Edge device security authentication method and apparatus, device, storage medium, and product

Abstract

The present application discloses an edge device security authentication method and apparatus, a device, a storage medium, and a product. The edge device security authentication method comprises: receiving a first initial ID, a first steganographic key, and a shared steganographic key which are allocated by a cloud platform; on the basis of the shared steganographic key, encrypting the first initial ID and the first steganographic key, obtaining a first encrypted file; sending the first encrypted file to other edge devices in an edge device set, so that the other edge devices decrypt the first encrypted file on the basis of respective shared steganographic keys thereof, to obtain a decrypted first initial ID and a first steganographic key of a device to be authenticated, and upload the decrypted first initial ID and the first steganographic key of said device and respective pre-allocated second steganographic keys to the cloud platform for security authentication, to obtain a security authentication result. According to the present application, a steganographic means having high capacity is used on a cloud platform, improving the security of an edge device.

Description

Security authentication method, device, equipment, storage medium and product of edge device

[0001] Cross-reference to Related Applications

[0002] The present application is based on the Chinese patent application No. 202410448727.X, filed on April 15, 2024, and claims priority to the Chinese patent application, the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the field of information security, in particular to a security authentication method, device, equipment, storage medium and computer program product of edge device. BACKGROUND

[0004] At present, a pre-designed industrial system is usually used to manage factory production in an industrial environment. The industrial system is vulnerable to network threats, which causes production operations to be unable to run normally, so it is crucial to set strong network security measures in the industrial system.

[0005] In related technologies, the system architecture of the industrial system usually adopts network security measures such as secure communication protocols, data encryption, access control and identity verification mechanisms, which helps to protect industrial infrastructure, data and operations from unauthorized access and data leakage. However, due to the small capacity of the edge device itself, adding ordinary network security measures will result in low network convergence speed, which affects the production process of the factory. Therefore, in the security authentication of the edge device, a low-capacity steganography method is usually used, and the low-capacity steganography method is more vulnerable to attacks from other devices, resulting in low security of the edge device.

[0006] SUMMARY

[0007] The main purpose of the present application is to provide a security authentication method, device, equipment, storage medium and computer program product of edge device, which aims to solve the technical problem of low security of the edge device in the prior art.

[0008] To achieve the above purpose, the present application provides a security authentication method of edge device, applied to any to-be-authenticated device in a set of edge devices, the security authentication method of edge device comprising:

[0009] receiving a first initial ID, a first steganography key and a shared steganography key distributed by a cloud platform;

[0010] encrypting the first initial ID and the first steganography key based on the shared steganography key to obtain a first encrypted file;

[0011] send the first encrypted file to other edge devices under the set of edge devices, so that the other edge devices decrypt the first encrypted file based on the respective shared steganographic key to obtain the decrypted first initial ID and first steganographic key of the to-be-authenticated device, and upload the decrypted first initial ID and first steganographic key of the to-be-authenticated device and the respective corresponding pre-assigned second steganographic key to the cloud platform for security authentication to obtain a security authentication result.

[0012] Optionally, the step of encrypting the first initial ID and the first steganographic key based on the shared steganographic key to obtain the first encrypted file comprises:

[0013] extracting feature information of the first initial ID and the first steganographic key based on a preset VGG network to obtain first feature information;

[0014] encrypting the first feature information based on the shared steganographic key to obtain the first encrypted file.

[0015] Optionally, the step of extracting feature information of the first initial ID and the first steganographic key based on a preset VGG network to obtain first feature information comprises:

[0016] extracting second feature information of the first initial ID and third feature information of the first steganographic key based on a preset VGG network;

[0017] encoding the second feature information and the third feature information into first feature information based on a preset AdaIN layer, and performing normalized mapping on the first feature information to obtain normalized first feature information.

[0018] The application further provides a security authentication method of an edge device, applied to any edge device other than a to-be-authenticated device under a set of edge devices, and the security authentication method of the edge device comprises:

[0019] receiving a first encrypted file sent by the to-be-authenticated device;

[0020] decrypting the first encrypted file based on a shared steganographic key pre-assigned by a cloud platform to obtain a decrypted first initial ID and first steganographic key of the to-be-authenticated device;

[0021] uploading the decrypted first initial ID and first steganographic key of the to-be-authenticated device and a second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication to obtain a security authentication result.

[0022] Optionally, the step of decrypting the first encrypted file based on the cloud platform pre-allocated shared steganographic key to obtain the decrypted first initial ID and the first steganographic key of the to-be-authenticated device comprises:

[0023] performing feature extraction on the first encrypted file based on a preset convolution layer under a VGG network to obtain fourth feature information;

[0024] performing normalization on the fourth feature information based on a preset normalization layer to obtain normalized fourth feature information, wherein each convolution layer in the VGG network is provided with a normalization layer;

[0025] performing feature expansion on the normalized fourth feature information based on a preset expansion interpolation to obtain expanded fourth feature information;

[0026] decrypting the expanded fourth feature information based on the cloud platform pre-allocated shared steganographic key to obtain the decrypted first initial ID and the first steganographic key of the to-be-authenticated device.

[0027] Optionally, after the step of uploading the decrypted first initial ID and the first steganographic key of the to-be-authenticated device and the cloud platform pre-allocated second steganographic key to the cloud platform for security authentication to obtain a security authentication result, the method comprises:

[0028] determining whether the security authentication result is an authentication success result;

[0029] if the security authentication result is the authentication success result, retaining the first initial ID and encrypting the first initial ID and the second steganographic key to obtain a second encrypted file;

[0030] sending the second encrypted file to the to-be-authenticated device, so that the to-be-authenticated device decrypts the second encrypted file based on the shared steganographic key to obtain the decrypted first initial ID and the second steganographic key, and uploads the decrypted first initial ID and the second steganographic key and the first steganographic key to the cloud platform for communication security authentication to obtain a communication security authentication result.

[0031] The application also provides a security authentication device of an edge device, which comprises:

[0032] a receiving module configured to receive a first initial ID, a first steganographic key and a shared steganographic key distributed by a cloud platform;

[0033] an encryption module configured to encrypt the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file;

[0034] The authentication module is configured to send the first encrypted file to other edge devices in the set of edge devices, so that the other edge devices decrypt the first encrypted file based on the respective shared steganographic key to obtain the decrypted first initial ID and first steganographic key of the to-be-authenticated device, and upload the decrypted first initial ID and first steganographic key of the to-be-authenticated device and the respective pre-assigned second steganographic key to the cloud platform for security authentication to obtain a security authentication result.

[0035] The application further provides a security authentication device of an edge device, which comprises:

[0036] The receiving module is configured to receive a first encrypted file sent by a to-be-authenticated device.

[0037] The decryption module is configured to decrypt the first encrypted file based on the shared steganographic key pre-assigned by the cloud platform to obtain the decrypted first initial ID and first steganographic key of the to-be-authenticated device.

[0038] The authentication module is configured to upload the decrypted first initial ID and first steganographic key of the to-be-authenticated device and the second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication to obtain a security authentication result.

[0039] The application further provides a security authentication device of an edge device, which comprises a memory, a processor and a program for implementing the security authentication method of the edge device stored in the memory,

[0040] The memory is configured to store the program for implementing the security authentication method of the edge device.

[0041] The processor is configured to execute the program for implementing the security authentication method of the edge device to implement the steps of the security authentication method of the edge device.

[0042] The application further provides a storage medium having a program for implementing the security authentication method of the edge device stored thereon, and the program for implementing the security authentication method of the edge device is executed by a processor to implement the steps of the security authentication method of the edge device.

[0043] When the steganographic encrypted file of the to-be-authenticated edge device is generated, the application initiates a security authentication request to surrounding edge devices, and then the encrypted file of the to-be-authenticated edge device is decrypted by the edge devices, and finally the security authentication of the edge device is implemented on the cloud platform, so that the edge computing device has the authentication function of the cloud data center, that is, the steganographic means with high capacity is used on the cloud platform, so that the security of the edge device is improved on the basis of reducing the device side computing power pressure. BRIEF DESCRIPTION OF DRAWINGS

[0044] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate the embodiments of the present application and, together with the description, further serve to explain the principles of the present application. In order to clearly illustrate the technical solutions of the embodiments or the prior art in the present application, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced as follows. Obviously, the drawings of the present application can also provide further drawings based on these drawings for those skilled in the art without creative effort.

[0045] FIG. 1 is a flowchart of a first embodiment of a security authentication method of an edge device according to the present application;

[0046] FIG. 2 is a flowchart of a second embodiment of a security authentication method of an edge device according to the present application;

[0047] FIG. 3 is a module diagram of a security authentication device of an edge device according to the present application;

[0048] FIG. 4 is a device structure diagram of a hardware operating environment related to the embodiments of the present application.

[0049] The implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are merely intended to explain the present application and not to limit the present application.

[0051] Referring to FIG. 1, FIG. 1 is a flowchart of a first embodiment of a security authentication method of an edge device according to the present application.

[0052] In the first embodiment, the security authentication method of the edge device is applied to any to-be-authenticated device under a set of edge devices, and specifically includes the following steps:

[0053] Step S100, receiving a first initial ID, a first steganographic key and a shared steganographic key distributed by a cloud platform;

[0054] It should be noted that the specific application scenario of the security authentication method of the edge device is preferably an industrial internet system, and the execution subject of the security authentication method of the edge device is any to-be-authenticated device under a set of edge devices of the industrial internet system. The to-be-authenticated device includes an edge device newly configured to the industrial internet network and an edge device requiring authentication.

[0055] It can be understood that the first initial ID of the to-be-authenticated device, the first steganographic key and the shared steganographic key are assigned by the cloud platform when the to-be-authenticated device is deployed, wherein the first initial ID and the first steganographic key of the to-be-authenticated device are unique, that is, the initial ID and the steganographic key assigned by the cloud platform to each edge device are different, but the shared steganographic key between the edge devices is the same. It should be noted that after the edge devices first receive the initial ID, the steganographic key and the shared steganographic key assigned by the cloud platform, subsequent device authentication does not need to be assigned again.

[0056] In a specific implementation, when the edge device is deployed, the administrator in the cloud resource assigns an initial ID (D q ) to each edge device, which is associated with a steganographic key (H q ) for transmitting business security authentication and a shared steganographic key (W s ) for identity authentication. Preferably, the edge device uses its embedded neural processing unit (NPU, neural processing unit) to store its D q , W s and H q .

[0057] Step S200, encrypting the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file;

[0058] It should be noted that before the to-be-authenticated device is steganographically encrypted, the to-be-authenticated device also needs to be initialized based on the cloud platform, and only after the to-be-authenticated device is initialized, identity authentication with surrounding edge devices begins.

[0059] In a specific implementation, the to-be-authenticated device first connects the first initial ID (D q-a ) with its own steganographic key (H q-a ), and uses the shared steganographic key (W s ) initiated by the cloud platform to encrypt, forming a first encrypted file, which can be represented as W s (D q-a ||H q-a ). The to-be-authenticated device generates a request packet through all NPU sent to the area, wherein the generated request packet includes the first encrypted file of the to-be-authenticated device and an identity verification request instruction.

[0060] In a specific implementation, the step of encrypting the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file includes:

[0061] The first initial ID and the first steganographic key are subjected to feature extraction based on a preset VGG (Visual Geometry Group) network to obtain first feature information; and the first feature information is subjected to encryption based on the shared steganographic key to obtain a first encrypted file.

[0062] It should be noted that the VGG network is a visual geometry group model network, and a steganographic scheme of the VGG network structure generally includes a generator, an extractor and a steganalysis analyzer. The generator receives a file and secret information and generates a steganographic file. The extractor extracts a secret message from the steganographic file. The steganalysis analyzer receives a file containing steganographic information and learns to distinguish between the two. After rough adversarial training, a powerful generator and steganalysis analyzer are produced.

[0063] In a specific implementation, the encryption process of the first encrypted file is implemented by a VGG network, wherein the VGG network includes a convolutional layer, a ReLU (Rectified Linear Unit) layer and a max-pooling layer. The VGG network is used to extract high-dimensional features from an initial ID (D q ) and a steganographic key (H q ), and the features are connected; and the device to be authenticated is subjected to encryption by a shared steganographic key (W s ) to obtain a first encrypted file W s (D q-a ||H q-a ).

[0064] In a specific implementation, the step of extracting first feature information based on a preset VGG network from the first initial ID and the first steganographic key includes:

[0065] The second feature information of the first initial ID and the third feature information of the first steganographic key are extracted based on a preset VGG network; the second feature information and the third feature information are encoded into first feature information based on a preset AdaIN (Adaptive Instance Normalization) layer, and the first feature information is subjected to normalized mapping to obtain normalized first feature information.

[0066] It should be noted that the AdaIN layer is an adaptive instance normalization layer, and the AdaIN layer can align the mean and variance of the content features with the mean and variance of the style features, and has a processing speed comparable to the current normalization method, but is not limited by a predefined style set.

[0067] In a specific implementation, the second feature information of the first initial ID and the third feature information of the first steganographic key are encoded into a feature through an AdaIN layer, and then the feature is mapped back to form a complete encrypted file transmission. In this way, the steganographic key (H q ) and the shared steganographic key (W s ) have been embedded in the original data. The encryption calculation process of the AdaIN layer is as follows:

[0068] Where, μ(·) represents the mean of the key matrix, σ 2 (·) represents the variance of the key matrix, D q represents the initial ID, H q represents the steganographic key, and W s represents the shared steganographic key.

[0069] It can be understood that, compared with the convolution layer, AdaIN has better stylization effect and does not require training parameters, which makes the overall training speed of the network faster and the time spent less.

[0070] The scheme expands the steganography capability. By designing a feature extraction from the steganographic key and the initial ID, and mapping the extracted feature back to form an encrypted file. In the case of unchanged original data migration effect, the steganographic capability is greatly improved.

[0071] In step S300, the first encrypted file is sent to other edge devices in the edge device set, so that other edge devices decrypt the first encrypted file based on their respective shared steganographic keys to obtain the decrypted first initial ID and first steganographic key of the device to be authenticated, and upload the decrypted first initial ID and first steganographic key of the device to be authenticated and their respective pre-assigned second steganographic keys to the cloud platform for security authentication to obtain a security authentication result.

[0072] It should be noted that, in the present application, NPU-A represents the device to be authenticated, and NPU-B represents other edge devices in the edge device set. After NPU-A sends the first encrypted file to other edge devices NPU-B in the edge device set, other NPU (i.e. NPU-B) will use the cloud shared steganographic key (W s ) to decrypt it. The shared steganographic key assigned by the cloud platform to each NPU is the same, so this process is similar to the AES (Advanced Encryption Standard Technology) symmetric encryption method, and all NPU use this shared steganographic key to establish mutual trust.

[0073] In a specific implementation, when other NPU (NPU-B) decrypts to obtain the ID (D q-a ) and steganographic key (H q-a ) of NPU-A, NPU-B sends the ID (D q-a ), steganographic key (H q-a ) of NPU-A and its own steganographic key (H q-b ) to the cloud platform for joint checking to confirm the authenticity of NPU-A. After the cloud platform confirms the ID and steganographic key, NPU-B will save a copy of the ID (D' q-a ) of NPU-A, and identify NPU-A as passing the identity verification. If not, the cloud will automatically start a factory emergency response program and notify the administrator to intervene.

[0074] When the steganographic encrypted file of the edge device to be authenticated is generated, the application initiates a security authentication request to each surrounding edge device, and then decrypts the encrypted file of the edge device to be authenticated through each edge device, and finally realizes the security authentication of the edge device on the cloud platform, so that the edge computing device has the authentication function of the cloud data center, that is, using a steganographic means with high capacity on the cloud platform, so as to improve the security of the edge device on the basis of reducing the device side computing power pressure.

[0075] Based on the above first embodiment, the application further provides another embodiment, which refers to FIG. 2. The security authentication method of the edge device is applied to any edge device except the device to be authenticated in the edge device set, and specifically includes the following steps:

[0076] Step A100, receiving the first encrypted file sent by the device to be authenticated;

[0077] In a specific implementation, after the device to be authenticated sends the first encrypted file to each edge device in the edge device set, the edge device receives the first encrypted file sent by the device to be authenticated, and performs the subsequent security authentication steps.

[0078] Step A200, decrypting the first encrypted file based on the shared steganographic key pre-allocated by the cloud platform to obtain the first initial ID and the first steganographic key of the decrypted device to be authenticated;

[0079] In a specific implementation, the edge device will use the cloud shared steganographic key (W s ) to decrypt it. The shared steganographic key allocated by the cloud platform to each NPU is the same, so this process is similar to the AES symmetric encryption method, and all NPUs use this shared steganographic key to establish mutual trust.

[0080] In a specific implementation, when the edge device (NPU-B) decrypts to obtain the ID (Dq-a ) and its stego key (H q-a ), NPU-B sends the ID (D q-a ) of NPU-A, the stego key (H q-a ) of NPU-A and its own stego key (H q-b ) to the cloud platform for joint verification of the authenticity of NPU-A. After the cloud platform verifies the ID and the stego key, NPU-B will save a copy of the ID (D' q-a ) of NPU-A and identify NPU-A as passing the authentication. If not, the cloud platform will automatically start a factory emergency response program and notify the administrator to intervene.

[0081] In a specific implementation, the method for the edge device to decrypt the first encrypted file based on the shared stego key pre-allocated by the cloud platform to obtain the first initial ID and the first stego key of the to-be-authenticated device further includes the following steps:

[0082] perform feature extraction on the first encrypted file based on a preset convolution layer under a VGG network to obtain fourth feature information; perform normalization on the fourth feature information based on a preset normalization layer to obtain normalized fourth feature information, wherein each convolution layer in the VGG network is provided with a normalization layer; perform feature expansion on the normalized fourth feature information based on a preset expansion interpolation to obtain expanded fourth feature information; and decrypt the expanded fourth feature information based on the shared stego key pre-allocated by the cloud platform to obtain the first initial ID and the first stego key of the to-be-authenticated device.

[0083] It should be noted that the decryption process of the edge device proposed in the present application fully utilizes the characteristics of the stego key matrix to ensure higher extraction accuracy. Specifically, the single decryption of the edge device includes three convolution layers, and each convolution layer adds a ReLU layer. Although each convolution process will reduce the size of the key by half, and the features extracted by each convolution layer will be combined with features of the same size in the decoding process. This scheme of expanding the feature size by interpolation expansion, which expands the feature size by one time each time, ensures that the convolution layers of the feature decoding network do not change the file size.

[0084] It can be understood that the above scheme is designed to avoid the loss of steganographic information caused by the reduction of feature size. Therefore, W s (D q-a ||H q-a) will be processed by two times of decryption, i.e. six convolutional layers and ReLU functions. After each convolutional layer, there is a normalization (BN, batch normalization) layer to improve the network convergence speed. The convolution kernel parameter of each convolutional layer is set to be consistent with the steganographic key matrix, and the step parameter is set to be 1, so that the size of the feature does not change during the extraction of steganographic information, but the number of channels changes constantly.

[0085] Step A300, upload the first initial ID of the decrypted device to be authenticated and the first steganographic key, and the second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication, and obtain a security authentication result.

[0086] In a specific implementation, the application also proposes a method for calculating loss, wherein the calculation of loss is to evaluate whether the decrypted information is consistent with the initial information, specifically, the loss mainly includes two parts: one is the loss function L ne of steganography, and the other is the loss function L d of the VGG decryption network. Therefore, the system is set to take the minimum value of L ne .

[0087] In a specific implementation, in the process of embedding steganographic information, the VGG encryption network should not only try to reduce the impact of steganographic information embedding on the migration of initial ID data, but also make the decryption network extract the steganographic key from the information as accurately as possible. Therefore, when designing the loss function L ne , the shared steganographic loss L Ws and the steganographic loss L Hq of business transmission authentication are considered at the same time. Specifically, the loss function L ne of steganography is: L ne =L Ws +kL Hq +bL d

[0088] Wherein, k and b are the weights of the steganographic loss and the loss of extracting encrypted data, respectively, for balancing L Ws , L Hq and L d .

[0089] Further, the application proposes to use the Euclidean distance to measure the loss of shared steganographic key: L Ws =‖f(g(r)-r)‖2

[0090] Wherein, r represents the result of the AdaIN layer, f(·) represents the VGG encryption network, and g(·) represents the VGG decryption network. Through this loss function, the generated result feature is constrained to be consistent with the feature r processed by AdaIN as much as possible, so as to improve the content similarity between the decryption result and the data before encryption.

[0091] The VGG encryption network only needs to be accurately extracted from the stego key, and the mean square error is used to evaluate the steganographic loss L of service transmission authentication w The steganographic loss L of service transmission authentication is Hq :

[0092] Where G represents a set of specific layers in the neural network, H q represents the stego key, μ(·) represents the mean, σ 2 (·) represents the variance. φ(·) represents the output of the VGG encryption network layer.

[0093] At the same time, the decryption data loss L d is

[0094] Wherein, τ(·) represents the output of the VGG decryption network layer.

[0095] In a specific implementation, after the step of uploading the first initial ID and the first stego key of the decrypted device to be authenticated and the second stego key pre-assigned by the cloud platform to the cloud platform for security authentication to obtain a security authentication result, the method comprises the following steps:

[0096] determining whether the security authentication result is an authentication success result; if the security authentication result is an authentication success result, retaining the first initial ID, and encrypting the first initial ID and the second stego key to obtain a second encrypted file; sending the second encrypted file to the device to be authenticated, so that the device to be authenticated decrypts the second encrypted file based on the shared stego key to obtain the decrypted first initial ID and the second stego key, and uploads the decrypted first initial ID and the second stego key, and the first stego key to the cloud platform for communication security authentication to obtain a communication security authentication result.

[0097] It should be noted that the present application further proposes a communication security authentication of the edge device after the identity authentication of the edge device, wherein the execution subject of the method is an edge device which has a communication connection relationship with the device to be authenticated.

[0098] In a specific implementation, the edge device NPU-B needs to combine the ID (D q-a ) of the edge device NPU-A authenticated for security with itself (H q-b ) to form D q-a ||H q-b and send it to NPU-A, and NPU-A receives the encrypted package and forwards the stego key (H q-a ) of itself and the package to the cloud, and the cloud receives it and uses Hq-a Decrypted D q-a ||H q-b . Compare with H q-a Decrypted D' q-a and original D q-a , if consistent, correct. Once verified, confirm that NPU-A and NPU-B communicate securely, and once an anomaly is found, start the factory emergency response program.

[0099] After verification, information transmission between NPU-B and NPU-A does not need to be verified again under the condition that both devices are powered on. Since communication between the ends is rare, and virus intrusion has no effect on the sinking serial communication of the production line equipment, direct communication can be performed. However, NPU-A, NPU-B, and the core network still need to use the shared steganography key W s Fast authentication. If the device is powered off, it is considered to be reinitialized.

[0100] The algorithm for this transmission information security authentication is executed by the cloud, reducing the end-side computing power pressure. During the execution process in the cloud, the functions and tools of conventional automation and extended cloud resources are used to alleviate the situation of excessive cloud resource occupation, such as automatic expansion, load balancing.

[0101] In a specific implementation, since many Internet factories use SIM cards and core networks that are not isolated, viruses can invade devices through weak authentication ports of any edge device and enter the entire private network environment. According to this actual situation, no risk level is set in this scheme, and all edge devices are considered equally important by default, and a security authentication method for the edge device is proposed, which has the following beneficial effects:

[0102] 1. Add a technical solution to prevent malicious devices from participating in load balancing. After the edge device initialization is completed, identity authentication is required with the surrounding edge devices and information copies are generated in the surrounding edge devices;

[0103] 2. The steganography capability is expanded and the loss of steganographic information caused by the reduction of feature size is avoided. By designing a feature extraction from the steganography key and the initial ID, and mapping the extracted features back to form an encrypted file. In the case of unchanged original data migration effect, the steganography capability is greatly improved;

[0104] 3. In W s (D q-a ||H q-a ) decryption, there is a normalization (BN) layer after each convolution layer to improve the network convergence speed.

[0105] The method enables the edge computing device to have a centralized authentication function of the cloud data center, reduces the end-side computing power pressure. In addition, even if the attacker accidentally attacks the system, it is difficult to find traces of modification from steganography and to crack the key. This can encourage customers to use more convenient data transmission methods and has a wide application prospect. The scheme is preferably applied in the Internet factory scene, breaking the current factory's prejudice for low end-side business information security.

[0106] The application also provides a security authentication device of an edge device, referring to FIG. 3, the security authentication device of the edge device comprises:

[0107] The receiving module 10 is configured to receive a first initial ID, a first steganographic key and a shared steganographic key distributed by a cloud platform;

[0108] The encryption module 20 is configured to encrypt the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file;

[0109] The authentication module 30 is configured to send the first encrypted file to other edge devices under a set of edge devices, so that the other edge devices decrypt the first encrypted file based on their respective shared steganographic keys to obtain the first initial ID and the first steganographic key of the to-be-authenticated device after decryption, and upload the first initial ID and the first steganographic key of the to-be-authenticated device after decryption and their respective pre-allocated second steganographic keys to the cloud platform for security authentication to obtain a security authentication result.

[0110] Optionally, the encryption module 20 comprises:

[0111] The extraction module is configured to perform feature extraction on the first initial ID and the first steganographic key based on a preset VGG network to obtain first feature information;

[0112] The feature encryption module is configured to encrypt the first feature information based on the shared steganographic key to obtain the first encrypted file.

[0113] Optionally, the extraction module comprises:

[0114] The feature extraction module is configured to extract second feature information of the first initial ID and third feature information of the first steganographic key based on a preset VGG network;

[0115] The mapping module is configured to encode the second feature information and the third feature information into first feature information based on a preset AdaIN layer, and perform normalized mapping on the first feature information to obtain normalized first feature information.

[0116] The specific implementation of the security authentication device of the edge device in the present application is basically the same as each embodiment of the security authentication method of the edge device described above, and will not be repeated here.

[0117] Referring to FIG. 4, FIG. 4 is a terminal structure diagram of a hardware running environment related to an embodiment of the present application.

[0118] As shown in FIG. 4, the terminal can include a processor 1001 such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. The communication bus 1002 is used to realize the connection and communication between the components. The user interface 1003 can include a display screen (Display) and an input unit such as a keyboard (Keyboard). The optional user interface 1003 can also include a standard wired interface and a wireless interface. The network interface 1004 can optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory or a stable memory (non-volatile memory) such as a disk memory. The memory 1005 can also be an independent storage device from the aforementioned processor 1001.

[0119] Optionally, the security authentication device of the edge device can also include a rectangular user interface, a network interface, a camera, an RF (Radio Frequency, Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, etc. The rectangular user interface can include a display screen (Display) and an input sub-module such as a keyboard (Keyboard). The optional rectangular user interface can also include a standard wired interface and a wireless interface. The network interface can optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0120] Those skilled in the art can understand that the security authentication device structure of the edge device shown in FIG. 3 does not constitute a limitation on the security authentication device of the edge device, and can include more or fewer components than the diagram, or combine certain components, or different component arrangements.

[0121] As shown in FIG. 4, the memory 1005 as a storage medium can include an operating system, a network communication module, and a security authentication program of the edge device. The operating system is a program that manages and controls the hardware and software resources of the security authentication device of the edge device, supports the running of the security authentication program of the edge device and other software and / or programs. The network communication module is used to realize the communication between the components in the memory 1005, and the communication between other hardware and software in the security authentication system of the edge device.

[0122] In the security authentication device of the edge device shown in FIG. 4, the processor 1001 is configured to execute the security authentication program of the edge device stored in the memory 1005, and implement the steps of the security authentication method of the edge device according to any one of the above embodiments.

[0123] The security authentication device of the edge device according to the embodiments of the present application is basically the same as the security authentication method of the edge device described above, and will not be repeated here.

[0124] The present application also provides a storage medium having a security authentication method of an edge device stored thereon, wherein the security authentication method of the edge device is executed by a processor to implement the security authentication method of the edge device as follows:

[0125] Receiving a first initial ID, a first steganographic key and a shared steganographic key assigned by a cloud platform;

[0126] Based on the shared steganographic key, the first initial ID and the first steganographic key are encrypted to obtain a first encrypted file;

[0127] The first encrypted file is sent to each of the other edge devices under the set of edge devices, so that each of the other edge devices decrypts the first encrypted file based on the respective shared steganographic key to obtain the decrypted first initial ID and the first steganographic key of the to-be-authenticated device, and uploads the decrypted first initial ID and the first steganographic key of the to-be-authenticated device and the respective pre-assigned second steganographic key to the cloud platform for security authentication to obtain a security authentication result.

[0128] Optionally, the step of encrypting the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file comprises:

[0129] Based on a preset VGG network, the first initial ID and the first steganographic key are feature extracted to obtain first feature information;

[0130] Based on the shared steganographic key, the first feature information is encrypted to obtain a first encrypted file.

[0131] Optionally, the step of extracting the first initial ID and the first steganographic key based on the preset VGG network to obtain first feature information comprises:

[0132] Based on a preset VGG network, the second feature information of the first initial ID and the third feature information of the first steganographic key are extracted;

[0133] The second feature information and the third feature information are encoded into first feature information based on a preset AdaIN layer, and the first feature information is normalized to obtain normalized first feature information.

[0134] The security authentication method of the edge device further includes:

[0135] A first encrypted file sent by the device to be authenticated is received.

[0136] The first encrypted file is decrypted based on a shared steganographic key pre-assigned by the cloud platform to obtain a first initial ID and a first steganographic key of the decrypted device to be authenticated.

[0137] The first initial ID and the first steganographic key of the decrypted device to be authenticated, and a second steganographic key pre-assigned by the cloud platform are uploaded to the cloud platform for security authentication to obtain a security authentication result.

[0138] Optionally, the step of decrypting the first encrypted file based on the shared steganographic key pre-assigned by the cloud platform to obtain the first initial ID and the first steganographic key of the decrypted device to be authenticated includes:

[0139] The first encrypted file is feature-extracted based on a convolution layer under a preset VGG network to obtain fourth feature information.

[0140] The fourth feature information is normalized based on a preset normalization layer to obtain normalized fourth feature information, wherein each convolution layer in the VGG network is provided with a normalization layer.

[0141] The normalized fourth feature information is feature-extended based on a preset extended interpolation to obtain extended fourth feature information.

[0142] The extended fourth feature information is decrypted based on the shared steganographic key pre-assigned by the cloud platform to obtain the first initial ID and the first steganographic key of the decrypted device to be authenticated.

[0143] Optionally, after the step of uploading the first initial ID and the first steganographic key of the decrypted device to be authenticated, and the second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication to obtain a security authentication result, the method includes:

[0144] It is judged whether the security authentication result is an authentication success result.

[0145] If the security authentication result is an authentication success result, the first initial ID is retained, and the first initial ID and the second steganographic key are encrypted to obtain a second encrypted file.

[0146] The second encrypted file is sent to the device to be authenticated, so that the device to be authenticated decrypts the second encrypted file based on the shared stego key to obtain the decrypted first initial ID and second stego key, and uploads the decrypted first initial ID and second stego key and the first stego key to the cloud platform for communication security authentication to obtain a communication security authentication result.

[0147] The storage medium specific embodiments of the present application are basically the same as the above-mentioned edge device security authentication method embodiments, and will not be repeated here.

[0148] The present application also provides a computer program product, including a computer program which is executed by a processor to realize the steps of the above-mentioned edge device security authentication method.

[0149] The specific embodiments of the computer program product of the present application are basically the same as the above-mentioned edge device security authentication method embodiments, and will not be repeated here.

[0150] It should be noted that in this paper, the term "including", "containing" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the sentence "including a…" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0151] The above-mentioned application example serial numbers are only for description, not representing the pros and cons of the embodiments.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by software plus the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of software product, which is stored in a storage medium (such as ROM / RAM, magnetic disc, optical disc) as described above, including a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the method described in each embodiment of the present application.

[0153] The above merely preferred embodiments of the present application, and not therefore limit the patent scope of the present application, any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A security authentication method of an edge device, characterized by, The security authentication method of the edge device is applied to any to-be-authenticated device under a set of edge devices, and the security authentication method comprises the following steps: receiving a first initial ID, a first steganographic key and a shared steganographic key distributed by a cloud platform; encrypting the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file; sending the first encrypted file to other edge devices under the set of edge devices, so that the other edge devices decrypt the first encrypted file based on the respective shared steganographic keys to obtain the first initial ID and the first steganographic key of the to-be-authenticated device after decryption, and upload the first initial ID and the first steganographic key of the to-be-authenticated device after decryption and the respective pre-assigned second steganographic keys to the cloud platform for security authentication to obtain a security authentication result.

2. The security authentication method of the edge device according to claim 1, wherein, The step of encrypting the first initial ID and the first steganographic key based on the shared steganographic key to obtain a first encrypted file comprises the following steps: extracting features of the first initial ID and the first steganographic key based on a preset VGG (Visual Geometry Group) network to obtain first feature information; encrypting the first feature information based on the shared steganographic key to obtain the first encrypted file.

3. The security authentication method of the edge device according to claim 2, wherein, The step of extracting features of the first initial ID and the first steganographic key based on a preset VGG network to obtain first feature information comprises the following steps: extracting second feature information of the first initial ID and third feature information of the first steganographic key based on the preset VGG network; encoding the second feature information and the third feature information into first feature information based on a preset AdaIN (Adaptive Instance Normalization) layer, and performing normalized mapping on the first feature information to obtain normalized first feature information.

4. A security authentication method of an edge device, characterized by, The security authentication method of the edge device is applied to any to-be-authenticated device under a set of edge devices, and the security authentication method comprises the following steps: receiving a first encrypted file sent by a to-be-authenticated device; decrypting the first encrypted file based on a shared steganographic key pre-assigned by a cloud platform to obtain a first initial ID and a first steganographic key of the to-be-authenticated device after decryption; uploading the first initial ID and the first steganographic key of the to-be-authenticated device after decryption and the second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication to obtain a security authentication result.

5. The security authentication method of the edge device according to claim 4, wherein, The step of decrypting the first encrypted file based on a shared steganographic key pre-assigned by a cloud platform to obtain a first initial ID and a first steganographic key of the to-be-authenticated device after decryption comprises the following steps: extracting features of the first encrypted file based on a convolution layer under a preset VGG network to obtain fourth feature information; performing normalization on the fourth feature information based on a preset normalization layer to obtain normalized fourth feature information, wherein a normalization layer is arranged after each convolution layer in the VGG network; The fourth normalized feature information is subjected to feature expansion based on a preset expansion interpolation, to obtain expanded fourth feature information; The expanded fourth feature information is decrypted based on a shared steganographic key pre-assigned by the cloud platform, to obtain a decrypted first initial ID and a first steganographic key of the device to be authenticated.

6. The security authentication method of an edge device according to claim 4 or 5, wherein, After the step of uploading the decrypted first initial ID and the first steganographic key of the device to be authenticated, and the second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication, to obtain a security authentication result, the method comprises: determining whether the security authentication result is an authentication success result; if the security authentication result is an authentication success result, retaining the first initial ID, and encrypting the first initial ID and the second steganographic key to obtain a second encrypted file; sending the second encrypted file to the device to be authenticated, so that the device to be authenticated decrypts the second encrypted file based on the shared steganographic key, to obtain a decrypted first initial ID and a second steganographic key, and uploads the decrypted first initial ID and the second steganographic key, and the first steganographic key to the cloud platform for communication security authentication, to obtain a communication security authentication result.

7. A security authentication apparatus of an edge device, characterized by comprising: The security authentication device of the edge device comprises: a receiving module configured to receive a first initial ID, a first steganographic key and a shared steganographic key pre-assigned by the cloud platform; an encryption module configured to encrypt the first initial ID and the first steganographic key based on the shared steganographic key, to obtain a first encrypted file; an authentication module configured to send the first encrypted file to other edge devices under the edge device set, so that the other edge devices decrypt the first encrypted file based on their respective shared steganographic keys, to obtain a decrypted first initial ID and a first steganographic key of the device to be authenticated, and upload the decrypted first initial ID and the first steganographic key of the device to be authenticated, and their respective pre-assigned second steganographic keys to the cloud platform for security authentication, to obtain a security authentication result.

8. A security authentication apparatus of an edge device, characterized by, The security authentication device of the edge device comprises: a receiving module configured to receive a first encrypted file sent by the device to be authenticated; a decryption module configured to decrypt the first encrypted file based on a shared steganographic key pre-assigned by the cloud platform, to obtain a decrypted first initial ID and a first steganographic key of the device to be authenticated; an authentication module configured to upload the decrypted first initial ID and the first steganographic key of the device to be authenticated, and a second steganographic key pre-assigned by the cloud platform to the cloud platform for security authentication, to obtain a security authentication result.

9. A security authentication device of an edge device, characterized by, The security authentication device of the edge device comprises a memory, a processor and a program stored in the memory for implementing the security authentication method of the edge device, the memory is configured to store the program for implementing the security authentication method of the edge device; the processor is configured to execute the program for implementing the security authentication method of the edge device, to implement the steps of the security authentication method of the edge device according to any one of claims 1 to 6.

10. A storage medium, characterized by The storage medium stores a program for implementing the security authentication method of the edge device, and the program for implementing the security authentication method of the edge device is executed by the processor to implement the steps of the security authentication method of the edge device according to any one of claims 1 to 6.

11. A computer program product, characterised in that, The computer program product comprises a security authentication program of an edge device, and the security authentication program of the edge device is executed by the processor to implement the steps of the security authentication method of the edge device according to any one of claims 1 to 6.

Images