Near-field security authentication method, device, equipment, storage medium and program product

Abstract

The application relates to a near-field security authentication method and device, equipment, a storage medium and a program product, and relates to the technical field of power operation and maintenance security management. The method comprises the following steps: a power device establishes a Bluetooth connection with a target terminal in response to a Bluetooth connection request and an operation request sent by the target terminal; a Bluetooth channel probe is performed through the Bluetooth connection established between the power device and the target terminal to obtain a current distance between the power device and the target terminal; a security distance threshold corresponding to an operation type identifier carried by the operation request is obtained based on a preset mapping table; and an operation corresponding to the operation request is performed when the current distance is not greater than the security distance threshold. The method can utilize the physical unclonable characteristics of a BLE CS (Bluetooth channel probe), that is, the ranging result of the Bluetooth channel probe is strictly bound to the physical position of the device and cannot be forged by a relay, so that near-field security distance authentication against relay attacks is realized.

Description

Technical Field

[0001] This application relates to the field of power operation and maintenance safety management technology, and in particular to a near-field safety authentication method, device, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] In the field of power operation and maintenance, remote authentication is a common security measure. Maintenance personnel use handheld terminals to enter usernames and passwords, or use digital certificates / U-Keys (U-shields), to authenticate with the meter or backend system via a secure communication channel before performing operations such as switching on / off and configuring parameters. However, this type of authentication scheme is at the information security level and cannot verify whether the operator is physically near the meter. Therefore, it is vulnerable to relay attacks. Attackers can use relay devices to relay legitimate authentication signals to the target meter over a long distance, completing illegal operations without approaching the meter.

[0003] Existing anti-relay attack measures, such as strict communication timeout limits, cannot completely eliminate the risk because electromagnetic waves travel at the speed of light, allowing long-distance relays to complete within a millisecond-level timeout window. Distance-bounding protocols are a theoretical solution to relay attacks, but traditional implementations require additional hardware such as UWB (Ultra Wide Band), increasing deployment costs and complexity. Furthermore, existing remote authentication schemes use binary logic for access control; once authentication is successful, all authorized operations can be executed. They lack fine-grained permission classification based on the actual physical distance between the operator and the meter. For example, they cannot distinguish the security requirements of different operations such as reading data at close range, configuring parameters at medium range, and performing circuit breaker actions at long range, making it difficult to flexibly control operational risks according to the specific field operation scenario. Summary of the Invention

[0004] Based on this, it is necessary to provide a near-field security authentication method, device, computer equipment, computer-readable storage medium, and computer program product that can utilize the physical non-cloning characteristic of BLE CS (Bluetooth Channel Probe), that is, the ranging result of Bluetooth Channel Probe is strictly bound to the physical location of the device and cannot be forged by a repeater, so as to achieve near-field security distance authentication that is resistant to relay attacks.

[0005] In a first aspect, this application provides a near-field security authentication method, which is applied in power equipment, and the method includes:

[0006] In response to Bluetooth connection requests and operation requests sent by the target terminal, establish a Bluetooth connection with the target terminal;

[0007] Bluetooth channel detection is performed through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal;

[0008] Based on a preset mapping table, obtain the safe distance threshold corresponding to the operation type identifier carried in the operation request;

[0009] If the current distance is not greater than the safe distance threshold, execute the operation corresponding to the operation request.

[0010] In one embodiment, Bluetooth channel probing is performed via a Bluetooth connection established with the target terminal to obtain the current distance between the power equipment and the target terminal, including:

[0011] By establishing a Bluetooth connection with the target terminal, multiple Bluetooth channel probes are repeatedly performed to obtain multiple distance measurement results;

[0012] The current distance between the power equipment and the target terminal is determined by statistical processing of multiple distance measurement results.

[0013] In one embodiment, before obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, the method further includes:

[0014] Determine the distance measurement variance based on multiple distance measurement results;

[0015] Accordingly, after obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, the method further includes:

[0016] If the current distance is not greater than the safe distance threshold and the ranging variance is less than the preset threshold, execute the operation corresponding to the operation request.

[0017] In one embodiment, before obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, the method further includes:

[0018] Send a random number challenge to the target terminal;

[0019] Receive the response value returned by the target terminal in response to the random number challenge, and determine the response time between sending the random number challenge and receiving the response value;

[0020] Accordingly, after obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, the method further includes:

[0021] If the current distance is not greater than the safe distance threshold, the distance variance is less than the preset threshold, the response value is a correct response to the random number challenge, and the response time is less than the preset time window, then the operation corresponding to the operation request will be executed.

[0022] In one embodiment, the preset time window is determined based on a safe distance threshold and a preset processing delay.

[0023] In one embodiment, after performing the operation corresponding to the operation request, the method further includes:

[0024] Generate operation records corresponding to the operations;

[0025] Upload the operation log to the target platform;

[0026] Receive alarm information sent by the target platform;

[0027] The alarm information is generated by the target platform based on the operation records of the power equipment, when it determines that the power equipment meets at least one of the following anomaly judgment conditions:

[0028] Within a preset time range, the fluctuation range of the current distance corresponding to multiple consecutive operation requests exceeds the preset fluctuation threshold;

[0029] The current distance reported multiple times is within the danger zone corresponding to the safe distance threshold;

[0030] The difference between the distance measurement variance in the operation log and the historical baseline variance is greater than the set value; the historical baseline variance is determined by the target platform based on the historical operation logs of the power equipment.

[0031] Secondly, this application also provides a near-field security authentication device, which is applied in power equipment, and the device includes:

[0032] The connection module is used to establish a Bluetooth connection with the target terminal in response to Bluetooth connection requests and operation requests sent by the target terminal.

[0033] The ranging module is used to perform Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal;

[0034] The authentication module is used to obtain the safe distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table; if the current distance is not greater than the safe distance threshold, the operation corresponding to the operation request is executed.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0036] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0038] The aforementioned near-field security authentication method, device, computer equipment, computer-readable storage medium, and computer program product involve a power device responding to a Bluetooth connection request and operation request sent by a target terminal, establishing a Bluetooth connection with the target terminal, performing Bluetooth channel probing through the established Bluetooth connection to obtain the current distance between the power device and the target terminal, obtaining the security distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, and executing the operation corresponding to the operation request if the current distance is not greater than the security distance threshold. This approach abandons the traditional authentication method that relies solely on the communication protocol layer, instead utilizing the physical layer ranging capability of Bluetooth channel probing to strictly bind security authentication to the actual physical location of the operating terminal. Attackers cannot bypass distance verification through remote signal relay, fundamentally eliminating the security vulnerability of existing remote authentication schemes that can still be relayed within millisecond-level timeout windows. A preset mapping table configures corresponding security distance thresholds for operation types with different sensitivity levels. Before executing an operation, the current distance between the target terminal and the power device is obtained in real time; authorization is granted when this distance is not greater than the corresponding security distance threshold, making permission management more flexible and precise. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a diagram illustrating the application environment of a near-field security authentication method in one embodiment.

[0041] Figure 2 This is a flowchart illustrating a near-field security authentication method in one embodiment;

[0042] Figure 3 This is a schematic diagram of a preset mapping table in one embodiment;

[0043] Figure 4This is a schematic diagram of the authentication process in a normal operation scenario and a relay attack scenario in one embodiment;

[0044] Figure 5 This is a schematic diagram of the architecture of a near-field security authentication system in one embodiment.

[0045] Figure 6 This is a schematic diagram of the interaction process between power equipment and target terminal in one embodiment;

[0046] Figure 7 This is a structural block diagram of a near-field security authentication device in one embodiment;

[0047] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0049] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0050] The near-field security authentication method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, the power equipment 102 communicates with the server 104 via a network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated onto the server 104, or it can be located in the cloud or on another network server.

[0051] In this embodiment, the power equipment 102 responds to the Bluetooth connection request and operation request sent by the target terminal, establishes a Bluetooth connection with the target terminal, performs Bluetooth channel detection through the established Bluetooth connection to obtain the current distance between the power equipment and the target terminal, obtains the safe distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, and executes the operation corresponding to the operation request if the current distance is not greater than the safe distance threshold. It is understood that this embodiment constructs a security authentication protocol based on physical distance, using the high-precision physical ranging results of BLE CS as a necessary condition for security authentication. Sensitive operations of the power equipment are only allowed after the physical distance verification is passed.

[0052] Among them, power equipment 102 refers to various power consumption or distribution facilities installed on-site in the power distribution network, including but not limited to electricity meters, distribution boxes, switch cabinets, branch boxes, cable joints, and other target objects with unique identification that require regular inspection or operation. Target terminals can be, but are not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, handheld terminals, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart vehicle equipment, projection equipment, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0053] In one exemplary embodiment, such as Figure 2 As shown, a near-field security authentication method is provided, which is applied to... Figure 1 The following explanation uses electrical equipment 102 as an example, including:

[0054] Step 202: In response to the Bluetooth connection request and operation request sent by the target terminal, establish a Bluetooth connection with the target terminal.

[0055] The target terminal refers to a mobile intelligent device carried by power operation and maintenance personnel, including but not limited to smartphones, tablets, or dedicated handheld terminals, on which an application (APP) for power equipment operation and maintenance is installed. An operation request refers to a data packet containing instructions for the operation to be performed, sent from the target terminal to the power equipment. This packet includes at least an operation type identifier (such as closing, opening, parameter configuration, data reading, etc.), operation parameters (such as configuration values ​​or read addresses), and an operator identity token (used for subsequent identity authentication and auditing records).

[0056] In one optional implementation, the power device has Bluetooth broadcast enabled by default and is in a discoverable state, continuously listening for Bluetooth connection requests from target terminals. When the target terminal's app discovers the power device through scanning and triggers a connection operation, the target terminal sends a Bluetooth connection request (including connection parameters, device address, etc.) to the power device. Upon receiving the request, the power device establishes a physical link with the target terminal according to the standard Bluetooth Low Energy (BLE) connection procedure. During the connection establishment process, both parties can negotiate link-layer security parameters, such as using LE Secure Connections for encrypted pairing to ensure the confidentiality and integrity of the communication link; alternatively, if pairing is not required, security can also be ensured through subsequent application-layer encryption.

[0057] For example, to ensure connection stability, the power device can set a connection timeout (e.g., 30 seconds). If the connection is not completed or is interrupted within the timeout period, the process is terminated and an error status is returned, allowing the target terminal to retry. After the connection is established, the target terminal can send an operation request to the power device through the BLE link. The power device receives and parses the request, obtaining the operation type, parameters, and identity token, preparing for subsequent distance measurement and permission determination. In addition, the power device also records the connection establishment timestamp and the target terminal's device address as initial information for the audit log.

[0058] Step 204: Perform Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal.

[0059] Bluetooth Channel Sounding (BLE CS) is a ranging technique that utilizes the time-of-flight and phase rotation characteristics of Bluetooth physical layer signals during spatial propagation. It calculates the straight-line distance between two devices through bidirectional ranging frame exchange and phase measurement. The current distance refers to the estimated straight-line distance between the power equipment and the target terminal obtained within the current ranging cycle.

[0060] In one optional implementation, after the power equipment and the target terminal establish a BLE connection, one of them initiates a CS ranging procedure. Exemplarily, the CS ranging procedure includes: the initiator sending a ranging request frame, the responder returning a response frame containing timestamps or phase information, both parties collecting phase measurements at multiple frequencies through multiple frame exchanges, and calculating the distance based on round-trip time (RTT) or phase difference. This procedure requires no additional hardware and fully reuses the BLE standard physical layer and link layer. Optionally, the target device's application initiates the CS ranging procedure.

[0061] Optionally, to reduce user waiting time, CS ranging can be performed in parallel with the transmission of operation requests. That is, after establishing a Bluetooth connection in step S102, the power device starts the CS ranging thread at the same time as receiving the operation request.

[0062] Optionally, the power equipment can perform multiple CS ranging measurements, discarding obvious outliers and taking the median or weighted average as the final current distance to improve measurement stability. Furthermore, if multipath interference exists in the environment, such as when the power equipment is located in an underground parking garage or near dense meter boxes, ranging can be performed alternately on different physical channels and the results fused, or Kalman filtering can be used to smooth the distance sequence. If the CS ranging timeout occurs, for example, if no valid result is returned after more than 2 seconds, it is considered a ranging failure, the operation is terminated, an error code is returned, and the target terminal is allowed to retry.

[0063] Step 206: Based on the preset mapping table, obtain the safe distance threshold corresponding to the operation type identifier carried in the operation request.

[0064] The preset mapping table refers to a set of policy data that is predefined and stored in the local non-volatile memory of the power equipment, or stored in a cloud-based security management platform and can be synchronized to the power equipment as needed. This table records the correspondence between operation type identifiers and safety distance thresholds in key-value pairs. The operation type identifier is a code or string included in the operation request in step S102, used to uniquely distinguish different operation categories. The safety distance threshold refers to the maximum physical distance allowed for the safe execution of a certain type of operation; the smaller the threshold, the higher the near-field safety requirements for that operation.

[0065] In one optional implementation, the power equipment parses the operation request sent by the target terminal, extracts the operation type identifier, and performs an exact match query in the preset mapping table. If the query is successful, the corresponding safety distance threshold is returned directly; if the query fails, i.e., the operation type is not defined in the preset mapping table, the power equipment can take one of the following strategies: refuse to execute the operation and return an error message; or use a preset default safety distance threshold, such as taking the minimum value among all thresholds to ensure conservative safety; or request a real-time policy update from the backend system.

[0066] Optionally, the preset mapping table can support a dynamic update mechanism: power equipment periodically pulls the latest policy table from the cloud security management platform, or receives update instructions actively pushed from the background, to flexibly adapt to security level adjustments in different deployment environments. Furthermore, the cloud security management platform can be deployed as a cloud policy center, enabling centralized configuration, version management, and batch distribution of mapping tables for all power equipment in the network. Operations administrators can modify the distance threshold for any operation type at any time via the cloud console, with immediate effect, without requiring on-site configuration. Optionally, the mapping table can also be configured with additional rules based on time periods or operator roles, such as enforcing stricter thresholds during nighttime or holidays, or granting a slightly wider threshold range to senior maintenance personnel. Optionally, the mapping table can also support an emergency mode: when a security threat is detected or an emergency instruction is received, the distance requirements for all operations can be temporarily tightened, such as uniformly lowering all thresholds by 50% or setting them to the minimum safe value, until the emergency is lifted; this emergency policy can be triggered with one click via the cloud and synchronized to all relevant power equipment.

[0067] For example, the safe distance threshold is 10 meters for the operation type of reading meter operating data; 3 meters for modifying meter configuration parameters; 2 meters for performing a circuit breaker operation; 1 meter for entering calibration / test mode; and 2 meters for firmware upgrade, which requires additional authentication. The safe distance threshold can be flexibly configured according to the security level of the meter deployment environment; for example, stricter distance thresholds can be used for meters in public areas.

[0068] Step 208: If the current distance is not greater than the safe distance threshold, execute the operation corresponding to the operation request.

[0069] The operation corresponding to the execution of the operation request refers to the power equipment calling the local function module to complete specific business actions based on the operation type identifier and operation parameters contained in the operation request, such as reading meter data, modifying configuration parameters, performing circuit breaker operation, or entering calibration mode.

[0070] In a specific implementation, after completing distance measurement and threshold query, the power equipment compares the current distance value with the safe distance threshold. If the current distance is less than or equal to the threshold, it is determined that the operator is within the permissible physical near-field range, meeting the safety authorization conditions, and the power equipment then executes the requested operation. If the current distance is greater than the safe distance threshold, the operation is refused, and the power equipment returns a rejection response to the target terminal, prompting the operator to move closer to the equipment and try again.

[0071] Optionally, if an anomaly occurs during operation, such as communication interruption or hardware failure, the power equipment should roll back to its pre-operation state and record the reason for the failure. After the operation is completed, the power equipment can choose to maintain the connection or actively disconnect, depending on the preset strategy. For example, for high-risk operations such as switching on and off, it is recommended to immediately disconnect and require re-authentication after execution to enhance security. All the above judgment and execution processes are completed in real time within the power equipment, without relying on the backend network, thus ensuring that the security authorization logic can still be executed normally in environments with weak signals or without a public network.

[0072] In the aforementioned near-field security authentication method, the power equipment responds to the Bluetooth connection request and operation request sent by the target terminal, establishing a Bluetooth connection with the target terminal. Through this established Bluetooth connection, Bluetooth channel probing is performed to obtain the current distance between the power equipment and the target terminal. Based on a preset mapping table, the safe distance threshold corresponding to the operation type identifier carried in the operation request is obtained. If the current distance is not greater than the safe distance threshold, the operation corresponding to the operation request is executed. This method abandons the traditional authentication method that relies solely on the communication protocol layer, instead utilizing the physical layer ranging capability of Bluetooth channel probing to strictly bind security authentication to the actual physical location of the operating terminal. Attackers cannot bypass distance verification through remote signal relay, fundamentally eliminating the security vulnerability of existing remote authentication schemes that can still be relayed within millisecond-level timeout windows. A preset mapping table configures corresponding safe distance thresholds for operation types with different sensitivity levels. Before executing an operation, the current distance between the target terminal and the power equipment is obtained in real time; authorization is granted when this distance is not greater than the corresponding safe distance threshold, making permission management more flexible and precise.

[0073] In an exemplary embodiment, step 204 includes: repeatedly performing Bluetooth channel probing multiple times through a Bluetooth connection established with the target terminal to obtain multiple distance measurement results; and performing statistical processing based on the multiple distance measurement results to determine the current distance between the power equipment and the target terminal.

[0074] The distance measurement result refers to the raw distance estimate output after a single CS ranging process is completed. Statistical processing refers to the process of cleaning and mathematically aggregating data from multiple measurement results to suppress the impact of random noise and multipath interference on ranging accuracy. The current distance refers to the final distance estimate obtained after statistical processing, which serves as the basis for subsequent permission determination.

[0075] Understandably, upon receiving an operation request from the target terminal, the power equipment does not immediately execute the operation but instead initiates a repeated ranging process. The power equipment and the target terminal continuously perform N CS ranging operations over the established BLE connection, where N is a preset positive integer, ranging from, for example, 5 to 10 times. For example, each ranging operation alternates across multiple frequency channels to obtain rich phase samples; a single ranging operation takes approximately 20 to 50 milliseconds, and the total time for N ranging operations is controlled to within 1 second to ensure a good user experience.

[0076] After N ranging measurements, the power equipment obtains the original distance sequence {d1, d2, ..., dN}. The power equipment performs statistical processing on this sequence: the median is taken as the final current distance. The median is naturally robust to outliers and suitable for distance estimation in multipath environments. Alternatively, a weighted average method can be used, for example, by using the reciprocal of the ranging variance as the weight for a weighted summation; the smaller the variance, the greater the weight, thus statistically optimizing the distance estimation accuracy. Optionally, to improve the robustness of ranging in multipath environments, the power equipment can specify that CS ranging is performed alternately on different physical channels, and calculate the channel quality weight for the measurement results on each channel, ultimately fusing them into a single distance estimate. All the above statistical processing is completed locally on the power equipment, without relying on the backend network, ensuring that the ranging verification process can still be executed normally in environments with weak signals or without a public network.

[0077] In an exemplary embodiment, before step 206, the method further includes: determining the distance variance based on multiple distance measurement results; correspondingly, after step 206, the method further includes: performing the operation corresponding to the operation request when the current distance is not greater than a safe distance threshold and the distance variance is less than a preset threshold.

[0078] Among them, ranging variance refers to the sample variance obtained by statistically calculating the original distance sequences obtained from multiple Bluetooth channel probes. It is used to quantify the dispersion between each measurement result, and its value directly reflects the quality of the current wireless channel environment: the smaller the variance, the more concentrated the measurement results and the higher the ranging reliability; the larger the variance, the higher the multipath interference, signal fading, or noise level, and the lower the reliability of the ranging results. The preset threshold refers to the upper limit of variance pre-configured in the power equipment, which serves as a threshold for determining whether the ranging confidence level is acceptable.

[0079] In one optional implementation, after the power equipment performs N consecutive CS ranging operations and obtains the original distance sequence {d1, d2, ..., dN}, in addition to determining the current distance according to the aforementioned statistical processing method, it simultaneously calculates the sample variance of the sequence, or uses the mean absolute deviation as a substitute indicator. After comparing the current distance with the safe distance threshold, the power equipment further compares the ranging variance with a preset threshold. Only when the current distance is less than or equal to the safe distance threshold and the ranging variance is less than the preset threshold, does the power equipment determine that the distance verification is completely passed and allow the execution of the operation corresponding to the operation request. If the variance is greater than or equal to the preset threshold, even if the distance meets the requirements, the power equipment still rejects the operation and returns a relevant prompt to the target terminal, such as: insufficient wireless channel quality, ranging result is unreliable, please retry or move to an area with better signal. For example, this rejection event due to channel quality is also recorded in the audit log to assist maintenance personnel in assessing the impact of the field environment on the reliability of ranging.

[0080] Optionally, power equipment can employ an adaptive handling strategy for variance exceeding the limit, rather than simply rejecting the operation. For example, when the variance is between 80% and 100% of a preset threshold, additional ranging operations are performed and the variance is recalculated, such as increasing N=10 from N=5. If the situation improves, the operation continues. If the variance exceeds the threshold but the operational risk level is low (such as reading data), the operation can be allowed but with reduced access privileges (e.g., only returning some non-sensitive data), and authorization under low-confidence ranging is noted in the audit log. For high-risk operations (such as switching on and off), the operation is strictly rejected.

[0081] Optionally, the preset threshold can be dynamically adjusted. Power equipment can record historical ranging variance distribution and adaptively update the threshold during long-term operation to adapt to the actual local channel environment; the backend system can also push differentiated thresholds according to the geographical location of the power equipment, such as relaxing the threshold in underground parking garages and tightening the threshold in open areas, thereby achieving the best balance between security and availability.

[0082] In this embodiment, the ranging variance determination is used as an additional security gating condition for distance comparison, which significantly improves the anti-spoofing ability of the ranging results and the overall authentication robustness.

[0083] In an exemplary embodiment, before step 206, the method further includes: sending a random number challenge to the target terminal; receiving the response value returned by the target terminal for the random number challenge, and determining the response time between sending the random number challenge and receiving the response value; correspondingly, after step 206, the method further includes: if the current distance is not greater than a safe distance threshold, the ranging variance is less than a preset threshold, the response value is a correct response to the random number challenge, and the response time is less than a preset time window, then the operation corresponding to the operation request is executed.

[0084] The nonce challenge refers to an unpredictable random number generated by the power equipment to prevent attackers from bypassing authentication by replaying past legitimate responses. Its response time also serves as an indirect measure of physical distance, making the additional latency introduced by relay attacks unacceptable within the time window constraint. The response value is the verification result returned by the target terminal after processing the nonce challenge using a pre-shared key or an agreed-upon cryptographic algorithm. The response time is the time interval between the power equipment issuing the nonce challenge and the power equipment fully receiving the response value.

[0085] In one alternative implementation, the power equipment, while performing the CS ranging procedure or immediately after ranging is completed, sends a random number challenge to the target terminal via the established BLE connection and starts a local timer. Upon receiving the challenge, the target terminal calculates the response value using its internally stored key or according to a pre-agreed cryptographic algorithm and replies immediately. The power equipment stops timing and records the response time after fully receiving the response value.

[0086] Understandably, a preset time window refers to the maximum allowable time from when the power equipment issues a challenge to when a correct response must be received, used to limit the response time to the signal propagation time corresponding to the physical near-field location. Optionally, this preset time window can be pre-set, i.e., a fixed time value directly configured in the power equipment or backend system.

[0087] In one exemplary embodiment, the preset time window is determined based on a safe distance threshold and a preset processing delay.

[0088] The preset processing delay refers to the inherent time overhead required for the target terminal to send out a correct response value from receiving the random number challenge, including the time for calculating the response value and protocol stack processing. Its value can be calibrated through laboratory testing or obtained through device capability information exchange during the BLE connection establishment phase. Optionally, the preset time window is a dynamically calculated upper limit based on the safe distance threshold for this operation, and its mathematical expression is:

[0089] T_max=2×D_threshold / c+t_processing;

[0090] In the formula, c is the speed of light; t_processing is the preset processing delay. If the actual physical distance to the target terminal exceeds the allowable range, the round-trip propagation time of the wireless signal will inevitably exceed T_max. Even under ideal channel conditions, it will be impossible to complete the response within the window, thus effectively defending against relay attacks. This is because the additional delay introduced by the relay device will significantly increase the response time, causing it to exceed the window.

[0091] Optionally, the t_processing time in the preset time window can be dynamically adjusted according to the target terminal's model or capabilities, for example, by exchanging device capability information during the connection establishment phase.

[0092] Understandably, the power equipment sequentially verifies four conditions: (1) the current distance is less than or equal to the safe distance threshold; (2) the distance variance is less than the preset threshold; (3) the received response value is completely consistent with the locally calculated expected response value; and (4) the response time is less than T_max. When all conditions are met simultaneously, the safety verification is deemed to have passed completely and the operation is executed; if any condition is not met, execution is refused and the corresponding error reason is returned, and the failed attempt is recorded in the audit log.

[0093] Optionally, the challenge and response mechanism can be executed in parallel with CS ranging, that is, random number challenges are sent intermittently while ranging frames are being exchanged, so that the time constraint verification does not significantly increase the overall process time.

[0094] In this embodiment, in addition to distance verification, a hard time constraint based on physical propagation delay is added, which improves the ability to resist relay attacks.

[0095] In one alternative implementation, the preset mapping table can be adopted as follows: Figure 3 The strategy configuration shown clearly demonstrates the correspondence between different operation types and safe distance thresholds, CS ranging confidence requirements, and additional safety conditions. Figure 3 The system defines five typical operation types, with the corresponding safety distance threshold for each type gradually tightening as the sensitivity of the operation increases. Reading operational data is considered a low-risk operation, permissible from a relatively long distance (within 10 meters) to ensure convenience for routine inspections. Modifying configuration parameters and performing circuit breaker operation are considered medium-risk operations, requiring the operator to be within 3 meters and 2 meters respectively. Calibration / testing mode is a high-risk operation, requiring the operator to be within 1 meter, ensuring that only personnel very close to the equipment can enter this mode. While firmware upgrades have the same distance requirements as circuit breaker operation, they are further reinforced with additional safety requirements due to their significant impact on equipment integrity and stability. The different thresholds corresponding to different sensitivity levels allow for low-risk routine operations without requiring excessive proximity to the equipment, while high-risk operations require the operator to be close to the equipment's vicinity, achieving a balance between safety and convenience.

[0096] Figure 3Different ranging confidence requirements are configured for different operation types, using ranging variance as a quantitative indicator. The smaller the variance threshold, the higher the requirement for the stability and reliability of the ranging results. Specifically, reading operational data requires medium confidence (variance < 0.3), because slight ranging fluctuations at longer distances have limited impact on low-risk operations; modifying configuration parameters, performing power on / off switching, and firmware upgrades all require high confidence (variance < 0.15) to ensure accurate and reliable ranging results at close ranges and avoid misauthorization due to channel fluctuations; calibration / testing mode requires extremely high confidence (variance < 0.05), and can only be entered when the wireless channel quality is excellent and multiple ranging results are highly consistent, fundamentally eliminating the possibility of ranging deviations caused by multipath interference. Through this hierarchical design, the ranging confidence requirements are strictly matched with the operational risk level, ensuring the reliability of high-risk operations while avoiding imposing excessively high channel condition requirements on low-risk operations, which could affect operational efficiency.

[0097] Figure 3 The document also defines progressively enhanced security conditions beyond distance and confidence level. Reading runtime data requires no additional requirements; modifying configuration parameters adds identity token verification to confirm the operator's legitimacy; power-on / off switching adds challenge and response time constraints on top of the identity token to provide additional defense against relay attacks; calibration / testing modes further incorporate a two-person witness mechanism, requiring two maintenance personnel with valid identity tokens to be within close range and mutually confirm their presence before entry; firmware upgrades use firmware signature verification instead of challenges and responses to ensure the upgraded firmware image originates from a trusted source and has not been tampered with.

[0098] Understandable Figure 3 The example shown is only a typical configuration. In actual deployment, the parameters in the table can be flexibly adjusted according to the security level of the environment where the electricity meter is located.

[0099] In an exemplary embodiment, after executing the operation corresponding to the operation request, the method further includes: generating an operation record corresponding to the operation; uploading the operation record to the target platform; and receiving alarm information issued by the target platform.

[0100] The alarm information is generated by the target platform based on the operation records of the power equipment, when it determines that the power equipment meets at least one of the following anomaly judgment conditions:

[0101] Within a preset time range, the fluctuation range of the current distance corresponding to multiple consecutive operation requests exceeds the preset fluctuation threshold;

[0102] The current distance reported multiple times is within the danger zone corresponding to the safe distance threshold;

[0103] The difference between the distance measurement variance in the operation log and the historical baseline variance is greater than the set value; the historical baseline variance is determined by the target platform based on the historical operation logs of the power equipment.

[0104] Operation logs refer to structured data entries generated by power equipment after an operation is completed. These entries include fields such as operation type, timestamp, distance measured (i.e., current distance), operator identity token, distance variance, and operation result. They are used for subsequent auditing and anomaly analysis. The target platform refers to a cloud-based power operation and maintenance security audit system with data storage, pattern analysis, and alarm rule engine functions. Alarm information is a notification message sent by the target platform to the power equipment or management terminal after detecting abnormal behavior patterns. It may include the alarm type, risk level, and suggested handling measures.

[0105] Understandably, after the operation is completed, the power equipment generates a complete record of the operation and can return the execution result to the handheld terminal through the BLE secure channel. The power equipment then asynchronously uploads the operation record to the target platform using its own network connection. If the upload fails due to network unavailability, the locally cached record will not be uploaded. It will be re-uploaded after the network is restored, and a timestamp will be added to ensure the integrity of the audit chain.

[0106] After receiving the operation records reported by each electricity meter, the target platform executes the following anomaly detection logic. When at least one condition is met, an alarm message is generated and sent to the relevant power equipment or management terminal:

[0107] 1. Distance Fluctuation Anomaly: If, within a preset time range (e.g., 1 minute), the fluctuation amplitude of the current distance corresponding to multiple consecutive operation requests from the same power device exceeds a preset fluctuation threshold, it is considered an anomaly. The fluctuation amplitude refers to the difference between the maximum and minimum distances within that time window; the preset fluctuation threshold can be dynamically set based on the standard deviation of the meter's historical operation distances multiplied by a coefficient (e.g., 3 times). This type of anomaly may indicate that an attacker is testing relay equipment or adjusting signal delay parameters, intending to approach the authorized boundary.

[0108] 2. Distance Critical Anomaly: An alarm is triggered if multiple consecutive reported current distances fall within the danger zone corresponding to the safe distance threshold. The danger zone refers to a narrow band formed by offsetting the safe distance threshold downwards by a certain percentage (e.g., 95% to 100% of the threshold). For example, if the safe distance threshold is 2.0 meters, then 1.95 meters to 2.0 meters is classified as the danger zone. This pattern may reflect an attacker deliberately suppressing the ranging results to the edge of the threshold by precisely controlling the signal delay to pass verification, which is highly suspicious.

[0109] 3. Ranging Variance Baseline Deviation: If the difference between the ranging variance in the operation record and the historical baseline variance is greater than the set value, it is considered abnormal. The historical baseline variance is a reference value obtained by the target platform through statistical calculation (e.g., taking the median or mean) of all ranging variance values ​​reported by the same power equipment during normal operation (e.g., the past 30 days). It represents the variance level under normal channel quality conditions in the environment where the meter is located. The set value can be set as a certain multiple (e.g., 2 times) of the baseline variance or the absolute difference. A variance significantly higher than the baseline usually indicates abnormal interference to the wireless channel, possibly due to an attacker attempting to interfere with the CS ranging process by injecting noise or reflected signals.

[0110] Optionally, the target platform can classify the above-mentioned abnormal conditions into low-risk, medium-risk, and high-risk categories according to their severity. For example, an alarm triggered by a single critical distance is considered low-risk, while the simultaneous occurrence of distance fluctuation and variance deviation is considered high-risk. The platform can also link the work order system to notify the operations and maintenance supervisor for review.

[0111] Optionally, the target platform periodically (e.g., daily) recalculates the historical baseline variance and distance fluctuation threshold for each meter to adapt the baseline to seasonal or environmental changes and avoid false alarms.

[0112] Optionally, the target platform can assign a weighted score to the number of anomalies accumulated by the same device within the sliding time window, and only issue an alarm when the score exceeds a threshold, so as to reduce the false alarm rate caused by a single sporadic interference.

[0113] Optionally, for high-risk alarms, the target platform can remotely trigger the meter to enter a security lock state, preventing any subsequent operations until the administrator manually unlocks it, and push alarm messages to the on-duty personnel's mobile terminals.

[0114] In this embodiment, the above-mentioned local recording and cloud auditing collaboration mechanism enables full lifecycle tracing of operational behavior and intelligent anomaly detection, significantly improving the power operation and maintenance safety situation awareness capability.

[0115] In other alternative implementations, a degraded distance verification scheme can be provided for scenarios where some handheld terminals or power devices lack full Bluetooth Channel Probe (BLE CS) functionality. Specifically, when neither the power device nor the target terminal can perform CS ranging, it can degrade to a coarse distance estimation based on Received Signal Strength Indication (RSSI). RSSI refers to the power strength of the Bluetooth signal received by the target terminal from the power device; its value monotonically decreases with increasing distance but is susceptible to environmental attenuation and interference from signal amplification devices. In this scheme, the power device or target terminal measures the RSSI value of the current Bluetooth link and compares it with a preset RSSI threshold. If the RSSI is greater than the threshold, it is determined that the operator is near the meter, and authorization is granted. It should be noted that this degradation scheme is less secure than the CS ranging scheme because RSSI can be forged by signal amplifiers, but it is simple to implement, widely compatible, and still offers a significant security improvement compared to traditional schemes that do not perform physical distance verification at all. The RSSI threshold can be dynamically calibrated according to the deployment environment and can be averaged from multiple measurements to suppress instantaneous fluctuations.

[0116] In another optional implementation, the aforementioned preset mapping table may not be stored locally on the power equipment, but instead is centrally maintained and distributed by a cloud-based security management platform. In this implementation, after receiving an operation request, the power equipment does not query the local mapping table, but instead sends a query request to the cloud platform via a secure network connection. This request can carry the operation type identifier and the equipment identifier, and the cloud platform returns the currently applicable safe distance threshold in real time. This method supports centralized management and instant updates of policies. For example, in the event of a sudden security incident or emergency, the operations and maintenance administrator can tighten the distance requirements for all operations with a single click through the cloud console, such as uniformly reducing all thresholds to 50% of their original values.

[0117] In another optional implementation, the method further includes: achieving real-time location sharing among multiple personnel, intelligent dynamic task reallocation, and collaborative search through BLE communication between terminals and cloud data sharing among maintenance personnel, thereby improving the efficiency of collaborative work among multiple maintenance personnel. Each terminal periodically reports its own location, current work status, and completed work order information to the cloud task management platform. The cloud platform integrates the location data and task progress of all terminals to construct a global work status map. Based on the above information sharing mechanism, the cloud platform maintains a list of pending meter tasks, with each task including the meter location and operation type. When a maintenance personnel completes the current task, the terminal sends an idle status to the cloud. The cloud, based on the personnel's current location, combined with the locations of other idle personnel and the distribution of pending tasks, uses nearest neighbor allocation or a weighted Hungarian algorithm to dynamically assign the nearest task with a matching operation type to the personnel, while updating the task status to avoid multiple personnel repeatedly going to the same area. In addition, if a task is not completed for a long time after being assigned, such as exceeding a preset time, the cloud automatically reassigns the task to other nearby idle personnel to achieve load balancing. In some application scenarios, there is a need for multiple maintenance personnel to collaboratively search for target power equipment. In collaborative search scenarios, when multiple maintenance personnel need to locate a target power device, each terminal shares its current CS (Cross-Site) distance to the target power device and, combined with its own location coordinates, generates a simplified multi-point positioning heatmap or directional guidance on the terminal app. The cloud platform can record all location trajectories and task allocation history for post-event efficiency analysis and work order optimization.

[0118] Optionally, to reduce implementation complexity, a simplified collaborative solution is provided, particularly suitable for situations where the number of maintenance personnel involved in the search is small (e.g., 2-3 people) or the working environment is relatively open with clearly defined meter distribution. In this simplified solution, there is no need to construct a multi-point positioning heatmap; the current CS distance between each maintenance worker and the target power equipment is directly displayed on their handheld terminal APP. Each maintenance worker verbally communicates their distance value and direction of movement via voice call or walkie-talkie, and then manually coordinates the search path and rendezvous point accordingly. Optionally, the APP can provide simple directional arrows to help maintenance personnel determine whether they are approaching or moving away from the target, thus compensating for the lack of a map heatmap.

[0119] To enhance the immutability of operation audit logs, in an optional embodiment, security audit logs can be combined with blockchain technology. Specifically, after each operation is performed by the power equipment, the hash value of the operation record is written to the blockchain network, while the original operation record can be stored in a local or cloud database. The hash value is a fixed-length digest calculated from the original data using a one-way hash algorithm; any modification to the original data will result in a change in the hash value, which cannot be forged. Through the distributed consensus and chain structure of the blockchain, all stored audit records possess temporal order and immutability, providing irrefutable digital evidence for post-event traceability and compliance audits.

[0120] Understandably, referring to Figure 4 In a normal operating scenario, a legitimate maintenance personnel's handheld terminal is positioned near the target meter, with an actual physical distance of 1.5 meters. After establishing a BLE connection between the handheld terminal and the meter, the meter initiates a BLE CS ranging procedure, performing phase and time-of-flight measurements on multiple frequency channels. After multiple ranging measurements and statistical processing, the meter outputs a current distance d = 1.5 meters. This value is less than the safe distance threshold of 2 meters, thus the distance verification is successful, and the meter is permitted to execute operations initiated by the legitimate operator.

[0121] In a relay attack scenario, the attacker, located more than 100 meters away from the target meter, attempts to forward the authentication signal from a distance to the target meter using two cascaded relay devices (repeater #1 and repeater #2) to deceive the meter into believing the operator is within close range. In this scenario, the total delay of the relay forwarding path (including the 100-meter round-trip delay and the processing delay of the two relay stages) causes the meter to calculate a distance of approximately 100 meters, plus the additional delay and phase error introduced by the relay, far exceeding the 2.0-meter safe distance threshold. The distance verification fails, the meter refuses to perform the operation, and the attacker's relaying behavior is effectively blocked.

[0122] based on Figure 4 The comparison between normal operation scenarios and relay attack scenarios shown in this application embodiment demonstrates that the physical layer ranging mechanism of Bluetooth Channel Probing (BLE CS) is naturally immune to relay attacks. Its anti-attack principle is as follows:

[0123] 1. The physical non-cloning property of Phase-Based Ranging (PBR). BLE CS calculates distance by measuring the spatial phase rotation of the signal across multiple frequency channels. When an attacker uses a relay device to receive, amplify, and forward the signal, the mixing, local oscillator offset, and filtering stages in the RF link inevitably introduce additional phase distortion and nonlinear group delay. These distortions have a non-consistent effect on the phase measurements across different frequency channels, which is exposed as anomalies in the phase response curve during the multi-frequency joint processing of CS, leading to a significant deviation between the final ranging result and the actual physical distance. In other words, relay devices cannot maintain the intelligibility of the signal without altering its phase characteristics, while CS's phase measurement can naturally detect this change.

[0124] 2. Delay accumulation effect based on Time-Trip Time (RTT) ranging. CS's RTT mode measures the round-trip time of a signal in space. The fixed processing delay introduced by the repeater during relaying (even if only tens of nanoseconds) is directly added to the ranging result. Under the speed of light conditions, a 1-nanosecond delay corresponds to a distance error of approximately 0.3 meters, which is sufficient to push a relay signal that originally met the safety threshold beyond the threshold. More importantly, the non-idealities of the signal path in relay scenarios, such as buffer jitter and clock asynchrony, will lead to a significant increase in the variance of consecutive RTT measurements. This statistical characteristic can be identified by the quality detection mechanism of power equipment and trigger a rejection decision.

[0125] 3. The Hard Cutoff Effect of Challenge and Response Time Constraints. In addition to the physical layer protection inherent in CS ranging itself, the preset time window (T_max) introduced in this application further compresses the survival space of relay attacks at the system level. Even if an attacker uses a low-latency, high-speed relay device, the cumulative delay caused by the inherent multi-round interactive frame exchange in the CS ranging protocol will physically exceed the strictly set time window. This window uses the speed of light propagation limit as a hard constraint; any terminal located outside the allowed distance, regardless of the relay device's performance, will not be able to meet the T_max condition in its end-to-end response time.

[0126] 4. The fundamental difference from upper-layer security protocols (such as TLS). Traditional security protocols like TLS protect the confidentiality and integrity of communication content, ensuring the authenticity of the identities of both parties through encryption and certificate mechanisms. However, they cannot verify the physical location of the other end of the communication; certificate holders can complete authentication from any geographical location. In contrast, BLE CS ranging directly measures the propagation delay and phase rotation of radio frequency signals in physical space. Its results are strictly bound to the physical location of the device, making it impossible for a relay device to forge a legitimate short-range ranging result without altering the physical propagation characteristics.

[0127] In one exemplary embodiment, refer to Figure 5 The near-field security authentication system includes: a handheld terminal layer (operation initiator), a power equipment layer (security authentication executor), and a cloud platform layer (security policy and auditing party).

[0128] The handheld terminal includes: a BLECS ranging module, responsible for performing Bluetooth Channel Probe (BLECS) ranging with the power equipment, including phase measurement and round-trip time measurement on multiple frequency channels, and providing the power equipment with the response frame data required for ranging, as the basis for distance calculation by the power equipment; a user authentication module, supporting multiple methods such as password verification, digital certificate verification, or biometric recognition (such as fingerprints and faces), to verify the identity and legitimacy of maintenance personnel before initiating an operation and generate an operator identity token for subsequent auditing and traceability; and an operation request encapsulation module, which encapsulates the operation type, operation parameters, and user identity token into a standardized operation request data packet and submits it to the power equipment via the BLE link.

[0129] The power equipment includes: a BLECS ranging engine, which uses a fusion of phase ranging (PBR) and round-trip time ranging (RTT) to work with the handheld terminal's CS module to perform multiple ranging measurements to determine the current distance; a security policy storage module, which stores a preset operation-distance mapping policy table, defining the safe distance threshold, required CS confidence level, and additional security requirements for various operation types. This module supports local querying and can also be dynamically updated via real-time cloud distribution; a challenge-response verification engine, which sends a random number challenge to the handheld terminal during the CS ranging process, starts a timer, receives the response value, and verifies the correctness of the response value and whether the response time is less than a preset time window; and an atomic operation execution unit, which, after all distance verification, confidence level verification, and challenge-response verification have passed, is responsible for executing the specific business operation within a limited time window (e.g., 500 milliseconds), ensuring the atomicity and consistency of the operation, and automatically rolling back in case of execution failure.

[0130] The cloud platform includes: a security policy management center, responsible for the centralized configuration, version management, and dynamic distribution of distance mapping policies for all electricity meters across the network. Administrators can modify thresholds or additional conditions for any operation type through the cloud console, supporting one-click emergency policy overlay, such as temporarily tightening all distance requirements during sudden security incidents, and ensuring that policy updates are instantly synchronized to all electricity meters. An audit log database receives operation records reported by each electricity meter, storing them in a structured manner by device and time dimensions to build a complete operation audit dataset, supporting retrieval and backtracking by multiple conditions such as operator, time, and device. A historical data analysis module performs statistical analysis on historical operation data in the audit log database, establishing a baseline for normal operation modes for each electricity meter, including historical distance distribution range, historical baseline variance, operation frequency, and other statistical characteristics, providing data support for anomaly detection. An anomaly detection engine performs multi-dimensional anomaly pattern recognition based on historical baseline data and newly reported operation records, including but not limited to: abnormal distance fluctuations from multiple operations on the same device within a very short period, distance values ​​continuously falling within the threshold danger range, and significant deviations in distance variance relative to the historical baseline. The audit report generation module generates structured audit reports based on audit log data, covering information such as the operator's identity, operation time, operation type, CS ranging distance, and operation result for each operation. The anomaly alarm module receives the judgment results from the anomaly detection engine, generates structured alarm information, and notifies operations and maintenance personnel in real time. The blockchain evidence storage module writes the hash value of each operation record to the blockchain network, utilizing the distributed consensus and chain structure of the blockchain to ensure the immutability and chronological order of audit records.

[0131] In one exemplary embodiment, refer to Figure 6 The handheld terminal (APP) and the power equipment (BLE CS module) interact sequentially in five stages to complete a safety operation:

[0132] 1. Phase 1 (Connection Establishment and Operation Request): The APP initiates a BLE connection to the power equipment and simultaneously submits an operation request (including operation type, parameters, and identity token); the power equipment responds to the connection and replies with a ranging trigger confirmation.

[0133] 2. Phase Two (CS Ranging and Distance Verification): Both parties execute the Bluetooth Channel Probe Procedure (CS Procedure), exchanging phase and timestamp data on multiple frequency channels and completing 5 consecutive ranging measurements; the power equipment takes the median to obtain the current distance d_cs and calculates the variance to assess the confidence level.

[0134] 3. Phase Three (Challenge-Response Time Constraint): The power equipment sends a random number challenge (Nonce) and starts timing; the terminal returns a signed response value, and the power equipment verifies the correctness of the response and whether the response time is less than the preset time window T_max, while confirming that d_cs and variance meet the threshold requirements.

[0135] 4. Phase Four (Atomic Operation Execution): After all verifications are passed, the power equipment executes the specific operation within a 500-millisecond window and returns the operation result upon completion.

[0136] 5. Phase Five (Security Audit): The power equipment generates an audit log, including the operation type, d_cs, timestamp, and operator, and sends the log and operation results back to the terminal for confirmation; the power equipment then asynchronously uploads the log to the cloud.

[0137] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0138] Based on the same inventive concept, this application also provides a near-field security authentication device for implementing the near-field security authentication method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more near-field security authentication device embodiments provided below can be found in the limitations of the near-field security authentication method described above, and will not be repeated here.

[0139] In one exemplary embodiment, such as Figure 7 As shown, a near-field security authentication device is provided, which is applied in power equipment. The device includes:

[0140] The connection module 702 is used to establish a Bluetooth connection with the target terminal in response to the Bluetooth connection request and operation request sent by the target terminal;

[0141] The ranging module 704 is used to perform Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal;

[0142] The authentication module 706 is used to obtain the security distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table; and to execute the operation corresponding to the operation request if the current distance is not greater than the security distance threshold.

[0143] The aforementioned near-field security authentication device abandons the traditional authentication method that relies solely on the communication protocol layer. Instead, it utilizes the physical layer ranging capability of Bluetooth channel detection to strictly bind security authentication to the actual physical location of the operating terminal. Attackers cannot bypass distance verification through remote signal relay, fundamentally eliminating the security vulnerability of existing remote authentication schemes that can still be relayed within millisecond-level timeout windows. A preset mapping table configures corresponding security distance thresholds for different sensitivity levels of operation types. Before execution, the current distance between the target terminal and the power equipment is obtained in real time. Authorization is granted when this distance is not greater than the corresponding security distance threshold, making access control more flexible and precise.

[0144] In an exemplary embodiment, the ranging module 704 is further configured to repeatedly perform Bluetooth channel probing multiple times through a Bluetooth connection established with the target terminal to obtain multiple distance measurement results; and to perform statistical processing based on the multiple distance measurement results to determine the current distance between the power equipment and the target terminal.

[0145] In an exemplary embodiment, the ranging module 704 is further configured to determine the ranging variance based on multiple distance measurement results; the authentication module 706 is further configured to execute the operation corresponding to the operation request when the current distance is not greater than the safe distance threshold and the ranging variance is less than the preset threshold.

[0146] In an exemplary embodiment, the authentication module 706 is further configured to send a random number challenge to the target terminal; receive the response value returned by the target terminal for the random number challenge, and determine the response time between sending the random number challenge and receiving the response value; if the current distance is not greater than the safe distance threshold, the ranging variance is less than the preset threshold, the response value is a correct response to the random number challenge, and the response time is less than the preset time window, then the operation corresponding to the operation request is executed.

[0147] In one exemplary embodiment, the preset time window is determined based on a safe distance threshold and a preset processing delay.

[0148] In an exemplary embodiment, the near-field security authentication device further includes: an alarm module, used to generate operation records corresponding to operations; upload the operation records to a target platform; and receive alarm information issued by the target platform; wherein the alarm information is generated by the target platform based on the operation records of the power equipment and when it determines that the power equipment meets at least one of the following abnormal judgment conditions: within a preset time range, the fluctuation amplitude of the current distance corresponding to multiple consecutive operation requests exceeds a preset fluctuation threshold; the current distances reported multiple times are all within the danger zone corresponding to the safe distance threshold; the difference between the distance measurement variance in the operation record and the historical benchmark variance is greater than a set value; the historical benchmark variance is determined by the target platform based on the historical operation records of the power equipment.

[0149] Each module in the aforementioned near-field security authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0150] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a near-field security authentication method.

[0151] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0152] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: in response to a Bluetooth connection request and an operation request sent by a target terminal, establishing a Bluetooth connection with the target terminal; performing Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power device and the target terminal; obtaining a safe distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table; and executing the operation corresponding to the operation request if the current distance is not greater than the safe distance threshold.

[0153] In one embodiment, when the processor executes the computer program, it also performs the following steps: repeatedly performing Bluetooth channel probing multiple times through a Bluetooth connection established with the target terminal to obtain multiple distance measurement results; and performing statistical processing based on the multiple distance measurement results to determine the current distance between the power equipment and the target terminal.

[0154] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining the ranging variance based on multiple distance measurement results; and performing the operation corresponding to the operation request if the current distance is not greater than a safe distance threshold and the ranging variance is less than a preset threshold.

[0155] In one embodiment, when the processor executes the computer program, it further performs the following steps: sending a random number challenge to the target terminal; receiving the response value returned by the target terminal for the random number challenge, and determining the response time between sending the random number challenge and receiving the response value; if the current distance is not greater than the safe distance threshold, the ranging variance is less than the preset threshold, the response value is a correct response to the random number challenge, and the response time is less than the preset time window, then the operation corresponding to the operation request is executed.

[0156] In one embodiment, when the processor executes the computer program, it also performs the following steps: generating an operation record corresponding to the operation; uploading the operation record to the target platform; and receiving alarm information issued by the target platform.

[0157] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: in response to a Bluetooth connection request and an operation request sent by a target terminal, establishing a Bluetooth connection with the target terminal; performing Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal; obtaining a safe distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table; and performing the operation corresponding to the operation request if the current distance is not greater than the safe distance threshold.

[0158] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: repeatedly performing Bluetooth channel probing multiple times through a Bluetooth connection established with the target terminal to obtain multiple distance measurement results; and performing statistical processing based on the multiple distance measurement results to determine the current distance between the power equipment and the target terminal.

[0159] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the ranging variance based on multiple distance measurement results; and performing the operation corresponding to the operation request if the current distance is not greater than a safe distance threshold and the ranging variance is less than a preset threshold.

[0160] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending a random number challenge to the target terminal; receiving the response value returned by the target terminal for the random number challenge, and determining the response time between sending the random number challenge and receiving the response value; if the current distance is not greater than the safe distance threshold, the ranging variance is less than the preset threshold, the response value is a correct response to the random number challenge, and the response time is less than the preset time window, then the operation corresponding to the operation request is executed.

[0161] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating an operation record corresponding to the operation; uploading the operation record to the target platform; and receiving alarm information issued by the target platform.

[0162] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: in response to a Bluetooth connection request and an operation request sent by a target terminal, establishing a Bluetooth connection with the target terminal; performing Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal; obtaining a safe distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table; and performing the operation corresponding to the operation request if the current distance is not greater than the safe distance threshold.

[0163] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: repeatedly performing Bluetooth channel probing multiple times through a Bluetooth connection established with the target terminal to obtain multiple distance measurement results; and performing statistical processing based on the multiple distance measurement results to determine the current distance between the power equipment and the target terminal.

[0164] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: determining the ranging variance based on multiple distance measurement results; and performing the operation corresponding to the operation request if the current distance is not greater than a safe distance threshold and the ranging variance is less than a preset threshold.

[0165] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: sending a random number challenge to the target terminal; receiving the response value returned by the target terminal for the random number challenge, and determining the response time between sending the random number challenge and receiving the response value; if the current distance is not greater than the safe distance threshold, the ranging variance is less than the preset threshold, the response value is a correct response to the random number challenge, and the response time is less than the preset time window, then the operation corresponding to the operation request is executed.

[0166] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating an operation record corresponding to the operation; uploading the operation record to the target platform; and receiving alarm information issued by the target platform.

[0167] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0168] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0169] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0170] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A near-field security authentication method, characterized in that, The method is applied to power equipment, and the method includes: In response to Bluetooth connection requests and operation requests sent by the target terminal, a Bluetooth connection is established with the target terminal; Bluetooth channel detection is performed by establishing a Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal; Based on a preset mapping table, obtain the safe distance threshold corresponding to the operation type identifier carried in the operation request; If the current distance is not greater than the safe distance threshold, execute the operation corresponding to the operation request.

2. The method according to claim 1, characterized in that, The step of performing Bluetooth channel detection through the established Bluetooth connection with the target terminal to obtain the current distance between the power equipment and the target terminal includes: By establishing a Bluetooth connection with the target terminal, multiple Bluetooth channel probes are repeatedly performed to obtain multiple distance measurement results; Based on the statistical processing of the multiple distance measurement results, the current distance between the power equipment and the target terminal is determined.

3. The method according to claim 2, characterized in that, Before obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on the preset mapping table, the method further includes: The distance measurement variance is determined based on the multiple distance measurement results; Accordingly, after obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, the method further includes: If the current distance is not greater than the safe distance threshold and the ranging variance is less than the preset threshold, the operation corresponding to the operation request is executed.

4. The method according to claim 3, characterized in that, Before obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on the preset mapping table, the method further includes: Send a random number challenge to the target terminal; Receive the response value returned by the target terminal in response to the random number challenge, and determine the response time between sending the random number challenge and receiving the response value; Accordingly, after obtaining the safety distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table, the method further includes: If the current distance is not greater than the safe distance threshold, the ranging variance is less than a preset threshold, the response value is a correct response to the random number challenge, and the response time is less than a preset time window, then the operation corresponding to the operation request is executed.

5. The method according to claim 4, characterized in that, The preset time window is determined based on the safe distance threshold and the preset processing delay.

6. The method according to claim 3, characterized in that, After executing the operation corresponding to the operation request, the method further includes: Generate the operation record corresponding to the operation; Upload the operation record to the target platform; Receive alarm information sent by the target platform; The alarm information is generated by the target platform based on the operation records of the power equipment, when it determines that the power equipment meets at least one of the following anomaly determination conditions: Within a preset time range, the fluctuation range of the current distance corresponding to multiple consecutive operation requests exceeds the preset fluctuation threshold; The current distance reported multiple times is within the danger zone corresponding to the safe distance threshold; The difference between the ranging variance in the operation record and the historical benchmark variance is greater than a set value; the historical benchmark variance is determined by the target platform based on the historical operation records of the power equipment.

7. A near-field security authentication device, characterized in that, The device is used in power equipment, and the device includes: The connection module is used to establish a Bluetooth connection with the target terminal in response to Bluetooth connection requests and operation requests sent by the target terminal. The ranging module is used to perform Bluetooth channel detection through a Bluetooth connection established with the target terminal to obtain the current distance between the power equipment and the target terminal; The authentication module is used to obtain the security distance threshold corresponding to the operation type identifier carried in the operation request based on a preset mapping table; and to execute the operation corresponding to the operation request if the current distance is not greater than the security distance threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images