics of the cryptographic algorithm itself. Then, based on the importance of each parameter characteristic in the deployment industrial scenario, a comprehensive strength score is performed to obtain the cryptographic strength of each node. At this time, for nodes with low cryptographic strength, their configuration parameters are further optimized to ensure their communication security.

[0004] However, in real-world production scenarios, the security status of a node can significantly affect other nodes associated with it through communication links, data flows, or control logic. The cryptographic strength obtained from the above assessment only represents the numerical strength of the cryptographic algorithm itself, ignoring the fact that when business scenarios change, the cryptographic strength of some nodes may be weakened due to changes in associated nodes, thereby increasing the risk of information leakage. Summary of the Invention

[0005] To address the issue of insufficient accuracy in cryptographic strength assessment of edge nodes in the current Industrial Internet of Things (IIoT), this application provides a cryptographic strength assessment method and system based on IIoT edge nodes.

[0006] Firstly, this application provides a cryptographic strength evaluation method based on industrial IoT edge nodes, applied in a node management gateway, the method comprising:

[0007] Obtain current business scenario information, and match multiple edge nodes based on the current business scenario information;

[0008] Multiple edge nodes are input into a preset node association knowledge graph for association clustering to obtain the association node graph corresponding to each edge node;

[0009] Based on the associated node graphs corresponding to each of the multiple edge nodes, statistical parameters corresponding to each of the multiple edge nodes are calculated. The statistical parameters include the number of associated nodes, the average performance attenuation coefficient, and the information entropy of cryptographic components.

[0010] Calculate the risk propagation coefficient corresponding to each of the multiple edge nodes based on the statistical parameters corresponding to each of the multiple edge nodes;

[0011] Based on the risk propagation coefficients corresponding to each of the multiple edge nodes, the cryptographic strength of the multiple edge nodes is corrected to obtain the corrected cryptographic strength of each of the multiple edge nodes;

[0012] If the corrected cryptographic strength of the target edge node is less than the preset cryptographic strength threshold, a risk warning is generated to remind the engineer to upgrade the cryptographic algorithm of the target edge node, which is any one of the multiple edge nodes.

[0013] Optionally, the connection edge relationship between any two connected nodes in the preset node association knowledge graph includes any one of the following: data flow dependency relationship, logical control relationship, and physical co-location relationship.

[0014] Optionally, based on the associated node graph corresponding to each of the multiple edge nodes, the average performance degradation coefficient corresponding to each of the multiple edge nodes is calculated, specifically including:

[0015] Obtain standard performance parameter data and real-time performance parameter data of the first edge node, wherein the first edge node is any one of the plurality of edge nodes;

[0016] The performance degradation coefficient of the first edge node is obtained by comparing the standard performance parameter data with the real-time performance parameter data.

[0017] Calculate the pitch between the first edge node and multiple associated edge nodes in the associated node graph of the first edge node;

[0018] Based on the pitch between the multiple associated edge nodes and the first edge node, the risk weights of the multiple associated edge nodes are determined;

[0019] Based on the risk weights and performance degradation coefficients of the multiple associated edge nodes, the average performance degradation coefficient of the first edge node is calculated.

[0020] Optionally, based on the associated node graphs corresponding to each of the multiple edge nodes, the information entropy of the cryptographic components corresponding to each of the multiple edge nodes is calculated, specifically as follows:

[0021] Starting from the second edge node, the associated node graph of the second edge node is traversed according to the arithmetic interval of 1, 2, 3, ..., n, to obtain multiple arithmetic interval groups, where the second edge node is any one of the multiple edge nodes;

[0022] Calculate the information entropy of the cryptographic components for each of the multiple arithmetic interval groups;

[0023] The cryptographic component information entropy of the second edge node is obtained by weighted fusion of the cryptographic component information entropy of multiple arithmetic interval groups.

[0024] Optionally, calculating the cryptographic component information entropy of the multiple arithmetic interval groups specifically includes:

[0025] Identify the pitch value of the arithmetic pitch group to be calculated, wherein the arithmetic pitch group to be calculated is any one of the plurality of arithmetic pitch groups;

[0026] Based on the pitch value of the arithmetic pitch group to be calculated, the minimum information entropy calculation unit of the arithmetic pitch group to be calculated is obtained by matching from the preset pitch-information entropy minimum calculation unit mapping table, wherein the minimum information entropy calculation unit includes a component unit, an algorithm unit, and a parameter unit.

[0027] The cryptographic component information entropy of the arithmetic pitch group to be calculated is calculated based on the minimum information entropy calculation unit of the arithmetic pitch group to be calculated.

[0028] Optionally, the step of weighted summing of the cryptographic component information entropies of multiple arithmetic interval groups to obtain the cryptographic component information entropy of the second edge node further includes:

[0029] Starting from the second edge node, traverse the number of nodes in multiple arithmetic pitch groups one by one;

[0030] The effective risk radius is determined based on a preset threshold for the proportion of nodes.

[0031] Based on the effective risk radius, calculate the information entropy of cryptographic components within the effective risk radius.

[0032] Optionally, the step of calculating the risk propagation coefficient corresponding to each of the multiple edge nodes based on the statistical parameters corresponding to each of the multiple edge nodes specifically involves:

[0033] The statistical parameters corresponding to each of the multiple edge nodes are converted into multiple multidimensional risk vectors, wherein the statistical parameters of one edge node correspond to one multidimensional risk vector.

[0034] Calculate the sample mean vector of multiple said multidimensional risk vectors;

[0035] The Mahalanobis distance algorithm is used to calculate the Mahalanobis distance between the multiple multidimensional risk vectors and the sample mean vector respectively;

[0036] The Mahalanobis distances corresponding to each of the multiple multidimensional risk vectors are matched with a preset chi-square distribution mapping table to obtain the chi-square values ​​corresponding to each of the multiple multidimensional risk vectors. The chi-square distribution mapping table includes the correspondence between Mahalanobis distances and chi-square values.

[0037] The chi-square values ​​corresponding to each of the multiple multidimensional risk vectors are normalized to obtain the risk propagation coefficients corresponding to each of the multiple edge nodes.

[0038] Secondly, this application provides a cryptographic strength evaluation system based on industrial IoT edge nodes. The system is a node management gateway, and includes an acquisition module, a processing module, and a sending module, wherein:

[0039] The acquisition module is used to acquire current business scenario information and match multiple edge nodes based on the current business scenario information; input the multiple edge nodes into a preset node association knowledge graph for association clustering to obtain the association node graph corresponding to each of the multiple edge nodes;

[0040] The processing module is used to calculate statistical parameters corresponding to each of the multiple edge nodes based on the associated node graphs corresponding to each of the multiple edge nodes. The statistical parameters include the number of associated nodes, the average performance decay coefficient, and the information entropy of cryptographic components.

[0041] Calculate the risk propagation coefficient corresponding to each of the multiple edge nodes based on the statistical parameters corresponding to each of the multiple edge nodes;

[0042] Based on the risk propagation coefficients corresponding to each of the multiple edge nodes, the cryptographic strength of the multiple edge nodes is corrected to obtain the corrected cryptographic strength of each of the multiple edge nodes;

[0043] The sending module is used to generate a risk warning if the corrected password strength of the target edge node is less than a preset password strength threshold, so as to remind the engineer to upgrade the password algorithm of the target edge node, wherein the target edge node is any one of the multiple edge nodes.

[0044] Thirdly, this application provides an electronic device including a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any one of the first aspects.

[0045] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed, perform the method described in any one of the first aspects.

[0046] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0047] For the current business scenario, this application first matches multiple relevant edge nodes based on the current business scenario information, and then inputs the multiple edge nodes into a preset node association knowledge graph for association clustering to obtain the association node graph corresponding to each edge node. At this time, this application considers that the security status of a node can significantly affect other nodes associated with it through communication links, data flow, or control logic. For example, if an attacker attacks a certain node, after the node is cracked, the operating status of its associated nodes can be deduced based on the operating status of the node, and then a specific attack method can be formulated to reduce the difficulty of cracking its associated nodes, thereby weakening the password strength of its associated nodes. Therefore, this application calculates the statistical parameters corresponding to multiple edge nodes to evaluate the risk propagation coefficient after each edge node is compromised. The statistical parameters include the number of associated nodes, the average performance decay coefficient, and the information entropy of cryptographic components. The number of associated nodes reflects the scope of risk propagation, while the average performance decay coefficient and the information entropy of cryptographic components reflect the difficulty of risk propagation. Then, the preset password strength of each edge node is corrected according to the risk propagation coefficient of each edge node to obtain the corrected password strength of each edge node. The corrected password strength reflects the adaptability of the password strength of the edge node to the risk in the current business scenario. If the corrected password strength of an edge node is low, it means that the security protection performance of the edge node is not enough to cope with the occurrence of risks. At this time, a risk warning is generated to remind engineers to upgrade the cryptographic algorithm of the edge node to improve its security protection capability, thereby reducing the risk of information leakage in the system. Attached Figure Description

[0048] Figure 1 is a flowchart illustrating a cryptographic strength evaluation method based on an industrial Internet of Things edge node provided in an embodiment of this application.

[0049] Figure 2 is a schematic diagram of the structure of a cryptographic strength evaluation system based on an industrial Internet of Things edge node provided in an embodiment of this application.

[0050] Figure 3 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0051] Explanation of reference numerals in the attached drawings: 1. Acquisition module; 2. Processing module; 3. Transmission module; 300. Electronic device; 301. Processor; 302. Communication bus; 303. User interface; 304. Network interface; 305. Memory. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0053] This application provides a cryptographic strength evaluation method based on industrial IoT edge nodes. This method is applied to a node management gateway, as shown in Figure 1. The method includes steps S101 to S106, as follows:

[0054] S101. Obtain the current business scenario information and match multiple edge nodes based on the current business scenario information.

[0055] In the above steps, the node management gateway reads the current business scenario information of the upper-level production management system and parses out multiple scenario features such as scenario identifier, process flow number and control link ID. Then, it matches the multiple scenario features with the preset business scenario-node mapping table to obtain multiple edge nodes corresponding to the previous business scenario. The multiple edge nodes include, but are not limited to, monitoring nodes, control nodes and execution nodes.

[0056] S102. Input multiple edge nodes into a preset node association knowledge graph for association clustering to obtain the association node graph corresponding to each edge node.

[0057] In the above steps, the preset node association knowledge graph is configured to include multiple edge nodes and connection edges between multiple edge nodes. In addition, according to the typical attack scenarios of industrial Internet of Things, this application configures the connection edge relationship between any two connected nodes as one of data flow dependency relationship, logical control relationship, and physical co-location relationship. If the two nodes have a data flow dependency relationship, it means that the output data of one node is the input data of the other node. If the two nodes have a logical control relationship, it means that one node is the control node of the other node, and the control node sends control commands to the controlled node. If the two nodes have a physical co-location relationship, it means that the two nodes are in the same physical location and share the same resources.

[0058] Then, the multiple edge nodes of the current business scenario are matched with the preset node association knowledge graph to identify the multiple associated edge nodes corresponding to each edge node and construct an association node graph. For any edge node's association node graph, there is a reachable node path between any two associated edge nodes.

[0059] S103. Based on the associated node graphs of multiple edge nodes, calculate the statistical parameters corresponding to each edge node. The statistical parameters include the number of associated nodes, the average performance decay coefficient, and the information entropy of cryptographic components.

[0060] In the above steps, this application considers that in the current Industrial Internet of Things (IIoT), the cryptographic strength assessment of edge nodes mainly focuses on the mathematical strength of their cryptographic algorithms, such as key length and algorithm complexity. However, in actual attack scenarios, when attackers find that the target node itself has high cryptographic strength and is difficult to directly break, they often adopt a roundabout strategy. They first attack multiple other edge nodes that are closely related to the target node in terms of data flow, control logic, or physical topology. By successfully infiltrating these related nodes, attackers can listen to, hijack, or tamper with the communication data between them and the target node, and then analyze and deduce the target node's operating status, behavior patterns, key update rules, and communication protocol details. Then, based on this stolen intelligence, attackers can formulate highly customized attack strategies, such as man-in-the-middle attacks, replay attacks, and protocol vulnerability exploitation, making the target node's original cryptographic algorithm unable to cope with the customized attack strategies, thus paralyzing the target node and causing production interruptions or leakage of sensitive information. For example, in the control system of an intelligent assembly line, an industrial PLC responsible for core logic operations is configured with a high-strength national cryptographic algorithm, making it difficult for attackers to directly crack the PLC. However, the attacker discovers that the PLC continuously communicates with multiple vision sensors responsible for reading part parameters, and also finds that the cryptographic configuration of these vision sensors is relatively weak. Therefore, the attacker first compromises one of the vision sensors, eavesdropping on the "part specifications qualified" instruction data packets it reports to the PLC. Then, through analysis, the attacker understands the format, sending cycle, and verification rules of the instruction. Next, the attacker forges a large number of "parts unqualified" instructions and injects them into the communication link at a high frequency. At this point, although the PLC's cryptographic algorithm can verify the authenticity of the instructions, it cannot resist this data flood attack based on a legitimate format. As a result, the PLC eventually becomes severely overloaded due to processing a large number of forged instructions, leading to the PLC's paralysis and causing the entire production line to shut down.

[0061] Therefore, this application considers not only the mathematical strength of the edge node cryptographic algorithm itself, but also the risk adaptability of the edge node to the current business scenario, thus providing a key basis for the subsequent upgrade of the cryptographic algorithms of each edge node. Specifically, for any edge node among multiple edge nodes under the current business scenario information, the statistical parameters corresponding to the edge node are calculated. The statistical parameters include the number of associated nodes, the average performance decay coefficient, and the cryptographic component information entropy. It should be noted that the number of associated nodes represents the risk impact range of the edge node. The more associated nodes, the greater the impact range after the edge node is compromised, and the easier it is for the edge node to be compromised due to associated nodes. The average performance decay coefficient represents the health of the edge node and its multiple associated edge nodes under the current business scenario. The higher the average performance decay coefficient, the lower the actual operating efficiency of the cryptographic algorithm, and the easier it is to be directly compromised due to resource bottlenecks. The cryptographic component information entropy represents the heterogeneity of the cryptographic configuration in the local area formed by the edge node and its multiple associated edge nodes. The lower the cryptographic component information entropy, the higher the risk of attackers using the same methods to batch compromise the area where the edge node is located. This approach characterizes the risk adaptability of each edge node from two dimensions: the scope and difficulty of risk propagation. The number of associated nodes for each edge node can be obtained by directly traversing its corresponding associated node graph and counting the total number of nodes in the associated node graph.

[0062] In one implementation, when calculating the average performance degradation coefficient of the target edge node, this application first obtains standard performance parameter data and real-time performance parameter data of the target edge node. The standard performance parameter data can be understood as the performance parameter data of the edge node under normal load conditions, and the real-time performance parameter data is the current performance parameter data of the edge node. The performance parameter data includes, but is not limited to, encryption / decryption data throughput, single encryption / decryption operation duration, CPU utilization, etc. Then, the standard performance parameter data is compared with the real-time performance parameter data to obtain the performance degradation coefficient of the target edge node. For example, if the target edge node... The throughput of AES-256-GCM encryption operation under standard testing is 1000 ops / s, while the currently measured real-time throughput is 650 ops / s. Therefore, the performance degradation coefficient of the target edge node in the "throughput" performance dimension can be calculated as (1000−650) / 1000=0.35, that is, there is a 35% performance degradation. Then, since the performance parameter data includes multiple performance dimensions, after calculating the performance degradation coefficients of multiple performance dimensions, this application performs weighted fusion of the performance degradation coefficients of each dimension according to the preset weights of each performance dimension to obtain a comprehensive performance degradation system. Then, using the above method, the performance degradation coefficients corresponding to multiple associated edge nodes in the associated node graph of the target edge node are also calculated simultaneously. At this point, it should be noted that in an associated node graph, the closer the pitch between the associated edge node and the target edge node, the tighter the business coupling and data exchange frequency between the two. Therefore, when a node that is closer to the target edge node experiences performance degradation, it is more likely to affect the password strength of the target edge node than a node that is closer to the target edge node. Here, pitch can be understood as the total number of connecting edges between two nodes. For example, two directly connected nodes have a pitch of 1, and two nodes connected by a node separated by one node have a pitch of 2.

[0063] Therefore, after obtaining the performance degradation coefficients of the target edge node and its corresponding multiple associated edge nodes, this application traverses the shortest interval between the multiple associated edge nodes and the target edge node in the associated node graph of the target edge node. Then, based on the shortest interval between the multiple associated edge nodes and the target edge node, an exponential decay function is used to determine the risk weight of the multiple associated edge nodes. The closer the interval, the higher the risk weight. The exponential decay function can take the following form:

[0064]

[0065] in, Let i be the risk weight of the i-th associated edge node. The shortest pitch of the i-th associated edge node. This is the performance risk index decay coefficient.

[0066] Finally, based on the risk weights of multiple associated edge nodes, the performance degradation coefficients of all nodes in the associated node graph (including the target edge node itself, whose pitch can be regarded as 0 and risk weight is 1) are weighted and averaged to calculate the mean performance degradation coefficient of the target edge node. This makes the mean performance degradation coefficient of the target edge node more consistent with the security risks caused by the performance degradation of associated nodes in the real state.

[0067] In one implementation, when calculating the cryptographic component information entropy of a target edge node, the influence of associated edge nodes at different distances on the cryptographic strength of the target edge node also varies. Specifically, the closer the node, the more closely it is coupled with the target node in business operations and data exchange. If its cryptographic component configuration is highly homogeneous with that of the target edge node, it will greatly lower the threshold for attackers to move, thereby severely weakening the cryptographic strength of the target node's cryptographic algorithm. Conversely, for nodes that are farther away, even if their cryptographic component configuration is highly homogeneous with that of the target edge node, the risk they pose will decrease with the complexity and uncertainty of the path. Therefore, in order to accurately assess the impact of cryptographic component information entropy on the cryptographic strength of the target edge node, this application proposes a hierarchical entropy calculation method, specifically:

[0068] Starting from the target edge node, based on the topology of its associated node graph, all associated nodes are divided into different arithmetic interval groups according to the interval from the starting point as 1, 2, 3... up to n (n is the maximum interval in the graph). This forms a multi-layered node set with the target edge node as the core and from near to far. Multiple associated edge nodes belonging to the same arithmetic interval group have the same interval as the target edge node. Then, the Shannon entropy formula is used to calculate the cryptographic component information entropy of all associated edge nodes in each arithmetic interval group H(k){k=1,2,3...,n}. The cryptographic component information entropy of the k-th layer arithmetic interval group reflects the homogenization risk of the associated edge nodes in the cryptographic component configuration. Finally, an exponential decay function is used to determine the risk weights of multiple arithmetic interval groups. The exponential decay function can take the following form:

[0069]

[0070] in, Let i be the risk weight of the i-th arithmetic interval group. Let be the pitch of the i-th arithmetic pitch group. This is the decay coefficient of the homogenization risk index.

[0071] Finally, based on the risk weights of multiple arithmetic pitch groups, the cryptographic component information entropy of multiple arithmetic pitch groups is calculated and weighted to obtain the cryptographic component information entropy of the target edge node. This makes the cryptographic component information entropy of the target edge node more representative of the configuration heterogeneity pressure faced by the target edge node within the real risk propagation range.

[0072] In one possible implementation, if the pitch between the associated edge node and the target edge node is too far, the associated edge node has a small impact on the homogenization of the cryptographic components of the target edge node. In this case, incorporating the cryptographic component information entropy of the arithmetic pitch group of its level into the calculation of the cryptographic component information entropy of the target edge node will introduce noise unrelated to the risk of homogenization, thereby reducing the accuracy of the cryptographic component information entropy of the target edge node. Therefore, starting from the target edge node, the cumulative number of nodes in the arithmetic interval groups of its associated node graph is traversed one by one in ascending order of pitch. Then, based on the preset node number percentage threshold, the effective risk radius is determined. For example, assuming the target edge node covers a total of 30 nodes and the preset node number percentage threshold is 80%, if the arithmetic interval group with pitch 1 contains 10 associated edge nodes, the arithmetic interval group with pitch 2 contains 8 associated edge nodes, and the arithmetic interval group with pitch 3 contains 8 associated edge nodes, then 10+8+8=26, which is greater than 30*80%=24. Therefore, the effective risk radius is determined to be pitch 3. At this time, only the cryptographic component information entropy of the arithmetic interval groups with pitches of 1, 2, and 3 is included in the calculation of the cryptographic component information entropy of the target edge node, thereby improving the accuracy of the cryptographic component information entropy of the target edge node.

[0073] In one possible implementation, for arithmetic pitch groups with large pitches relative to the target edge node, the granularity of their information entropy calculation may introduce "granularity noise," thereby masking the risk of homogenization of cryptographic components in near-end arithmetic pitch groups. Therefore, to address this issue, this application identifies the pitch values ​​of multiple arithmetic pitch groups and then matches these pitch values ​​with a preset pitch-information entropy minimum calculation unit mapping table. The pitch-information entropy minimum calculation unit mapping table defines the correspondence between pitch and information entropy calculation granularity. The minimum information entropy calculation unit, from coarse to fine, consists of: component units (e.g., "encryption suite," "authentication module"), algorithm units (e.g., "..."), and other related units. The mapping rules for AES, SM4, and parameter units (such as AES-256-GCM and RSA-2048-OAEP-SHA256) are as follows: the smaller the pitch, the finer the granularity of the matched information entropy calculation unit; the larger the pitch, the coarser the granularity of the matched information entropy calculation unit. This yields the minimum information entropy calculation unit for multiple arithmetic pitch groups. Then, for any arithmetic pitch group to be calculated, based on its corresponding minimum information entropy calculation unit, the identifier of the cryptographic component configured at the corresponding granularity for each associated edge node within that group is extracted, and its distributed information entropy is calculated, thus obtaining the cryptographic component information entropy for that arithmetic pitch group. This dynamic granularity entropy calculation method reduces the "granularity noise" of the distant arithmetic pitch groups, thereby improving the accuracy of the cryptographic component information entropy of the target edge node.

[0074] S104. Calculate the risk propagation coefficient for each edge node based on the statistical parameters corresponding to each edge node.

[0075] In the above steps, the statistical parameters of each edge node can be regarded as a multidimensional risk vector representing its risk status. In order to accurately measure the risk propagation coefficient of each edge node, this application first uses Mahalanobis distance to represent the degree of anomaly of the multidimensional risk vector of each edge node, and then uses a chi-square distribution mapping table with 3 degrees of freedom (the statistical parameters of this application are 3-dimensional, so the degree of freedom is 3) to map the Mahalanobis distance of each edge node to a probability value (chi-square value). The chi-square distribution mapping table includes the correspondence between Mahalanobis distance and chi-square value. The probability value of each edge node is normalized to obtain its risk propagation coefficient. The chi-square value of any edge node i can be understood as the probability that a sample randomly selected from the overall anomaly distribution of the current industrial Internet of Things network has an anomaly degree that does not exceed the anomaly degree of edge node i. The larger the chi-square value, the higher the anomaly degree of edge node i itself in the entire industrial Internet of Things network, the higher its possibility of being a vulnerable point, and the greater the potential for risk propagation.

[0076] It should be noted that the anomaly level of the multidimensional risk vector for each edge node is calculated using Mahalanobis distance, as detailed below:

[0077] First, the multidimensional risk vectors of each edge node are constructed into a risk vector matrix. Then, the sample mean vector of multiple multidimensional risk vectors is calculated, i.e.:

[0078]

[0079] Where u is the sample mean vector. Let i be the i-th multidimensional risk vector. These represent the number of associated nodes, performance reduction coefficient, and cryptographic component information entropy of the i-th multidimensional risk vector, respectively.

[0080] Then, based on the sample mean vectors of multiple multidimensional risk vectors, the covariance matrix of the risk vector matrix is ​​calculated, i.e.:

[0081]

[0082] in, Let be the covariance matrix.

[0083] Then, the anomaly degree of the i-th multidimensional risk vector is calculated as follows:

[0084]

[0085] in, Let be the Mahalanobis distance between the i-th multidimensional risk vector and the sample mean vector. Since the Mahalanobis distance can quantify the overall deviation between an individual and its peer group, the larger the Mahalanobis distance, the greater the overall deviation. Therefore, in this application, it can be used to represent the degree of anomaly of the multidimensional risk vector.

[0086] S105. Based on the risk propagation coefficients corresponding to each edge node, the cryptographic strength of each edge node is corrected to obtain the corrected cryptographic strength of each edge node.

[0087] In the above steps, for any one of the multiple edge nodes, this application multiplies its risk propagation coefficient by the initial cryptographic strength of the edge node to obtain the modified cryptographic strength of the edge node, so that the modified cryptographic strength can characterize the risk adaptability of the edge node in the current business scenario.

[0088] S106. If the corrected cryptographic strength of the target edge node is less than the preset cryptographic strength threshold, a risk warning is generated to remind the engineer to upgrade the cryptographic algorithm of the target edge node. The target edge node is any one of multiple edge nodes.

[0089] In the above steps, if the modified password strength of the target edge node is less than the preset password strength threshold, it indicates that the password algorithm of the target edge node has weak risk adaptability in the current business scenario. In this case, a risk warning is generated to remind engineers to upgrade the password algorithm of the target edge node to improve its security protection capabilities. If the modified password strength of the target edge node is greater than or equal to the preset password strength threshold, it indicates that the password algorithm of the target edge node still has high password strength in the current business scenario, that is, it can adapt to the risks of the current business scenario, and no processing is required.

[0090] Referring to Figure 2, this application also provides a cryptographic strength evaluation system based on industrial IoT edge nodes. The system is a node management gateway, and includes an acquisition module 1, a processing module 2, and a sending module 3, wherein:

[0091] Module 2 is used to acquire current business scenario information and match multiple edge nodes based on the current business scenario information; input the multiple edge nodes into a preset node association knowledge graph for association clustering to obtain the association node graph corresponding to each of the multiple edge nodes;

[0092] Processing module 2 is used to calculate the statistical parameters corresponding to each of the multiple edge nodes based on the associated node graphs of each edge node. The statistical parameters include the number of associated nodes, the average performance decay coefficient, and the information entropy of cryptographic components. Based on the statistical parameters corresponding to each of the multiple edge nodes, it calculates the risk propagation coefficient corresponding to each of the multiple edge nodes. Based on the risk propagation coefficient corresponding to each of the multiple edge nodes, it corrects the cryptographic strength of the multiple edge nodes to obtain the corrected cryptographic strength of each of the multiple edge nodes.

[0093] The sending module 3 is used to generate a risk warning if the modified password strength of the target edge node is less than the preset password strength threshold, so as to remind the engineer to upgrade the password algorithm of the target edge node. The target edge node is any one of multiple edge nodes.

[0094] It should be noted that the above embodiments of the apparatus are only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0095] This application also discloses an electronic device. Referring to FIG3, FIG3 is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. The electronic device 300 may include: at least one processor 301, at least one network interface 304, a user interface 303, a memory 305, and at least one communication bus 302.

[0096] The communication bus 302 is used to enable communication between these components.

[0097] The user interface 303 may include a display screen and a camera. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0098] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0099] The processor 301 may include one or more processing cores. The processor 301 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 305, and by calling data stored in memory 305. Optionally, the processor 301 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 301 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 301 and may be implemented as a separate chip.

[0100] The memory 305 may include random access memory (RAM) or read-only memory. Optionally, the memory 305 may include a non-transitory computer-readable storage medium. The memory 305 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 305 may also be at least one storage device located remotely from the aforementioned processor 301. Referring to FIG3, the memory 305, as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for a cryptographic strength evaluation method based on an industrial Internet of Things edge node.

[0101] In the electronic device 300 shown in Figure 3, the user interface 303 is mainly used to provide an input interface for the user and obtain user input data; while the processor 301 can be used to call an application stored in the memory 305 for a cryptographic strength evaluation method based on industrial IoT edge nodes. When executed by one or more processors 301, the electronic device 300 performs one or more of the methods described in the above embodiments. It should be noted that, for the foregoing method embodiments, for the sake of simplicity, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily necessary for this application.

[0102] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0103] In the various embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some service interface; the indirect coupling or communication connection between apparatuses or units may be electrical or other forms.

[0104] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0105] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0106] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0107] The above description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Other embodiments of this disclosure will be readily apparent to those skilled in the art upon consideration of the specification and the disclosure of practical truths.

[0108] This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

Claims

1. A method for evaluating cryptographic strength based on industrial IoT edge nodes, characterized in that, The method, applied in a node management gateway, includes: acquiring current business scenario information and matching multiple edge nodes based on the current business scenario information; inputting the multiple edge nodes into a preset node association knowledge graph for association clustering to obtain an association node graph corresponding to each of the multiple edge nodes; calculating statistical parameters corresponding to each of the multiple edge nodes based on the association node graphs, the statistical parameters including the number of associated nodes, the average performance decay coefficient, and the information entropy of cryptographic components; calculating risk propagation coefficients corresponding to each of the multiple edge nodes based on the statistical parameters; correcting the cryptographic strength of the multiple edge nodes based on the risk propagation coefficients, to obtain corrected cryptographic strengths corresponding to each of the multiple edge nodes; if the corrected cryptographic strength of a target edge node is less than a preset cryptographic strength threshold, generating a risk warning to remind engineers to upgrade the cryptographic algorithm of the target edge node, where the target edge node is any one of the multiple edge nodes.

2. The method according to claim 1, characterized in that, The connection edge relationship between any two connected nodes in the preset node association knowledge graph includes any one of the following: data flow dependency relationship, logical control relationship, and physical co-location relationship.

3. The method according to claim 1, characterized in that, Based on the associated node graphs corresponding to each of the multiple edge nodes, the average performance degradation coefficient of each of the multiple edge nodes is calculated. Specifically, this includes: obtaining standard performance parameter data and real-time performance parameter data of a first edge node, where the first edge node is any one of the multiple edge nodes; comparing the standard performance parameter data with the real-time performance parameter data to obtain the performance degradation coefficient of the first edge node; calculating the pitch between the multiple associated edge nodes in the associated node graph of the first edge node and the first edge node; determining the risk weights of the multiple associated edge nodes based on the pitches between the multiple associated edge nodes and the first edge node; and calculating the average performance degradation coefficient of the first edge node based on the risk weights and performance degradation coefficients of the multiple associated edge nodes.

4. The method according to claim 1, characterized in that, Based on the associated node graphs corresponding to the multiple edge nodes, the cryptographic component information entropy corresponding to each of the multiple edge nodes is calculated. Specifically, starting from the second edge node, the associated node graph of the second edge node is traversed according to an arithmetic progression of 1, 2, 3, ..., n with a pitch interval of 1, to obtain multiple arithmetic progression groups, where the second edge node is any one of the multiple edge nodes; the cryptographic component information entropy of the multiple arithmetic progression groups is calculated respectively; and the cryptographic component information entropy of the multiple arithmetic progression groups is weighted and fused to obtain the cryptographic component information entropy of the second edge node.

5. The method according to claim 4, characterized in that, The step of calculating the cryptographic component information entropy of multiple arithmetic pitch groups specifically includes: identifying the pitch value of the arithmetic pitch group to be calculated, wherein the arithmetic pitch group to be calculated is any one of the multiple arithmetic pitch groups; matching the minimum information entropy calculation unit of the arithmetic pitch group to be calculated from a preset pitch-minimum information entropy calculation unit mapping table according to the pitch value of the arithmetic pitch group to be calculated, wherein the minimum information entropy calculation unit includes a component unit, an algorithm unit, and a parameter unit; and calculating the cryptographic component information entropy of the arithmetic pitch group to be calculated based on the minimum information entropy calculation unit of the arithmetic pitch group to be calculated.

6. The method according to claim 4, characterized in that, The step of weighted summing of the cryptographic component information entropies of multiple arithmetic interval groups to obtain the cryptographic component information entropy of the second edge node further includes: taking the second edge node as the starting point, traversing the number of nodes in multiple arithmetic interval groups one by one; determining the effective risk radius based on a preset node number ratio threshold; and calculating the cryptographic component information entropy within the effective risk radius based on the effective risk radius.

7. The method according to claim 1, characterized in that, The step of calculating the risk propagation coefficient corresponding to each of the multiple edge nodes based on their respective statistical parameters specifically involves: converting the statistical parameters corresponding to each of the multiple edge nodes into multiple multidimensional risk vectors, wherein the statistical parameters of one edge node correspond to one multidimensional risk vector; calculating the sample mean vector of the multiple multidimensional risk vectors; using the Mahalanobis distance algorithm, calculating the Mahalanobis distance between each of the multiple multidimensional risk vectors and the sample mean vector; matching the Mahalanobis distances corresponding to each of the multiple multidimensional risk vectors with a preset chi-square distribution mapping table to obtain the chi-square value corresponding to each of the multiple multidimensional risk vectors, wherein the chi-square distribution mapping table includes the correspondence between Mahalanobis distances and chi-square values; and normalizing the chi-square values ​​corresponding to each of the multiple multidimensional risk vectors to obtain the risk propagation coefficient corresponding to each of the multiple edge nodes.

8. A cryptographic strength evaluation system based on industrial Internet of Things edge nodes, characterized in that, The system is a node management gateway, comprising an acquisition module (1), a processing module (2), and a sending module (3), wherein: the acquisition module (1) is used to acquire current business scenario information and match multiple edge nodes according to the current business scenario information; input the multiple edge nodes into a preset node association knowledge graph for association clustering to obtain the association node graph corresponding to each of the multiple edge nodes; the processing module (2) is used to calculate the statistical parameters corresponding to each of the multiple edge nodes based on the association node graph corresponding to each of the multiple edge nodes, the statistical parameters including the number of associated nodes, the average performance decay coefficient, and the information entropy of cryptographic components; calculate the risk propagation coefficient corresponding to each of the multiple edge nodes according to the statistical parameters corresponding to each of the multiple edge nodes; and correct the cryptographic strength of the multiple edge nodes according to the risk propagation coefficient corresponding to each of the multiple edge nodes to obtain the corrected cryptographic strength corresponding to each of the multiple edge nodes; the sending module (3) is used to generate a risk warning if the corrected cryptographic strength of the target edge node is less than a preset cryptographic strength threshold, so as to remind engineers to upgrade the cryptographic algorithm of the target edge node, the target edge node being any one of the multiple edge nodes.

9. An electronic device, characterized in that, The device includes a processor (301), a memory (305), a user interface (303), and a network interface (304). The memory (305) is used to store instructions. The user interface (303) and the network interface (304) are used to communicate with other devices. The processor (301) is used to execute the instructions stored in the memory (305) to cause the electronic device (300) to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed, perform the method as described in any one of claims 1 to 7.

Images